[Charlie-Root]

Summary

Makes sm-cli usable as an operations tool on top of NetBox: it can resolve BMC address and credentials from NetBox, read diagnostics, work on many hosts in parallel, and guards changes. Existing command syntax and inventory.yaml keep working.

Changes

Host sources

• --source netbox (or SMCLI_SOURCE=netbox): device → oob_ip → assigned interface → custom fields ipmi_username / ipmi_password, using NETBOX_URL / NETBOX_TOKEN. Credentials only in memory.
• Selection by name, or --rack, --site, --tag, --role (paginated).
• --inventory <file|-> for the file source.

New read-only commands

• power status, info (model, serial, BIOS/BMC firmware, power, health), sensors [--problems] (Thermal + Power), sel [--since] [--limit] [--manager] (event log, newest first, follows paging).

Runner

• Every command accepts multiple hosts; --parallel (default 5); one result per host; -o json; exit code 1 if any host failed; summary on stderr.
• --timeout per request (default 15s) — previously none, a dead BMC could hang.

Safety

• --dry-run for all changing commands (only discovery GETs are sent).
• Changing more than one host requires --yes.
• -v logs requests to stderr with password fields masked; user <name> - <host> reads the password from stdin.
• Request bodies are built with json.Marshal instead of string formatting.
• New power shutdown (GracefulShutdown).

Fixes

• -v never worked: SetVerbose was called before flags were parsed.
• acl was registered twice (in main.go and cmd/acl.go).
• Global CurrentHost / RedfishPath state replaced by a per-host host.Client (needed for parallel runs).
• Redfish errors now fail the command (non-zero exit) instead of only being printed.

Other

• Unit tests (fake BMC and NetBox via httptest) and a Test workflow (gofmt, vet, go test -race) on PRs and main.
• README rewritten for the new features.

Testing

• go vet, gofmt, go test -race ./... pass.
• Read-only against real hardware via NetBox: power status, info, sensors, sel on cpu-r5-10; power status --rack C.W15 --role server → 37 ok.
• Write paths verified only with --dry-run (no request sent) and the --yes guard; no power/boot/media/user/acl change was made on real hardware.

Notes

• Virtual media and ACL paths are unchanged (Managers/1/...), as before.
• After merge, a new tag (e.g. 1.1.0) triggers the existing release workflow.