gather-info: implement CX feedback phases 1-4

Phase 1 — Services bug fix + transfer commands:
- Batch D-Bus service status via ListUnitsByNamesContext (one call, existence-gated)
- Distro-aware service name resolution (sshd→ssh on Debian)
- Fabricmanager false-positive handling (tri-state NVSwitch detection)
- OpenStack floating IP detection via metadata service
- SCP transfer commands with default-route annotation (netlink.RouteGet)

Phase 2 — Severity expansion + collection modes:
- Sentinel SeverityUnspecified=0, SeverityInfo=1, explicit integer values
- Hidden field on Issue for SUMMARY.txt visibility control
- JSON-consistent severity serialization (MarshalJSON/UnmarshalJSON)
- Collection modes: --mode=safe|quick|standard|deep with CLI flag override
- DCGM level-2 diag gated behind --enable-active-gpu-diag

Phase 3-4 — Triage analysis + output:
- Xid classifier with 24-code NVIDIA catalog, Xid 154 dynamic severity
- Firewall posture detection (iptables/ufw/nftables/firewalld)
- Critical log extraction with hidden low-confidence findings
- Triage output in triage/ (human) + triage/_data/ (JSON)
- Synthetic triage collector result in manifest/report

UI + branding:
- Rebrand NexGenCloud → Hyperstack (magenta/light-magenta)
- Dynamic SystemInfo box widths, rounded Unicode borders
- Unified transfer box with live spinner feedback
- Schema version bump 1.0.0 → 1.1.0

Author: Banshee1221

customers/vm-troubleshooting/.gitignore

@@ -1 +1,2 @@
 bin/
+gather-info

customers/vm-troubleshooting/CODEMAP.md

@@ -91,6 +91,18 @@ Keep this file updated in the same change as architecture or collector changes.
 - Does NOT use `apt-key` or `add-apt-repository` (conflicts with cuda-keyring).
 - Must remain explicit, interactive, and non-fatal to the overall diagnostics run.
 
+### `internal/transfer/`
+- Owns SCP/transfer command generation for the diagnostic archive.
+- Discovers IPs via `net.Interfaces()`, detects default route via `netlink.RouteGet`, detects SSH username via `SUDO_USER`/`os/user`.
+- Template-first output: editable placeholders always first, discovered IPs as hints with default-route annotation (★).
+- `transfer_commands.txt` saved in archive; rendered in styled Unicode boxes on terminal.
+
+### `internal/triage/`
+- Owns post-collection analysis: Xid classification, firewall posture detection, critical log extraction.
+- Runs after collectors, before summary/manifest generation. Findings injected as a synthetic "triage" collector result.
+- Output: `triage/*.txt` (human) + `triage/_data/*.json` (machine). Hidden findings omitted from SUMMARY.txt but present in manifest/report.
+- Xid catalog: 24 datacenter-relevant codes from NVIDIA r590, with Xid 154 dynamic severity from recovery action text.
+
 ### `internal/collector/`
 - Owns domain collectors and shared collector helpers.
 - Keep collectors narrow and artifact-oriented.
@@ -101,10 +113,10 @@ Keep this file updated in the same change as architecture or collector changes.
 |---|---|---|---|
 | `SystemCollector` | `system/`, `hardware/`, `processes/` | Mixed | Native summary + command artifacts for support familiarity |
 | `NetworkCollector` | `network/` | Mixed | Native link/route/neigh probes plus network stack command/config artifacts |
-| `NvidiaCollector` | `nvidia/` | No | `nvidia-smi`, `dmesg`, `systemctl` |
+| `NvidiaCollector` | `nvidia/` | No | `nvidia-smi`, `dmesg`, `systemctl`; sets `nvswitch_present` fact from lspci |
 | `DcgmCollector` | `dcgm/` | No | `dcgmi` discovery, health, stats, and level 2 diag (1-min cap) |
 | `DockerCollector` | `docker/` | Mostly shell | Docker CLI plus Go sanitization |
-| `ServicesCollector` | `services/` | Mixed | `go-systemd` facts plus `systemctl status` artifacts |
+| `ServicesCollector` | `services/` | Mixed | Batch D-Bus resolution (`ListUnitsByNamesContext`), distro-aware SSH name (`sshd`→`ssh` on Debian), existence-gated per-service artifacts, fabricmanager false-positive handling (tri-state NVSwitch detection) |
 | `JournalCollector` | `logs/` | No | `journalctl`/`dmesg` are authoritative |
 | `PackagesCollector` | `packages/` | No | Package managers remain distro authority |
 | `AdditionalCollector` | `system/`, `hardware/` | Mixed | Limits, sysctl, LVM, sensors, mounts |

customers/vm-troubleshooting/internal/cli/root.go

@@ -2,7 +2,6 @@ package cli
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
@@ -12,27 +11,34 @@ import (
 	"github.com/NexGenCloud/vm-diagnostics/internal/runner"
 	"github.com/NexGenCloud/vm-diagnostics/internal/ui"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 )
 
 func NewRootCmd() *cobra.Command {
 	cfg := &config.Config{OutputDir: "/tmp", JournalSince: "boot"}
 	cmd := &cobra.Command{
 		Use:           "gather-info",
-		Short:         "Collect VM diagnostics for NexGenCloud support",
+		Short:         "Collect VM diagnostics for Hyperstack support",
 		Version:       config.Version,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		RunE: func(cmd *cobra.Command, _ []string) error {
+			// Collect explicitly-set flags before applying mode
+			explicit := make(map[string]bool)
+			cmd.Flags().Visit(func(f *pflag.Flag) {
+				explicit[f.Name] = true
+			})
+			if err := cfg.ApplyMode(explicit); err != nil {
+				return err
+			}
+
 			uiImpl := ui.New(cfg.Verbosity, cfg.NonInteractive)
 
-			// First signal: cancel context (graceful shutdown).
-			// After the first signal, stop() resets signal handling to default
-			// so a second Ctrl+C immediately kills the process.
 			ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-			uiImpl.SetDone(ctx.Done()) // unblocks interactive prompts on Ctrl+C
+			uiImpl.SetDone(ctx.Done())
 			go func() {
 				<-ctx.Done()
-				stop() // reset to default: next signal = immediate kill
+				stop()
 				uiImpl.Warn("Interrupted. Cleaning up... (press Ctrl+C again to force quit)")
 			}()
 
@@ -45,7 +51,6 @@ func NewRootCmd() *cobra.Command {
 				}
 				return exitError{code: config.ExitFatal, err: err}
 			}
-			fmt.Fprintln(os.Stdout, res.ArchivePath)
 			if res.ExitCode != config.ExitSuccess {
 				return exitError{code: res.ExitCode}
 			}
@@ -55,11 +60,13 @@ func NewRootCmd() *cobra.Command {
 	flags := cmd.Flags()
 	flags.StringVarP(&cfg.OutputDir, "output-dir", "o", cfg.OutputDir, "Output directory for the archive")
 	flags.StringVarP(&cfg.JournalSince, "journal-since", "j", cfg.JournalSince, "Collect journal logs since TIMESPEC")
+	flags.StringVarP(&cfg.Mode, "mode", "m", "", "Collection mode: safe, quick, standard, deep")
 	flags.BoolVar(&cfg.SkipNvidia, "skip-nvidia", false, "Skip NVIDIA diagnostics")
 	flags.BoolVar(&cfg.SkipDocker, "skip-docker", false, "Skip Docker diagnostics")
 	flags.BoolVar(&cfg.SkipDCGM, "skip-dcgm", false, "Skip DCGM diagnostics")
 	flags.BoolVar(&cfg.SkipJournal, "skip-journal", false, "Skip journal collection")
 	flags.BoolVar(&cfg.SkipServices, "skip-services", false, "Skip service collection")
+	flags.BoolVar(&cfg.SkipPackages, "skip-packages", false, "Skip package collection")
 	flags.BoolVar(&cfg.IncludeFullJournal, "include-full-journal", false, "Include full journal dump")
 	flags.BoolVar(&cfg.IncludeContainerLogs, "include-container-logs", false, "Include container logs")
 	flags.BoolVar(&cfg.EnableActiveGPUDiag, "enable-active-gpu-diag", false, "Enable active DCGM GPU diagnostics")

customers/vm-troubleshooting/internal/cli/root_test.go

@@ -21,7 +21,7 @@ func TestRootCmdHelpIncludesCoreFlags(t *testing.T) {
 		t.Fatalf("help failed: %v", err)
 	}
 	help := stdout.String()
-	for _, flag := range []string{"--output-dir", "--journal-since", "--skip-nvidia", "--skip-docker", "--skip-dcgm", "--skip-journal", "--skip-services", "--include-full-journal", "--include-container-logs", "--enable-active-gpu-diag", "--non-interactive", "--verbose"} {
+	for _, flag := range []string{"--output-dir", "--journal-since", "--mode", "--skip-nvidia", "--skip-docker", "--skip-dcgm", "--skip-journal", "--skip-services", "--skip-packages", "--include-full-journal", "--include-container-logs", "--enable-active-gpu-diag", "--non-interactive", "--verbose"} {
 		if !strings.Contains(help, flag) {
 			t.Fatalf("help missing %s\n%s", flag, help)
 		}

customers/vm-troubleshooting/internal/collector/collector.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"sort"
+	"strings"
 	"time"
 
 	"github.com/NexGenCloud/vm-diagnostics/internal/ui"
@@ -43,7 +44,7 @@ var ValidTags = map[string]bool{
 	"docker": true, "docker-security": true,
 	"services": true, "journal": true, "oom": true,
 	"packages": true, "storage": true, "infiniband": true,
-	"processes": true, "config": true,
+	"processes": true, "config": true, "triage": true,
 }
 
 // ValidParserHints is the controlled vocabulary for parser hints.
@@ -172,13 +173,16 @@ type Issue struct {
 	Severity Severity
 	Category string
 	Message  string
+	Hidden   bool // default false = shown in SUMMARY.txt
 }
 
 type Severity int
 
 const (
-	SeverityWarning Severity = iota
-	SeverityCritical
+	SeverityUnspecified Severity = 0 // sentinel — catches uninitialized Issue{}
+	SeverityInfo        Severity = 1
+	SeverityWarning     Severity = 2
+	SeverityCritical    Severity = 3
 )
 
 type Registry struct{ collectors []Collector }
@@ -239,12 +243,52 @@ func (r *Registry) RunAll(ctx context.Context, skip map[string]bool, u ui.UI) ([
 	return results, nil
 }
 
-// SeverityString returns the string representation of a severity level.
-func SeverityString(s Severity) string {
+// String returns the string representation of a severity level.
+func (s Severity) String() string {
 	switch s {
+	case SeverityInfo:
+		return "info"
+	case SeverityWarning:
+		return "warning"
 	case SeverityCritical:
 		return "critical"
 	default:
-		return "warning"
+		return "unspecified"
+	}
+}
+
+// ParseSeverity converts a string to Severity. Returns error on unknown input.
+func ParseSeverity(s string) (Severity, error) {
+	switch s {
+	case "info":
+		return SeverityInfo, nil
+	case "warning":
+		return SeverityWarning, nil
+	case "critical":
+		return SeverityCritical, nil
+	default:
+		return SeverityUnspecified, fmt.Errorf("unknown severity %q", s)
 	}
 }
+
+// MarshalJSON serializes Severity as a JSON string (e.g. "info", "warning", "critical").
+// This ensures consistent serialization across all JSON outputs (manifest, report, triage).
+func (s Severity) MarshalJSON() ([]byte, error) {
+	return []byte(`"` + s.String() + `"`), nil
+}
+
+// UnmarshalJSON deserializes a JSON string to Severity.
+func (s *Severity) UnmarshalJSON(data []byte) error {
+	str := strings.Trim(string(data), `"`)
+	parsed, err := ParseSeverity(str)
+	if err != nil {
+		return err
+	}
+	*s = parsed
+	return nil
+}
+
+// Valid reports whether the severity is a known non-sentinel value.
+func (s Severity) Valid() bool {
+	return s >= SeverityInfo && s <= SeverityCritical
+}