Merge branch 'next/major' of github.com:Start9Labs/start-os into mcp

sideload-by-url
docs: document excluded RPC methods + remove system.shell from MCP
2026-04-02 05:23:14 +00:00 · 2026-03-23 10:52:43 -06:00 · 2026-03-17 19:17:49 -06:00 · 2026-03-17 17:13:04 -06:00 · 2026-03-17 15:51:59 -06:00 · 2026-03-15 23:35:32 -06:00
237 changed files with 5324 additions and 4095 deletions
--- a/.github/actions/setup-build/action.yml
+++ b/.github/actions/setup-build/action.yml
@@ -47,7 +47,7 @@ runs:
        sudo rm -rf /usr/share/swift
        sudo rm -rf "$AGENT_TOOLSDIRECTORY"

-    # Some runners lack /opt/hostedtoolcache, which setup-python and setup-qemu expect
+    # BuildJet runners lack /opt/hostedtoolcache, which setup-python and setup-qemu expect
    - name: Ensure hostedtoolcache exists
      shell: bash
      run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache
--- a/.github/workflows/start-cli.yaml
+++ b/.github/workflows/start-cli.yaml
@@ -63,7 +63,7 @@ jobs:
              "ALL": ["x86_64-unknown-linux-musl", "x86_64-apple-darwin", "aarch64-unknown-linux-musl", "aarch64-apple-darwin", "riscv64gc-unknown-linux-musl"]
            }')[github.event.inputs.platform || 'ALL']
          }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
    steps:
      - name: Mount tmpfs
        if: ${{ github.event.inputs.runner == 'fast' }}
--- a/.github/workflows/start-registry.yaml
+++ b/.github/workflows/start-registry.yaml
@@ -59,7 +59,7 @@ jobs:
              "ALL": ["x86_64", "aarch64", "riscv64"]
            }')[github.event.inputs.platform || 'ALL']
          }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
    steps:
      - name: Mount tmpfs
        if: ${{ github.event.inputs.runner == 'fast' }}
@@ -89,7 +89,7 @@ jobs:
    permissions:
      contents: read
      packages: write
-    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
    steps:
      - name: Cleaning up unnecessary files
        run: |
--- a/.github/workflows/start-tunnel.yaml
+++ b/.github/workflows/start-tunnel.yaml
@@ -59,7 +59,7 @@ jobs:
              "ALL": ["x86_64", "aarch64", "riscv64"]
            }')[github.event.inputs.platform || 'ALL']
          }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
    steps:
      - name: Mount tmpfs
        if: ${{ github.event.inputs.runner == 'fast' }}
--- a/.github/workflows/startos-iso.yaml
+++ b/.github/workflows/startos-iso.yaml
@@ -29,7 +29,7 @@ on:
          - aarch64
          - aarch64-nonfree
          - aarch64-nvidia
-          - raspberrypi
+          # - raspberrypi
          - riscv64
          - riscv64-nonfree
      deploy:
@@ -89,9 +89,9 @@ jobs:
              "riscv64": "ubuntu-latest"
            }')[matrix.arch],
            fromJson('{
-              "x86_64": "amd64-fast",
-              "aarch64": "aarch64-fast",
-              "riscv64": "amd64-fast"
+              "x86_64": "buildjet-32vcpu-ubuntu-2204",
+              "aarch64": "buildjet-32vcpu-ubuntu-2204-arm",
+              "riscv64": "buildjet-32vcpu-ubuntu-2204"
            }')[matrix.arch]
          )
        )[github.event.inputs.runner == 'fast']
@@ -153,15 +153,15 @@ jobs:
              "riscv64-nonfree": "ubuntu-24.04-arm",
            }')[matrix.platform],
            fromJson('{
-              "x86_64": "amd64-fast",
-              "x86_64-nonfree": "amd64-fast",
-              "x86_64-nvidia": "amd64-fast",
-              "aarch64": "aarch64-fast",
-              "aarch64-nonfree": "aarch64-fast",
-              "aarch64-nvidia": "aarch64-fast",
-              "raspberrypi": "aarch64-fast",
-              "riscv64": "amd64-fast",
-              "riscv64-nonfree": "amd64-fast",
+              "x86_64": "buildjet-8vcpu-ubuntu-2204",
+              "x86_64-nonfree": "buildjet-8vcpu-ubuntu-2204",
+              "x86_64-nvidia": "buildjet-8vcpu-ubuntu-2204",
+              "aarch64": "buildjet-8vcpu-ubuntu-2204-arm",
+              "aarch64-nonfree": "buildjet-8vcpu-ubuntu-2204-arm",
+              "aarch64-nvidia": "buildjet-8vcpu-ubuntu-2204-arm",
+              "raspberrypi": "buildjet-8vcpu-ubuntu-2204-arm",
+              "riscv64": "buildjet-8vcpu-ubuntu-2204",
+              "riscv64-nonfree": "buildjet-8vcpu-ubuntu-2204",
            }')[matrix.platform]
          )
        )[github.event.inputs.runner == 'fast']
@@ -203,7 +203,7 @@ jobs:
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
        if: ${{ github.event.inputs.runner != 'fast' }}

-      # Some runners lack /opt/hostedtoolcache, which setup-qemu expects
+      # BuildJet runners lack /opt/hostedtoolcache, which setup-qemu expects
      - name: Ensure hostedtoolcache exists
        run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache

@@ -268,123 +268,3 @@ jobs:
          name: ${{ matrix.platform }}.img
          path: results/*.img
        if: ${{ matrix.platform == 'raspberrypi' }}
-
-  deploy:
-    name: Deploy
-    needs: [image]
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.deploy != 'NONE'
-    runs-on: ubuntu-latest
-    env:
-      REGISTRY: >-
-        ${{
-          fromJson('{
-            "alpha": "https://alpha-registry-x.start9.com",
-            "beta": "https://beta-registry.start9.com"
-          }')[github.event.inputs.deploy]
-        }}
-      S3_BUCKET: s3://startos-images
-      S3_CDN: https://startos-images.nyc3.cdn.digitaloceanspaces.com
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          sparse-checkout: web/package.json
-
-      - name: Determine version
-        id: version
-        run: |
-          VERSION=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' web/package.json | head -1)
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Version: $VERSION"
-
-      - name: Determine platforms
-        id: platforms
-        run: |
-          INPUT="${{ github.event.inputs.platform }}"
-          if [ "$INPUT" = "ALL" ]; then
-            PLATFORMS="x86_64 x86_64-nonfree x86_64-nvidia aarch64 aarch64-nonfree aarch64-nvidia riscv64 riscv64-nonfree"
-          else
-            PLATFORMS="$INPUT"
-          fi
-          echo "list=$PLATFORMS" >> "$GITHUB_OUTPUT"
-          echo "Platforms: $PLATFORMS"
-
-      - name: Download squashfs artifacts
-        uses: actions/download-artifact@v8
-        with:
-          pattern: "*.squashfs"
-          path: artifacts/
-          merge-multiple: true
-
-      - name: Download ISO artifacts
-        uses: actions/download-artifact@v8
-        with:
-          pattern: "*.iso"
-          path: artifacts/
-          merge-multiple: true
-
-      - name: Install start-cli
-        run: |
-          ARCH=$(uname -m)
-          OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-          ASSET_NAME="start-cli_${ARCH}-${OS}"
-          DOWNLOAD_URL=$(curl -fsS \
-            -H "Authorization: token ${{ github.token }}" \
-            https://api.github.com/repos/Start9Labs/start-os/releases \
-            | jq -r '[.[].assets[] | select(.name=="'"$ASSET_NAME"'")] | first | .browser_download_url')
-          curl -fsSL \
-            -H "Authorization: token ${{ github.token }}" \
-            -H "Accept: application/octet-stream" \
-            "$DOWNLOAD_URL" -o /tmp/start-cli
-          sudo install -m 755 /tmp/start-cli /usr/local/bin/start-cli
-          echo "start-cli: $(start-cli --version)"
-
-      - name: Configure S3
-        run: |
-          sudo apt-get install -y -qq s3cmd > /dev/null
-          cat > ~/.s3cfg <<EOF
-          [default]
-          access_key = ${{ secrets.S3_ACCESS_KEY }}
-          secret_key = ${{ secrets.S3_SECRET_KEY }}
-          host_base = nyc3.digitaloceanspaces.com
-          host_bucket = %(bucket)s.nyc3.digitaloceanspaces.com
-          use_https = True
-          EOF
-
-      - name: Set up developer key
-        run: |
-          mkdir -p ~/.startos
-          printf '%s' "${{ secrets.DEV_KEY }}" > ~/.startos/developer.key.pem
-
-      - name: Upload to S3
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          cd artifacts
-          for PLATFORM in ${{ steps.platforms.outputs.list }}; do
-            for file in *_${PLATFORM}.squashfs *_${PLATFORM}.iso; do
-              [ -f "$file" ] || continue
-              echo "Uploading $file..."
-              s3cmd put -P "$file" "${{ env.S3_BUCKET }}/v${VERSION}/$file"
-            done
-          done
-
-      - name: Register OS version
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          start-cli --registry="${{ env.REGISTRY }}" registry os version add \
-            "$VERSION" "v${VERSION}" '' ">=0.3.5 <=${VERSION}"
-
-      - name: Index assets in registry
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          cd artifacts
-          for PLATFORM in ${{ steps.platforms.outputs.list }}; do
-            for file in *_${PLATFORM}.squashfs *_${PLATFORM}.iso; do
-              [ -f "$file" ] || continue
-              echo "Indexing $file for platform $PLATFORM..."
-              start-cli --registry="${{ env.REGISTRY }}" registry os asset add \
-                --platform="$PLATFORM" \
-                --version="$VERSION" \
-                "$file" \
-                "${{ env.S3_CDN }}/v${VERSION}/$file"
-            done
-          done
--- a/.gitignore
+++ b/.gitignore
@@ -23,4 +23,3 @@ tmp
 web/.i18n-checked
 docs/USER.md
 *.s9pk
-/build/lib/migration-images
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -8,7 +8,7 @@ StartOS is an open-source Linux distribution for running personal servers. It ma
 - Frontend: Angular 21 + TypeScript + Taiga UI 5
 - Container runtime: Node.js/TypeScript with LXC
 - Database/State: Patch-DB (git submodule) - storage layer with reactive frontend sync
- API: JSON-RPC via rpc-toolkit (see `core/rpc-toolkit.md`)
+- API: JSON-RPC via rpc-toolkit (see `core/rpc-toolkit.md`), MCP for LLM agents (see `core/mcp/ARCHITECTURE.md`)
 - Auth: Password + session cookie, public/private key signatures, local authcookie (see `core/src/middleware/auth/`)

 ## Project Structure
@@ -28,7 +28,7 @@ StartOS is an open-source Linux distribution for running personal servers. It ma

 ## Components

- **`core/`** — Rust backend daemon. Produces a single binary `startbox` that is symlinked as `startd` (main daemon), `start-cli` (CLI), `start-container` (runs inside LXC containers), `registrybox` (package registry), and `tunnelbox` (VPN/tunnel). Handles all backend logic: RPC API, service lifecycle, networking (DNS, ACME, WiFi, Tor, WireGuard), backups, and database state management. See [core/ARCHITECTURE.md](core/ARCHITECTURE.md).
+- **`core/`** — Rust backend daemon. Produces a single binary `startbox` that is symlinked as `startd` (main daemon), `start-cli` (CLI), `start-container` (runs inside LXC containers), `registrybox` (package registry), and `tunnelbox` (VPN/tunnel). Handles all backend logic: RPC API, MCP server for LLM agents, service lifecycle, networking (DNS, ACME, WiFi, Tor, WireGuard), backups, and database state management. See [core/ARCHITECTURE.md](core/ARCHITECTURE.md).

 - **`web/`** — Angular 21 + TypeScript workspace using Taiga UI 5. Contains three applications (admin UI, setup wizard, VPN management) and two shared libraries (common components/services, marketplace). Communicates with the backend exclusively via JSON-RPC. See [web/ARCHITECTURE.md](web/ARCHITECTURE.md).

@@ -54,7 +54,7 @@ Rust (core/)
 Key make targets along this chain:

 | Step | Command                                 | What it does                      |
-|---|---|---|
+| ---- | --------------------------------------- | --------------------------------- |
 | 1    | `cargo check -p start-os`               | Verify Rust compiles              |
 | 2    | `make ts-bindings`                      | Export ts-rs types → rsync to SDK |
 | 3    | `cd sdk && make baseDist dist`          | Build SDK packages                |
@@ -90,6 +90,17 @@ StartOS uses Patch-DB for reactive state synchronization:

 This means the UI is always eventually consistent with the backend — after any mutating API call, the frontend waits for the corresponding PatchDB diff before resolving, so the UI reflects the result immediately.

+## MCP Server (LLM Agent Interface)
+
+StartOS includes an [MCP](https://modelcontextprotocol.io/) (Model Context Protocol) server at `/mcp`, enabling LLM agents to discover and invoke the same operations available through the UI and CLI. The MCP server runs inside the StartOS server process alongside the RPC API.
+
+- **Tools**: Every RPC method is exposed as an MCP tool with LLM-optimized descriptions and JSON Schema inputs. Agents call `tools/list` to discover what's available and `tools/call` to invoke operations.
+- **Resources**: System state is exposed via MCP resources backed by Patch-DB. Agents subscribe to `startos:///public` and receive debounced revision diffs over SSE, maintaining a local state cache without polling.
+- **Auth**: Same session cookie auth as the UI — no separate credentials.
+- **Transport**: MCP Streamable HTTP — POST for requests, GET for SSE notification stream, DELETE for session teardown.
+
+See [core/ARCHITECTURE.md](core/ARCHITECTURE.md#mcp-server) for implementation details.
+
 ## Further Reading

 - [core/ARCHITECTURE.md](core/ARCHITECTURE.md) — Rust backend architecture
--- a/7
+++ b/7
@@ -15,7 +15,7 @@ IMAGE_TYPE=$(shell if [ "$(PLATFORM)" = raspberrypi ]; then echo img; else echo
 WEB_UIS := web/dist/raw/ui/index.html web/dist/raw/setup-wizard/index.html
 COMPRESSED_WEB_UIS := web/dist/static/ui/index.html web/dist/static/setup-wizard/index.html
 FIRMWARE_ROMS := build/lib/firmware/$(PLATFORM) $(shell jq --raw-output '.[] | select(.platform[] | contains("$(PLATFORM)")) | "./build/lib/firmware/$(PLATFORM)/" + .id + ".rom.gz"' build/lib/firmware.json)
-BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS) build/lib/migration-images/.done
+BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS)
 IMAGE_RECIPE_SRC := $(call ls-files, build/image-recipe/)
 STARTD_SRC := core/startd.service $(BUILD_SRC)
 CORE_SRC := $(call ls-files, core) $(shell git ls-files --recurse-submodules patch-db) $(GIT_HASH_FILE)
@@ -89,7 +89,6 @@ clean:
 	rm -rf container-runtime/node_modules
 	rm -f container-runtime/*.squashfs
 	(cd sdk && make clean)
-	rm -rf build/lib/migration-images
 	rm -f env/*.txt

 format:
@@ -106,10 +105,6 @@ test-sdk: $(call ls-files, sdk) sdk/base/lib/osBindings/index.ts
 test-container-runtime: container-runtime/node_modules/.package-lock.json $(call ls-files, container-runtime/src) container-runtime/package.json container-runtime/tsconfig.json 
 	cd container-runtime && npm test

-build/lib/migration-images/.done: build/save-migration-images.sh
-	ARCH=$(ARCH) ./build/save-migration-images.sh build/lib/migration-images
-	touch $@
-
 install-cli: $(GIT_HASH_FILE)
 	./core/build/build-cli.sh --install

--- a/build/apt/publish-deb.sh
+++ b/build/apt/publish-deb.sh
@@ -83,16 +83,11 @@ if [ ${#DEB_FILES[@]} -eq 0 ]; then
    exit 1
 fi

-# Copy each deb to the pool, removing old versions of the same package+arch
+# Copy each deb to the pool, renaming to standard format
 for deb in "${DEB_FILES[@]}"; do
    PKG_NAME="$(dpkg-deb --field "$deb" Package)"
-    PKG_ARCH="$(dpkg-deb --field "$deb" Architecture)"
    POOL_DIR="$REPO_DIR/pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}"
    mkdir -p "$POOL_DIR"
-    # Remove old versions for the same architecture
-    for old in "$POOL_DIR"/${PKG_NAME}_*_${PKG_ARCH}.deb; do
-        [ -f "$old" ] && rm -v "$old"
-    done
    cp "$deb" "$POOL_DIR/"
    dpkg-name -o "$POOL_DIR/$(basename "$deb")" 2>/dev/null || true
    echo "Added: $(basename "$deb") -> pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}/"
@@ -138,7 +133,7 @@ fi

 # Upload to S3
 echo "Uploading to s3://${BUCKET}/ ..."
-s3 sync --acl-public --no-mime-magic --delete-removed "$REPO_DIR/" "s3://${BUCKET}/"
+s3 sync --acl-public --no-mime-magic "$REPO_DIR/" "s3://${BUCKET}/"

 [ -n "$S3CMD_CONFIG" ] && rm -f "$S3CMD_CONFIG"
 echo "Done."
--- a/build/lib/scripts/forward-port
+++ b/build/lib/scripts/forward-port
@@ -58,18 +58,15 @@ iptables -t nat -A ${NAME}_OUTPUT -d "$sip" -p udp --dport "$sport" -j DNAT --to
 iptables -A ${NAME}_FORWARD -d $dip -p tcp --dport $dport -m state --state NEW -j ACCEPT
 iptables -A ${NAME}_FORWARD -d $dip -p udp --dport $dport -m state --state NEW -j ACCEPT

-# NAT hairpin: masquerade so replies route back through this host for proper
-# NAT reversal instead of taking a direct path that bypasses conntrack.
-# Host-to-target hairpin: locally-originated packets whose original destination
-# was sip (before OUTPUT DNAT rewrote it to dip).  Using --ctorigdst ties the
-# rule to this specific sip, so multiple WAN IPs forwarding the same port to
-# different targets each get their own masquerade.
-iptables -t nat -A ${NAME}_POSTROUTING -m addrtype --src-type LOCAL -m conntrack --ctorigdst "$sip" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
-iptables -t nat -A ${NAME}_POSTROUTING -m addrtype --src-type LOCAL -m conntrack --ctorigdst "$sip" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
-# Same-subnet hairpin: when traffic originates from the same subnet as the DNAT
-# target (e.g. a container reaching another container, or a WireGuard peer
-# connecting to itself via the tunnel's public IP).
-iptables -t nat -A ${NAME}_POSTROUTING -s "$dip/$dprefix" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
-iptables -t nat -A ${NAME}_POSTROUTING -s "$dip/$dprefix" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
+# NAT hairpin: masquerade traffic from the bridge subnet or host to the DNAT
+# target, so replies route back through the host for proper NAT reversal.
+# Container-to-container hairpin (source is on the bridge subnet)
+if [ -n "$bridge_subnet" ]; then
+    iptables -t nat -A ${NAME}_POSTROUTING -s "$bridge_subnet" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
+    iptables -t nat -A ${NAME}_POSTROUTING -s "$bridge_subnet" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
+fi
+# Host-to-container hairpin (host connects to its own gateway IP, source is sip)
+iptables -t nat -A ${NAME}_POSTROUTING -s "$sip" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
+iptables -t nat -A ${NAME}_POSTROUTING -s "$sip" -d "$dip" -p udp --dport "$dport" -j MASQUERADE

 exit $err
--- a/build/manage-release.sh
+++ b/build/manage-release.sh
@@ -8,7 +8,6 @@ S3_BUCKET="s3://startos-images"
 S3_CDN="https://startos-images.nyc3.cdn.digitaloceanspaces.com"
 START9_GPG_KEY="2D63C217"

-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ARCHES="aarch64 aarch64-nonfree aarch64-nvidia riscv64 riscv64-nonfree x86_64 x86_64-nonfree x86_64-nvidia"
 CLI_ARCHES="aarch64 riscv64 x86_64"

@@ -84,21 +83,16 @@ resolve_gh_user() {
    GH_GPG_KEY=$(git config user.signingkey 2>/dev/null || true)
 }

-# Fetch the URL for an OS asset from the registry index.
-# Usage: registry_url <iso|squashfs|img> <platform>
-registry_url() {
-    local ext=$1 platform=$2
-    if [ -z "${_REGISTRY_INDEX:-}" ]; then
-        _REGISTRY_INDEX=$(start-cli --registry=$REGISTRY registry os index)
-    fi
-    echo "$_REGISTRY_INDEX" | jq -r ".versions[\"$VERSION\"].$ext[\"$platform\"].urls[0]"
-}
-
 # --- Subcommands ---

 cmd_download() {
    require_version

+    if [ -z "${RUN_ID:-}" ]; then
+        read -rp "RUN_ID (OS images, leave blank to skip): " RUN_ID
+    fi
+    RUN_ID=$(parse_run_id "${RUN_ID:-}")
+
    if [ -z "${ST_RUN_ID:-}" ]; then
        read -rp "ST_RUN_ID (start-tunnel, leave blank to skip): " ST_RUN_ID
    fi
@@ -111,14 +105,14 @@ cmd_download() {

    ensure_release_dir

-    # Download OS images from registry (deployed by GitHub workflow)
-    echo "Downloading OS images from registry..."
+    if [ -n "$RUN_ID" ]; then
        for arch in $ARCHES; do
-        for ext in squashfs iso; do
-            echo "  $ext $arch"
-            start-cli --registry=$REGISTRY registry os asset get "$ext" "$VERSION" "$arch" -d "$(pwd)"
+            while ! gh run download -R $REPO "$RUN_ID" -n "$arch.squashfs" -D "$(pwd)"; do sleep 1; done
        done
+        for arch in $ARCHES; do
+            while ! gh run download -R $REPO "$RUN_ID" -n "$arch.iso" -D "$(pwd)"; do sleep 1; done
        done
+    fi

    if [ -n "$ST_RUN_ID" ]; then
        for arch in $CLI_ARCHES; do
@@ -149,12 +143,19 @@ cmd_pull() {
        gh release download -R $REPO "v$VERSION" -p "$file" -D "$(pwd)" --clobber
    done

-    # Download ISOs and squashfs from registry
-    echo "Downloading OS images from registry..."
+    # Download ISOs and squashfs from S3 CDN
    for arch in $ARCHES; do
        for ext in squashfs iso; do
-            echo "  $ext $arch"
-            start-cli --registry=$REGISTRY registry os asset get "$ext" "$VERSION" "$arch" -d "$(pwd)"
+            # Get the actual filename from the GH release asset list or body
+            local filename
+            filename=$(gh release view -R $REPO "v$VERSION" --json assets -q ".assets[].name" | grep "_${arch}\\.${ext}$" || true)
+            if [ -z "$filename" ]; then
+                filename=$(gh release view -R $REPO "v$VERSION" --json body -q .body | grep -oP "[^ ]*_${arch}\\.${ext}" | head -1 || true)
+            fi
+            if [ -n "$filename" ]; then
+                echo "Downloading $filename from S3..."
+                curl -fSL -o "$filename" "$S3_CDN/v$VERSION/$filename"
+            fi
        done
    done
 }
@@ -169,12 +170,14 @@ cmd_upload() {
    require_version
    enter_release_dir

-    # OS images (iso/squashfs) are already on S3 via the GitHub workflow.
-    # Upload only debs and CLI binaries to the GitHub Release.
    for file in $(release_files); do
        case "$file" in
-            *.iso|*.squashfs) ;;
-            *) gh release upload -R $REPO "v$VERSION" "$file" ;;
+            *.iso|*.squashfs)
+                s3cmd put -P "$file" "$S3_BUCKET/v$VERSION/$file"
+                ;;
+            *)
+                gh release upload -R $REPO "v$VERSION" "$file"
+                ;;
        esac
    done
 }
@@ -245,24 +248,6 @@ cmd_cosign() {
    echo "Done. Personal signatures for $GH_USER added to v$VERSION."
 }

-cmd_publish_tunnel() {
-    require_version
-    enter_release_dir
-
-    local tunnel_debs=()
-    for file in start-tunnel*.deb; do
-        [ -f "$file" ] && tunnel_debs+=("$file")
-    done
-
-    if [ ${#tunnel_debs[@]} -eq 0 ]; then
-        >&2 echo "No start-tunnel .deb files found in release directory"
-        exit 1
-    fi
-
-    echo "Publishing start-tunnel debs to apt repository..."
-    "$SCRIPT_DIR/apt/publish-deb.sh" "${tunnel_debs[@]}"
-}
-
 cmd_notes() {
    require_version
    enter_release_dir
@@ -270,14 +255,14 @@ cmd_notes() {
    cat << EOF
 # ISO Downloads

- [x86_64/AMD64]($(registry_url iso x86_64-nonfree))
- [x86_64/AMD64 + NVIDIA]($(registry_url iso x86_64-nvidia))
- [x86_64/AMD64-slim (FOSS-only)]($(registry_url iso x86_64) "Without proprietary software or drivers")
- [aarch64/ARM64]($(registry_url iso aarch64-nonfree))
- [aarch64/ARM64 + NVIDIA]($(registry_url iso aarch64-nvidia))
- [aarch64/ARM64-slim (FOSS-Only)]($(registry_url iso aarch64) "Without proprietary software or drivers")
- [RISCV64 (RVA23)]($(registry_url iso riscv64-nonfree))
- [RISCV64 (RVA23)-slim (FOSS-only)]($(registry_url iso riscv64) "Without proprietary software or drivers")
+- [x86_64/AMD64]($S3_CDN/v$VERSION/$(ls *_x86_64-nonfree.iso))
+- [x86_64/AMD64 + NVIDIA]($S3_CDN/v$VERSION/$(ls *_x86_64-nvidia.iso))
+- [x86_64/AMD64-slim (FOSS-only)]($S3_CDN/v$VERSION/$(ls *_x86_64.iso) "Without proprietary software or drivers")
+- [aarch64/ARM64]($S3_CDN/v$VERSION/$(ls *_aarch64-nonfree.iso))
+- [aarch64/ARM64 + NVIDIA]($S3_CDN/v$VERSION/$(ls *_aarch64-nvidia.iso))
+- [aarch64/ARM64-slim (FOSS-Only)]($S3_CDN/v$VERSION/$(ls *_aarch64.iso) "Without proprietary software or drivers")
+- [RISCV64 (RVA23)]($S3_CDN/v$VERSION/$(ls *_riscv64-nonfree.iso))
+- [RISCV64 (RVA23)-slim (FOSS-only)]($S3_CDN/v$VERSION/$(ls *_riscv64.iso) "Without proprietary software or drivers")

 EOF
    cat << 'EOF'
@@ -333,8 +318,9 @@ EOF

 cmd_full_release() {
    cmd_download
+    cmd_register
    cmd_upload
-    cmd_publish_tunnel
+    cmd_index
    cmd_sign
    cmd_notes
 }
@@ -344,23 +330,22 @@ usage() {
 Usage: manage-release.sh <subcommand>

 Subcommands:
-  download        Download OS images from registry + other artifacts from GH Actions
-                  OS images are pulled via start-cli from the registry (deployed by GH workflow)
-                  Requires: ST_RUN_ID, CLI_RUN_ID (any combination)
+  download      Download artifacts from GitHub Actions runs
+                Requires: RUN_ID, ST_RUN_ID, CLI_RUN_ID (any combination)
  pull          Download an existing release from the GH tag and S3
  register      Register the version in the Start9 registry
  upload        Upload artifacts to GitHub Releases and S3
  index         Add assets to the registry index
-  publish-tunnel  Publish start-tunnel .deb files to the apt repository
  sign          Sign all artifacts with Start9 org key (+ personal key if available)
                and upload signatures.tar.gz
  cosign        Add personal GPG signature to an existing release's signatures
                (requires 'pull' first so you can verify assets before signing)
  notes         Print release notes with download links and checksums
-  full-release    Run: download → register → upload → publish-tunnel → sign → notes
+  full-release  Run: download → register → upload → index → sign → notes

 Environment variables:
  VERSION     (required) Release version
+  RUN_ID      GitHub Actions run ID for OS images (download subcommand)
  ST_RUN_ID   GitHub Actions run ID for start-tunnel (download subcommand)
  CLI_RUN_ID  GitHub Actions run ID for start-cli (download subcommand)
  GH_USER     Override GitHub username (default: autodetected via gh cli)
@@ -374,7 +359,6 @@ case "${1:-}" in
    register) cmd_register ;;
    upload)   cmd_upload ;;
    index)    cmd_index ;;
-    publish-tunnel) cmd_publish_tunnel ;;
    sign)     cmd_sign ;;
    cosign)   cmd_cosign ;;
    notes)    cmd_notes ;;
--- a/build/save-migration-images.sh
+++ b/build/save-migration-images.sh
@@ -1,36 +0,0 @@
-#!/bin/bash
-# Save Docker images needed by the 0.3.6-alpha.0 migration as tarballs
-# so they can be bundled into the OS and loaded without internet access.
-set -e
-
-ARCH="${ARCH:-x86_64}"
-DESTDIR="${1:-build/lib/migration-images}"
-
-if [ "$ARCH" = "x86_64" ]; then
-    DOCKER_PLATFORM="linux/amd64"
-elif [ "$ARCH" = "aarch64" ]; then
-    DOCKER_PLATFORM="linux/arm64"
-else
-    DOCKER_PLATFORM="linux/$ARCH"
-fi
-
-IMAGES=("tonistiigi/binfmt:latest")
-if [ "$ARCH" != "riscv64" ]; then
-    IMAGES=("start9/compat:latest" "start9/utils:latest" "${IMAGES[@]}")
-fi
-
-mkdir -p "$DESTDIR"
-
-for IMAGE in "${IMAGES[@]}"; do
-    FILENAME=$(echo "$IMAGE" | sed 's|/|_|g; s/:/_/g').tar
-    if [ -f "$DESTDIR/$FILENAME" ]; then
-        echo "Skipping $IMAGE (already saved)"
-        continue
-    fi
-    echo "Pulling $IMAGE for $DOCKER_PLATFORM..."
-    docker pull --platform "$DOCKER_PLATFORM" "$IMAGE"
-    echo "Saving $IMAGE to $DESTDIR/$FILENAME..."
-    docker save "$IMAGE" -o "$DESTDIR/$FILENAME"
-done
-
-echo "Migration images saved to $DESTDIR"
--- a/container-runtime/package-lock.json
+++ b/container-runtime/package-lock.json
@@ -37,7 +37,7 @@
    },
    "../sdk/dist": {
      "name": "@start9labs/start-sdk",
-      "version": "1.0.0",
+      "version": "0.4.0-beta.64",
      "license": "MIT",
      "dependencies": {
        "@iarna/toml": "^3.0.0",
--- a/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
+++ b/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
@@ -396,12 +396,6 @@ export class SystemForEmbassy implements System {
    if (this.manifest.id === "nostr") {
      this.manifest.id = "nostr-rs-relay"
    }
-    if (this.manifest.id === "ghost") {
-      this.manifest.id = "ghost-legacy"
-    }
-    if (this.manifest.id === "synapse") {
-      this.manifest.id = "synapse-legacy"
-    }
  }

  async init(
@@ -500,7 +494,7 @@ export class SystemForEmbassy implements System {
      const host = new MultiHost({ effects, id })
      const internalPorts = new Set(
        Object.values(interfaceValue["tor-config"]?.["port-mapping"] ?? {})
-          .map((v) => parseInt(v))
+          .map(Number.parseInt)
          .concat(
            ...Object.values(interfaceValue["lan-config"] ?? {}).map(
              (c) => c.internal,
--- a/core/ARCHITECTURE.md
+++ b/core/ARCHITECTURE.md
@@ -23,6 +23,7 @@ The crate produces a single binary `startbox` that is symlinked under different
 - `src/context/` — Context types (RpcContext, CliContext, InitContext, DiagnosticContext)
 - `src/service/` — Service lifecycle management with actor pattern (`service_actor.rs`)
 - `src/db/model/` — Patch-DB models (`public.rs` synced to frontend, `private.rs` backend-only)
+- `src/mcp/` — MCP server for LLM agents (see [MCP Server](#mcp-server) below)
 - `src/net/` — Networking (DNS, ACME, WiFi, Tor via Arti, WireGuard)
 - `src/s9pk/` — S9PK package format (merkle archive)
 - `src/registry/` — Package registry management
@@ -38,16 +39,19 @@ See [rpc-toolkit.md](rpc-toolkit.md) for full handler patterns and configuration
 Patch-DB provides diff-based state synchronization. Changes to `db/model/public.rs` automatically sync to the frontend.

 **Key patterns:**
+
 - `db.peek().await` — Get a read-only snapshot of the database state
 - `db.mutate(|db| { ... }).await` — Apply mutations atomically, returns `MutateResult`
 - `#[derive(HasModel)]` — Derive macro for types stored in the database, generates typed accessors

 **Generated accessor types** (from `HasModel` derive):
+
 - `as_field()` — Immutable reference: `&Model<T>`
 - `as_field_mut()` — Mutable reference: `&mut Model<T>`
 - `into_field()` — Owned value: `Model<T>`

 **`Model<T>` APIs** (from `db/prelude.rs`):
+
 - `.de()` — Deserialize to `T`
 - `.ser(&value)` — Serialize from `T`
 - `.mutate(|v| ...)` — Deserialize, mutate, reserialize
@@ -63,6 +67,12 @@ See [i18n-patterns.md](i18n-patterns.md) for internationalization key convention

 See [core-rust-patterns.md](core-rust-patterns.md) for common utilities (Invoke trait, Guard pattern, mount guards, Apply trait, etc.).

+## MCP Server
+
+The MCP (Model Context Protocol) server at `src/mcp/` exposes the StartOS RPC API to LLM agents via the Streamable HTTP transport at `/mcp`. Tools wrap the existing RPC handlers; resources expose Patch-DB state with debounced SSE subscriptions; auth reuses the UI session cookie.
+
+See [src/mcp/ARCHITECTURE.md](src/mcp/ARCHITECTURE.md) for transport details, session lifecycle, tool dispatch, resource subscriptions, CORS, and body size limits.
+
 ## Related Documentation

 - [rpc-toolkit.md](rpc-toolkit.md) — JSON-RPC handler patterns
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -1967,18 +1967,6 @@ dependencies = [
 "once_cell",
 ]

-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fallible-streaming-iterator"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
-
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -3574,17 +3562,6 @@ dependencies = [
 "redox_syscall 0.7.3",
 ]

-[[package]]
-name = "libsqlite3-sys"
-version = "0.32.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbb8270bb4060bd76c6e96f20c52d80620f1d82a3470885694e41e0f81ef6fe7"
-dependencies = [
- "cc",
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "libyml"
 version = "0.0.5"
@@ -5467,20 +5444,6 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

-[[package]]
-name = "rusqlite"
-version = "0.34.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37e34486da88d8e051c7c0e23c3f15fd806ea8546260aa2fec247e97242ec143"
-dependencies = [
- "bitflags 2.11.0",
- "fallible-iterator",
- "fallible-streaming-iterator",
- "hashlink",
- "libsqlite3-sys",
- "smallvec",
-]
-
 [[package]]
 name = "rust-argon2"
 version = "3.0.0"
@@ -6476,7 +6439,7 @@ dependencies = [

 [[package]]
 name = "start-os"
-version = "0.4.0-beta.0"
+version = "0.4.0-alpha.22"
 dependencies = [
 "aes",
 "async-acme",
@@ -6573,7 +6536,6 @@ dependencies = [
 "reqwest_cookie_store",
 "rpassword",
 "rpc-toolkit",
- "rusqlite",
 "rust-argon2",
 "rust-i18n",
 "semver",
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -15,7 +15,7 @@ license = "MIT"
 name = "start-os"
 readme = "README.md"
 repository = "https://github.com/Start9Labs/start-os"
-version = "0.4.0-beta.0" # VERSION_BUMP
+version = "0.4.0-alpha.22" # VERSION_BUMP

 [lib]
 name = "startos"
@@ -182,7 +182,6 @@ qrcode = "0.14.1"
 r3bl_tui = "0.7.6"
 rand = "0.9.2"
 regex = "1.10.2"
-rusqlite = { version = "0.34", features = ["bundled"] }
 reqwest = { version = "0.12.25", features = [
  "http2",
  "json",
@@ -251,3 +250,5 @@ opt-level = 3
 [profile.dev.package.backtrace]
 opt-level = 3

+[profile.dev.package.sqlx-macros]
+opt-level = 3
--- a/core/locales/i18n.yaml
+++ b/core/locales/i18n.yaml
@@ -1721,14 +1721,6 @@ lxc.mod.cleaned-up-containers:
  fr_FR: "Conteneurs LXC orphelins nettoyés avec succès"
  pl_PL: "Pomyślnie wyczyszczono wiszące kontenery LXC"

-# version/v0_3_6_alpha_0.rs
-migration.migrating-package:
-  en_US: "Migrating package %{package}..."
-  de_DE: "Paket %{package} wird migriert..."
-  es_ES: "Migrando paquete %{package}..."
-  fr_FR: "Migration du paquet %{package}..."
-  pl_PL: "Migracja pakietu %{package}..."
-
 # registry/admin.rs
 registry.admin.unknown-signer:
  en_US: "Unknown signer"
@@ -1826,28 +1818,13 @@ registry.os.version.signer-not-authorized:
  fr_FR: "Le signataire %{signer} n'est pas autorisé à signer pour v%{version}"
  pl_PL: "Sygnatariusz %{signer} nie jest autoryzowany do podpisywania v%{version}"

-# registry/os/promote.rs
-registry.os.promote.need-from-or-to:
-  en_US: "At least one of --from or --to must be specified"
-  de_DE: "Mindestens --from oder --to muss angegeben werden"
-  es_ES: "Se debe especificar al menos --from o --to"
-  fr_FR: "Au moins --from ou --to doit être spécifié"
-  pl_PL: "Należy podać przynajmniej --from lub --to"
-
-registry.os.promote.version-not-found:
-  en_US: "OS version %{version} not found on source registry"
-  de_DE: "OS-Version %{version} nicht in der Quell-Registry gefunden"
-  es_ES: "Versión del SO %{version} no encontrada en el registro de origen"
-  fr_FR: "Version OS %{version} introuvable dans le registre source"
-  pl_PL: "Wersja OS %{version} nie znaleziona w rejestrze źródłowym"
-
 # registry/package/mod.rs
 registry.package.remove-not-exist:
-  en_US: "%{id}%{version}%{sighash} does not exist, so not removed"
-  de_DE: "%{id}%{version}%{sighash} existiert nicht, daher nicht entfernt"
-  es_ES: "%{id}%{version}%{sighash} no existe, por lo que no se eliminó"
-  fr_FR: "%{id}%{version}%{sighash} n'existe pas, donc non supprimé"
-  pl_PL: "%{id}%{version}%{sighash} nie istnieje, więc nie usunięto"
+  en_US: "%{id}@%{version}%{sighash} does not exist, so not removed"
+  de_DE: "%{id}@%{version}%{sighash} existiert nicht, daher nicht entfernt"
+  es_ES: "%{id}@%{version}%{sighash} no existe, por lo que no se eliminó"
+  fr_FR: "%{id}@%{version}%{sighash} n'existe pas, donc non supprimé"
+  pl_PL: "%{id}@%{version}%{sighash} nie istnieje, więc nie usunięto"

 # registry/package/add.rs
 registry.package.add.must-specify-url:
@@ -1871,13 +1848,6 @@ registry.package.missing-signer:
  fr_FR: "Signataire manquant"
  pl_PL: "Brak sygnatariusza"

-registry.package.remove-has-versions:
-  en_US: "Package %{id} has versions; use --force to remove"
-  de_DE: "Paket %{id} hat Versionen; verwenden Sie --force zum Entfernen"
-  es_ES: "El paquete %{id} tiene versiones; use --force para eliminar"
-  fr_FR: "Le paquet %{id} a des versions ; utilisez --force pour supprimer"
-  pl_PL: "Pakiet %{id} ma wersje; użyj --force aby usunąć"
-
 registry.package.unauthorized:
  en_US: "Unauthorized"
  de_DE: "Nicht autorisiert"
@@ -1892,20 +1862,6 @@ registry.package.add-mirror.unauthorized:
  fr_FR: "Non autorisé"
  pl_PL: "Brak autoryzacji"

-registry.package.promote.need-from-or-to:
-  en_US: "At least one of --from or --to must be specified"
-  de_DE: "Mindestens --from oder --to muss angegeben werden"
-  es_ES: "Se debe especificar al menos --from o --to"
-  fr_FR: "Au moins --from ou --to doit être spécifié"
-  pl_PL: "Należy podać przynajmniej --from lub --to"
-
-registry.package.promote.version-not-found:
-  en_US: "Version %{version} of %{id} not found on source registry"
-  de_DE: "Version %{version} von %{id} nicht in der Quell-Registry gefunden"
-  es_ES: "Versión %{version} de %{id} no encontrada en el registro de origen"
-  fr_FR: "Version %{version} de %{id} introuvable dans le registre source"
-  pl_PL: "Wersja %{version} pakietu %{id} nie znaleziona w rejestrze źródłowym"
-
 registry.package.cannot-remove-last-mirror:
  en_US: "Cannot remove last mirror from an s9pk"
  de_DE: "Letzter Spiegel kann nicht aus einem s9pk entfernt werden"
@@ -2693,13 +2649,6 @@ help.arg.add-signer-key:
  fr_FR: "Ajouter une clé publique au signataire"
  pl_PL: "Dodaj klucz publiczny do sygnatariusza"

-help.arg.address:
-  en_US: "Network address"
-  de_DE: "Netzwerkadresse"
-  es_ES: "Dirección de red"
-  fr_FR: "Adresse réseau"
-  pl_PL: "Adres sieciowy"
-
 help.arg.allow-model-mismatch:
  en_US: "Allow database model mismatch"
  de_DE: "Datenbankmodell-Abweichung erlauben"
@@ -2854,13 +2803,6 @@ help.arg.echoip-urls:
  fr_FR: "URLs du service Echo IP pour la détection d'IP externe"
  pl_PL: "Adresy URL usługi Echo IP do wykrywania zewnętrznego IP"

-help.arg.ed25519:
-  en_US: "Use Ed25519 instead of NIST P-256"
-  de_DE: "Ed25519 anstelle von NIST P-256 verwenden"
-  es_ES: "Usar Ed25519 en lugar de NIST P-256"
-  fr_FR: "Utiliser Ed25519 au lieu de NIST P-256"
-  pl_PL: "Użyj Ed25519 zamiast NIST P-256"
-
 help.arg.emulate-missing-arch:
  en_US: "Emulate missing architecture using this one"
  de_DE: "Fehlende Architektur mit dieser emulieren"
@@ -2917,13 +2859,6 @@ help.arg.force-clear-task:
  fr_FR: "Forcer la suppression de la tâche même si elle est en cours"
  pl_PL: "Wymuś wyczyszczenie zadania nawet jeśli jest uruchomione"

-help.arg.force-remove-package:
-  en_US: "Force removal even if the package has versions"
-  de_DE: "Entfernung erzwingen, auch wenn das Paket Versionen hat"
-  es_ES: "Forzar la eliminación aunque el paquete tenga versiones"
-  fr_FR: "Forcer la suppression même si le paquet a des versions"
-  pl_PL: "Wymuś usunięcie nawet jeśli pakiet ma wersje"
-
 help.arg.force-stderr-tty:
  en_US: "Force stderr to be treated as a TTY"
  de_DE: "stderr als TTY behandeln erzwingen"
@@ -2945,13 +2880,6 @@ help.arg.force-uninstall:
  fr_FR: "Ignorer les erreurs dans le script de désinitialisation du service"
  pl_PL: "Ignoruj błędy w skrypcie deinicjalizacji usługi"

-help.arg.from-registry-url:
-  en_US: "Source registry URL to promote from"
-  de_DE: "Quell-Registry-URL zum Heraufstufen"
-  es_ES: "URL del registro de origen para promover"
-  fr_FR: "URL du registre source pour la promotion"
-  pl_PL: "URL rejestru źródłowego do promowania"
-
 help.arg.host-url:
  en_US: "URL of the StartOS server"
  de_DE: "URL des StartOS-Servers"
@@ -2959,13 +2887,6 @@ help.arg.host-url:
  fr_FR: "URL du serveur StartOS"
  pl_PL: "URL serwera StartOS"

-help.arg.hostnames:
-  en_US: "Hostnames to include in the certificate"
-  de_DE: "Hostnamen, die in das Zertifikat aufgenommen werden sollen"
-  es_ES: "Nombres de host para incluir en el certificado"
-  fr_FR: "Noms d'hôtes à inclure dans le certificat"
-  pl_PL: "Nazwy hostów do uwzględnienia w certyfikacie"
-
 help.arg.icon-path:
  en_US: "Path to service icon file"
  de_DE: "Pfad zur Service-Icon-Datei"
@@ -2973,13 +2894,6 @@ help.arg.icon-path:
  fr_FR: "Chemin vers le fichier d'icône du service"
  pl_PL: "Ścieżka do pliku ikony usługi"

-help.arg.icon-source:
-  en_US: "Icon source: file path, file:// URL, http(s):// URL, or data: URL"
-  de_DE: "Icon-Quelle: Dateipfad, file://-URL, http(s)://-URL oder data:-URL"
-  es_ES: "Fuente del icono: ruta de archivo, URL file://, URL http(s):// o URL data:"
-  fr_FR: "Source de l'icône : chemin de fichier, URL file://, URL http(s):// ou URL data:"
-  pl_PL: "Źródło ikony: ścieżka pliku, URL file://, URL http(s):// lub URL data:"
-
 help.arg.image-id:
  en_US: "Docker image identifier"
  de_DE: "Docker-Image-Kennung"
@@ -3064,34 +2978,6 @@ help.arg.merge:
  fr_FR: "Fusionner avec la plage de versions existante au lieu de remplacer"
  pl_PL: "Połącz z istniejącym zakresem wersji zamiast zastępować"

-help.arg.metrics-after:
-  en_US: "Start of time range (RFC 3339 timestamp)"
-  de_DE: "Beginn des Zeitraums (RFC 3339 Zeitstempel)"
-  es_ES: "Inicio del rango de tiempo (marca de tiempo RFC 3339)"
-  fr_FR: "Début de la plage temporelle (horodatage RFC 3339)"
-  pl_PL: "Początek zakresu czasu (znacznik czasu RFC 3339)"
-
-help.arg.metrics-before:
-  en_US: "End of time range (RFC 3339 timestamp)"
-  de_DE: "Ende des Zeitraums (RFC 3339 Zeitstempel)"
-  es_ES: "Fin del rango de tiempo (marca de tiempo RFC 3339)"
-  fr_FR: "Fin de la plage temporelle (horodatage RFC 3339)"
-  pl_PL: "Koniec zakresu czasu (znacznik czasu RFC 3339)"
-
-help.arg.metrics-pkg-id:
-  en_US: "Filter by package ID"
-  de_DE: "Nach Paket-ID filtern"
-  es_ES: "Filtrar por ID de paquete"
-  fr_FR: "Filtrer par identifiant de paquet"
-  pl_PL: "Filtruj według identyfikatora pakietu"
-
-help.arg.metrics-version:
-  en_US: "Filter by version"
-  de_DE: "Nach Version filtern"
-  es_ES: "Filtrar por versión"
-  fr_FR: "Filtrer par version"
-  pl_PL: "Filtruj według wersji"
-
 help.arg.mirror-url:
  en_US: "URL of the mirror"
  de_DE: "URL des Spiegels"
@@ -3204,12 +3090,12 @@ help.arg.platform:
  fr_FR: "Identifiant de la plateforme cible"
  pl_PL: "Identyfikator platformy docelowej"

-help.arg.port:
-  en_US: "Port number"
-  de_DE: "Portnummer"
-  es_ES: "Número de puerto"
-  fr_FR: "Numéro de port"
-  pl_PL: "Numer portu"
+help.arg.postgres-connection-url:
+  en_US: "PostgreSQL connection URL"
+  de_DE: "PostgreSQL-Verbindungs-URL"
+  es_ES: "URL de conexión PostgreSQL"
+  fr_FR: "URL de connexion PostgreSQL"
+  pl_PL: "URL połączenia PostgreSQL"

 help.arg.proxy-url:
  en_US: "HTTP/SOCKS proxy URL"
@@ -3288,13 +3174,6 @@ help.arg.server-id:
  fr_FR: "Identifiant unique du serveur"
  pl_PL: "Unikalny identyfikator serwera"

-help.arg.set-as-default-outbound:
-  en_US: "Set as the default outbound gateway"
-  de_DE: "Als Standard-Ausgangs-Gateway festlegen"
-  es_ES: "Establecer como puerta de enlace de salida predeterminada"
-  fr_FR: "Définir comme passerelle de sortie par défaut"
-  pl_PL: "Ustaw jako domyślną bramę wychodzącą"
-
 help.arg.set-signer-name:
  en_US: "Set the signer name"
  de_DE: "Unterzeichnernamen festlegen"
@@ -3435,13 +3314,6 @@ help.arg.target-version-range:
  fr_FR: "Contrainte de plage de version cible"
  pl_PL: "Ograniczenie zakresu wersji docelowej"

-help.arg.to-registry-url:
-  en_US: "Destination registry URL to promote to"
-  de_DE: "Ziel-Registry-URL zum Heraufstufen"
-  es_ES: "URL del registro de destino para promover"
-  fr_FR: "URL du registre de destination pour la promotion"
-  pl_PL: "URL rejestru docelowego do promowania"
-
 help.arg.tor-proxy-url:
  en_US: "Tor SOCKS proxy URL"
  de_DE: "Tor-SOCKS-Proxy-URL"
@@ -3666,13 +3538,6 @@ help.arg.gateway-name:
  fr_FR: "Nom de la passerelle"
  pl_PL: "Nazwa bramy"

-help.arg.gateway-type:
-  en_US: "Type of gateway"
-  de_DE: "Typ des Gateways"
-  es_ES: "Tipo de puerta de enlace"
-  fr_FR: "Type de passerelle"
-  pl_PL: "Typ bramy"
-
 help.arg.governor-name:
  en_US: "CPU governor name"
  de_DE: "CPU-Governor-Name"
@@ -4199,13 +4064,6 @@ about.add-version-signer:
  fr_FR: "Ajouter un signataire de version"
  pl_PL: "Dodaj sygnatariusza wersji"

-about.add-vhost-passthrough:
-  en_US: "Add vhost passthrough"
-  de_DE: "Vhost-Passthrough hinzufügen"
-  es_ES: "Agregar passthrough de vhost"
-  fr_FR: "Ajouter un passthrough vhost"
-  pl_PL: "Dodaj passthrough vhost"
-
 about.add-wifi-ssid-password:
  en_US: "Add wifi ssid and password"
  de_DE: "WLAN-SSID und Passwort hinzufügen"
@@ -4255,13 +4113,6 @@ about.check-for-updates:
  fr_FR: "Vérifier les mises à jour disponibles"
  pl_PL: "Sprawdź dostępne aktualizacje"

-about.check-port-reachability:
-  en_US: "Check if a port is reachable from the WAN"
-  de_DE: "Prüfen, ob ein Port vom WAN erreichbar ist"
-  es_ES: "Comprobar si un puerto es accesible desde la WAN"
-  fr_FR: "Vérifier si un port est accessible depuis le WAN"
-  pl_PL: "Sprawdź, czy port jest osiągalny z WAN"
-
 about.check-update-startos:
  en_US: "Check a given registry for StartOS updates and update if available"
  de_DE: "Ein bestimmtes Registry auf StartOS-Updates prüfen und bei Verfügbarkeit aktualisieren"
@@ -4360,13 +4211,6 @@ about.commands-authentication:
  fr_FR: "Commandes liées à l'authentification, comme connexion, déconnexion"
  pl_PL: "Polecenia związane z uwierzytelnianiem, np. logowanie, wylogowanie"

-about.commands-authorized-keys:
-  en_US: "Commands for managing authorized keys"
-  de_DE: "Befehle zur Verwaltung autorisierter Schlüssel"
-  es_ES: "Comandos para gestionar claves autorizadas"
-  fr_FR: "Commandes pour gérer les clés autorisées"
-  pl_PL: "Polecenia do zarządzania autoryzowanymi kluczami"
-
 about.commands-backup:
  en_US: "Commands related to backup creation and backup targets"
  de_DE: "Befehle zur Backup-Erstellung und Backup-Zielen"
@@ -4430,41 +4274,6 @@ about.commands-experimental:
  fr_FR: "Commandes liées à la configuration d'options expérimentales comme zram et le gouverneur CPU"
  pl_PL: "Polecenia konfiguracji opcji eksperymentalnych jak zram i regulator CPU"

-about.commands-host-address-domain:
-  en_US: "Commands for managing host address domains"
-  de_DE: "Befehle zur Verwaltung von Host-Adressdomänen"
-  es_ES: "Comandos para gestionar dominios de direcciones del host"
-  fr_FR: "Commandes pour gérer les domaines d'adresses de l'hôte"
-  pl_PL: "Polecenia do zarządzania domenami adresów hosta"
-
-about.commands-host-addresses:
-  en_US: "Commands for managing host addresses"
-  de_DE: "Befehle zur Verwaltung von Host-Adressen"
-  es_ES: "Comandos para gestionar direcciones del host"
-  fr_FR: "Commandes pour gérer les adresses de l'hôte"
-  pl_PL: "Polecenia do zarządzania adresami hosta"
-
-about.commands-host-bindings:
-  en_US: "Commands for managing host bindings"
-  de_DE: "Befehle zur Verwaltung von Host-Bindungen"
-  es_ES: "Comandos para gestionar vínculos del host"
-  fr_FR: "Commandes pour gérer les liaisons de l'hôte"
-  pl_PL: "Polecenia do zarządzania powiązaniami hosta"
-
-about.commands-host-private-domain:
-  en_US: "Commands for managing private domains for a host"
-  de_DE: "Befehle zur Verwaltung privater Domänen für einen Host"
-  es_ES: "Comandos para gestionar dominios privados de un host"
-  fr_FR: "Commandes pour gérer les domaines privés d'un hôte"
-  pl_PL: "Polecenia do zarządzania prywatnymi domenami hosta"
-
-about.commands-host-public-domain:
-  en_US: "Commands for managing public domains for a host"
-  de_DE: "Befehle zur Verwaltung öffentlicher Domänen für einen Host"
-  es_ES: "Comandos para gestionar dominios públicos de un host"
-  fr_FR: "Commandes pour gérer les domaines publics d'un hôte"
-  pl_PL: "Polecenia do zarządzania publicznymi domenami hosta"
-
 about.commands-host-system-ui:
  en_US: "Commands for modifying the host for the system ui"
  de_DE: "Befehle zum Ändern des Hosts für die System-UI"
@@ -4521,13 +4330,6 @@ about.commands-packages:
  fr_FR: "Commandes liées aux paquets"
  pl_PL: "Polecenia związane z pakietami"

-about.commands-port-forward:
-  en_US: "Commands for managing port forwards"
-  de_DE: "Befehle zur Verwaltung von Portweiterleitungen"
-  es_ES: "Comandos para gestionar reenvíos de puertos"
-  fr_FR: "Commandes pour gérer les redirections de ports"
-  pl_PL: "Polecenia do zarządzania przekierowaniami portów"
-
 about.commands-registry:
  en_US: "Commands related to the registry"
  de_DE: "Befehle zum Registry"
@@ -4542,20 +4344,6 @@ about.commands-registry-db:
  fr_FR: "Commandes pour interagir avec la base de données, comme dump et apply"
  pl_PL: "Polecenia interakcji z bazą danych, np. dump i apply"

-about.commands-registry-metrics:
-  en_US: "Query registry usage metrics"
-  de_DE: "Registry-Nutzungsmetriken abfragen"
-  es_ES: "Consultar métricas de uso del registro"
-  fr_FR: "Consulter les métriques d'utilisation du registre"
-  pl_PL: "Zapytaj o metryki użycia rejestru"
-
-about.commands-registry-info:
-  en_US: "View or edit registry information"
-  de_DE: "Registry-Informationen anzeigen oder bearbeiten"
-  es_ES: "Ver o editar información del registro"
-  fr_FR: "Afficher ou modifier les informations du registre"
-  pl_PL: "Wyświetl lub edytuj informacje rejestru"
-
 about.commands-restore-backup:
  en_US: "Commands for restoring package(s) from backup"
  de_DE: "Befehle zum Wiederherstellen von Paketen aus dem Backup"
@@ -4598,20 +4386,6 @@ about.commands-tunnel:
  fr_FR: "Commandes liées à StartTunnel"
  pl_PL: "Polecenia związane z StartTunnel"

-about.commands-tunnel-update:
-  en_US: "Commands for checking and applying tunnel updates"
-  de_DE: "Befehle zum Prüfen und Anwenden von Tunnel-Updates"
-  es_ES: "Comandos para verificar y aplicar actualizaciones del túnel"
-  fr_FR: "Commandes pour vérifier et appliquer les mises à jour du tunnel"
-  pl_PL: "Polecenia do sprawdzania i stosowania aktualizacji tunelu"
-
-about.commands-tunnel-web:
-  en_US: "Commands for managing the tunnel web interface"
-  de_DE: "Befehle zur Verwaltung der Tunnel-Weboberfläche"
-  es_ES: "Comandos para gestionar la interfaz web del túnel"
-  fr_FR: "Commandes pour gérer l'interface web du tunnel"
-  pl_PL: "Polecenia do zarządzania interfejsem webowym tunelu"
-
 about.commands-wifi:
  en_US: "Commands related to wifi networks i.e. add, connect, delete"
  de_DE: "Befehle zu WLAN-Netzwerken, z.B. hinzufügen, verbinden, löschen"
@@ -4752,13 +4526,6 @@ about.display-s9pk-manifest:
  fr_FR: "Afficher le manifeste s9pk"
  pl_PL: "Wyświetl manifest s9pk"

-about.display-s9pk-root-sighash-and-maxsize:
-  en_US: "Display the s9pk root signature hash and max size"
-  de_DE: "Den s9pk-Root-Signaturhash und die maximale Größe anzeigen"
-  es_ES: "Mostrar el hash de firma raíz y el tamaño máximo del s9pk"
-  fr_FR: "Afficher le hachage de signature racine et la taille maximale du s9pk"
-  pl_PL: "Wyświetl hash podpisu głównego i maksymalny rozmiar s9pk"
-
 about.display-server-metrics:
  en_US: "Display server metrics"
  de_DE: "Server-Metriken anzeigen"
@@ -4822,20 +4589,6 @@ about.dump-address-resolution-table:
  fr_FR: "Exporter la table de résolution d'adresses"
  pl_PL: "Zrzuć tabelę rozpoznawania adresów"

-about.dump-port-forward-table:
-  en_US: "Dump port forward table"
-  de_DE: "Portweiterleitungstabelle ausgeben"
-  es_ES: "Volcar tabla de reenvío de puertos"
-  fr_FR: "Exporter la table de redirection de ports"
-  pl_PL: "Zrzuć tabelę przekierowań portów"
-
-about.dump-vhost-proxy-table:
-  en_US: "Dump vhost proxy table"
-  de_DE: "Vhost-Proxy-Tabelle ausgeben"
-  es_ES: "Volcar tabla de proxy vhost"
-  fr_FR: "Exporter la table de proxy vhost"
-  pl_PL: "Zrzuć tabelę proxy vhost"
-
 about.echo-message:
  en_US: "Echo a message back"
  de_DE: "Eine Nachricht zurückgeben"
@@ -4871,13 +4624,6 @@ about.enable-kiosk-mode:
  fr_FR: "Activer le mode kiosque"
  pl_PL: "Włącz tryb kiosku"

-about.enable-or-disable-port-forward:
-  en_US: "Enable or disable a port forward"
-  de_DE: "Portweiterleitung aktivieren oder deaktivieren"
-  es_ES: "Habilitar o deshabilitar un reenvío de puerto"
-  fr_FR: "Activer ou désactiver une redirection de port"
-  pl_PL: "Włącz lub wyłącz przekierowanie portu"
-
 about.enable-webserver:
  en_US: "Enable the webserver"
  de_DE: "Webserver aktivieren"
@@ -4969,13 +4715,6 @@ about.get-developer-pubkey:
  fr_FR: "Obtenir la clé publique du développeur"
  pl_PL: "Pobierz klucz publiczny dewelopera"

-about.get-device-info:
-  en_US: "Display device information"
-  de_DE: "Geräteinformationen anzeigen"
-  es_ES: "Mostrar información del dispositivo"
-  fr_FR: "Afficher les informations de l'appareil"
-  pl_PL: "Wyświetl informacje o urządzeniu"
-
 about.get-initialization-progress:
  en_US: "Get initialization progress"
  de_DE: "Initialisierungsfortschritt abrufen"
@@ -4990,27 +4729,6 @@ about.get-listen-address-for-webserver:
  fr_FR: "Obtenir l'adresse d'écoute du serveur web"
  pl_PL: "Pobierz adres nasłuchiwania serwera internetowego"

-about.get-metrics-downloads:
-  en_US: "Count package download requests with optional filters"
-  de_DE: "Paket-Download-Anfragen mit optionalen Filtern zählen"
-  es_ES: "Contar solicitudes de descarga de paquetes con filtros opcionales"
-  fr_FR: "Compter les demandes de téléchargement de paquets avec filtres optionnels"
-  pl_PL: "Zlicz żądania pobrania pakietów z opcjonalnymi filtrami"
-
-about.get-metrics-summary:
-  en_US: "Get a summary of registry usage metrics"
-  de_DE: "Zusammenfassung der Registry-Nutzungsmetriken abrufen"
-  es_ES: "Obtener un resumen de las métricas de uso del registro"
-  fr_FR: "Obtenir un résumé des métriques d'utilisation du registre"
-  pl_PL: "Pobierz podsumowanie metryk użycia rejestru"
-
-about.get-metrics-users:
-  en_US: "Count unique active users within a time range"
-  de_DE: "Eindeutige aktive Benutzer in einem Zeitraum zählen"
-  es_ES: "Contar usuarios activos únicos dentro de un rango de tiempo"
-  fr_FR: "Compter les utilisateurs actifs uniques dans un intervalle de temps"
-  pl_PL: "Zlicz unikalnych aktywnych użytkowników w zakresie czasu"
-
 about.get-os-versions-info:
  en_US: "Get OS versions info"
  de_DE: "Informationen zu Betriebssystemversionen abrufen"
@@ -5186,13 +4904,6 @@ about.list-paths-of-package-ingredients:
  fr_FR: "Lister les chemins des composants du package"
  pl_PL: "Wyświetl ścieżki składników pakietu"

-about.list-registry-categories:
-  en_US: "List registry categories"
-  de_DE: "Registry-Kategorien auflisten"
-  es_ES: "Listar categorías del registro"
-  fr_FR: "Lister les catégories du registre"
-  pl_PL: "Wyświetl kategorie rejestru"
-
 about.list-registry-info-packages:
  en_US: "List registry info and packages"
  de_DE: "Registry-Informationen und Pakete auflisten"
@@ -5221,13 +4932,6 @@ about.list-version-signers:
  fr_FR: "Lister les signataires de versions"
  pl_PL: "Wyświetl sygnatariuszy wersji"

-about.list-vhost-passthrough:
-  en_US: "List vhost passthroughs"
-  de_DE: "Vhost-Passthroughs auflisten"
-  es_ES: "Listar passthroughs de vhost"
-  fr_FR: "Lister les passthroughs vhost"
-  pl_PL: "Wyświetl passthrough vhost"
-
 about.list-wifi-info:
  en_US: "List wifi information"
  de_DE: "WLAN-Informationen auflisten"
@@ -5277,13 +4981,6 @@ about.manage-query-dns:
  fr_FR: "Gérer et interroger le DNS"
  pl_PL: "Zarządzaj i odpytuj DNS"

-about.manage-ssl-certificates:
-  en_US: "Manage SSL certificates"
-  de_DE: "SSL-Zertifikate verwalten"
-  es_ES: "Gestionar certificados SSL"
-  fr_FR: "Gérer les certificats SSL"
-  pl_PL: "Zarządzaj certyfikatami SSL"
-
 about.manage-ssl-vhost-proxy:
  en_US: "Manage SSL vhost proxy"
  de_DE: "SSL-vhost-Proxy verwalten"
@@ -5347,20 +5044,6 @@ about.persist-new-notification:
  fr_FR: "Persister une nouvelle notification"
  pl_PL: "Utrwal nowe powiadomienie"

-about.promote-os-registry:
-  en_US: "Promote an OS version from one registry to another"
-  de_DE: "Eine OS-Version von einer Registry in eine andere heraufstufen"
-  es_ES: "Promover una versión del SO de un registro a otro"
-  fr_FR: "Promouvoir une version OS d'un registre à un autre"
-  pl_PL: "Promuj wersję OS z jednego rejestru do drugiego"
-
-about.promote-package-registry:
-  en_US: "Promote a package from one registry to another"
-  de_DE: "Ein Paket von einer Registry in eine andere heraufstufen"
-  es_ES: "Promover un paquete de un registro a otro"
-  fr_FR: "Promouvoir un paquet d'un registre à un autre"
-  pl_PL: "Promuj pakiet z jednego rejestru do drugiego"
-
 about.publish-s9pk:
  en_US: "Publish s9pk to S3 bucket and index on registry"
  de_DE: "S9pk in S3-Bucket veröffentlichen und in Registry indizieren"
@@ -5494,13 +5177,6 @@ about.remove-package-signer:
  fr_FR: "Supprimer le signataire du package"
  pl_PL: "Usuń sygnatariusza pakietu"

-about.remove-signer:
-  en_US: "Remove signer and all their authorizations"
-  de_DE: "Unterzeichner und alle Autorisierungen entfernen"
-  es_ES: "Eliminar firmante y todas sus autorizaciones"
-  fr_FR: "Supprimer le signataire et toutes ses autorisations"
-  pl_PL: "Usuń sygnatariusza i wszystkie jego autoryzacje"
-
 about.remove-port-forward:
  en_US: "Remove port forward"
  de_DE: "Portweiterleitung entfernen"
@@ -5550,13 +5226,6 @@ about.remove-version-signer:
  fr_FR: "Supprimer le signataire de version"
  pl_PL: "Usuń sygnatariusza wersji"

-about.remove-vhost-passthrough:
-  en_US: "Remove vhost passthrough"
-  de_DE: "Vhost-Passthrough entfernen"
-  es_ES: "Eliminar passthrough de vhost"
-  fr_FR: "Supprimer un passthrough vhost"
-  pl_PL: "Usuń passthrough vhost"
-
 about.remove-wifi-network:
  en_US: "Remove a wifi network"
  de_DE: "Ein WLAN-Netzwerk entfernen"
@@ -5641,13 +5310,6 @@ about.run-service-action:
  fr_FR: "Exécuter une action de service"
  pl_PL: "Uruchom akcję usługi"

-about.set-address-enabled-for-binding:
-  en_US: "Set a gateway address enabled for a binding"
-  de_DE: "Gateway-Adresse für eine Bindung aktivieren"
-  es_ES: "Establecer una dirección de gateway habilitada para un vínculo"
-  fr_FR: "Définir une adresse de passerelle activée pour une liaison"
-  pl_PL: "Ustaw adres bramy jako włączony dla powiązania"
-
 about.set-country:
  en_US: "Set the country"
  de_DE: "Das Land festlegen"
@@ -5655,13 +5317,6 @@ about.set-country:
  fr_FR: "Définir le pays"
  pl_PL: "Ustaw kraj"

-about.set-default-outbound-gateway:
-  en_US: "Set the default outbound gateway"
-  de_DE: "Standard-Ausgangs-Gateway festlegen"
-  es_ES: "Establecer la puerta de enlace de salida predeterminada"
-  fr_FR: "Définir la passerelle sortante par défaut"
-  pl_PL: "Ustaw domyślną bramę wychodzącą"
-
 about.set-echoip-urls:
  en_US: "Set the Echo IP service URLs"
  de_DE: "Die Echo-IP-Dienst-URLs festlegen"
@@ -5704,13 +5359,6 @@ about.set-listen-address-for-webserver:
  fr_FR: "Définir l'adresse d'écoute du serveur web"
  pl_PL: "Ustaw adres nasłuchiwania serwera internetowego"

-about.set-outbound-gateway-package:
-  en_US: "Set the outbound gateway for a package"
-  de_DE: "Ausgangs-Gateway für ein Paket festlegen"
-  es_ES: "Establecer la puerta de enlace de salida para un paquete"
-  fr_FR: "Définir la passerelle sortante pour un package"
-  pl_PL: "Ustaw bramę wychodzącą dla pakietu"
-
 about.set-registry-icon:
  en_US: "Set the registry icon"
  de_DE: "Das Registry-Symbol festlegen"
@@ -5809,13 +5457,6 @@ about.stop-service:
  fr_FR: "Arrêter un service"
  pl_PL: "Zatrzymaj usługę"

-about.ssl-generate-certificate:
-  en_US: "Generate an SSL certificate from the system root CA"
-  de_DE: "SSL-Zertifikat von der System-Root-CA generieren"
-  es_ES: "Generar un certificado SSL desde la CA raíz del sistema"
-  fr_FR: "Générer un certificat SSL depuis l'autorité racine du système"
-  pl_PL: "Wygeneruj certyfikat SSL z głównego CA systemu"
-
 about.teardown-rebuild-containers:
  en_US: "Teardown and rebuild containers"
  de_DE: "Container abbauen und neu erstellen"
@@ -5886,13 +5527,6 @@ about.update-firmware:
  fr_FR: "Mettre à jour le firmware"
  pl_PL: "Zaktualizuj oprogramowanie układowe"

-about.update-port-forward-label:
-  en_US: "Update the label of a port forward"
-  de_DE: "Bezeichnung einer Portweiterleitung aktualisieren"
-  es_ES: "Actualizar la etiqueta de un reenvío de puerto"
-  fr_FR: "Mettre à jour le libellé d'une redirection de port"
-  pl_PL: "Zaktualizuj etykietę przekierowania portu"
-
 about.view-edit-gateway-configs:
  en_US: "View and edit gateway configurations"
  de_DE: "Gateway-Konfigurationen anzeigen und bearbeiten"
--- a/core/man/start-cli/start-cli-net-forward-dump-table.1
+++ b/core/man/start-cli/start-cli-net-forward-dump-table.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-net-forward-dump-table 1  "dump-table " 
 .SH NAME
-start\-cli\-net\-forward\-dump\-table \- Dump port forward table
+start\-cli\-net\-forward\-dump\-table
 .SH SYNOPSIS
 \fBstart\-cli net forward dump\-table\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-Dump port forward table
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-net-forward.1
+++ b/core/man/start-cli/start-cli-net-forward.1
@@ -14,4 +14,3 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-net\-forward\-dump\-table(1)
-Dump port forward table
--- a/core/man/start-cli/start-cli-net-gateway-check-port.1
+++ b/core/man/start-cli/start-cli-net-gateway-check-port.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-gateway-check-port 1  "check-port " 
 .SH NAME
-start\-cli\-net\-gateway\-check\-port \- Check if a port is reachable from the WAN
+start\-cli\-net\-gateway\-check\-port \- about.check\-port\-reachability
 .SH SYNOPSIS
 \fBstart\-cli net gateway check\-port\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIPORT\fR> <\fIGATEWAY\fR> 
 .SH DESCRIPTION
-Check if a port is reachable from the WAN
+about.check\-port\-reachability
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
@@ -16,7 +16,7 @@ Check if a port is reachable from the WAN
 Print help
 .TP
 <\fIPORT\fR>
-Port number
+help.arg.port
 .TP
 <\fIGATEWAY\fR>
 Gateway identifier
--- a/core/man/start-cli/start-cli-net-gateway-set-default-outbound.1
+++ b/core/man/start-cli/start-cli-net-gateway-set-default-outbound.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-gateway-set-default-outbound 1  "set-default-outbound " 
 .SH NAME
-start\-cli\-net\-gateway\-set\-default\-outbound \- Set the default outbound gateway
+start\-cli\-net\-gateway\-set\-default\-outbound \- about.set\-default\-outbound\-gateway
 .SH SYNOPSIS
 \fBstart\-cli net gateway set\-default\-outbound\fR [\fB\-h\fR|\fB\-\-help\fR] [\fIGATEWAY\fR] 
 .SH DESCRIPTION
-Set the default outbound gateway
+about.set\-default\-outbound\-gateway
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-net-gateway.1
+++ b/core/man/start-cli/start-cli-net-gateway.1
@@ -17,7 +17,7 @@ start\-cli\-net\-gateway\-check\-dns(1)
 Check DNS configuration for a gateway
 .TP
 start\-cli\-net\-gateway\-check\-port(1)
-Check if a port is reachable from the WAN
+about.check\-port\-reachability
 .TP
 start\-cli\-net\-gateway\-forget(1)
 Forget a disconnected gateway
@@ -26,7 +26,7 @@ start\-cli\-net\-gateway\-list(1)
 Show gateways StartOS can listen on
 .TP
 start\-cli\-net\-gateway\-set\-default\-outbound(1)
-Set the default outbound gateway
+about.set\-default\-outbound\-gateway
 .TP
 start\-cli\-net\-gateway\-set\-name(1)
 Rename a gateway
--- a/core/man/start-cli/start-cli-net-ssl-generate-certificate.1
+++ b/core/man/start-cli/start-cli-net-ssl-generate-certificate.1
@@ -1,22 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-net-ssl-generate-certificate 1  "generate-certificate " 
-.SH NAME
-start\-cli\-net\-ssl\-generate\-certificate \- Generate an SSL certificate from the system root CA
-.SH SYNOPSIS
-\fBstart\-cli net ssl generate\-certificate\fR [\fB\-\-ed25519\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fIHOSTNAMES\fR] 
-.SH DESCRIPTION
-Generate an SSL certificate from the system root CA
-.SH OPTIONS
-.TP
-\fB\-\-ed25519\fR
-Use Ed25519 instead of NIST P\-256
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-[\fIHOSTNAMES\fR]
-Hostnames to include in the certificate
--- a/core/man/start-cli/start-cli-net-ssl.1
+++ b/core/man/start-cli/start-cli-net-ssl.1
@@ -1,17 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-net-ssl 1  "ssl " 
-.SH NAME
-start\-cli\-net\-ssl \- Manage SSL certificates
-.SH SYNOPSIS
-\fBstart\-cli net ssl\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
-.SH DESCRIPTION
-Manage SSL certificates
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.SH SUBCOMMANDS
-.TP
-start\-cli\-net\-ssl\-generate\-certificate(1)
-Generate an SSL certificate from the system root CA
--- a/core/man/start-cli/start-cli-net-tunnel-add.1
+++ b/core/man/start-cli/start-cli-net-tunnel-add.1
@@ -10,7 +10,7 @@ Add a new tunnel
 .SH OPTIONS
 .TP
 \fB\-\-set\-as\-default\-outbound\fR
-Set as the default outbound gateway
+help.arg.set\-as\-default\-outbound
 .TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
@@ -22,7 +22,7 @@ Tunnel name
 WireGuard configuration
 .TP
 [\fIGATEWAY_TYPE\fR]
-Type of gateway
+help.arg.gateway\-type
 .br

 .br
--- a/core/man/start-cli/start-cli-net-vhost-add-passthrough.1
+++ b/core/man/start-cli/start-cli-net-vhost-add-passthrough.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-add-passthrough 1  "add-passthrough " 
 .SH NAME
-start\-cli\-net\-vhost\-add\-passthrough \- Add vhost passthrough
+start\-cli\-net\-vhost\-add\-passthrough
 .SH SYNOPSIS
 \fBstart\-cli net vhost add\-passthrough\fR <\fB\-\-hostname\fR> <\fB\-\-listen\-port\fR> <\fB\-\-backend\fR> [\fB\-\-public\-gateway\fR] [\fB\-\-private\-ip\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-Add vhost passthrough
 .SH OPTIONS
 .TP
 \fB\-\-hostname\fR \fI<HOSTNAME>\fR
--- a/core/man/start-cli/start-cli-net-vhost-dump-table.1
+++ b/core/man/start-cli/start-cli-net-vhost-dump-table.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-dump-table 1  "dump-table " 
 .SH NAME
-start\-cli\-net\-vhost\-dump\-table \- Dump vhost proxy table
+start\-cli\-net\-vhost\-dump\-table
 .SH SYNOPSIS
 \fBstart\-cli net vhost dump\-table\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-Dump vhost proxy table
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-net-vhost-list-passthrough.1
+++ b/core/man/start-cli/start-cli-net-vhost-list-passthrough.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-list-passthrough 1  "list-passthrough " 
 .SH NAME
-start\-cli\-net\-vhost\-list\-passthrough \- List vhost passthroughs
+start\-cli\-net\-vhost\-list\-passthrough
 .SH SYNOPSIS
 \fBstart\-cli net vhost list\-passthrough\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-List vhost passthroughs
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-net-vhost-remove-passthrough.1
+++ b/core/man/start-cli/start-cli-net-vhost-remove-passthrough.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-remove-passthrough 1  "remove-passthrough " 
 .SH NAME
-start\-cli\-net\-vhost\-remove\-passthrough \- Remove vhost passthrough
+start\-cli\-net\-vhost\-remove\-passthrough
 .SH SYNOPSIS
 \fBstart\-cli net vhost remove\-passthrough\fR <\fB\-\-hostname\fR> <\fB\-\-listen\-port\fR> [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-Remove vhost passthrough
 .SH OPTIONS
 .TP
 \fB\-\-hostname\fR \fI<HOSTNAME>\fR
--- a/core/man/start-cli/start-cli-net-vhost.1
+++ b/core/man/start-cli/start-cli-net-vhost.1
@@ -14,13 +14,9 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-net\-vhost\-add\-passthrough(1)
-Add vhost passthrough
 .TP
 start\-cli\-net\-vhost\-dump\-table(1)
-Dump vhost proxy table
 .TP
 start\-cli\-net\-vhost\-list\-passthrough(1)
-List vhost passthroughs
 .TP
 start\-cli\-net\-vhost\-remove\-passthrough(1)
-Remove vhost passthrough
--- a/core/man/start-cli/start-cli-net.1
+++ b/core/man/start-cli/start-cli-net.1
@@ -25,9 +25,6 @@ Manage port forwards
 start\-cli\-net\-gateway(1)
 View and edit gateway configurations
 .TP
-start\-cli\-net\-ssl(1)
-Manage SSL certificates
-.TP
 start\-cli\-net\-tunnel(1)
 Manage tunnels
 .TP
--- a/core/man/start-cli/start-cli-package-attach.1
+++ b/core/man/start-cli/start-cli-package-attach.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-package-attach 1  "attach " 
 .SH NAME
-start\-cli\-package\-attach \- Execute commands in container
+start\-cli\-package\-attach
 .SH SYNOPSIS
 \fBstart\-cli package attach\fR [\fB\-\-force\-tty\fR] [\fB\-s\fR|\fB\-\-subcontainer\fR] [\fB\-n\fR|\fB\-\-name\fR] [\fB\-u\fR|\fB\-\-user\fR] [\fB\-i\fR|\fB\-\-image\-id\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> [\fICOMMAND\fR] 
 .SH DESCRIPTION
-Execute commands in container
 .SH OPTIONS
 .TP
 \fB\-\-force\-tty\fR
--- a/core/man/start-cli/start-cli-package-backup-restore.1
+++ b/core/man/start-cli/start-cli-package-backup-restore.1
@@ -4,14 +4,11 @@
 .SH NAME
 start\-cli\-package\-backup\-restore \- Restore packages from backup
 .SH SYNOPSIS
-\fBstart\-cli package backup restore\fR [\fB\-\-server\-id\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fITARGET_ID\fR> <\fIPASSWORD\fR> [\fIIDS\fR] 
+\fBstart\-cli package backup restore\fR [\fB\-h\fR|\fB\-\-help\fR] <\fITARGET_ID\fR> <\fIPASSWORD\fR> [\fIIDS\fR] 
 .SH DESCRIPTION
 Restore packages from backup
 .SH OPTIONS
 .TP
-\fB\-\-server\-id\fR \fI<SERVER_ID>\fR
-Unique server identifier
-.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
--- a/core/man/start-cli/start-cli-package-host-address-domain-private.1
+++ b/core/man/start-cli/start-cli-package-host-address-domain-private.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-package-host-address-domain-private 1  "private " 
 .SH NAME
-start\-cli\-package\-host\-address\-domain\-private \- Commands for managing private domains for a host
+start\-cli\-package\-host\-address\-domain\-private
 .SH SYNOPSIS
 \fBstart\-cli package host address domain private\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing private domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-package-host-address-domain-public.1
+++ b/core/man/start-cli/start-cli-package-host-address-domain-public.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-package-host-address-domain-public 1  "public " 
 .SH NAME
-start\-cli\-package\-host\-address\-domain\-public \- Commands for managing public domains for a host
+start\-cli\-package\-host\-address\-domain\-public
 .SH SYNOPSIS
 \fBstart\-cli package host address domain public\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing public domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-package-host-address-domain.1
+++ b/core/man/start-cli/start-cli-package-host-address-domain.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-package-host-address-domain 1  "domain " 
 .SH NAME
-start\-cli\-package\-host\-address\-domain \- Commands for managing host address domains
+start\-cli\-package\-host\-address\-domain
 .SH SYNOPSIS
 \fBstart\-cli package host address domain\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing host address domains
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -14,7 +13,5 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-package\-host\-address\-domain\-private(1)
-Commands for managing private domains for a host
 .TP
 start\-cli\-package\-host\-address\-domain\-public(1)
-Commands for managing public domains for a host
--- a/core/man/start-cli/start-cli-package-host-address.1
+++ b/core/man/start-cli/start-cli-package-host-address.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-package-host-address 1  "address " 
 .SH NAME
-start\-cli\-package\-host\-address \- Commands for managing host addresses
+start\-cli\-package\-host\-address
 .SH SYNOPSIS
 \fBstart\-cli package host address\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIHOST\fR> <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing host addresses
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -17,7 +16,6 @@ Host identifier
 .SH SUBCOMMANDS
 .TP
 start\-cli\-package\-host\-address\-domain(1)
-Commands for managing host address domains
 .TP
 start\-cli\-package\-host\-address\-list(1)
 List addresses for a host
--- a/core/man/start-cli/start-cli-package-host-binding-set-address-enabled.1
+++ b/core/man/start-cli/start-cli-package-host-binding-set-address-enabled.1
@@ -2,15 +2,15 @@
 .el .ds Aq '
 .TH start-cli-package-host-binding-set-address-enabled 1  "set-address-enabled " 
 .SH NAME
-start\-cli\-package\-host\-binding\-set\-address\-enabled \- Set a gateway address enabled for a binding
+start\-cli\-package\-host\-binding\-set\-address\-enabled \- about.set\-address\-enabled\-for\-binding
 .SH SYNOPSIS
 \fBstart\-cli package host binding set\-address\-enabled\fR <\fB\-\-address\fR> [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIINTERNAL_PORT\fR> 
 .SH DESCRIPTION
-Set a gateway address enabled for a binding
+about.set\-address\-enabled\-for\-binding
 .SH OPTIONS
 .TP
 \fB\-\-address\fR \fI<ADDRESS>\fR
-Network address
+help.arg.address
 .TP
 \fB\-\-enabled\fR \fI<ENABLED>\fR
 Enable or disable this binding
--- a/core/man/start-cli/start-cli-package-host-binding.1
+++ b/core/man/start-cli/start-cli-package-host-binding.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-package-host-binding 1  "binding " 
 .SH NAME
-start\-cli\-package\-host\-binding \- Commands for managing host bindings
+start\-cli\-package\-host\-binding
 .SH SYNOPSIS
 \fBstart\-cli package host binding\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIHOST\fR> <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing host bindings
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -20,4 +19,4 @@ start\-cli\-package\-host\-binding\-list(1)
 List bindings for a host
 .TP
 start\-cli\-package\-host\-binding\-set\-address\-enabled(1)
-Set a gateway address enabled for a binding
+about.set\-address\-enabled\-for\-binding
--- a/core/man/start-cli/start-cli-package-host.1
+++ b/core/man/start-cli/start-cli-package-host.1
@@ -17,7 +17,5 @@ Package identifier
 .SH SUBCOMMANDS
 .TP
 start\-cli\-package\-host\-address(1)
-Commands for managing host addresses
 .TP
 start\-cli\-package\-host\-binding(1)
-Commands for managing host bindings
--- a/core/man/start-cli/start-cli-package-set-outbound-gateway.1
+++ b/core/man/start-cli/start-cli-package-set-outbound-gateway.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-set-outbound-gateway 1  "set-outbound-gateway " 
 .SH NAME
-start\-cli\-package\-set\-outbound\-gateway \- Set the outbound gateway for a package
+start\-cli\-package\-set\-outbound\-gateway \- about.set\-outbound\-gateway\-package
 .SH SYNOPSIS
 \fBstart\-cli package set\-outbound\-gateway\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIPACKAGE\fR> [\fIGATEWAY\fR] 
 .SH DESCRIPTION
-Set the outbound gateway for a package
+about.set\-outbound\-gateway\-package
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-package.1
+++ b/core/man/start-cli/start-cli-package.1
@@ -17,7 +17,6 @@ start\-cli\-package\-action(1)
 Commands to get action input or run an action
 .TP
 start\-cli\-package\-attach(1)
-Execute commands in container
 .TP
 start\-cli\-package\-backup(1)
 Commands for restoring package(s) from backup
@@ -47,7 +46,7 @@ start\-cli\-package\-restart(1)
 Restart a service
 .TP
 start\-cli\-package\-set\-outbound\-gateway(1)
-Set the outbound gateway for a package
+about.set\-outbound\-gateway\-package
 .TP
 start\-cli\-package\-start(1)
 Start a service
--- a/core/man/start-cli/start-cli-registry-admin-signer-remove.1
+++ b/core/man/start-cli/start-cli-registry-admin-signer-remove.1
@@ -1,16 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-admin-signer-remove 1  "remove " 
-.SH NAME
-start\-cli\-registry\-admin\-signer\-remove \- Remove signer and all their authorizations
-.SH SYNOPSIS
-\fBstart\-cli registry admin signer remove\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
-.SH DESCRIPTION
-Remove signer and all their authorizations
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-<\fIID\fR>
-Signer identifier
--- a/core/man/start-cli/start-cli-registry-admin-signer.1
+++ b/core/man/start-cli/start-cli-registry-admin-signer.1
@@ -21,6 +21,3 @@ Edit signer information
 .TP
 start\-cli\-registry\-admin\-signer\-list(1)
 List signers
-.TP
-start\-cli\-registry\-admin\-signer\-remove(1)
-Remove signer and all their authorizations
--- a/core/man/start-cli/start-cli-registry-info-set-icon.1
+++ b/core/man/start-cli/start-cli-registry-info-set-icon.1
@@ -13,4 +13,4 @@ Set the registry icon
 Print help
 .TP
 <\fIICON\fR>
-Icon source: file path, file:// URL, http(s):// URL, or data: URL
+Path to service icon file
--- a/core/man/start-cli/start-cli-registry-info.1
+++ b/core/man/start-cli/start-cli-registry-info.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-registry-info 1  "info " 
 .SH NAME
-start\-cli\-registry\-info \- View or edit registry information
+start\-cli\-registry\-info \- Display registry info
 .SH SYNOPSIS
 \fBstart\-cli registry info\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fIsubcommands\fR]
 .SH DESCRIPTION
-View or edit registry information
+Display registry info
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-registry-metrics-downloads.1
+++ b/core/man/start-cli/start-cli-registry-metrics-downloads.1
@@ -1,28 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-metrics-downloads 1  "downloads " 
-.SH NAME
-start\-cli\-registry\-metrics\-downloads \- Count package download requests with optional filters
-.SH SYNOPSIS
-\fBstart\-cli registry metrics downloads\fR [\fB\-\-pkg\-id\fR] [\fB\-\-version\fR] [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
-.SH DESCRIPTION
-Count package download requests with optional filters
-.SH OPTIONS
-.TP
-\fB\-\-pkg\-id\fR \fI<PKG_ID>\fR
-Filter by package ID
-.TP
-\fB\-\-version\fR \fI<VERSION>\fR
-Filter by version
-.TP
-\fB\-\-after\fR \fI<AFTER>\fR
-Start of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-before\fR \fI<BEFORE>\fR
-End of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
--- a/core/man/start-cli/start-cli-registry-metrics-summary.1
+++ b/core/man/start-cli/start-cli-registry-metrics-summary.1
@@ -1,16 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-metrics-summary 1  "summary " 
-.SH NAME
-start\-cli\-registry\-metrics\-summary \- Get a summary of registry usage metrics
-.SH SYNOPSIS
-\fBstart\-cli registry metrics summary\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
-.SH DESCRIPTION
-Get a summary of registry usage metrics
-.SH OPTIONS
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
--- a/core/man/start-cli/start-cli-registry-metrics-users.1
+++ b/core/man/start-cli/start-cli-registry-metrics-users.1
@@ -1,22 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-metrics-users 1  "users " 
-.SH NAME
-start\-cli\-registry\-metrics\-users \- Count unique active users within a time range
-.SH SYNOPSIS
-\fBstart\-cli registry metrics users\fR [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
-.SH DESCRIPTION
-Count unique active users within a time range
-.SH OPTIONS
-.TP
-\fB\-\-after\fR \fI<AFTER>\fR
-Start of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-before\fR \fI<BEFORE>\fR
-End of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
--- a/core/man/start-cli/start-cli-registry-metrics.1
+++ b/core/man/start-cli/start-cli-registry-metrics.1
@@ -1,23 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-metrics 1  "metrics " 
-.SH NAME
-start\-cli\-registry\-metrics \- Query registry usage metrics
-.SH SYNOPSIS
-\fBstart\-cli registry metrics\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
-.SH DESCRIPTION
-Query registry usage metrics
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.SH SUBCOMMANDS
-.TP
-start\-cli\-registry\-metrics\-downloads(1)
-Count package download requests with optional filters
-.TP
-start\-cli\-registry\-metrics\-summary(1)
-Get a summary of registry usage metrics
-.TP
-start\-cli\-registry\-metrics\-users(1)
-Count unique active users within a time range
--- a/core/man/start-cli/start-cli-registry-os-promote.1
+++ b/core/man/start-cli/start-cli-registry-os-promote.1
@@ -1,22 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-os-promote 1  "promote " 
-.SH NAME
-start\-cli\-registry\-os\-promote \- Promote an OS version from one registry to another
-.SH SYNOPSIS
-\fBstart\-cli registry os promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIVERSION\fR> 
-.SH DESCRIPTION
-Promote an OS version from one registry to another
-.SH OPTIONS
-.TP
-\fB\-\-from\fR \fI<FROM>\fR
-Source registry URL to promote from
-.TP
-\fB\-\-to\fR \fI<TO>\fR
-Destination registry URL to promote to
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-<\fIVERSION\fR>
-StartOS version number
--- a/core/man/start-cli/start-cli-registry-os.1
+++ b/core/man/start-cli/start-cli-registry-os.1
@@ -19,8 +19,5 @@ Commands to add, sign, or get registry assets
 start\-cli\-registry\-os\-index(1)
 List OS versions index
 .TP
-start\-cli\-registry\-os\-promote(1)
-Promote an OS version from one registry to another
-.TP
 start\-cli\-registry\-os\-version(1)
 Commands to add, remove, or list versions or version signers
--- a/core/man/start-cli/start-cli-registry-package-category-list.1
+++ b/core/man/start-cli/start-cli-registry-package-category-list.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-registry-package-category-list 1  "list " 
 .SH NAME
-start\-cli\-registry\-package\-category\-list \- List registry categories
+start\-cli\-registry\-package\-category\-list
 .SH SYNOPSIS
 \fBstart\-cli registry package category list\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-List registry categories
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-registry-package-category.1
+++ b/core/man/start-cli/start-cli-registry-package-category.1
@@ -20,7 +20,6 @@ start\-cli\-registry\-package\-category\-add\-package(1)
 Add a package to a category
 .TP
 start\-cli\-registry\-package\-category\-list(1)
-List registry categories
 .TP
 start\-cli\-registry\-package\-category\-remove(1)
 Remove category from registry
--- a/core/man/start-cli/start-cli-registry-package-download.1
+++ b/core/man/start-cli/start-cli-registry-package-download.1
@@ -4,7 +4,7 @@
 .SH NAME
 start\-cli\-registry\-package\-download \- Download s9pk package
 .SH SYNOPSIS
-\fBstart\-cli registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-a\fR|\fB\-\-arch\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
+\fBstart\-cli registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
 .SH DESCRIPTION
 Download s9pk package
 .SH OPTIONS
@@ -15,9 +15,6 @@ Target version range constraint
 \fB\-d\fR, \fB\-\-dest\fR \fI<DEST>\fR
 Destination path for download
 .TP
-\fB\-a\fR, \fB\-\-arch\fR \fI<ARCH>\fR
-Target CPU architecture (e.g. x86_64, aarch64)
-.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
--- a/core/man/start-cli/start-cli-registry-package-promote.1
+++ b/core/man/start-cli/start-cli-registry-package-promote.1
@@ -1,25 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-cli-registry-package-promote 1  "promote " 
-.SH NAME
-start\-cli\-registry\-package\-promote \- Promote a package from one registry to another
-.SH SYNOPSIS
-\fBstart\-cli registry package promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
-.SH DESCRIPTION
-Promote a package from one registry to another
-.SH OPTIONS
-.TP
-\fB\-\-from\fR \fI<FROM>\fR
-Source registry URL to promote from
-.TP
-\fB\-\-to\fR \fI<TO>\fR
-Destination registry URL to promote to
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-<\fIID\fR>
-Package identifier
-.TP
-<\fIVERSION\fR>
-Package version
--- a/core/man/start-cli/start-cli-registry-package-remove.1
+++ b/core/man/start-cli/start-cli-registry-package-remove.1
@@ -4,7 +4,7 @@
 .SH NAME
 start\-cli\-registry\-package\-remove \- Remove package from registry
 .SH SYNOPSIS
-\fBstart\-cli registry package remove\fR [\fB\-\-sighash\fR] [\fB\-\-force\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> [\fIVERSION\fR] 
+\fBstart\-cli registry package remove\fR [\fB\-\-sighash\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
 .SH DESCRIPTION
 Remove package from registry
 .SH OPTIONS
@@ -12,14 +12,11 @@ Remove package from registry
 \fB\-\-sighash\fR \fI<SIGHASH>\fR
 Hash for signature verification
 .TP
-\fB\-\-force\fR
-Force removal even if the package has versions
-.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
 <\fIID\fR>
 Package identifier
 .TP
-[\fIVERSION\fR]
+<\fIVERSION\fR>
 Package version
--- a/core/man/start-cli/start-cli-registry-package.1
+++ b/core/man/start-cli/start-cli-registry-package.1
@@ -31,9 +31,6 @@ List installation candidates
 start\-cli\-registry\-package\-index(1)
 List packages and categories
 .TP
-start\-cli\-registry\-package\-promote(1)
-Promote a package from one registry to another
-.TP
 start\-cli\-registry\-package\-remove(1)
 Remove package from registry
 .TP
--- a/core/man/start-cli/start-cli-registry.1
+++ b/core/man/start-cli/start-cli-registry.1
@@ -23,10 +23,7 @@ start\-cli\-registry\-index(1)
 List registry info and packages
 .TP
 start\-cli\-registry\-info(1)
-View or edit registry information
-.TP
-start\-cli\-registry\-metrics(1)
-Query registry usage metrics
+Display registry info
 .TP
 start\-cli\-registry\-os(1)
 Commands related to OS assets and versions
--- a/core/man/start-cli/start-cli-s9pk-inspect-commitment.1
+++ b/core/man/start-cli/start-cli-s9pk-inspect-commitment.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-s9pk-inspect-commitment 1  "commitment " 
 .SH NAME
-start\-cli\-s9pk\-inspect\-commitment \- Display the s9pk root signature hash and max size
+start\-cli\-s9pk\-inspect\-commitment \- about.display\-s9pk\-root\-sighash\-and\-maxsize
 .SH SYNOPSIS
 \fBstart\-cli s9pk inspect commitment\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-Display the s9pk root signature hash and max size
+about.display\-s9pk\-root\-sighash\-and\-maxsize
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-s9pk-inspect.1
+++ b/core/man/start-cli/start-cli-s9pk-inspect.1
@@ -20,7 +20,7 @@ start\-cli\-s9pk\-inspect\-cat(1)
 Display file contents from s9pk
 .TP
 start\-cli\-s9pk\-inspect\-commitment(1)
-Display the s9pk root signature hash and max size
+about.display\-s9pk\-root\-sighash\-and\-maxsize
 .TP
 start\-cli\-s9pk\-inspect\-file\-tree(1)
 Display list of paths in s9pk
--- a/core/man/start-cli/start-cli-server-device-info.1
+++ b/core/man/start-cli/start-cli-server-device-info.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-device-info 1  "device-info " 
 .SH NAME
-start\-cli\-server\-device\-info \- Display device information
+start\-cli\-server\-device\-info \- about.get\-device\-info
 .SH SYNOPSIS
 \fBstart\-cli server device\-info\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-Display device information
+about.get\-device\-info
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-cli/start-cli-server-host-address-domain-private.1
+++ b/core/man/start-cli/start-cli-server-host-address-domain-private.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-server-host-address-domain-private 1  "private " 
 .SH NAME
-start\-cli\-server\-host\-address\-domain\-private \- Commands for managing private domains for a host
+start\-cli\-server\-host\-address\-domain\-private
 .SH SYNOPSIS
 \fBstart\-cli server host address domain private\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing private domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-server-host-address-domain-public.1
+++ b/core/man/start-cli/start-cli-server-host-address-domain-public.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-server-host-address-domain-public 1  "public " 
 .SH NAME
-start\-cli\-server\-host\-address\-domain\-public \- Commands for managing public domains for a host
+start\-cli\-server\-host\-address\-domain\-public
 .SH SYNOPSIS
 \fBstart\-cli server host address domain public\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing public domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-server-host-address-domain.1
+++ b/core/man/start-cli/start-cli-server-host-address-domain.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-server-host-address-domain 1  "domain " 
 .SH NAME
-start\-cli\-server\-host\-address\-domain \- Commands for managing host address domains
+start\-cli\-server\-host\-address\-domain
 .SH SYNOPSIS
 \fBstart\-cli server host address domain\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing host address domains
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -14,7 +13,5 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-server\-host\-address\-domain\-private(1)
-Commands for managing private domains for a host
 .TP
 start\-cli\-server\-host\-address\-domain\-public(1)
-Commands for managing public domains for a host
--- a/core/man/start-cli/start-cli-server-host-address.1
+++ b/core/man/start-cli/start-cli-server-host-address.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-server-host-address 1  "address " 
 .SH NAME
-start\-cli\-server\-host\-address \- Commands for managing host addresses
+start\-cli\-server\-host\-address
 .SH SYNOPSIS
 \fBstart\-cli server host address\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing host addresses
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -14,7 +13,6 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-server\-host\-address\-domain(1)
-Commands for managing host address domains
 .TP
 start\-cli\-server\-host\-address\-list(1)
 List addresses for a host
--- a/core/man/start-cli/start-cli-server-host-binding-set-address-enabled.1
+++ b/core/man/start-cli/start-cli-server-host-binding-set-address-enabled.1
@@ -2,15 +2,15 @@
 .el .ds Aq '
 .TH start-cli-server-host-binding-set-address-enabled 1  "set-address-enabled " 
 .SH NAME
-start\-cli\-server\-host\-binding\-set\-address\-enabled \- Set a gateway address enabled for a binding
+start\-cli\-server\-host\-binding\-set\-address\-enabled \- about.set\-address\-enabled\-for\-binding
 .SH SYNOPSIS
 \fBstart\-cli server host binding set\-address\-enabled\fR <\fB\-\-address\fR> [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIINTERNAL_PORT\fR> 
 .SH DESCRIPTION
-Set a gateway address enabled for a binding
+about.set\-address\-enabled\-for\-binding
 .SH OPTIONS
 .TP
 \fB\-\-address\fR \fI<ADDRESS>\fR
-Network address
+help.arg.address
 .TP
 \fB\-\-enabled\fR \fI<ENABLED>\fR
 Enable or disable this binding
--- a/core/man/start-cli/start-cli-server-host-binding.1
+++ b/core/man/start-cli/start-cli-server-host-binding.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-server-host-binding 1  "binding " 
 .SH NAME
-start\-cli\-server\-host\-binding \- Commands for managing host bindings
+start\-cli\-server\-host\-binding
 .SH SYNOPSIS
 \fBstart\-cli server host binding\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing host bindings
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -17,4 +16,4 @@ start\-cli\-server\-host\-binding\-list(1)
 List bindings for a host
 .TP
 start\-cli\-server\-host\-binding\-set\-address\-enabled(1)
-Set a gateway address enabled for a binding
+about.set\-address\-enabled\-for\-binding
--- a/core/man/start-cli/start-cli-server-host.1
+++ b/core/man/start-cli/start-cli-server-host.1
@@ -14,7 +14,5 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-server\-host\-address(1)
-Commands for managing host addresses
 .TP
 start\-cli\-server\-host\-binding(1)
-Commands for managing host bindings
--- a/core/man/start-cli/start-cli-server.1
+++ b/core/man/start-cli/start-cli-server.1
@@ -17,7 +17,7 @@ start\-cli\-server\-clear\-smtp(1)
 Remove system smtp server and credentials
 .TP
 start\-cli\-server\-device\-info(1)
-Display device information
+about.get\-device\-info
 .TP
 start\-cli\-server\-experimental(1)
 Commands related to configuring experimental options such as zram and cpu governor
--- a/core/man/start-cli/start-cli-tunnel-auth-key.1
+++ b/core/man/start-cli/start-cli-tunnel-auth-key.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-tunnel-auth-key 1  "key " 
 .SH NAME
-start\-cli\-tunnel\-auth\-key \- Commands for managing authorized keys
+start\-cli\-tunnel\-auth\-key
 .SH SYNOPSIS
 \fBstart\-cli tunnel auth key\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing authorized keys
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-tunnel-auth.1
+++ b/core/man/start-cli/start-cli-tunnel-auth.1
@@ -17,7 +17,6 @@ start\-cli\-tunnel\-auth\-get\-pubkey(1)
 Get the public key from the server
 .TP
 start\-cli\-tunnel\-auth\-key(1)
-Commands for managing authorized keys
 .TP
 start\-cli\-tunnel\-auth\-login(1)
 Login to a new auth session
--- a/core/man/start-cli/start-cli-tunnel-port-forward-set-enabled.1
+++ b/core/man/start-cli/start-cli-tunnel-port-forward-set-enabled.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-port-forward-set-enabled 1  "set-enabled " 
 .SH NAME
-start\-cli\-tunnel\-port\-forward\-set\-enabled \- Enable or disable a port forward
+start\-cli\-tunnel\-port\-forward\-set\-enabled \- about.enable\-or\-disable\-port\-forward
 .SH SYNOPSIS
 \fBstart\-cli tunnel port\-forward set\-enabled\fR [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fISOURCE\fR> 
 .SH DESCRIPTION
-Enable or disable a port forward
+about.enable\-or\-disable\-port\-forward
 .SH OPTIONS
 .TP
 \fB\-\-enabled\fR
--- a/core/man/start-cli/start-cli-tunnel-port-forward-update-label.1
+++ b/core/man/start-cli/start-cli-tunnel-port-forward-update-label.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-port-forward-update-label 1  "update-label " 
 .SH NAME
-start\-cli\-tunnel\-port\-forward\-update\-label \- Update the label of a port forward
+start\-cli\-tunnel\-port\-forward\-update\-label \- about.update\-port\-forward\-label
 .SH SYNOPSIS
 \fBstart\-cli tunnel port\-forward update\-label\fR [\fB\-h\fR|\fB\-\-help\fR] <\fISOURCE\fR> [\fILABEL\fR] 
 .SH DESCRIPTION
-Update the label of a port forward
+about.update\-port\-forward\-label
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-tunnel-port-forward.1
+++ b/core/man/start-cli/start-cli-tunnel-port-forward.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-tunnel-port-forward 1  "port-forward " 
 .SH NAME
-start\-cli\-tunnel\-port\-forward \- Commands for managing port forwards
+start\-cli\-tunnel\-port\-forward
 .SH SYNOPSIS
 \fBstart\-cli tunnel port\-forward\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing port forwards
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -20,7 +19,7 @@ start\-cli\-tunnel\-port\-forward\-remove(1)
 Remove port forward
 .TP
 start\-cli\-tunnel\-port\-forward\-set\-enabled(1)
-Enable or disable a port forward
+about.enable\-or\-disable\-port\-forward
 .TP
 start\-cli\-tunnel\-port\-forward\-update\-label(1)
-Update the label of a port forward
+about.update\-port\-forward\-label
--- a/core/man/start-cli/start-cli-tunnel-update.1
+++ b/core/man/start-cli/start-cli-tunnel-update.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-tunnel-update 1  "update " 
 .SH NAME
-start\-cli\-tunnel\-update \- Commands for checking and applying tunnel updates
+start\-cli\-tunnel\-update
 .SH SYNOPSIS
 \fBstart\-cli tunnel update\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for checking and applying tunnel updates
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-tunnel-web.1
+++ b/core/man/start-cli/start-cli-tunnel-web.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-cli-tunnel-web 1  "web " 
 .SH NAME
-start\-cli\-tunnel\-web \- Commands for managing the tunnel web interface
+start\-cli\-tunnel\-web
 .SH SYNOPSIS
 \fBstart\-cli tunnel web\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing the tunnel web interface
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/core/man/start-cli/start-cli-tunnel.1
+++ b/core/man/start-cli/start-cli-tunnel.1
@@ -23,7 +23,6 @@ start\-cli\-tunnel\-device(1)
 Add, remove, or list devices in subnets
 .TP
 start\-cli\-tunnel\-port\-forward(1)
-Commands for managing port forwards
 .TP
 start\-cli\-tunnel\-restart(1)
 Reboot the tunnel server
@@ -32,7 +31,5 @@ start\-cli\-tunnel\-subnet(1)
 Add, remove, or modify subnets
 .TP
 start\-cli\-tunnel\-update(1)
-Commands for checking and applying tunnel updates
 .TP
 start\-cli\-tunnel\-web(1)
-Commands for managing the tunnel web interface
--- a/core/man/start-cli/start-cli.1
+++ b/core/man/start-cli/start-cli.1
@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH start-cli 1  "start-cli 0.4.0-beta.0" 
+.TH start-cli 1  "start-cli 0.4.0-alpha.21" 
 .SH NAME
 start\-cli
 .SH SYNOPSIS
@@ -117,4 +117,4 @@ Command for calculating the blake3 hash of a file
 start\-cli\-wifi(1)
 Commands related to wifi networks i.e. add, connect, delete
 .SH VERSION
-v0.4.0\-beta.0
+v0.4.0\-alpha.21
--- a/core/man/start-container/start-container-pipe-wrap.1
+++ b/core/man/start-container/start-container-pipe-wrap.1
@@ -1,15 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-container-pipe-wrap 1  "pipe-wrap " 
-.SH NAME
-start\-container\-pipe\-wrap
-.SH SYNOPSIS
-\fBstart\-container pipe\-wrap\fR [\fB\-h\fR|\fB\-\-help\fR] [\fICOMMAND\fR] 
-.SH DESCRIPTION
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-[\fICOMMAND\fR]
-Command to execute in the container
--- a/core/man/start-container/start-container.1
+++ b/core/man/start-container/start-container.1
@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH start-container 1  "start-container 0.4.0-beta.0" 
+.TH start-container 1  "start-container 0.4.0-alpha.21" 
 .SH NAME
 start\-container
 .SH SYNOPSIS
@@ -34,8 +34,6 @@ start\-container\-get\-status(1)
 .TP
 start\-container\-git\-info(1)
 .TP
-start\-container\-pipe\-wrap(1)
-.TP
 start\-container\-plugin(1)
 .TP
 start\-container\-rebuild(1)
@@ -52,4 +50,4 @@ start\-container\-shutdown(1)
 .TP
 start\-container\-subcontainer(1)
 .SH VERSION
-v0.4.0\-beta.0
+v0.4.0\-alpha.21
--- a/core/man/start-registry/start-registry-admin-signer-remove.1
+++ b/core/man/start-registry/start-registry-admin-signer-remove.1
@@ -1,16 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-admin-signer-remove 1  "remove " 
-.SH NAME
-start\-registry\-admin\-signer\-remove \- Remove signer and all their authorizations
-.SH SYNOPSIS
-\fBstart\-registry admin signer remove\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
-.SH DESCRIPTION
-Remove signer and all their authorizations
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-<\fIID\fR>
-Signer identifier
--- a/core/man/start-registry/start-registry-admin-signer.1
+++ b/core/man/start-registry/start-registry-admin-signer.1
@@ -21,6 +21,3 @@ Edit signer information
 .TP
 start\-registry\-admin\-signer\-list(1)
 List signers
-.TP
-start\-registry\-admin\-signer\-remove(1)
-Remove signer and all their authorizations
--- a/core/man/start-registry/start-registry-info-set-icon.1
+++ b/core/man/start-registry/start-registry-info-set-icon.1
@@ -13,4 +13,4 @@ Set the registry icon
 Print help
 .TP
 <\fIICON\fR>
-Icon source: file path, file:// URL, http(s):// URL, or data: URL
+Path to service icon file
--- a/core/man/start-registry/start-registry-info.1
+++ b/core/man/start-registry/start-registry-info.1
@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-registry-info 1  "info " 
 .SH NAME
-start\-registry\-info \- View or edit registry information
+start\-registry\-info \- Display registry info
 .SH SYNOPSIS
 \fBstart\-registry info\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fIsubcommands\fR]
 .SH DESCRIPTION
-View or edit registry information
+Display registry info
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-registry/start-registry-metrics-downloads.1
+++ b/core/man/start-registry/start-registry-metrics-downloads.1
@@ -1,28 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-metrics-downloads 1  "downloads " 
-.SH NAME
-start\-registry\-metrics\-downloads \- Count package download requests with optional filters
-.SH SYNOPSIS
-\fBstart\-registry metrics downloads\fR [\fB\-\-pkg\-id\fR] [\fB\-\-version\fR] [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
-.SH DESCRIPTION
-Count package download requests with optional filters
-.SH OPTIONS
-.TP
-\fB\-\-pkg\-id\fR \fI<PKG_ID>\fR
-Filter by package ID
-.TP
-\fB\-\-version\fR \fI<VERSION>\fR
-Filter by version
-.TP
-\fB\-\-after\fR \fI<AFTER>\fR
-Start of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-before\fR \fI<BEFORE>\fR
-End of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
--- a/core/man/start-registry/start-registry-metrics-summary.1
+++ b/core/man/start-registry/start-registry-metrics-summary.1
@@ -1,16 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-metrics-summary 1  "summary " 
-.SH NAME
-start\-registry\-metrics\-summary \- Get a summary of registry usage metrics
-.SH SYNOPSIS
-\fBstart\-registry metrics summary\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
-.SH DESCRIPTION
-Get a summary of registry usage metrics
-.SH OPTIONS
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
--- a/core/man/start-registry/start-registry-metrics-users.1
+++ b/core/man/start-registry/start-registry-metrics-users.1
@@ -1,22 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-metrics-users 1  "users " 
-.SH NAME
-start\-registry\-metrics\-users \- Count unique active users within a time range
-.SH SYNOPSIS
-\fBstart\-registry metrics users\fR [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
-.SH DESCRIPTION
-Count unique active users within a time range
-.SH OPTIONS
-.TP
-\fB\-\-after\fR \fI<AFTER>\fR
-Start of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-before\fR \fI<BEFORE>\fR
-End of time range (RFC 3339 timestamp)
-.TP
-\fB\-\-format\fR
-
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
--- a/core/man/start-registry/start-registry-metrics.1
+++ b/core/man/start-registry/start-registry-metrics.1
@@ -1,23 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-metrics 1  "metrics " 
-.SH NAME
-start\-registry\-metrics \- Query registry usage metrics
-.SH SYNOPSIS
-\fBstart\-registry metrics\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
-.SH DESCRIPTION
-Query registry usage metrics
-.SH OPTIONS
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.SH SUBCOMMANDS
-.TP
-start\-registry\-metrics\-downloads(1)
-Count package download requests with optional filters
-.TP
-start\-registry\-metrics\-summary(1)
-Get a summary of registry usage metrics
-.TP
-start\-registry\-metrics\-users(1)
-Count unique active users within a time range
--- a/core/man/start-registry/start-registry-os-promote.1
+++ b/core/man/start-registry/start-registry-os-promote.1
@@ -1,22 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-os-promote 1  "promote " 
-.SH NAME
-start\-registry\-os\-promote \- Promote an OS version from one registry to another
-.SH SYNOPSIS
-\fBstart\-registry os promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIVERSION\fR> 
-.SH DESCRIPTION
-Promote an OS version from one registry to another
-.SH OPTIONS
-.TP
-\fB\-\-from\fR \fI<FROM>\fR
-Source registry URL to promote from
-.TP
-\fB\-\-to\fR \fI<TO>\fR
-Destination registry URL to promote to
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-<\fIVERSION\fR>
-StartOS version number
--- a/core/man/start-registry/start-registry-os.1
+++ b/core/man/start-registry/start-registry-os.1
@@ -19,8 +19,5 @@ Commands to add, sign, or get registry assets
 start\-registry\-os\-index(1)
 List OS versions index
 .TP
-start\-registry\-os\-promote(1)
-Promote an OS version from one registry to another
-.TP
 start\-registry\-os\-version(1)
 Commands to add, remove, or list versions or version signers
--- a/core/man/start-registry/start-registry-package-category-list.1
+++ b/core/man/start-registry/start-registry-package-category-list.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-registry-package-category-list 1  "list " 
 .SH NAME
-start\-registry\-package\-category\-list \- List registry categories
+start\-registry\-package\-category\-list
 .SH SYNOPSIS
 \fBstart\-registry package category list\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-List registry categories
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
--- a/core/man/start-registry/start-registry-package-category.1
+++ b/core/man/start-registry/start-registry-package-category.1
@@ -20,7 +20,6 @@ start\-registry\-package\-category\-add\-package(1)
 Add a package to a category
 .TP
 start\-registry\-package\-category\-list(1)
-List registry categories
 .TP
 start\-registry\-package\-category\-remove(1)
 Remove category from registry
--- a/core/man/start-registry/start-registry-package-download.1
+++ b/core/man/start-registry/start-registry-package-download.1
@@ -4,7 +4,7 @@
 .SH NAME
 start\-registry\-package\-download \- Download s9pk package
 .SH SYNOPSIS
-\fBstart\-registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-a\fR|\fB\-\-arch\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
+\fBstart\-registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
 .SH DESCRIPTION
 Download s9pk package
 .SH OPTIONS
@@ -15,9 +15,6 @@ Target version range constraint
 \fB\-d\fR, \fB\-\-dest\fR \fI<DEST>\fR
 Destination path for download
 .TP
-\fB\-a\fR, \fB\-\-arch\fR \fI<ARCH>\fR
-Target CPU architecture (e.g. x86_64, aarch64)
-.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
--- a/core/man/start-registry/start-registry-package-promote.1
+++ b/core/man/start-registry/start-registry-package-promote.1
@@ -1,25 +0,0 @@
-.ie \n(.g .ds Aq \(aq
-.el .ds Aq '
-.TH start-registry-package-promote 1  "promote " 
-.SH NAME
-start\-registry\-package\-promote \- Promote a package from one registry to another
-.SH SYNOPSIS
-\fBstart\-registry package promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
-.SH DESCRIPTION
-Promote a package from one registry to another
-.SH OPTIONS
-.TP
-\fB\-\-from\fR \fI<FROM>\fR
-Source registry URL to promote from
-.TP
-\fB\-\-to\fR \fI<TO>\fR
-Destination registry URL to promote to
-.TP
-\fB\-h\fR, \fB\-\-help\fR
-Print help
-.TP
-<\fIID\fR>
-Package identifier
-.TP
-<\fIVERSION\fR>
-Package version
--- a/core/man/start-registry/start-registry-package-remove.1
+++ b/core/man/start-registry/start-registry-package-remove.1
@@ -4,7 +4,7 @@
 .SH NAME
 start\-registry\-package\-remove \- Remove package from registry
 .SH SYNOPSIS
-\fBstart\-registry package remove\fR [\fB\-\-sighash\fR] [\fB\-\-force\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> [\fIVERSION\fR] 
+\fBstart\-registry package remove\fR [\fB\-\-sighash\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
 .SH DESCRIPTION
 Remove package from registry
 .SH OPTIONS
@@ -12,14 +12,11 @@ Remove package from registry
 \fB\-\-sighash\fR \fI<SIGHASH>\fR
 Hash for signature verification
 .TP
-\fB\-\-force\fR
-Force removal even if the package has versions
-.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
 <\fIID\fR>
 Package identifier
 .TP
-[\fIVERSION\fR]
+<\fIVERSION\fR>
 Package version
--- a/core/man/start-registry/start-registry-package.1
+++ b/core/man/start-registry/start-registry-package.1
@@ -31,9 +31,6 @@ List installation candidates
 start\-registry\-package\-index(1)
 List packages and categories
 .TP
-start\-registry\-package\-promote(1)
-Promote a package from one registry to another
-.TP
 start\-registry\-package\-remove(1)
 Remove package from registry
 .TP
--- a/core/man/start-registry/start-registry.1
+++ b/core/man/start-registry/start-registry.1
@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH start-registry 1  "start-registry 0.4.0-beta.0" 
+.TH start-registry 1  "start-registry 0.4.0-alpha.21" 
 .SH NAME
 start\-registry
 .SH SYNOPSIS
@@ -55,10 +55,7 @@ start\-registry\-index(1)
 List registry info and packages
 .TP
 start\-registry\-info(1)
-View or edit registry information
-.TP
-start\-registry\-metrics(1)
-Query registry usage metrics
+Display registry info
 .TP
 start\-registry\-os(1)
 Commands related to OS assets and versions
@@ -66,4 +63,4 @@ Commands related to OS assets and versions
 start\-registry\-package(1)
 Commands to index, add, or get packages
 .SH VERSION
-v0.4.0\-beta.0
+v0.4.0\-alpha.21
--- a/core/man/start-tunnel/start-tunnel-auth-key.1
+++ b/core/man/start-tunnel/start-tunnel-auth-key.1
@@ -2,11 +2,10 @@
 .el .ds Aq '
 .TH start-tunnel-auth-key 1  "key " 
 .SH NAME
-start\-tunnel\-auth\-key \- Commands for managing authorized keys
+start\-tunnel\-auth\-key
 .SH SYNOPSIS
 \fBstart\-tunnel auth key\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
-Commands for managing authorized keys
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Matt Hill	ca6a17eaad	Merge branch 'next/major' of github.com:Start9Labs/start-os into mcp	2026-03-23 10:52:43 -06:00
Matt Hill	f6db176f6d	sideload-by-url	2026-03-17 19:17:49 -06:00
Matt Hill	d8f8759dea	docs: document excluded RPC methods + remove system.shell from MCP Add comprehensive excluded methods section to MCP ARCHITECTURE.md categorizing all 105 excluded RPC methods by reason (wrong context, CLI tooling, registry admin, tunnel mgmt, security, etc.). Remove system.shell tool — host-level shell access is too broad a privilege for MCP agents. Agents can still exec into package subcontainers via package.shell. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 17:13:04 -06:00
Matt Hill	a9b0b43005	Merge branch 'next/major' of github.com:Start9Labs/start-os into mcp	2026-03-17 15:51:59 -06:00
Matt Hill	2b70b67824	MCP MVP	2026-03-15 23:35:32 -06:00