fix: fixes to command stream

.gitea/workflows/agent-release.yml

@@ -32,20 +32,20 @@ jobs:
                   mkdir -p dist
                   GOOS=linux GOARCH=amd64 go build \
                     -ldflags="-s -w -X main.Version=${VERSION}" \
-                    -o dist/keymanager-agent-linux-amd64 ./cmd
+                    -o dist/vantage-agent-linux-amd64 ./cmd
                   GOOS=linux GOARCH=arm64 go build \
                     -ldflags="-s -w -X main.Version=${VERSION}" \
-                    -o dist/keymanager-agent-linux-arm64 ./cmd
+                    -o dist/vantage-agent-linux-arm64 ./cmd
 
             - name: Checksums
               working-directory: agent/dist
-              run: sha256sum keymanager-agent-linux-amd64 keymanager-agent-linux-arm64 > checksums.txt
+              run: sha256sum vantage-agent-linux-amd64 vantage-agent-linux-arm64 > checksums.txt
 
             - name: Create release
               uses: https://gitea.com/actions/gitea-release-action@v1
               with:
                   token: ${{ secrets.RELEASE_TOKEN }}
                   files: |
-                      agent/dist/keymanager-agent-linux-amd64
-                      agent/dist/keymanager-agent-linux-arm64
+                      agent/dist/vantage-agent-linux-amd64
+                      agent/dist/vantage-agent-linux-arm64
                       agent/dist/checksums.txt

.gitea/workflows/server-deploy.yml

@@ -23,13 +23,13 @@ jobs:
 
             - name: Build and push server image
               run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/keymanager/server:latest"
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/server:latest"
                   docker build -t "$IMAGE" -f server/Dockerfile server/
                   docker push "$IMAGE"
 
             - name: Build and push web image
               run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/keymanager/web:latest"
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/web:latest"
                   docker build \
                     --build-arg NEXT_PUBLIC_API_URL="${{ vars.API_URL }}" \
                     -t "$IMAGE" \

agent/cmd/main.go

@@ -7,8 +7,8 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/mrhid6/keymanager/agent/internal/config"
-	agentsync "github.com/mrhid6/keymanager/agent/internal/sync"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	agentsync "github.com/mrhid6/vantage/agent/internal/sync"
 )
 
 var Version = "dev"
@@ -32,7 +32,7 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	log.Printf("keymanager-agent %s starting (server=%s, poll=%s)", Version, cfg.ServerURL, cfg.PollInterval)
+	log.Printf("vantage-agent %s starting (server=%s, poll=%s)", Version, cfg.ServerURL, cfg.PollInterval)
 	if err := agentsync.Run(ctx, cfg, Version); err != nil {
 		log.Fatalf("agent error: %v", err)
 	}

agent/go.mod

@@ -1,4 +1,4 @@
-module github.com/mrhid6/keymanager/agent
+module github.com/mrhid6/vantage/agent
 
 go 1.26
 

agent/internal/config/config.go

@@ -7,7 +7,7 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-const ConfigPath = "/etc/keymanager/config.yaml"
+const ConfigPath = "/etc/vantage/config.yaml"
 
 type Config struct {
 	ServerURL    string        `yaml:"server_url"`
@@ -38,7 +38,7 @@ func Save(cfg *Config) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll("/etc/keymanager", 0700); err != nil {
+	if err := os.MkdirAll("/etc/vantage", 0700); err != nil {
 		return err
 	}
 	return os.WriteFile(ConfigPath, data, 0600)

agent/internal/grpc/client.go

@@ -6,11 +6,12 @@ import (
 	"strings"
 	"time"
 
-	"github.com/mrhid6/keymanager/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/keepalive"
 )
 
 func init() {
@@ -19,14 +20,22 @@ func init() {
 
 type Client struct {
 	conn   *grpc.ClientConn
-	client pb.KeyManagerClient
+	client pb.VantageClient
 }
 
 func New(serverURL string, useTLS bool) (*Client, error) {
 	serverURL = strings.TrimPrefix(serverURL, "https://")
 	serverURL = strings.TrimPrefix(serverURL, "http://")
 
-	var dialOpts []grpc.DialOption
+	// Send a ping every 30s so proxies with a 60s idle timeout don't kill the
+	// long-lived CommandStream when no commands are flowing.
+	dialOpts := []grpc.DialOption{
+		grpc.WithKeepaliveParams(keepalive.ClientParameters{
+			Time:                30 * time.Second,
+			Timeout:             10 * time.Second,
+			PermitWithoutStream: false,
+		}),
+	}
 
 	if useTLS {
 		tlsCfg := &tls.Config{
@@ -48,7 +57,7 @@ func New(serverURL string, useTLS bool) (*Client, error) {
 
 	return &Client{
 		conn:   conn,
-		client: pb.NewKeyManagerClient(conn),
+		client: pb.NewVantageClient(conn),
 	}, nil
 }
 
@@ -105,8 +114,20 @@ func (c *Client) UploadGeneratedKey(serverID, agentToken, publicKey, privateKey,
 	return resp.KeyId, nil
 }
 
+func (c *Client) ReportUpdates(serverID, agentToken string, updates []pb.PackageUpdate) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	_, err := c.client.ReportUpdates(ctx, &pb.ReportUpdatesRequest{
+		ServerId:   serverID,
+		AgentToken: agentToken,
+		Updates:    updates,
+	})
+	return err
+}
+
 // CommandStream opens a long-lived bidirectional stream for server-pushed commands.
 // The caller controls the stream lifetime via ctx.
-func (c *Client) CommandStream(ctx context.Context) (pb.KeyManager_CommandStreamClient, error) {
+func (c *Client) CommandStream(ctx context.Context) (pb.Vantage_CommandStreamClient, error) {
 	return c.client.CommandStream(ctx)
 }

agent/internal/grpc/pb/vantage.pb.go

@@ -1,4 +1,4 @@
-// Hand-written gRPC bindings for keymanager.proto (agent side, JSON codec).
+// Hand-written gRPC bindings for vantage.proto (agent side, JSON codec).
 
 package pb
 
@@ -46,11 +46,28 @@ type UploadKeyResponse struct {
 
 // CommandStream message types
 
+type PackageUpdate struct {
+	Name           string `json:"name"`
+	CurrentVersion string `json:"current_version,omitempty"`
+	NewVersion     string `json:"new_version"`
+}
+
+type ReportUpdatesRequest struct {
+	ServerId   string          `json:"server_id"`
+	AgentToken string          `json:"agent_token"`
+	Updates    []PackageUpdate `json:"updates"`
+}
+
+type ReportUpdatesResponse struct{}
+
+type ApplyUpdatesCmd struct{}
+
 type ServerCommand struct {
-	CommandId   string          `json:"command_id"`
-	GenerateKey *GenerateKeyCmd `json:"generate_key,omitempty"`
-	DeleteKey   *DeleteKeyCmd   `json:"delete_key,omitempty"`
-	UpdateAgent *UpdateAgentCmd `json:"update_agent,omitempty"`
+	CommandId    string           `json:"command_id"`
+	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
+	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
+	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
+	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
 }
 
 type DeleteKeyCmd struct {
@@ -87,21 +104,21 @@ type CommandResult struct {
 
 // CommandStream client-side interface
 
-type KeyManager_CommandStreamClient interface {
+type Vantage_CommandStreamClient interface {
 	Send(*AgentMessage) error
 	Recv() (*ServerCommand, error)
 	grpc.ClientStream
 }
 
-type keyManagerCommandStreamClient struct {
+type vantageCommandStreamClient struct {
 	grpc.ClientStream
 }
 
-func (c *keyManagerCommandStreamClient) Send(m *AgentMessage) error {
+func (c *vantageCommandStreamClient) Send(m *AgentMessage) error {
 	return c.ClientStream.SendMsg(m)
 }
 
-func (c *keyManagerCommandStreamClient) Recv() (*ServerCommand, error) {
+func (c *vantageCommandStreamClient) Recv() (*ServerCommand, error) {
 	m := new(ServerCommand)
 	if err := c.ClientStream.RecvMsg(m); err != nil {
 		return nil, err
@@ -111,7 +128,7 @@ func (c *keyManagerCommandStreamClient) Recv() (*ServerCommand, error) {
 
 // CommandStream server-side interface (included for completeness)
 
-type KeyManager_CommandStreamServer interface {
+type Vantage_CommandStreamServer interface {
 	Send(*ServerCommand) error
 	Recv() (*AgentMessage, error)
 	grpc.ServerStream
@@ -133,22 +150,23 @@ func (s *keyManagerCommandStreamServer) Recv() (*AgentMessage, error) {
 	return m, nil
 }
 
-type KeyManagerClient interface {
+type VantageClient interface {
 	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
-	CommandStream(ctx context.Context, opts ...grpc.CallOption) (KeyManager_CommandStreamClient, error)
+	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
-type UnimplementedKeyManagerServer struct{}
+type UnimplementedVantageServer struct{}
 
-func (UnimplementedKeyManagerServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+func (UnimplementedVantageServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "not implemented")
 }
-func (UnimplementedKeyManagerServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
+func (UnimplementedVantageServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "not implemented")
 }
-func (UnimplementedKeyManagerServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
+func (UnimplementedVantageServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "not implemented")
 }
 
@@ -156,13 +174,13 @@ type keyManagerClient struct {
 	cc grpc.ClientConnInterface
 }
 
-func NewKeyManagerClient(cc grpc.ClientConnInterface) KeyManagerClient {
+func NewVantageClient(cc grpc.ClientConnInterface) VantageClient {
 	return &keyManagerClient{cc}
 }
 
 func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
 	out := new(RegisterResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/Register", in, out, opts...); err != nil {
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/Register", in, out, opts...); err != nil {
 		return nil, err
 	}
 	return out, nil
@@ -170,7 +188,7 @@ func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, op
 
 func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
 	out := new(SyncResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/SyncKeys", in, out, opts...); err != nil {
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncKeys", in, out, opts...); err != nil {
 		return nil, err
 	}
 	return out, nil
@@ -178,17 +196,25 @@ func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts .
 
 func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
 	out := new(UploadKeyResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/UploadGeneratedKey", in, out, opts...); err != nil {
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/UploadGeneratedKey", in, out, opts...); err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (KeyManager_CommandStreamClient, error) {
+func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error) {
+	out := new(ReportUpdatesResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportUpdates", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	desc := &grpc.StreamDesc{StreamName: "CommandStream", ServerStreams: true, ClientStreams: true}
-	stream, err := c.cc.NewStream(ctx, desc, "/keymanager.v1.KeyManager/CommandStream", opts...)
+	stream, err := c.cc.NewStream(ctx, desc, "/vantage.v1.Vantage/CommandStream", opts...)
 	if err != nil {
 		return nil, err
 	}
-	return &keyManagerCommandStreamClient{stream}, nil
+	return &vantageCommandStreamClient{stream}, nil
 }

agent/internal/keys/keys.go

@@ -12,8 +12,8 @@ import (
 
 const authorizedKeysPath = "/root/.ssh/authorized_keys"
 const sshConfigPath = "/root/.ssh/config"
-const managedConfigPath = "/root/.ssh/keymanager.conf"
-const includeDirective = "Include /root/.ssh/keymanager.conf"
+const managedConfigPath = "/root/.ssh/vantage.conf"
+const includeDirective = "Include /root/.ssh/vantage.conf"
 
 func ReadAuthorizedKeys() ([]string, error) {
 	data, err := os.ReadFile(authorizedKeysPath)
@@ -140,7 +140,7 @@ func GenerateKeyPair(keyPath string, opts KeyGenOptions) (string, error) {
 }
 
 // AddSSHIdentity writes an IdentityFile entry for keyPath into the managed
-// keymanager.conf include file, and ensures ~/.ssh/config includes it.
+// vantage.conf include file, and ensures ~/.ssh/config includes it.
 func AddSSHIdentity(keyPath string) error {
 	if err := os.MkdirAll(filepath.Dir(sshConfigPath), 0700); err != nil {
 		return fmt.Errorf("mkdir .ssh: %w", err)
@@ -204,7 +204,7 @@ func RemoveSSHIdentity(keyPath string) error {
 	return nil
 }
 
-// ensureIncludeDirective adds "Include /root/.ssh/keymanager.conf" to the top
+// ensureIncludeDirective adds "Include /root/.ssh/vantage.conf" to the top
 // of ~/.ssh/config if it is not already present. The Include must appear before
 // any Host stanzas to be effective for all connections.
 func ensureIncludeDirective() error {

agent/internal/sync/sync.go

@@ -15,10 +15,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/mrhid6/keymanager/agent/internal/config"
-	grpcclient "github.com/mrhid6/keymanager/agent/internal/grpc"
-	"github.com/mrhid6/keymanager/agent/internal/grpc/pb"
-	"github.com/mrhid6/keymanager/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/updates"
 )
 
 func Run(ctx context.Context, cfg *config.Config, version string) error {
@@ -61,6 +62,9 @@ func Run(ctx context.Context, cfg *config.Config, version string) error {
 	// Start the command stream alongside the poll loop.
 	go runCommandStream(ctx, cfg)
 
+	// Check for OS updates on startup and then hourly.
+	go runUpdateCheck(ctx, cfg)
+
 	ticker := time.NewTicker(cfg.PollInterval)
 	defer ticker.Stop()
 
@@ -173,12 +177,75 @@ func connectAndHandleStream(ctx context.Context, cfg *config.Config) error {
 		if cmd.UpdateAgent != nil {
 			go handleUpdateAgent(cmd)
 		}
+		if cmd.ApplyUpdates != nil {
+			go handleApplyUpdates(cfg, cmd)
+		}
 	}
 }
 
+func runUpdateCheck(ctx context.Context, cfg *config.Config) {
+	const interval = time.Hour
+
+	doCheck := func() {
+		pkgs, err := updates.CheckAvailable()
+		if err != nil {
+			log.Printf("update check error: %v", err)
+			return
+		}
+		pbUpdates := make([]pb.PackageUpdate, len(pkgs))
+		for i, p := range pkgs {
+			pbUpdates[i] = pb.PackageUpdate{
+				Name:           p.Name,
+				CurrentVersion: p.CurrentVersion,
+				NewVersion:     p.NewVersion,
+			}
+		}
+		client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+		if err != nil {
+			log.Printf("update report dial error: %v", err)
+			return
+		}
+		defer client.Close()
+		if err := client.ReportUpdates(cfg.ServerID, cfg.AgentToken, pbUpdates); err != nil {
+			log.Printf("ReportUpdates error: %v", err)
+			return
+		}
+		log.Printf("reported %d available OS updates", len(pkgs))
+	}
+
+	doCheck()
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			doCheck()
+		}
+	}
+}
+
+func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
+	log.Printf("applying OS updates (cmd=%s)…", cmd.CommandId)
+	if err := updates.ApplyAll(); err != nil {
+		log.Printf("OS upgrade failed (cmd=%s): %v", cmd.CommandId, err)
+		return
+	}
+	log.Printf("OS updates applied successfully (cmd=%s)", cmd.CommandId)
+
+	// Re-report the (now empty) update list so the server reflects the new state.
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return
+	}
+	defer client.Close()
+	_ = client.ReportUpdates(cfg.ServerID, cfg.AgentToken, nil)
+}
+
 func handleDeleteKey(cmd *pb.ServerCommand) {
 	label := cmd.DeleteKey.Label
-	keyPath := fmt.Sprintf("/root/.ssh/keymanager_%s", strings.ReplaceAll(label, " ", "_"))
+	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
 
 	if err := keys.RemoveSSHIdentity(keyPath); err != nil {
 		log.Printf("remove ssh identity failed (cmd=%s): %v", cmd.CommandId, err)
@@ -196,13 +263,13 @@ func handleUpdateAgent(cmd *pb.ServerCommand) {
 	u := cmd.UpdateAgent
 	arch := runtime.GOARCH // "amd64" or "arm64"
 	tag := "agent%2Fv" + u.Version
-	binaryURL := fmt.Sprintf("%s/mrhid6/keymanager/releases/download/%s/keymanager-agent-linux-%s", u.GiteaBaseURL, tag, arch)
-	checksumURL := fmt.Sprintf("%s/mrhid6/keymanager/releases/download/%s/checksums.txt", u.GiteaBaseURL, tag)
+	binaryURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/vantage-agent-linux-%s", u.GiteaBaseURL, tag, arch)
+	checksumURL := fmt.Sprintf("%s/mrhid6/vantage/releases/download/%s/checksums.txt", u.GiteaBaseURL, tag)
 
 	log.Printf("updating agent to v%s from %s (cmd=%s)", u.Version, u.GiteaBaseURL, cmd.CommandId)
 
 	// Download binary
-	tmpBin := "/tmp/keymanager-agent-update"
+	tmpBin := "/tmp/vantage-agent-update"
 	if err := downloadFile(binaryURL, tmpBin); err != nil {
 		log.Printf("update download failed (cmd=%s): %v", cmd.CommandId, err)
 		return
@@ -214,7 +281,7 @@ func handleUpdateAgent(cmd *pb.ServerCommand) {
 		log.Printf("update checksum fetch failed (cmd=%s): %v", cmd.CommandId, err)
 		return
 	}
-	if err := verifyChecksum(tmpBin, fmt.Sprintf("keymanager-agent-linux-%s", arch), checksumData); err != nil {
+	if err := verifyChecksum(tmpBin, fmt.Sprintf("vantage-agent-linux-%s", arch), checksumData); err != nil {
 		log.Printf("update checksum mismatch (cmd=%s): %v", cmd.CommandId, err)
 		os.Remove(tmpBin)
 		return
@@ -224,13 +291,13 @@ func handleUpdateAgent(cmd *pb.ServerCommand) {
 		log.Printf("update chmod failed (cmd=%s): %v", cmd.CommandId, err)
 		return
 	}
-	if err := os.Rename(tmpBin, "/usr/local/bin/keymanager-agent"); err != nil {
+	if err := os.Rename(tmpBin, "/usr/local/bin/vantage-agent"); err != nil {
 		log.Printf("update replace binary failed (cmd=%s): %v", cmd.CommandId, err)
 		return
 	}
 
 	log.Printf("agent binary replaced, restarting service (cmd=%s)", cmd.CommandId)
-	exec.Command("systemctl", "restart", "keymanager-agent").Run()
+	exec.Command("systemctl", "restart", "vantage-agent").Run()
 }
 
 func downloadFile(url, dest string) error {
@@ -290,7 +357,7 @@ func verifyChecksum(filePath, filename string, checksumData []byte) error {
 func handleGenerateKey(cfg *config.Config, cmd *pb.ServerCommand) {
 	g := cmd.GenerateKey
 	label := g.Label
-	keyPath := fmt.Sprintf("/root/.ssh/keymanager_%s", strings.ReplaceAll(label, " ", "_"))
+	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
 
 	opts := keys.KeyGenOptions{
 		KeyType:    g.KeyType,
@@ -352,7 +419,7 @@ func GenerateAndUpload(cfg *config.Config, label string) error {
 	}
 	defer client.Close()
 
-	keyPath := fmt.Sprintf("/root/.ssh/keymanager_%s", strings.ReplaceAll(label, " ", "_"))
+	keyPath := fmt.Sprintf("/root/.ssh/vantage_%s", strings.ReplaceAll(label, " ", "_"))
 	pubKey, err := keys.GenerateKeyPair(keyPath, keys.KeyGenOptions{Comment: label})
 	if err != nil {
 		return err

agent/internal/updates/updates.go

@@ -0,0 +1,239 @@
+package updates
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+type PackageUpdate struct {
+	Name           string
+	CurrentVersion string
+	NewVersion     string
+}
+
+func detectPM() string {
+	for _, pm := range []string{"apt-get", "dnf", "yum", "pacman", "zypper", "apk"} {
+		if _, err := exec.LookPath(pm); err == nil {
+			if pm == "apt-get" {
+				return "apt"
+			}
+			return pm
+		}
+	}
+	return ""
+}
+
+// CheckAvailable returns the list of packages with available upgrades.
+// Returns nil, nil when no supported package manager is found.
+func CheckAvailable() ([]PackageUpdate, error) {
+	switch detectPM() {
+	case "apt":
+		return checkApt()
+	case "dnf":
+		return checkDnfYum("dnf")
+	case "yum":
+		return checkDnfYum("yum")
+	case "pacman":
+		return checkPacman()
+	case "zypper":
+		return checkZypper()
+	case "apk":
+		return checkApk()
+	default:
+		return nil, nil
+	}
+}
+
+// ApplyAll runs a full non-interactive upgrade using the detected package manager.
+func ApplyAll() error {
+	switch detectPM() {
+	case "apt":
+		// Refresh lists first, then upgrade.
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		defer cancel()
+		if err := exec.CommandContext(ctx, "apt-get", "update", "-qq").Run(); err != nil {
+			return err
+		}
+		return exec.CommandContext(ctx, "apt-get", "upgrade", "-y").Run()
+	case "dnf":
+		return exec.Command("dnf", "upgrade", "-y").Run()
+	case "yum":
+		return exec.Command("yum", "upgrade", "-y").Run()
+	case "pacman":
+		return exec.Command("pacman", "-Syu", "--noconfirm").Run()
+	case "zypper":
+		return exec.Command("zypper", "update", "-y").Run()
+	case "apk":
+		return exec.Command("apk", "upgrade").Run()
+	default:
+		return nil
+	}
+}
+
+func checkApt() ([]PackageUpdate, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	// Best-effort refresh; ignore errors (cached data is fine).
+	exec.CommandContext(ctx, "apt-get", "update", "-qq").Run() //nolint:errcheck
+
+	out, err := exec.Command("apt", "list", "--upgradable").Output()
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		// Format: package/suite version arch [upgradable from: old-ver]
+		if !strings.Contains(line, "[upgradable from:") {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 2 {
+			continue
+		}
+		name := strings.SplitN(parts[0], "/", 2)[0]
+		newVer := parts[1]
+		oldVer := ""
+		if idx := strings.Index(line, "upgradable from: "); idx != -1 {
+			rest := line[idx+len("upgradable from: "):]
+			oldVer = strings.TrimSuffix(strings.TrimSpace(rest), "]")
+		}
+		updates = append(updates, PackageUpdate{Name: name, CurrentVersion: oldVer, NewVersion: newVer})
+	}
+	return updates, nil
+}
+
+func checkDnfYum(pm string) ([]PackageUpdate, error) {
+	cmd := exec.Command(pm, "check-update")
+	out, err := cmd.Output()
+	// Exit code 100 means updates are available — not an error.
+	if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 100 {
+		err = nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	pastHeader := false
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !pastHeader {
+			if strings.TrimSpace(line) == "" {
+				pastHeader = true
+			}
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 2 {
+			continue
+		}
+		// name.arch  new-version  repo
+		name := strings.SplitN(parts[0], ".", 2)[0]
+		updates = append(updates, PackageUpdate{Name: name, NewVersion: parts[1]})
+	}
+	return updates, nil
+}
+
+func checkPacman() ([]PackageUpdate, error) {
+	out, _ := exec.Command("pacman", "-Qu").Output()
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		parts := strings.Fields(scanner.Text())
+		// Format: package old-version -> new-version
+		if len(parts) < 4 {
+			continue
+		}
+		updates = append(updates, PackageUpdate{Name: parts[0], CurrentVersion: parts[1], NewVersion: parts[3]})
+	}
+	return updates, nil
+}
+
+func checkZypper() ([]PackageUpdate, error) {
+	out, err := exec.Command("zypper", "list-updates").Output()
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		// Data rows start with "v |" (available) or "i |" (installed but updatable).
+		if !strings.HasPrefix(line, "v |") && !strings.HasPrefix(line, "i |") {
+			continue
+		}
+		parts := strings.Split(line, "|")
+		if len(parts) < 5 {
+			continue
+		}
+		updates = append(updates, PackageUpdate{
+			Name:           strings.TrimSpace(parts[2]),
+			CurrentVersion: strings.TrimSpace(parts[3]),
+			NewVersion:     strings.TrimSpace(parts[4]),
+		})
+	}
+	return updates, nil
+}
+
+func checkApk() ([]PackageUpdate, error) {
+	out, err := exec.Command("apk", "list", "--upgradable").Output()
+	if err != nil {
+		return nil, err
+	}
+	var updates []PackageUpdate
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !strings.Contains(line, "[upgradable") {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) < 1 {
+			continue
+		}
+		pkgVer := parts[0]
+		name := apkName(pkgVer)
+		newVer := apkVersion(pkgVer)
+		oldVer := ""
+		if idx := strings.Index(line, "upgradable from:"); idx != -1 {
+			rest := strings.TrimSpace(line[idx+len("upgradable from:"):])
+			rest = strings.TrimSuffix(rest, "]")
+			oldVer = apkVersion(strings.TrimSpace(rest))
+		}
+		updates = append(updates, PackageUpdate{Name: name, CurrentVersion: oldVer, NewVersion: newVer})
+	}
+	return updates, nil
+}
+
+func apkName(pkgVer string) string {
+	parts := strings.Split(pkgVer, "-")
+	var name []string
+	for _, p := range parts {
+		if len(p) > 0 && p[0] >= '0' && p[0] <= '9' {
+			break
+		}
+		name = append(name, p)
+	}
+	return strings.Join(name, "-")
+}
+
+func apkVersion(pkgVer string) string {
+	parts := strings.Split(pkgVer, "-")
+	var ver []string
+	inVer := false
+	for _, p := range parts {
+		if !inVer && len(p) > 0 && p[0] >= '0' && p[0] <= '9' {
+			inVer = true
+		}
+		if inVer {
+			ver = append(ver, p)
+		}
+	}
+	return strings.Join(ver, "-")
+}

claude.md

@@ -1,4 +1,4 @@
-# KeyManager
+# Vantage
 
 A self-hosted SSH key management system. A central server (Go + Next.js + MongoDB) manages public key assignments across servers. A lightweight Go agent runs on each managed server, polls the central server via gRPC, and atomically rewrites `/root/.ssh/authorized_keys` to match the desired state.
 
@@ -34,7 +34,7 @@ A self-hosted SSH key management system. A central server (Go + Next.js + MongoD
 ## Repository Structure
 
 ```
-keymanager/
+vantage/
 ├── agent/
 │   ├── cmd/main.go
 │   └── internal/
@@ -56,7 +56,7 @@ keymanager/
 │   ├── app/
 │   └── components/
 ├── proto/
-│   └── keymanager/v1/keymanager.proto
+│   └── vantage/v1/vantage.proto
 ├── deploy/
 │   ├── docker-compose.yml
 │   └── agent.service
@@ -72,9 +72,9 @@ keymanager/
 
 ```protobuf
 syntax = "proto3";
-package keymanager.v1;
+package vantage.v1;
 
-service KeyManager {
+service Vantage {
   rpc Register(RegisterRequest)           returns (RegisterResponse);
   rpc SyncKeys(SyncRequest)               returns (SyncResponse);
   rpc UploadGeneratedKey(UploadKeyRequest) returns (UploadKeyResponse);
@@ -172,10 +172,10 @@ No streaming — polling only. Poll interval: **30 seconds**.
 
 ## Agent Lifecycle
 
-### Config file — `/etc/keymanager/config.yaml`
+### Config file — `/etc/vantage/config.yaml`
 
 ```yaml
-server_url: "keymanager.yourdomain.com:9090"
+server_url: "vantage.yourdomain.com:9090"
 server_id: "<uuid>"
 pre_reg_token: "<token>" # removed after first successful Register()
 agent_token: "" # written by agent after Register()
@@ -216,15 +216,15 @@ Config file permissions: `0600`. Config directory: `0700`.
 - Uploads public key via `UploadGeneratedKey()`
 - Private key stays local on the machine
 
-### Systemd unit — `/etc/systemd/system/keymanager-agent.service`
+### Systemd unit — `/etc/systemd/system/vantage-agent.service`
 
 ```ini
 [Unit]
-Description=KeyManager Agent
+Description=Vantage Agent
 After=network.target
 
 [Service]
-ExecStart=/usr/local/bin/keymanager-agent
+ExecStart=/usr/local/bin/vantage-agent
 Restart=always
 RestartSec=10
 User=root
@@ -241,14 +241,14 @@ WantedBy=multi-user.target
 2. Backend generates a short-lived pre-registration token (TTL: 1 hour) and a `server_id`
 3. UI displays a one-liner install command with copy button:
     ```bash
-    curl -fsSL https://keymanager.yourdomain.com/install | \
+    curl -fsSL https://vantage.yourdomain.com/install | \
       bash -s -- --server-id=<id> --token=<token>
     ```
 4. Install script:
     - Detects arch (`amd64` / `arm64`)
     - Downloads agent binary from Gitea release
     - Verifies SHA-256 checksum
-    - Writes `/etc/keymanager/config.yaml`
+    - Writes `/etc/vantage/config.yaml`
     - Installs and starts systemd unit
 5. On first `SyncKeys` call, server marks status as `active`
 
@@ -259,7 +259,7 @@ The backend serves `/install` dynamically, injecting the latest agent version by
 ## Security
 
 - gRPC over TLS (Let's Encrypt or self-signed with cert pinning on the agent)
-- Agent authenticates with a per-server token stored at `/etc/keymanager/config.yaml` (`0600`)
+- Agent authenticates with a per-server token stored at `/etc/vantage/config.yaml` (`0600`)
 - Server stores `SHA-256(agent_token)` — never the plaintext token
 - Private keys generated by agents are encrypted at rest in MongoDB (AES-256)
 - `authorized_keys` written as `0600`, owned by root
@@ -298,13 +298,13 @@ Build command:
 ```bash
 GOOS=linux GOARCH=amd64 go build \
   -ldflags="-s -w -X main.Version=${VERSION}" \
-  -o dist/keymanager-agent-linux-amd64 ./cmd
+  -o dist/vantage-agent-linux-amd64 ./cmd
 ```
 
 Release assets:
 
-- `keymanager-agent-linux-amd64`
-- `keymanager-agent-linux-arm64`
+- `vantage-agent-linux-amd64`
+- `vantage-agent-linux-arm64`
 - `checksums.txt`
 
 ### Server deploy — `.gitea/workflows/server-deploy.yml`
@@ -312,7 +312,7 @@ Release assets:
 Triggered on pushes to `main` touching `server/**`, `web/**`, or `proto/**`. Builds and pushes Docker images to the Gitea container registry, then deploys via SSH:
 
 ```bash
-cd /opt/keymanager && docker compose pull && docker compose up -d --remove-orphans
+cd /opt/vantage && docker compose pull && docker compose up -d --remove-orphans
 ```
 
 ### Tagging convention

deploy/agent.service

@@ -1,18 +1,18 @@
 [Unit]
-Description=KeyManager Agent
-Documentation=https://github.com/your-org/keymanager
+Description=Vantage Agent
+Documentation=https://github.com/your-org/vantage
 After=network.target
 Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=/usr/local/bin/keymanager-agent
+ExecStart=/usr/local/bin/vantage-agent
 Restart=always
 RestartSec=10
 User=root
 StandardOutput=journal
 StandardError=journal
-SyslogIdentifier=keymanager-agent
+SyslogIdentifier=vantage-agent
 
 # Security hardening
 NoNewPrivileges=true

deploy/docker-compose.yml

@@ -31,7 +31,7 @@ services:
       - "8080:8080"
       - "9090:9090"
     environment:
-      MONGO_URI: mongodb://mongo:27017/keymanager
+      MONGO_URI: mongodb://mongo:27017/vantage
       REDIS_ADDR: redis:6379
       GITEA_HOST: ${GITEA_HOST}
       PUBLIC_HOST: ${PUBLIC_HOST}

proto/vantage/v1/vantage.proto

@@ -1,13 +1,14 @@
 syntax = "proto3";
 
-package keymanager.v1;
+package vantage.v1;
 
-option go_package = "github.com/mrhid6/keymanager/server/internal/grpc/pb";
+option go_package = "github.com/mrhid6/vantage/server/internal/grpc/pb";
 
-service KeyManager {
+service Vantage {
   rpc Register(RegisterRequest)                returns (RegisterResponse);
   rpc SyncKeys(SyncRequest)                    returns (SyncResponse);
   rpc UploadGeneratedKey(UploadKeyRequest)      returns (UploadKeyResponse);
+  rpc ReportUpdates(ReportUpdatesRequest)       returns (ReportUpdatesResponse);
   // Bidirectional stream: agent sends auth once, server pushes commands.
   rpc CommandStream(stream AgentMessage)        returns (stream ServerCommand);
 }
@@ -65,12 +66,29 @@ message CommandResult {
   string message    = 3;
 }
 
+message PackageUpdate {
+  string name            = 1;
+  string current_version = 2;
+  string new_version     = 3;
+}
+
+message ReportUpdatesRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  repeated PackageUpdate updates = 3;
+}
+
+message ReportUpdatesResponse {}
+
+message ApplyUpdatesCmd {}
+
 message ServerCommand {
   string command_id = 1;
   oneof command {
-    GenerateKeyCmd generate_key = 2;
-    DeleteKeyCmd   delete_key   = 3;
-    UpdateAgentCmd update_agent = 4;
+    GenerateKeyCmd  generate_key  = 2;
+    DeleteKeyCmd    delete_key    = 3;
+    UpdateAgentCmd  update_agent  = 4;
+    ApplyUpdatesCmd apply_updates = 5;
   }
 }
 

server/Dockerfile

@@ -11,14 +11,14 @@ RUN go mod download
 COPY . .
 
 ARG VERSION=dev
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o /keymanager-server ./cmd
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.Version=${VERSION}" -o /vantage-server ./cmd
 
 # Runtime stage
 FROM scratch
 
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-COPY --from=builder /keymanager-server /keymanager-server
+COPY --from=builder /vantage-server /vantage-server
 
 EXPOSE 8080 9090
 
-ENTRYPOINT ["/keymanager-server"]
+ENTRYPOINT ["/vantage-server"]

server/cmd/main.go

@@ -7,16 +7,16 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
-	"github.com/mrhid6/keymanager/server/internal/api"
-	"github.com/mrhid6/keymanager/server/internal/auth"
-	"github.com/mrhid6/keymanager/server/internal/db"
-	grpcserver "github.com/mrhid6/keymanager/server/internal/grpc"
-	"github.com/mrhid6/keymanager/server/internal/services"
+	"github.com/mrhid6/vantage/server/internal/api"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/db"
+	grpcserver "github.com/mrhid6/vantage/server/internal/grpc"
+	"github.com/mrhid6/vantage/server/internal/services"
 )
 
 func main() {
 	mongoURI := getEnv("MONGO_URI", "mongodb://localhost:27017")
-	dbName := getEnv("MONGO_DB", "keymanager")
+	dbName := getEnv("MONGO_DB", "vantage")
 
 	if err := db.Connect(mongoURI, dbName); err != nil {
 		log.Fatalf("failed to connect to MongoDB: %v", err)

server/go.mod

@@ -1,4 +1,4 @@
-module github.com/mrhid6/keymanager/server
+module github.com/mrhid6/vantage/server
 
 go 1.26
 

server/internal/api/handlers.go

@@ -6,9 +6,9 @@ import (
 	"os"
 
 	"github.com/gin-gonic/gin"
-	"github.com/mrhid6/keymanager/server/internal/auth"
-	"github.com/mrhid6/keymanager/server/internal/models"
-	"github.com/mrhid6/keymanager/server/internal/services"
+	"github.com/mrhid6/vantage/server/internal/auth"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
 )
 
 func RegisterRoutes(r *gin.Engine) {
@@ -33,6 +33,7 @@ func RegisterRoutes(r *gin.Engine) {
 		apiGroup.DELETE("/servers/:id", deleteServer)
 		apiGroup.POST("/servers/:id/generate-key", generateKey)
 		apiGroup.POST("/servers/:id/update-agent", updateAgent)
+		apiGroup.POST("/servers/:id/apply-updates", applyUpdates)
 
 		apiGroup.GET("/agent/latest-version", getLatestAgentVersion)
 
@@ -81,7 +82,7 @@ func newServer(c *gin.Context) {
 	}
 	host := os.Getenv("PUBLIC_HOST")
 	if host == "" {
-		host = "https://keymanager.example.com"
+		host = "https://vantage.example.com"
 	}
 
 	installCmd := fmt.Sprintf(
@@ -290,6 +291,21 @@ func updateAgent(c *gin.Context) {
 	})
 }
 
+func applyUpdates(c *gin.Context) {
+	id := c.Param("id")
+	s, err := services.GetServer(id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
+		return
+	}
+
+	if err := services.DispatchApplyUpdates(s.ServerID); err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusAccepted, gin.H{"message": "apply updates command sent to agent"})
+}
+
 func handleUpdateScript(c *gin.Context) {
 	giteaHost := os.Getenv("GITEA_HOST")
 	if giteaHost == "" {
@@ -309,7 +325,7 @@ case "$ARCH" in
 esac
 
 # Get latest agent release tag
-LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/keymanager/releases?limit=10" \
+LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/vantage/releases?limit=10" \
   | grep -o '"tag_name":"agent/v[^"]*"' | head -1 | sed 's/"tag_name":"//;s/"//')
 
 if [ -z "$LATEST" ]; then
@@ -319,27 +335,27 @@ fi
 
 VERSION="${LATEST#agent/}"
 LATEST_ENCODED="${LATEST/\//%%2F}"
-BINARY_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST_ENCODED}/keymanager-agent-linux-${ARCH}"
-CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST_ENCODED}/checksums.txt"
+BINARY_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/vantage-agent-linux-${ARCH}"
+CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/checksums.txt"
 
-echo "Updating keymanager-agent to ${VERSION} (${ARCH})..."
+echo "Updating vantage-agent to ${VERSION} (${ARCH})..."
 
-curl -fsSL -o /tmp/keymanager-agent "${BINARY_URL}"
+curl -fsSL -o /tmp/vantage-agent "${BINARY_URL}"
 curl -fsSL -o /tmp/checksums.txt "${CHECKSUM_URL}"
 
 cd /tmp
-EXPECTED=$(grep "keymanager-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
-ACTUAL=$(sha256sum keymanager-agent | awk '{print $1}')
+EXPECTED=$(grep "vantage-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
+ACTUAL=$(sha256sum vantage-agent | awk '{print $1}')
 if [ "$EXPECTED" != "$ACTUAL" ]; then
   echo "Checksum mismatch!" >&2
   exit 1
 fi
 
-systemctl stop keymanager-agent || true
-install -m 0755 /tmp/keymanager-agent /usr/local/bin/keymanager-agent
-systemctl start keymanager-agent
+systemctl stop vantage-agent || true
+install -m 0755 /tmp/vantage-agent /usr/local/bin/vantage-agent
+systemctl start vantage-agent
 
-echo "keymanager-agent updated to ${VERSION} and restarted."
+echo "vantage-agent updated to ${VERSION} and restarted."
 `, giteaHost)
 
 	c.Header("Content-Type", "text/x-shellscript")
@@ -356,7 +372,7 @@ func handleInstallScript(c *gin.Context) {
 	}
 	publicHost := os.Getenv("PUBLIC_HOST")
 	if publicHost == "" {
-		publicHost = "keymanager.example.com"
+		publicHost = "vantage.example.com"
 	}
 	grpcHost := os.Getenv("GRPC_HOST")
 	if grpcHost == "" {
@@ -384,7 +400,7 @@ case "$ARCH" in
 esac
 
 # Get latest agent release tag
-LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/keymanager/releases?limit=10" \
+LATEST=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/mrhid6/vantage/releases?limit=10" \
   | grep -o '"tag_name":"agent/v[^"]*"' | head -1 | sed 's/"tag_name":"//;s/"//')
 
 if [ -z "$LATEST" ]; then
@@ -394,28 +410,28 @@ fi
 
 VERSION="${LATEST#agent/}"
 LATEST_ENCODED="${LATEST/\//%%2F}"
-BINARY_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST_ENCODED}/keymanager-agent-linux-${ARCH}"
-CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/keymanager/releases/download/${LATEST_ENCODED}/checksums.txt"
+BINARY_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/vantage-agent-linux-${ARCH}"
+CHECKSUM_URL="https://${GITEA_HOST}/mrhid6/vantage/releases/download/${LATEST_ENCODED}/checksums.txt"
 
-echo "Installing keymanager-agent ${VERSION} (${ARCH})..."
+echo "Installing vantage-agent ${VERSION} (${ARCH})..."
 
-curl -fsSL -o /tmp/keymanager-agent "${BINARY_URL}"
+curl -fsSL -o /tmp/vantage-agent "${BINARY_URL}"
 curl -fsSL -o /tmp/checksums.txt "${CHECKSUM_URL}"
 
 cd /tmp
-EXPECTED=$(grep "keymanager-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
-ACTUAL=$(sha256sum keymanager-agent | awk '{print $1}')
+EXPECTED=$(grep "vantage-agent-linux-${ARCH}" checksums.txt | awk '{print $1}')
+ACTUAL=$(sha256sum vantage-agent | awk '{print $1}')
 if [ "$EXPECTED" != "$ACTUAL" ]; then
   echo "Checksum mismatch!" >&2
   exit 1
 fi
 
-install -m 0755 /tmp/keymanager-agent /usr/local/bin/keymanager-agent
+install -m 0755 /tmp/vantage-agent /usr/local/bin/vantage-agent
 
-mkdir -p /etc/keymanager
-chmod 0700 /etc/keymanager
+mkdir -p /etc/vantage
+chmod 0700 /etc/vantage
 
-cat > /etc/keymanager/config.yaml <<EOF
+cat > /etc/vantage/config.yaml <<EOF
 server_url: "${GRPC_HOST}"
 server_id: "${SERVER_ID}"
 pre_reg_token: "${TOKEN}"
@@ -423,15 +439,15 @@ agent_token: ""
 poll_interval: 30s
 tls: true
 EOF
-chmod 0600 /etc/keymanager/config.yaml
+chmod 0600 /etc/vantage/config.yaml
 
-cat > /etc/systemd/system/keymanager-agent.service <<EOF
+cat > /etc/systemd/system/vantage-agent.service <<EOF
 [Unit]
-Description=KeyManager Agent
+Description=Vantage Agent
 After=network.target
 
 [Service]
-ExecStart=/usr/local/bin/keymanager-agent
+ExecStart=/usr/local/bin/vantage-agent
 Restart=always
 RestartSec=10
 User=root
@@ -441,9 +457,9 @@ WantedBy=multi-user.target
 EOF
 
 systemctl daemon-reload
-systemctl enable --now keymanager-agent
+systemctl enable --now vantage-agent
 
-echo "keymanager-agent installed and started."
+echo "vantage-agent installed and started."
 `, serverID, token, giteaHost, publicHost, grpcHost)
 
 	c.Header("Content-Type", "text/x-shellscript")

server/internal/grpc/pb/keymanager.pb.go

@@ -1,287 +0,0 @@
-// Hand-written gRPC bindings for keymanager.proto using JSON codec.
-// To use: register the JSON codec before creating gRPC servers/clients.
-
-package pb
-
-import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-// Message types
-
-type RegisterRequest struct {
-	ServerId    string `json:"server_id"`
-	PreRegToken string `json:"pre_reg_token"`
-	Hostname    string `json:"hostname"`
-	IpAddress   string `json:"ip_address"`
-	OsInfo      string `json:"os_info"`
-}
-
-type RegisterResponse struct {
-	AgentToken string `json:"agent_token"`
-}
-
-type SyncRequest struct {
-	ServerId     string `json:"server_id"`
-	AgentToken   string `json:"agent_token"`
-	AgentVersion string `json:"agent_version,omitempty"`
-}
-
-type SyncResponse struct {
-	PublicKeys []string `json:"public_keys"`
-}
-
-type UploadKeyRequest struct {
-	ServerId   string `json:"server_id"`
-	AgentToken string `json:"agent_token"`
-	PublicKey  string `json:"public_key"`
-	Label      string `json:"label"`
-	PrivateKey string `json:"private_key,omitempty"`
-}
-
-type UploadKeyResponse struct {
-	KeyId string `json:"key_id"`
-}
-
-// CommandStream message types
-
-type ServerCommand struct {
-	CommandId   string          `json:"command_id"`
-	GenerateKey *GenerateKeyCmd `json:"generate_key,omitempty"`
-	DeleteKey   *DeleteKeyCmd   `json:"delete_key,omitempty"`
-	UpdateAgent *UpdateAgentCmd `json:"update_agent,omitempty"`
-}
-
-type DeleteKeyCmd struct {
-	Label string `json:"label"`
-}
-
-type UpdateAgentCmd struct {
-	Version      string `json:"version"`
-	GiteaBaseURL string `json:"gitea_base_url"`
-}
-
-type GenerateKeyCmd struct {
-	Label      string `json:"label"`
-	KeyType    string `json:"key_type,omitempty"`
-	KeySize    int    `json:"key_size,omitempty"`
-	Passphrase string `json:"passphrase,omitempty"`
-	Comment    string `json:"comment,omitempty"`
-}
-
-type AgentMessage struct {
-	ServerId   string         `json:"server_id"`
-	AgentToken string         `json:"agent_token"`
-	Ready      *AgentReady    `json:"ready,omitempty"`
-	Result     *CommandResult `json:"result,omitempty"`
-}
-
-type AgentReady struct{}
-
-type CommandResult struct {
-	CommandId string `json:"command_id"`
-	Success   bool   `json:"success"`
-	Message   string `json:"message"`
-}
-
-// CommandStream server-side interface
-
-type KeyManager_CommandStreamServer interface {
-	Send(*ServerCommand) error
-	Recv() (*AgentMessage, error)
-	grpc.ServerStream
-}
-
-type keyManagerCommandStreamServer struct {
-	grpc.ServerStream
-}
-
-func (s *keyManagerCommandStreamServer) Send(m *ServerCommand) error {
-	return s.ServerStream.SendMsg(m)
-}
-
-func (s *keyManagerCommandStreamServer) Recv() (*AgentMessage, error) {
-	m := new(AgentMessage)
-	if err := s.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-// CommandStream client-side interface
-
-type KeyManager_CommandStreamClient interface {
-	Send(*AgentMessage) error
-	Recv() (*ServerCommand, error)
-	grpc.ClientStream
-}
-
-type keyManagerCommandStreamClient struct {
-	grpc.ClientStream
-}
-
-func (c *keyManagerCommandStreamClient) Send(m *AgentMessage) error {
-	return c.ClientStream.SendMsg(m)
-}
-
-func (c *keyManagerCommandStreamClient) Recv() (*ServerCommand, error) {
-	m := new(ServerCommand)
-	if err := c.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-// Server interface
-
-type KeyManagerServer interface {
-	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
-	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
-	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
-	CommandStream(KeyManager_CommandStreamServer) error
-}
-
-type UnimplementedKeyManagerServer struct{}
-
-func (UnimplementedKeyManagerServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Register not implemented")
-}
-
-func (UnimplementedKeyManagerServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SyncKeys not implemented")
-}
-
-func (UnimplementedKeyManagerServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UploadGeneratedKey not implemented")
-}
-
-func (UnimplementedKeyManagerServer) CommandStream(KeyManager_CommandStreamServer) error {
-	return status.Errorf(codes.Unimplemented, "method CommandStream not implemented")
-}
-
-// Client interface
-
-type KeyManagerClient interface {
-	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
-	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
-	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
-	CommandStream(ctx context.Context, opts ...grpc.CallOption) (KeyManager_CommandStreamClient, error)
-}
-
-type keyManagerClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewKeyManagerClient(cc grpc.ClientConnInterface) KeyManagerClient {
-	return &keyManagerClient{cc}
-}
-
-func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
-	out := new(RegisterResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/Register", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
-	out := new(SyncResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/SyncKeys", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
-	out := new(UploadKeyResponse)
-	if err := c.cc.Invoke(ctx, "/keymanager.v1.KeyManager/UploadGeneratedKey", in, out, opts...); err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (KeyManager_CommandStreamClient, error) {
-	stream, err := c.cc.NewStream(ctx, &KeyManager_ServiceDesc.Streams[0], "/keymanager.v1.KeyManager/CommandStream", opts...)
-	if err != nil {
-		return nil, err
-	}
-	return &keyManagerCommandStreamClient{stream}, nil
-}
-
-// Server registration
-
-func RegisterKeyManagerServer(s grpc.ServiceRegistrar, srv KeyManagerServer) {
-	s.RegisterService(&KeyManager_ServiceDesc, srv)
-}
-
-var KeyManager_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "keymanager.v1.KeyManager",
-	HandlerType: (*KeyManagerServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{MethodName: "Register", Handler: _KeyManager_Register_Handler},
-		{MethodName: "SyncKeys", Handler: _KeyManager_SyncKeys_Handler},
-		{MethodName: "UploadGeneratedKey", Handler: _KeyManager_UploadGeneratedKey_Handler},
-	},
-	Streams: []grpc.StreamDesc{
-		{
-			StreamName:    "CommandStream",
-			Handler:       _KeyManager_CommandStream_Handler,
-			ServerStreams: true,
-			ClientStreams: true,
-		},
-	},
-	Metadata: "keymanager/v1/keymanager.proto",
-}
-
-func _KeyManager_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RegisterRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyManagerServer).Register(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/Register"}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyManagerServer).Register(ctx, req.(*RegisterRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _KeyManager_SyncKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SyncRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyManagerServer).SyncKeys(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/SyncKeys"}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyManagerServer).SyncKeys(ctx, req.(*SyncRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _KeyManager_UploadGeneratedKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UploadKeyRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyManagerServer).UploadGeneratedKey(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/keymanager.v1.KeyManager/UploadGeneratedKey"}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyManagerServer).UploadGeneratedKey(ctx, req.(*UploadKeyRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _KeyManager_CommandStream_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(KeyManagerServer).CommandStream(&keyManagerCommandStreamServer{stream})
-}

server/internal/grpc/pb/vantage.pb.go

@@ -0,0 +1,334 @@
+// Hand-written gRPC bindings for vantage.proto using JSON codec.
+// To use: register the JSON codec before creating gRPC servers/clients.
+
+package pb
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// Message types
+
+type RegisterRequest struct {
+	ServerId    string `json:"server_id"`
+	PreRegToken string `json:"pre_reg_token"`
+	Hostname    string `json:"hostname"`
+	IpAddress   string `json:"ip_address"`
+	OsInfo      string `json:"os_info"`
+}
+
+type RegisterResponse struct {
+	AgentToken string `json:"agent_token"`
+}
+
+type SyncRequest struct {
+	ServerId     string `json:"server_id"`
+	AgentToken   string `json:"agent_token"`
+	AgentVersion string `json:"agent_version,omitempty"`
+}
+
+type SyncResponse struct {
+	PublicKeys []string `json:"public_keys"`
+}
+
+type UploadKeyRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+	PublicKey  string `json:"public_key"`
+	Label      string `json:"label"`
+	PrivateKey string `json:"private_key,omitempty"`
+}
+
+type UploadKeyResponse struct {
+	KeyId string `json:"key_id"`
+}
+
+// CommandStream message types
+
+type PackageUpdate struct {
+	Name           string `json:"name"`
+	CurrentVersion string `json:"current_version,omitempty"`
+	NewVersion     string `json:"new_version"`
+}
+
+type ReportUpdatesRequest struct {
+	ServerId   string          `json:"server_id"`
+	AgentToken string          `json:"agent_token"`
+	Updates    []PackageUpdate `json:"updates"`
+}
+
+type ReportUpdatesResponse struct{}
+
+type ApplyUpdatesCmd struct{}
+
+type ServerCommand struct {
+	CommandId    string           `json:"command_id"`
+	GenerateKey  *GenerateKeyCmd  `json:"generate_key,omitempty"`
+	DeleteKey    *DeleteKeyCmd    `json:"delete_key,omitempty"`
+	UpdateAgent  *UpdateAgentCmd  `json:"update_agent,omitempty"`
+	ApplyUpdates *ApplyUpdatesCmd `json:"apply_updates,omitempty"`
+}
+
+type DeleteKeyCmd struct {
+	Label string `json:"label"`
+}
+
+type UpdateAgentCmd struct {
+	Version      string `json:"version"`
+	GiteaBaseURL string `json:"gitea_base_url"`
+}
+
+type GenerateKeyCmd struct {
+	Label      string `json:"label"`
+	KeyType    string `json:"key_type,omitempty"`
+	KeySize    int    `json:"key_size,omitempty"`
+	Passphrase string `json:"passphrase,omitempty"`
+	Comment    string `json:"comment,omitempty"`
+}
+
+type AgentMessage struct {
+	ServerId   string         `json:"server_id"`
+	AgentToken string         `json:"agent_token"`
+	Ready      *AgentReady    `json:"ready,omitempty"`
+	Result     *CommandResult `json:"result,omitempty"`
+}
+
+type AgentReady struct{}
+
+type CommandResult struct {
+	CommandId string `json:"command_id"`
+	Success   bool   `json:"success"`
+	Message   string `json:"message"`
+}
+
+// CommandStream server-side interface
+
+type Vantage_CommandStreamServer interface {
+	Send(*ServerCommand) error
+	Recv() (*AgentMessage, error)
+	grpc.ServerStream
+}
+
+type keyManagerCommandStreamServer struct {
+	grpc.ServerStream
+}
+
+func (s *keyManagerCommandStreamServer) Send(m *ServerCommand) error {
+	return s.ServerStream.SendMsg(m)
+}
+
+func (s *keyManagerCommandStreamServer) Recv() (*AgentMessage, error) {
+	m := new(AgentMessage)
+	if err := s.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// CommandStream client-side interface
+
+type Vantage_CommandStreamClient interface {
+	Send(*AgentMessage) error
+	Recv() (*ServerCommand, error)
+	grpc.ClientStream
+}
+
+type vantageCommandStreamClient struct {
+	grpc.ClientStream
+}
+
+func (c *vantageCommandStreamClient) Send(m *AgentMessage) error {
+	return c.ClientStream.SendMsg(m)
+}
+
+func (c *vantageCommandStreamClient) Recv() (*ServerCommand, error) {
+	m := new(ServerCommand)
+	if err := c.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Server interface
+
+type VantageServer interface {
+	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
+	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
+	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
+	ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error)
+	CommandStream(Vantage_CommandStreamServer) error
+}
+
+type UnimplementedVantageServer struct{}
+
+func (UnimplementedVantageServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Register not implemented")
+}
+
+func (UnimplementedVantageServer) SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SyncKeys not implemented")
+}
+
+func (UnimplementedVantageServer) UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UploadGeneratedKey not implemented")
+}
+
+func (UnimplementedVantageServer) ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportUpdates not implemented")
+}
+
+func (UnimplementedVantageServer) CommandStream(Vantage_CommandStreamServer) error {
+	return status.Errorf(codes.Unimplemented, "method CommandStream not implemented")
+}
+
+// Client interface
+
+type VantageClient interface {
+	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
+	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
+	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
+	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
+}
+
+type keyManagerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewVantageClient(cc grpc.ClientConnInterface) VantageClient {
+	return &keyManagerClient{cc}
+}
+
+func (c *keyManagerClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	out := new(RegisterResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/Register", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error) {
+	out := new(SyncResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncKeys", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error) {
+	out := new(UploadKeyResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/UploadGeneratedKey", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error) {
+	out := new(ReportUpdatesResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportUpdates", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Vantage_ServiceDesc.Streams[0], "/vantage.v1.Vantage/CommandStream", opts...)
+	if err != nil {
+		return nil, err
+	}
+	return &vantageCommandStreamClient{stream}, nil
+}
+
+// Server registration
+
+func RegisterVantageServer(s grpc.ServiceRegistrar, srv VantageServer) {
+	s.RegisterService(&Vantage_ServiceDesc, srv)
+}
+
+var Vantage_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "vantage.v1.Vantage",
+	HandlerType: (*VantageServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{MethodName: "Register", Handler: _Vantage_Register_Handler},
+		{MethodName: "SyncKeys", Handler: _Vantage_SyncKeys_Handler},
+		{MethodName: "UploadGeneratedKey", Handler: _Vantage_UploadGeneratedKey_Handler},
+		{MethodName: "ReportUpdates", Handler: _Vantage_ReportUpdates_Handler},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "CommandStream",
+			Handler:       _Vantage_CommandStream_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "vantage/v1/vantage.proto",
+}
+
+func _Vantage_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).Register(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/Register"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).Register(ctx, req.(*RegisterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_SyncKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SyncRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).SyncKeys(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/SyncKeys"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).SyncKeys(ctx, req.(*SyncRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_UploadGeneratedKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UploadKeyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).UploadGeneratedKey(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/UploadGeneratedKey"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).UploadGeneratedKey(ctx, req.(*UploadKeyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_ReportUpdates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportUpdatesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportUpdates(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportUpdates"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportUpdates(ctx, req.(*ReportUpdatesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_CommandStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(VantageServer).CommandStream(&keyManagerCommandStreamServer{stream})
+}

server/internal/grpc/server.go

@@ -5,12 +5,15 @@ import (
 	"fmt"
 	"log"
 	"net"
+	"time"
 
-	"github.com/mrhid6/keymanager/server/internal/grpc/pb"
-	"github.com/mrhid6/keymanager/server/internal/services"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/status"
 )
 
@@ -18,11 +21,11 @@ func init() {
 	encoding.RegisterCodec(JSONCodec{})
 }
 
-type keyManagerServer struct {
-	pb.UnimplementedKeyManagerServer
+type vantageServer struct {
+	pb.UnimplementedVantageServer
 }
 
-func (s *keyManagerServer) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
+func (s *vantageServer) Register(ctx context.Context, req *pb.RegisterRequest) (*pb.RegisterResponse, error) {
 	agentToken, err := services.RegisterServer(req.ServerId, req.PreRegToken, req.Hostname, req.IpAddress, req.OsInfo)
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "registration failed: %v", err)
@@ -30,7 +33,7 @@ func (s *keyManagerServer) Register(ctx context.Context, req *pb.RegisterRequest
 	return &pb.RegisterResponse{AgentToken: agentToken}, nil
 }
 
-func (s *keyManagerServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*pb.SyncResponse, error) {
+func (s *vantageServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*pb.SyncResponse, error) {
 	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
 	if err != nil {
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
@@ -48,7 +51,7 @@ func (s *keyManagerServer) SyncKeys(ctx context.Context, req *pb.SyncRequest) (*
 	return &pb.SyncResponse{PublicKeys: keys}, nil
 }
 
-func (s *keyManagerServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKeyRequest) (*pb.UploadKeyResponse, error) {
+func (s *vantageServer) UploadGeneratedKey(ctx context.Context, req *pb.UploadKeyRequest) (*pb.UploadKeyResponse, error) {
 	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
 	if err != nil {
 		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
@@ -67,7 +70,27 @@ func (s *keyManagerServer) UploadGeneratedKey(ctx context.Context, req *pb.Uploa
 	return &pb.UploadKeyResponse{KeyId: key.KeyID}, nil
 }
 
-func (s *keyManagerServer) CommandStream(stream pb.KeyManager_CommandStreamServer) error {
+func (s *vantageServer) ReportUpdates(ctx context.Context, req *pb.ReportUpdatesRequest) (*pb.ReportUpdatesResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+
+	pkgs := make([]models.PackageUpdate, len(req.Updates))
+	for i, u := range req.Updates {
+		pkgs[i] = models.PackageUpdate{
+			Name:           u.Name,
+			CurrentVersion: u.CurrentVersion,
+			NewVersion:     u.NewVersion,
+		}
+	}
+	if err := services.StoreAvailableUpdates(srv.ServerID, pkgs); err != nil {
+		log.Printf("failed to store updates for %s: %v", srv.ServerID, err)
+	}
+	return &pb.ReportUpdatesResponse{}, nil
+}
+
+func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) error {
 	// First message authenticates the agent and signals readiness.
 	msg, err := stream.Recv()
 	if err != nil {
@@ -126,8 +149,21 @@ func StartGRPC(port int) error {
 		return fmt.Errorf("failed to listen: %w", err)
 	}
 
-	s := grpc.NewServer()
-	pb.RegisterKeyManagerServer(s, &keyManagerServer{})
+	s := grpc.NewServer(
+		// Accept client keepalive pings as fast as every 20s so the 30s agent
+		// ping interval is always within the allowed window.
+		grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
+			MinTime:             20 * time.Second,
+			PermitWithoutStream: false,
+		}),
+		grpc.KeepaliveParams(keepalive.ServerParameters{
+			// Server also pings the client after 45s of inactivity so both
+			// sides can detect a dead connection without waiting for a timeout.
+			Time:    45 * time.Second,
+			Timeout: 10 * time.Second,
+		}),
+	)
+	pb.RegisterVantageServer(s, &vantageServer{})
 
 	log.Printf("gRPC server listening on :%d", port)
 	return s.Serve(lis)

server/internal/models/server.go

@@ -6,17 +6,25 @@ import (
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 
-type Server struct {
-	ID             bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
-	ServerID       string        `bson:"server_id" json:"server_id"`
-	Hostname       string        `bson:"hostname" json:"hostname"`
-	IPAddress      string        `bson:"ip_address" json:"ip_address"`
-	OSInfo         string        `bson:"os_info" json:"os_info"`
-	PreRegToken    string        `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
-	PreRegExpires  *time.Time    `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
-	AgentTokenHash string        `bson:"agent_token_hash,omitempty" json:"-"`
-	Status         string        `bson:"status" json:"status"`
-	AgentVersion   string        `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
-	LastSeen       *time.Time    `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
-	CreatedAt      time.Time     `bson:"created_at" json:"created_at"`
+type PackageUpdate struct {
+	Name           string `bson:"name" json:"name"`
+	CurrentVersion string `bson:"current_version,omitempty" json:"current_version,omitempty"`
+	NewVersion     string `bson:"new_version" json:"new_version"`
+}
+
+type Server struct {
+	ID               bson.ObjectID  `bson:"_id,omitempty" json:"_id,omitempty"`
+	ServerID         string         `bson:"server_id" json:"server_id"`
+	Hostname         string         `bson:"hostname" json:"hostname"`
+	IPAddress        string         `bson:"ip_address" json:"ip_address"`
+	OSInfo           string         `bson:"os_info" json:"os_info"`
+	PreRegToken      string         `bson:"pre_reg_token,omitempty" json:"pre_reg_token,omitempty"`
+	PreRegExpires    *time.Time     `bson:"pre_reg_expires,omitempty" json:"pre_reg_expires,omitempty"`
+	AgentTokenHash   string         `bson:"agent_token_hash,omitempty" json:"-"`
+	Status           string         `bson:"status" json:"status"`
+	AgentVersion     string         `bson:"agent_version,omitempty" json:"agent_version,omitempty"`
+	LastSeen         *time.Time     `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
+	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
+	UpdatesCheckedAt *time.Time     `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
+	CreatedAt        time.Time      `bson:"created_at" json:"created_at"`
 }

server/internal/services/dispatch.go

@@ -9,7 +9,7 @@ import (
 	"sync"
 
 	"github.com/google/uuid"
-	"github.com/mrhid6/keymanager/server/internal/grpc/pb"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
 )
 
 type commandDispatcher struct {
@@ -78,7 +78,7 @@ func GetLatestAgentVersion() (string, error) {
 	if giteaHost == "" {
 		giteaHost = "gitea.example.com"
 	}
-	url := fmt.Sprintf("https://%s/api/v1/repos/mrhid6/keymanager/releases?limit=20", giteaHost)
+	url := fmt.Sprintf("https://%s/api/v1/repos/mrhid6/vantage/releases?limit=20", giteaHost)
 	resp, err := http.Get(url) //nolint:gosec
 	if err != nil {
 		return "", fmt.Errorf("fetch releases: %w", err)
@@ -134,6 +134,18 @@ func DispatchUpdateAgent(serverID string) (string, error) {
 	return version, nil
 }
 
+// DispatchApplyUpdates sends an apply-updates command to the named server's agent.
+func DispatchApplyUpdates(serverID string) error {
+	if !Dispatcher.IsConnected(serverID) {
+		return fmt.Errorf("agent is not connected to the command stream")
+	}
+	cmd := &pb.ServerCommand{
+		CommandId:    uuid.New().String(),
+		ApplyUpdates: &pb.ApplyUpdatesCmd{},
+	}
+	return Dispatcher.dispatch(serverID, cmd)
+}
+
 // DispatchDeleteKey sends a delete-key command to the named server's agent.
 // It is best-effort: if the agent is offline the local files will remain until next connection.
 func DispatchDeleteKey(serverID, label string) {

server/internal/services/keys.go

@@ -9,8 +9,8 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/mrhid6/keymanager/server/internal/db"
-	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 

server/internal/services/servers.go

@@ -6,11 +6,12 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/mrhid6/keymanager/server/internal/db"
-	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
 	"go.mongodb.org/mongo-driver/v2/bson"
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
@@ -141,7 +142,7 @@ func UpdateServerLastSeen(serverID, agentVersion string) error {
 	now := time.Now()
 	fields := bson.M{"last_seen": now, "status": "active"}
 	if agentVersion != "" {
-		fields["agent_version"] = agentVersion
+		fields["agent_version"] = strings.TrimPrefix(agentVersion, "v")
 	}
 	_, err := db.Col("servers").UpdateOne(ctx,
 		bson.M{"server_id": serverID},
@@ -181,6 +182,21 @@ func DeleteServer(serverID string) error {
 	return err
 }
 
+func StoreAvailableUpdates(serverID string, pkgs []models.PackageUpdate) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	now := time.Now()
+	_, err := db.Col("servers").UpdateOne(ctx,
+		bson.M{"server_id": serverID},
+		bson.M{"$set": bson.M{
+			"available_updates":  pkgs,
+			"updates_checked_at": now,
+		}},
+	)
+	return err
+}
+
 func MarkOfflineServers(threshold time.Duration) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()

server/internal/services/sync.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"time"
 
-	"github.com/mrhid6/keymanager/server/internal/db"
-	"github.com/mrhid6/keymanager/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
 	"go.mongodb.org/mongo-driver/v2/bson"
 )
 

web/app/layout.tsx

@@ -5,7 +5,7 @@ import { AuthProvider } from "@/components/AuthProvider";
 import { Sidebar } from "@/components/Sidebar";
 
 export const metadata: Metadata = {
-  title: "KeyManager",
+  title: "Vantage",
   description: "Self-hosted SSH key management",
 };
 

web/app/servers/[id]/page.tsx

@@ -1,76 +1,194 @@
-"use client";
+"use client";
 
 import { useState } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { useParams, useRouter } from "next/navigation";
 import Link from "next/link";
-import { api, ServerStatus, GenerateKeyOptions } from "@/lib/api";
+import { api, ServerStatus, GenerateKeyOptions, PackageUpdate } from "@/lib/api";
 import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
 import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
 
 function statusVariant(status: ServerStatus) {
-  switch (status) {
-    case "active": return "success";
-    case "pending": return "warning";
-    case "offline": return "danger";
-  }
+    switch (status) {
+        case "active":
+            return "success";
+        case "pending":
+            return "warning";
+        case "offline":
+            return "danger";
+    }
 }
 
 function formatDate(dateStr: string) {
-  return new Date(dateStr).toLocaleString();
+    return new Date(dateStr).toLocaleString();
 }
 
 const KEY_SIZES: Record<string, number[]> = {
-  rsa: [2048, 3072, 4096],
-  ecdsa: [256, 384, 521],
+    rsa: [2048, 3072, 4096],
+    ecdsa: [256, 384, 521],
 };
 
 const DEFAULT_SIZE: Record<string, number> = {
-  rsa: 4096,
-  ecdsa: 256,
+    rsa: 4096,
+    ecdsa: 256,
 };
 
-function GenerateKeyModal({
-  onClose,
-  onSubmit,
-  isPending,
-}: {
-  onClose: () => void;
-  onSubmit: (opts: GenerateKeyOptions) => void;
-  isPending: boolean;
-}) {
-  const [label, setLabel] = useState("");
-  const [keyType, setKeyType] = useState<"ed25519" | "rsa" | "ecdsa">("ed25519");
-  const [keySize, setKeySize] = useState<number>(4096);
-  const [passphrase, setPassphrase] = useState("");
-  const [comment, setComment] = useState("");
+function GenerateKeyModal({ onClose, onSubmit, isPending }: { onClose: () => void; onSubmit: (opts: GenerateKeyOptions) => void; isPending: boolean }) {
+    const [label, setLabel] = useState("");
+    const [keyType, setKeyType] = useState<"ed25519" | "rsa" | "ecdsa">("ed25519");
+    const [keySize, setKeySize] = useState<number>(4096);
+    const [passphrase, setPassphrase] = useState("");
+    const [comment, setComment] = useState("");
 
-  function handleKeyTypeChange(t: "ed25519" | "rsa" | "ecdsa") {
-    setKeyType(t);
-    if (t !== "ed25519") {
-      setKeySize(DEFAULT_SIZE[t]);
+    function handleKeyTypeChange(t: "ed25519" | "rsa" | "ecdsa") {
+        setKeyType(t);
+        if (t !== "ed25519") {
+            setKeySize(DEFAULT_SIZE[t]);
+        }
     }
-  }
 
-  function handleSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    onSubmit({
-      label: label || "generated",
-      key_type: keyType,
-      key_size: keyType !== "ed25519" ? keySize : undefined,
-      passphrase: passphrase || undefined,
-      comment: comment || undefined,
-    });
-  }
+    function handleSubmit(e: React.FormEvent) {
+        e.preventDefault();
+        onSubmit({
+            label: label || "generated",
+            key_type: keyType,
+            key_size: keyType !== "ed25519" ? keySize : undefined,
+            passphrase: passphrase || undefined,
+            comment: comment || undefined,
+        });
+    }
 
-  const sizes = KEY_SIZES[keyType];
+    const sizes = KEY_SIZES[keyType];
 
+    return (
+        <div className="fixed inset-0 z-50 flex items-center justify-center">
+            <div className="absolute inset-0 bg-black/60 backdrop-blur-sm" onClick={onClose} />
+            <div className="relative z-10 w-full max-w-md rounded-xl border border-border bg-surface-1 p-6 shadow-2xl">
+                <div className="mb-5 flex items-center justify-between">
+                    <h2 className="text-lg font-semibold text-text-primary">Generate SSH Key</h2>
+                    <button onClick={onClose} className="rounded-md p-1 text-text-secondary hover:text-text-primary transition-colors">
+                        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                            <path strokeLinecap="round" strokeLinejoin="round" d="M6 18L18 6M6 6l12 12" />
+                        </svg>
+                    </button>
+                </div>
+
+                <form onSubmit={handleSubmit} className="space-y-4">
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+                            Label <span className="text-text-tertiary">(used as the key name in Vantage)</span>
+                        </label>
+                        <input
+                            type="text"
+                            value={label}
+                            onChange={(e) => setLabel(e.target.value)}
+                            placeholder="e.g. server-deploy-key"
+                            className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                        />
+                    </div>
+
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key Type</label>
+                        <div className="grid grid-cols-3 gap-2">
+                            {(["ed25519", "rsa", "ecdsa"] as const).map((t) => (
+                                <button
+                                    key={t}
+                                    type="button"
+                                    onClick={() => handleKeyTypeChange(t)}
+                                    className={`rounded-lg border px-3 py-2 text-sm font-medium transition-colors ${
+                                        keyType === t ? "border-accent bg-accent/10 text-accent" : "border-border bg-surface-2 text-text-secondary hover:border-accent/40 hover:text-text-primary"
+                                    }`}
+                                >
+                                    {t}
+                                </button>
+                            ))}
+                        </div>
+                        {keyType === "ed25519" && <p className="mt-1.5 text-xs text-text-tertiary">Modern, fast, and secure. Recommended for new keys.</p>}
+                        {keyType === "rsa" && <p className="mt-1.5 text-xs text-text-tertiary">Widely compatible with older systems.</p>}
+                        {keyType === "ecdsa" && <p className="mt-1.5 text-xs text-text-tertiary">Elliptic curve — shorter keys, good compatibility.</p>}
+                    </div>
+
+                    {sizes && (
+                        <div>
+                            <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key Size (bits)</label>
+                            <select
+                                value={keySize}
+                                onChange={(e) => setKeySize(Number(e.target.value))}
+                                className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                            >
+                                {sizes.map((s) => (
+                                    <option key={s} value={s}>
+                                        {s}
+                                    </option>
+                                ))}
+                            </select>
+                        </div>
+                    )}
+
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+                            Comment <span className="text-text-tertiary">(embedded in the public key)</span>
+                        </label>
+                        <input
+                            type="text"
+                            value={comment}
+                            onChange={(e) => setComment(e.target.value)}
+                            placeholder="e.g. user@hostname"
+                            className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                        />
+                    </div>
+
+                    <div>
+                        <label className="mb-1.5 block text-sm font-medium text-text-secondary">
+                            Passphrase <span className="text-text-tertiary">(leave blank for no passphrase)</span>
+                        </label>
+                        <input
+                            type="password"
+                            value={passphrase}
+                            onChange={(e) => setPassphrase(e.target.value)}
+                            placeholder="Optional passphrase"
+                            autoComplete="new-password"
+                            className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                        />
+                    </div>
+
+                    <div className="flex gap-3 pt-1">
+                        <Button type="submit" variant="primary" loading={isPending} className="flex-1">
+                            Generate Key
+                        </Button>
+                        <Button type="button" variant="ghost" onClick={onClose}>
+                            Cancel
+                        </Button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    );
+}
+
+
+function UpdatesModal({
+  updates,
+  onClose,
+  onApply,
+  isApplying,
+  applySuccess,
+}: {
+  updates: PackageUpdate[];
+  onClose: () => void;
+  onApply: () => void;
+  isApplying: boolean;
+  applySuccess: boolean;
+}) {
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center">
       <div className="absolute inset-0 bg-black/60 backdrop-blur-sm" onClick={onClose} />
-      <div className="relative z-10 w-full max-w-md rounded-xl border border-border bg-surface-1 p-6 shadow-2xl">
+      <div className="relative z-10 w-full max-w-2xl rounded-xl border border-border bg-surface-1 p-6 shadow-2xl">
         <div className="mb-5 flex items-center justify-between">
-          <h2 className="text-lg font-semibold text-text-primary">Generate SSH Key</h2>
+          <div>
+            <h2 className="text-lg font-semibold text-text-primary">Available OS Updates</h2>
+            <p className="mt-0.5 text-sm text-text-secondary">{updates.length} package{updates.length !== 1 ? "s" : ""} available</p>
+          </div>
           <button
             onClick={onClose}
             className="rounded-md p-1 text-text-secondary hover:text-text-primary transition-colors"
@@ -81,383 +199,307 @@ function GenerateKeyModal({
           </button>
         </div>
 
-        <form onSubmit={handleSubmit} className="space-y-4">
-          <div>
-            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
-              Label <span className="text-text-tertiary">(used as the key name in KeyManager)</span>
-            </label>
-            <input
-              type="text"
-              value={label}
-              onChange={e => setLabel(e.target.value)}
-              placeholder="e.g. server-deploy-key"
-              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
-            />
-          </div>
-
-          <div>
-            <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key Type</label>
-            <div className="grid grid-cols-3 gap-2">
-              {(["ed25519", "rsa", "ecdsa"] as const).map(t => (
-                <button
-                  key={t}
-                  type="button"
-                  onClick={() => handleKeyTypeChange(t)}
-                  className={`rounded-lg border px-3 py-2 text-sm font-medium transition-colors ${
-                    keyType === t
-                      ? "border-accent bg-accent/10 text-accent"
-                      : "border-border bg-surface-2 text-text-secondary hover:border-accent/40 hover:text-text-primary"
-                  }`}
-                >
-                  {t}
-                </button>
+        <div className="max-h-80 overflow-y-auto rounded-lg border border-border">
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Package</Th>
+                <Th>Current</Th>
+                <Th>Available</Th>
+              </Tr>
+            </Thead>
+            <Tbody>
+              {updates.map((u) => (
+                <Tr key={u.name}>
+                  <Td><span className="font-medium font-mono text-sm">{u.name}</span></Td>
+                  <Td><span className="font-mono text-xs text-text-secondary">{u.current_version || "—"}</span></Td>
+                  <Td><span className="font-mono text-xs text-success">{u.new_version}</span></Td>
+                </Tr>
               ))}
-            </div>
-            {keyType === "ed25519" && (
-              <p className="mt-1.5 text-xs text-text-tertiary">Modern, fast, and secure. Recommended for new keys.</p>
-            )}
-            {keyType === "rsa" && (
-              <p className="mt-1.5 text-xs text-text-tertiary">Widely compatible with older systems.</p>
-            )}
-            {keyType === "ecdsa" && (
-              <p className="mt-1.5 text-xs text-text-tertiary">Elliptic curve — shorter keys, good compatibility.</p>
-            )}
-          </div>
-
-          {sizes && (
-            <div>
-              <label className="mb-1.5 block text-sm font-medium text-text-secondary">Key Size (bits)</label>
-              <select
-                value={keySize}
-                onChange={e => setKeySize(Number(e.target.value))}
-                className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
-              >
-                {sizes.map(s => (
-                  <option key={s} value={s}>{s}</option>
-                ))}
-              </select>
-            </div>
-          )}
-
-          <div>
-            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
-              Comment <span className="text-text-tertiary">(embedded in the public key)</span>
-            </label>
-            <input
-              type="text"
-              value={comment}
-              onChange={e => setComment(e.target.value)}
-              placeholder="e.g. user@hostname"
-              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
-            />
-          </div>
-
-          <div>
-            <label className="mb-1.5 block text-sm font-medium text-text-secondary">
-              Passphrase <span className="text-text-tertiary">(leave blank for no passphrase)</span>
-            </label>
-            <input
-              type="password"
-              value={passphrase}
-              onChange={e => setPassphrase(e.target.value)}
-              placeholder="Optional passphrase"
-              autoComplete="new-password"
-              className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
-            />
-          </div>
-
-          <div className="flex gap-3 pt-1">
-            <Button type="submit" variant="primary" loading={isPending} className="flex-1">
-              Generate Key
-            </Button>
-            <Button type="button" variant="ghost" onClick={onClose}>
-              Cancel
-            </Button>
-          </div>
-        </form>
-      </div>
-    </div>
-  );
-}
-
-export default function ServerDetailPage() {
-  const params = useParams();
-  const router = useRouter();
-  const queryClient = useQueryClient();
-  const serverId = params.id as string;
-  const [confirmDelete, setConfirmDelete] = useState(false);
-  const [showGenerateModal, setShowGenerateModal] = useState(false);
-  const [copiedUpdate, setCopiedUpdate] = useState(false);
-  const [updateSuccess, setUpdateSuccess] = useState(false);
-
-  const { data: server, isLoading, error } = useQuery({
-    queryKey: ["servers", serverId],
-    queryFn: () => api.getServer(serverId),
-    refetchInterval: 30_000,
-  });
-
-  const { mutate: generateKey, isPending: isGenerating } = useMutation({
-    mutationFn: (opts: GenerateKeyOptions) => api.generateKeyForServer(serverId, opts),
-    onSuccess: () => {
-      setShowGenerateModal(false);
-      queryClient.invalidateQueries({ queryKey: ["servers", serverId] });
-      queryClient.invalidateQueries({ queryKey: ["keys"] });
-    },
-  });
-
-  const { data: latestVersion } = useQuery({
-    queryKey: ["agent-latest-version"],
-    queryFn: () => api.getLatestAgentVersion(),
-    staleTime: 5 * 60_000,
-  });
-
-  const { mutate: triggerUpdate, isPending: isUpdating } = useMutation({
-    mutationFn: () => api.updateAgent(serverId),
-    onSuccess: () => {
-      setUpdateSuccess(true);
-      setTimeout(() => setUpdateSuccess(false), 4000);
-    },
-  });
-
-  const { mutate: deleteServer, isPending: isDeleting } = useMutation({
-    mutationFn: () => api.deleteServer(serverId),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["servers"] });
-      router.push("/servers");
-    },
-  });
-
-  if (isLoading) {
-    return (
-      <div className="flex h-full items-center justify-center">
-        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
-      </div>
-    );
-  }
-
-  if (error || !server) {
-    return (
-      <div className="p-8">
-        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">
-          Server not found or failed to load.
+            </Tbody>
+          </Table>
         </div>
-      </div>
-    );
-  }
 
-  return (
-    <div className="p-8">
-      {showGenerateModal && (
-        <GenerateKeyModal
-          onClose={() => setShowGenerateModal(false)}
-          onSubmit={opts => generateKey(opts)}
-          isPending={isGenerating}
-        />
-      )}
-
-      <div className="mb-6 flex items-start justify-between">
-        <div>
-          <div className="flex items-center gap-3">
-            <Link href="/servers" className="text-text-secondary hover:text-text-primary text-sm">
-              ← Servers
-            </Link>
-          </div>
-          <div className="mt-2 flex items-center gap-3">
-            <h1 className="text-2xl font-bold text-text-primary">{server.hostname}</h1>
-            <Badge variant={statusVariant(server.status)}>{server.status}</Badge>
-          </div>
-          <p className="mt-1 font-mono text-sm text-text-secondary">{server.ip_address}</p>
-        </div>
-        <div className="flex gap-2">
-          <Button
-            variant="secondary"
-            onClick={() => setShowGenerateModal(true)}
-          >
-            <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
-              <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
-            </svg>
-            Generate SSH Key
+        <div className="mt-5 flex items-center gap-3">
+          <Button variant="primary" loading={isApplying} onClick={onApply}>
+            {applySuccess ? "Sent!" : "Apply Updates"}
           </Button>
-          {!confirmDelete ? (
-            <Button variant="danger" onClick={() => setConfirmDelete(true)}>
-              Remove Server
-            </Button>
-          ) : (
-            <div className="flex items-center gap-2">
-              <span className="text-sm text-danger">Are you sure?</span>
-              <Button
-                variant="danger"
-                loading={isDeleting}
-                onClick={() => deleteServer()}
-              >
-                Confirm
-              </Button>
-              <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
-                Cancel
-              </Button>
-            </div>
-          )}
-        </div>
-      </div>
-
-      <div className="mb-6">
-        <Card>
-          <CardHeader>
-            <CardTitle>Update Agent</CardTitle>
-          </CardHeader>
-          <div className="mb-4 flex flex-wrap items-center gap-4 text-sm">
-            <div>
-              <span className="text-text-secondary">Installed: </span>
-              <span className="font-mono font-medium text-text-primary">
-                {server.agent_version ? `v${server.agent_version}` : "unknown"}
-              </span>
-            </div>
-            <div>
-              <span className="text-text-secondary">Latest: </span>
-              <span className="font-mono font-medium text-text-primary">
-                {latestVersion ? `v${latestVersion.version}` : "—"}
-              </span>
-            </div>
-            {latestVersion && server.agent_version && server.agent_version !== latestVersion.version && (
-              <Badge variant="warning">update available</Badge>
-            )}
-            {latestVersion && server.agent_version && server.agent_version === latestVersion.version && (
-              <Badge variant="success">up to date</Badge>
-            )}
-          </div>
-          <div className="flex flex-wrap gap-3">
-            <Button
-              variant="primary"
-              loading={isUpdating}
-              onClick={() => triggerUpdate()}
-              disabled={server.status !== "active"}
-              title={server.status !== "active" ? "Agent must be online to update" : undefined}
-            >
-              {updateSuccess ? "Update Sent!" : "Update Agent"}
-            </Button>
-            <div className="relative flex-1 min-w-64 rounded-lg border border-border bg-[#0a0c14] px-4 py-2.5 font-mono text-sm">
-              <span className="text-accent">$</span>{" "}
-              <span className="text-text-primary">{api.getUpdateCommand()}</span>
-              <button
-                onClick={async () => {
-                  await navigator.clipboard.writeText(api.getUpdateCommand());
-                  setCopiedUpdate(true);
-                  setTimeout(() => setCopiedUpdate(false), 2000);
-                }}
-                className="absolute right-2 top-1.5 rounded-md border border-border bg-surface-2 px-2 py-0.5 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
-              >
-                {copiedUpdate ? <span className="text-success">Copied!</span> : "Copy"}
-              </button>
-            </div>
-          </div>
-        </Card>
-      </div>
-
-      <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
-        <Card className="lg:col-span-1">
-          <CardHeader>
-            <CardTitle>Details</CardTitle>
-          </CardHeader>
-          <dl className="space-y-3 text-sm">
-            <div>
-              <dt className="text-text-secondary">Server ID</dt>
-              <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">{server.server_id}</dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">OS</dt>
-              <dd className="mt-0.5 text-text-primary">{server.os_info}</dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">Agent Version</dt>
-              <dd className="mt-0.5 font-mono text-text-primary">
-                {server.agent_version ? `v${server.agent_version}` : "unknown"}
-              </dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">Last Seen</dt>
-              <dd className="mt-0.5 text-text-primary">{server.last_seen ? formatDate(server.last_seen) : "Never"}</dd>
-            </div>
-            <div className="border-t border-border pt-3">
-              <dt className="text-text-secondary">Registered</dt>
-              <dd className="mt-0.5 text-text-primary">{formatDate(server.created_at)}</dd>
-            </div>
-          </dl>
-        </Card>
-
-        <div className="lg:col-span-2">
-          <Card padding={false}>
-            <div className="flex items-center justify-between border-b border-border px-6 py-4">
-              <h2 className="text-lg font-semibold text-text-primary">
-                Installed Keys
-                <span className="ml-2 rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-secondary">
-                  {server.keys?.filter(k => !k.revoked_at).length ?? 0} active
-                </span>
-              </h2>
-              <Link href="/keys">
-                <Button variant="ghost" size="sm">Manage Keys →</Button>
-              </Link>
-            </div>
-
-            {!server.keys || server.keys.length === 0 ? (
-              <div className="py-16 text-center">
-                <p className="text-text-secondary text-sm">No keys assigned to this server.</p>
-                <Link href="/keys">
-                  <Button variant="secondary" size="sm" className="mt-3">
-                    Assign a key
-                  </Button>
-                </Link>
-              </div>
-            ) : (
-              <Table>
-                <Thead>
-                  <Tr>
-                    <Th>Label</Th>
-                    <Th>Fingerprint</Th>
-                    <Th>Source</Th>
-                    <Th>Status</Th>
-                    <Th>Assigned</Th>
-                    <Th />
-                  </Tr>
-                </Thead>
-                <Tbody>
-                  {server.keys.filter(a => a.key).map((assignment) => (
-                    <Tr key={assignment.key_id}>
-                      <Td>
-                        <span className="font-medium">{assignment.key.label}</span>
-                      </Td>
-                      <Td>
-                        <span className="font-mono text-xs text-text-secondary">
-                          {assignment.key.fingerprint}
-                        </span>
-                      </Td>
-                      <Td>
-                        <Badge variant={assignment.key.source === "generated" ? "accent" : "neutral"}>
-                          {assignment.key.source}
-                        </Badge>
-                      </Td>
-                      <Td>
-                        <Badge variant={assignment.revoked_at ? "danger" : "success"}>
-                          {assignment.revoked_at ? "revoked" : "active"}
-                        </Badge>
-                      </Td>
-                      <Td>
-                        <span className="text-text-secondary text-xs">
-                          {formatDate(assignment.assigned_at)}
-                        </span>
-                      </Td>
-                      <Td>
-                        <Link href={`/keys/${assignment.key_id}`}>
-                          <Button variant="ghost" size="sm">View</Button>
-                        </Link>
-                      </Td>
-                    </Tr>
-                  ))}
-                </Tbody>
-              </Table>
-            )}
-          </Card>
+          <Button variant="ghost" onClick={onClose}>Close</Button>
+          <p className="ml-auto text-xs text-text-tertiary">Upgrade runs in the background. This may take several minutes.</p>
         </div>
       </div>
     </div>
   );
 }
+export default function ServerDetailPage() {
+    const params = useParams();
+    const router = useRouter();
+    const queryClient = useQueryClient();
+    const serverId = params.id as string;
+    const [confirmDelete, setConfirmDelete] = useState(false);
+    const [showGenerateModal, setShowGenerateModal] = useState(false);
+    const [copiedUpdate, setCopiedUpdate] = useState(false);
+    const [updateSuccess, setUpdateSuccess] = useState(false);
+  const [showUpdatesModal, setShowUpdatesModal] = useState(false);
+  const [applySuccess, setApplySuccess] = useState(false);
+
+    const {
+        data: server,
+        isLoading,
+        error,
+    } = useQuery({
+        queryKey: ["servers", serverId],
+        queryFn: () => api.getServer(serverId),
+        refetchInterval: 30_000,
+    });
+
+    const { mutate: generateKey, isPending: isGenerating } = useMutation({
+        mutationFn: (opts: GenerateKeyOptions) => api.generateKeyForServer(serverId, opts),
+        onSuccess: () => {
+            setShowGenerateModal(false);
+            queryClient.invalidateQueries({ queryKey: ["servers", serverId] });
+            queryClient.invalidateQueries({ queryKey: ["keys"] });
+        },
+    });
+
+    const { data: latestVersion } = useQuery({
+        queryKey: ["agent-latest-version"],
+        queryFn: () => api.getLatestAgentVersion(),
+        staleTime: 5 * 60_000,
+    });
+
+    const { mutate: triggerUpdate, isPending: isUpdating } = useMutation({
+        mutationFn: () => api.updateAgent(serverId),
+        onSuccess: () => {
+            setUpdateSuccess(true);
+            setTimeout(() => setUpdateSuccess(false), 4000);
+        },
+    });
+
+  
+  const { mutate: applyUpdates, isPending: isApplying } = useMutation({
+    mutationFn: () => api.applyUpdates(serverId),
+    onSuccess: () => {
+      setApplySuccess(true);
+      setTimeout(() => {
+        setApplySuccess(false);
+        setShowUpdatesModal(false);
+      }, 2000);
+    },
+  });
+  const { mutate: deleteServer, isPending: isDeleting } = useMutation({
+        mutationFn: () => api.deleteServer(serverId),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["servers"] });
+            router.push("/servers");
+        },
+    });
+
+    if (isLoading) {
+        return (
+            <div className="flex h-full items-center justify-center">
+                <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+            </div>
+        );
+    }
+
+    if (error || !server) {
+        return (
+            <div className="p-8">
+                <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Server not found or failed to load.</div>
+            </div>
+        );
+    }
+
+    return (
+        <div className="p-8">
+            {showGenerateModal && <GenerateKeyModal onClose={() => setShowGenerateModal(false)} onSubmit={(opts) => generateKey(opts)} isPending={isGenerating} />}
+
+            <div className="mb-6 flex items-start justify-between">
+                <div>
+                    <div className="flex items-center gap-3">
+                        <Link href="/servers" className="text-text-secondary hover:text-text-primary text-sm">
+                            ← Servers
+                        </Link>
+                    </div>
+                    <div className="mt-2 flex items-center gap-3">
+                        <h1 className="text-2xl font-bold text-text-primary">{server.hostname}</h1>
+                        <Badge variant={statusVariant(server.status)}>{server.status}</Badge>
+                    </div>
+                    <p className="mt-1 font-mono text-sm text-text-secondary">{server.ip_address}</p>
+                </div>
+                <div className="flex gap-2">
+                    <Button variant="secondary" onClick={() => setShowGenerateModal(true)}>
+                        <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+                            <path
+                                strokeLinecap="round"
+                                strokeLinejoin="round"
+                                d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z"
+                            />
+                        </svg>
+                        Generate SSH Key
+                    </Button>
+                    {!confirmDelete ? (
+                        <Button variant="danger" onClick={() => setConfirmDelete(true)}>
+                            Remove Server
+                        </Button>
+                    ) : (
+                        <div className="flex items-center gap-2">
+                            <span className="text-sm text-danger">Are you sure?</span>
+                            <Button variant="danger" loading={isDeleting} onClick={() => deleteServer()}>
+                                Confirm
+                            </Button>
+                            <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
+                                Cancel
+                            </Button>
+                        </div>
+                    )}
+                </div>
+            </div>
+
+            <div className="mb-6">
+                <Card>
+                    <CardHeader>
+                        <CardTitle>Update Agent</CardTitle>
+                    </CardHeader>
+                    <div className="mb-4 flex flex-wrap items-center gap-4 text-sm">
+                        <div>
+                            <span className="text-text-secondary">Installed: </span>
+                            <span className="font-mono font-medium text-text-primary">{server.agent_version ? `v${server.agent_version}` : "unknown"}</span>
+                        </div>
+                        <div>
+                            <span className="text-text-secondary">Latest: </span>
+                            <span className="font-mono font-medium text-text-primary">{latestVersion ? `v${latestVersion.version}` : "—"}</span>
+                        </div>
+                        {latestVersion && server.agent_version && server.agent_version !== latestVersion.version && <Badge variant="warning">update available</Badge>}
+                        {latestVersion && server.agent_version && server.agent_version === latestVersion.version && <Badge variant="success">up to date</Badge>}
+                    </div>
+                    <div className="flex flex-wrap gap-3">
+                        <Button
+                            variant="primary"
+                            loading={isUpdating}
+                            onClick={() => triggerUpdate()}
+                            disabled={server.status !== "active"}
+                            title={server.status !== "active" ? "Agent must be online to update" : undefined}
+                        >
+                            {updateSuccess ? "Update Sent!" : "Update Agent"}
+                        </Button>
+                        <div className="relative flex-1 min-w-64 rounded-lg border border-border bg-[#0a0c14] px-4 py-2.5 font-mono text-sm">
+                            <span className="text-accent">$</span> <span className="text-text-primary">{api.getUpdateCommand()}</span>
+                            <button
+                                onClick={async () => {
+                                    await navigator.clipboard.writeText(api.getUpdateCommand());
+                                    setCopiedUpdate(true);
+                                    setTimeout(() => setCopiedUpdate(false), 2000);
+                                }}
+                                className="absolute right-2 top-1.5 rounded-md border border-border bg-surface-2 px-2 py-0.5 text-xs font-medium text-text-secondary transition-colors hover:border-accent/50 hover:text-text-primary"
+                            >
+                                {copiedUpdate ? <span className="text-success">Copied!</span> : "Copy"}
+                            </button>
+                        </div>
+                    </div>
+                </Card>
+            </div>
+
+            <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
+                <Card className="lg:col-span-1">
+                    <CardHeader>
+                        <CardTitle>Details</CardTitle>
+                    </CardHeader>
+                    <dl className="space-y-3 text-sm">
+                        <div>
+                            <dt className="text-text-secondary">Server ID</dt>
+                            <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">{server.server_id}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">OS</dt>
+                            <dd className="mt-0.5 text-text-primary">{server.os_info}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">Agent Version</dt>
+                            <dd className="mt-0.5 font-mono text-text-primary">{server.agent_version ? `v${server.agent_version}` : "unknown"}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">Last Seen</dt>
+                            <dd className="mt-0.5 text-text-primary">{server.last_seen ? formatDate(server.last_seen) : "Never"}</dd>
+                        </div>
+                        <div className="border-t border-border pt-3">
+                            <dt className="text-text-secondary">Registered</dt>
+                            <dd className="mt-0.5 text-text-primary">{formatDate(server.created_at)}</dd>
+                        </div>
+                    </dl>
+                </Card>
+
+                <div className="lg:col-span-2">
+                    <Card padding={false}>
+                        <div className="flex items-center justify-between border-b border-border px-6 py-4">
+                            <h2 className="text-lg font-semibold text-text-primary">
+                                Installed SSH Keys
+                                <span className="ml-2 rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-secondary">{server.keys?.filter((k) => !k.revoked_at).length ?? 0} active</span>
+                            </h2>
+                            <Link href="/keys">
+                                <Button variant="ghost" size="sm">
+                                    Manage Keys →
+                                </Button>
+                            </Link>
+                        </div>
+
+                        {!server.keys || server.keys.length === 0 ? (
+                            <div className="py-16 text-center">
+                                <p className="text-text-secondary text-sm">No keys assigned to this server.</p>
+                                <Link href="/keys">
+                                    <Button variant="secondary" size="sm" className="mt-3">
+                                        Assign a key
+                                    </Button>
+                                </Link>
+                            </div>
+                        ) : (
+                            <Table>
+                                <Thead>
+                                    <Tr>
+                                        <Th>Label</Th>
+                                        <Th>Fingerprint</Th>
+                                        <Th>Source</Th>
+                                        <Th>Status</Th>
+                                        <Th>Assigned</Th>
+                                        <Th />
+                                    </Tr>
+                                </Thead>
+                                <Tbody>
+                                    {server.keys
+                                        .filter((a) => a.key)
+                                        .map((assignment) => (
+                                            <Tr key={assignment.key_id}>
+                                                <Td>
+                                                    <span className="font-medium">{assignment.key.label}</span>
+                                                </Td>
+                                                <Td>
+                                                    <span className="font-mono text-xs text-text-secondary">{assignment.key.fingerprint}</span>
+                                                </Td>
+                                                <Td>
+                                                    <Badge variant={assignment.key.source === "generated" ? "accent" : "neutral"}>{assignment.key.source}</Badge>
+                                                </Td>
+                                                <Td>
+                                                    <Badge variant={assignment.revoked_at ? "danger" : "success"}>{assignment.revoked_at ? "revoked" : "active"}</Badge>
+                                                </Td>
+                                                <Td>
+                                                    <span className="text-text-secondary text-xs">{formatDate(assignment.assigned_at)}</span>
+                                                </Td>
+                                                <Td>
+                                                    <Link href={`/keys/${assignment.key_id}`}>
+                                                        <Button variant="ghost" size="sm">
+                                                            View
+                                                        </Button>
+                                                    </Link>
+                                                </Td>
+                                            </Tr>
+                                        ))}
+                                </Tbody>
+                            </Table>
+                        )}
+                    </Card>
+                </div>
+            </div>
+        </div>
+    );
+}

web/app/servers/new/page.tsx

@@ -26,7 +26,7 @@ export default function NewServerPage() {
       <div className="mb-6">
         <h1 className="text-2xl font-bold text-text-primary">Add Server</h1>
         <p className="mt-1 text-sm text-text-secondary">
-          Generate an install command to register a new server with the KeyManager agent.
+          Generate an install command to register a new server with the Vantage agent.
         </p>
       </div>
 
@@ -39,7 +39,7 @@ export default function NewServerPage() {
             <p className="mb-6 text-sm text-text-secondary leading-relaxed">
               Click the button below to generate a one-time install command. The command
               contains a short-lived token (valid for 1 hour) that registers your server
-              and installs the KeyManager agent automatically.
+              and installs the Vantage agent automatically.
             </p>
 
             {error && (
@@ -111,8 +111,8 @@ export default function NewServerPage() {
                 {[
                   "The install script detects your CPU architecture (amd64 / arm64)",
                   "Downloads and verifies the latest agent binary from the Gitea release",
-                  "Writes /etc/keymanager/config.yaml with the server ID and token",
-                  "Installs and starts the keymanager-agent systemd service",
+                  "Writes /etc/vantage/config.yaml with the server ID and token",
+                  "Installs and starts the vantage-agent systemd service",
                   "The agent calls Register() to obtain a persistent auth token",
                   "The server status changes to active on the first successful sync",
                 ].map((step, i) => (

web/components/Sidebar.tsx

@@ -44,7 +44,7 @@ export function Sidebar() {
             <path strokeLinecap="round" strokeLinejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
           </svg>
         </div>
-        <span className="text-base font-semibold text-text-primary">KeyManager</span>
+        <span className="text-base font-semibold text-text-primary">Vantage</span>
       </div>
 
       <nav className="flex-1 overflow-y-auto px-3 py-4">
@@ -80,7 +80,7 @@ export function Sidebar() {
           </div>
         )}
         <div className="flex items-center justify-between">
-          <p className="text-xs text-text-secondary">KeyManager v1.0</p>
+          <p className="text-xs text-text-secondary">Vantage v1.0</p>
           {authEnabled && user && (
             <a
               href="/auth/logout"

web/lib/api.ts

@@ -1,6 +1,12 @@
 export type ServerStatus = "pending" | "active" | "offline";
 export type KeySource = "uploaded" | "generated";
 
+export interface PackageUpdate {
+  name: string;
+  current_version?: string;
+  new_version: string;
+}
+
 export interface Server {
   id: string;
   server_id: string;
@@ -11,6 +17,8 @@ export interface Server {
   agent_version?: string;
   last_seen: string;
   created_at: string;
+  available_updates?: PackageUpdate[];
+  updates_checked_at?: string;
 }
 
 export interface Key {
@@ -127,6 +135,12 @@ export const api = {
     });
   },
 
+  applyUpdates(serverId: string): Promise<{ message: string }> {
+    return request<{ message: string }>(`/servers/${serverId}/apply-updates`, {
+      method: "POST",
+    });
+  },
+
   // Keys
   listKeys(): Promise<Key[]> {
     return request<Key[]>("/keys");

web/package-lock.json

@@ -1,11 +1,11 @@
 {
-    "name": "keymanager-web",
+    "name": "vantage-web",
     "version": "0.1.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
-            "name": "keymanager-web",
+            "name": "vantage-web",
             "version": "0.1.0",
             "dependencies": {
                 "@tanstack/react-query": "^5.51.1",

web/package.json

@@ -1,5 +1,5 @@
 {
-    "name": "keymanager-web",
+    "name": "vantage-web",
     "version": "0.1.0",
     "private": true,
     "scripts": {