@daemonitor/plugins 1.0.3 → 1.1.1

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -0,0 +1,212 @@
+import { stat, open } from "node:fs/promises";
+import * as path from "node:path";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// Cap a single tail read so a rotated-in giant file (or fromStart on a large
+// log) can't blow up memory — read at most the last MAX_READ bytes.
+const MAX_READ = 5 * 1024 * 1024;
+// Field-position TOLERANT parsing. Log layouts vary a lot across these hosts:
+//   • standard combined:   `1.2.3.4 - - [t] "GET / HTTP/1.1" 200 ...`
+//   • vhost-first:          `example.com - 1.2.3.4 - - [t] "GET / HTTP/1.1" 200`
+//   • CF combined_with_host: `host - <edge_ip> - <cf_connecting_ip> - - [t] "GET .." "200"`
+// So neither the IP column NOR the status quoting is fixed. We therefore:
+//   1. pull the request + status from the quoted "$request" run (status may be
+//      bare or quoted → allow an optional leading quote), and
+//   2. take the LAST IP token BEFORE the `[timestamp]` as the client. That is
+//      the real requester in every layout here: when Cloudflare's
+//      $http_cf_connecting_ip is present it is logged AFTER $remote_addr (the CF
+//      edge), so "last IP" is the visitor, not the edge; when it's absent there
+//      is a single IP ($remote_addr) and "last" == "only".
+const REQ = /"([A-Z]+)\s+([^ "]+)[^"]*"\s+"?(\d{3})/;
+const IP_TOKEN = /^(?:(?:\d{1,3}\.){3}\d{1,3}|(?:[0-9a-fA-F]{0,4}:){2,}[0-9a-fA-F]{0,4})$/;
+function parseLine(line) {
+    const rq = REQ.exec(line);
+    if (!rq)
+        return null;
+    const br = line.indexOf("[");
+    const pre = br > 0 ? line.slice(0, br) : line;
+    const tokens = pre.split(/\s+/);
+    const ips = tokens.filter((t) => IP_TOKEN.test(t));
+    const ip = ips.length ? ips[ips.length - 1] : (tokens.find(Boolean) || "");
+    return { ip, method: rq[1], path: rq[2], status: Number(rq[3]), ua: "" };
+}
+const SUSPICIOUS_QUERY = /(?:^|[?&])(c|k|cmd|exec|e|q|f|file|dir|download|0|1|a)=/i;
+const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
+const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
+const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
+const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
+// Read new bytes since last offset, advancing state. Handles rotation (file
+// shrank → restart at 0) and partial trailing lines (buffered in remainder).
+async function readNew(source, st) {
+    let size;
+    try {
+        size = (await stat(source.path)).size;
+    }
+    catch {
+        return []; // file missing this cycle; try again next tick
+    }
+    if (!st.inited) {
+        st.offset = source.fromStart ? 0 : size;
+        st.remainder = "";
+        st.inited = true;
+    }
+    if (size < st.offset) {
+        // Truncated or rotated in place.
+        st.offset = 0;
+        st.remainder = "";
+    }
+    if (size <= st.offset)
+        return []; // nothing new
+    let start = st.offset;
+    if (size - start > MAX_READ)
+        start = size - MAX_READ; // bound the read
+    const len = size - start;
+    const buf = Buffer.allocUnsafe(len);
+    const fh = await open(source.path, "r");
+    try {
+        await fh.read(buf, 0, len, start);
+    }
+    finally {
+        await fh.close();
+    }
+    st.offset = size;
+    const text = st.remainder + buf.toString("utf8");
+    const lines = text.split("\n");
+    st.remainder = lines.pop() ?? ""; // last element is a partial line (no newline)
+    return lines;
+}
+function analyze(lines, cfg, windowSec) {
+    const burstThreshold = cfg.xmlrpcBurstThreshold ?? 20;
+    const batchIps = new Map(); // ip → count of batch/v1 → 207
+    const loginOkIps = new Set(); // ip with POST wp-login → 302
+    const xmlrpcByIp = new Map(); // ip → POST xmlrpc count
+    const webshell = new Map(); // pathNoQuery → sample
+    let total = 0;
+    for (const line of lines) {
+        const e = parseLine(line);
+        if (!e)
+            continue;
+        total++;
+        const qIdx = e.path.indexOf("?");
+        const pathNoQuery = qIdx === -1 ? e.path : e.path.slice(0, qIdx);
+        const query = qIdx === -1 ? "" : e.path.slice(qIdx + 1);
+        if ((BATCH_PATH.test(e.path) || pathNoQuery === "/wp-json/batch/v1") && e.status === 207) {
+            batchIps.set(e.ip, (batchIps.get(e.ip) || 0) + 1);
+        }
+        if (pathNoQuery === "/wp-login.php" && e.method === "POST" && e.status === 302) {
+            loginOkIps.add(e.ip);
+        }
+        if (pathNoQuery === "/xmlrpc.php" && e.method === "POST") {
+            xmlrpcByIp.set(e.ip, (xmlrpcByIp.get(e.ip) || 0) + 1);
+        }
+        // A .php under uploads is never legitimate; under a plugin dir it's only
+        // suspicious with a command-style or base64 query (webshell invocation).
+        // BUT only a SUCCESSFUL (2xx) response means the PHP actually executed —
+        // every WP site is probed constantly for my.php / academy.php / etc., and
+        // those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
+        // is pure noise; alert only when the shell actually RAN.
+        const executed = e.status >= 200 && e.status < 300;
+        const isUploadsPhp = UPLOADS_PHP.test(pathNoQuery);
+        const isPluginShell = PLUGIN_PHP.test(pathNoQuery) && (SUSPICIOUS_QUERY.test(query) || BASE64_BLOB.test(query));
+        if ((isUploadsPhp || isPluginShell) && executed) {
+            const cur = webshell.get(pathNoQuery) || { ip: e.ip, count: 0 };
+            cur.count++;
+            webshell.set(pathNoQuery, cur);
+        }
+    }
+    const findings = [];
+    // Correlation is the highest-signal event — flag it before the standalone
+    // batch/v1 finding so it leads.
+    for (const [ip, count] of batchIps) {
+        if (loginOkIps.has(ip)) {
+            findings.push({
+                rule: "batch-then-login", key: `batch-login:${ip}`, severity: "error", ip,
+                path: "/wp-json/batch/v1",
+                title: "WP2Shell: exploit + admin login",
+                detail: `${ip}: batch/v1 exploit (${count}×) followed by a successful wp-login (HTTP 302) — likely account takeover`,
+            });
+        }
+        else {
+            findings.push({
+                rule: "wp-batch-207", key: `batchv1:${ip}`, severity: "error", ip,
+                path: "/wp-json/batch/v1",
+                title: "WP2Shell batch/v1 exploit",
+                detail: `${ip}: POST /wp-json/batch/v1 → 207 (${count}×) — near-zero false positives`,
+            });
+        }
+    }
+    for (const [p, v] of webshell) {
+        findings.push({
+            rule: "webshell-exec", key: `webshell:${p}`, severity: "error", ip: v.ip, path: p,
+            title: "Webshell execution",
+            detail: `${v.ip} invoked ${p} (${v.count}×) — executable PHP in an upload/plugin path`,
+        });
+    }
+    for (const [ip, count] of xmlrpcByIp) {
+        if (count >= burstThreshold) {
+            findings.push({
+                rule: "xmlrpc-burst", key: `xmlrpc:${ip}`, severity: count >= burstThreshold * 5 ? "error" : "warning", ip,
+                path: "/xmlrpc.php",
+                title: "xmlrpc.php brute-force / amplification",
+                detail: `${ip}: ${count} POST /xmlrpc.php in ~${windowSec}s (threshold ${burstThreshold})`,
+            });
+        }
+    }
+    const counts = {
+        total,
+        batchV1: [...batchIps.values()].reduce((a, b) => a + b, 0),
+        xmlrpcPosts: [...xmlrpcByIp.values()].reduce((a, b) => a + b, 0),
+        webshellHits: [...webshell.values()].reduce((a, b) => a + b.count, 0),
+        loginSuccess: loginOkIps.size,
+    };
+    return { findings, counts };
+}
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+export function createLogWatchPlugin() {
+    let refreshTimer = null;
+    const states = new Map();
+    const sourcesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        if (Array.isArray(cfg.sources) && cfg.sources.length)
+            return cfg.sources;
+        if (cfg.path)
+            return [{ name: cfg.name, path: cfg.path, fromStart: cfg.fromStart }];
+        return [];
+    };
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const windowSec = Math.round((cfg.refreshInterval || 60000) / 1000);
+        for (const source of sourcesOf(plugin)) {
+            if (!source?.path)
+                continue;
+            const label = source.name || path.basename(source.path);
+            const uid = `log-${slug(source.name || source.path)}`;
+            let st = states.get(source.path);
+            if (!st) {
+                st = { offset: 0, remainder: "", inited: false };
+                states.set(source.path, st);
+            }
+            try {
+                const lines = await readNew(source, st);
+                const { findings, counts } = analyze(lines, cfg, windowSec);
+                await plugin.send({ name: label, source: label, path: source.path, window: windowSec, counts, findings }, uid);
+            }
+            catch (e) {
+                await plugin.send({ name: label, source: label, path: source.path, error: String(e?.message || e).slice(0, 160), findings: [] }, uid);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+        states.clear();
+    };
+    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createLogWatchPlugin;

package/dist/plugins/monitoring/LxcPlugin.js

@@ -0,0 +1,126 @@
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+import { exec } from "child_process";
+import { promisify } from "util";
+import { hostname } from "os";
+const execAsync = promisify(exec);
+const EXEC_OPTS = { maxBuffer: 32 * 1024 * 1024 };
+/** Parse LXD memory-limit strings like "1GB", "512MiB", "2GiB" to bytes. */
+function limitToBytes(value) {
+    if (!value)
+        return 0;
+    const unit = String(value).replace(/[0-9.\s]/g, "").toUpperCase();
+    const num = parseFloat(String(value).replace(/[^0-9.]/g, "")) || 0;
+    const mult = {
+        "": 1, B: 1, KB: 1e3, KIB: 1024, MB: 1e6, MIB: 1024 ** 2,
+        GB: 1e9, GIB: 1024 ** 3, TB: 1e12, TIB: 1024 ** 4,
+    };
+    return Math.round(num * (mult[unit] ?? 1));
+}
+export function createLxcPlugin() {
+    let refreshTimer = null;
+    let available = false;
+    let lxcBin = "lxc";
+    // cumulative CPU usage (ns) + wall clock (ms) per instance, for %-of-core calc
+    const prevCpu = new Map();
+    const setupFn = async (plugin) => {
+        lxcBin = plugin.config?.lxcBin || plugin.config?.bin || "lxc";
+        try {
+            await execAsync(`${lxcBin} version`, EXEC_OPTS);
+            available = true;
+        }
+        catch (err) {
+            available = false;
+            console.error(`lxc: "${lxcBin}" not available — plugin idle:`, err.message);
+        }
+    };
+    const refreshFn = async (plugin) => {
+        if (!available)
+            return;
+        try {
+            const { stdout } = await execAsync(`${lxcBin} list --format json`, EXEC_OPTS);
+            const instances = JSON.parse(stdout || "[]");
+            const only = plugin.config?.instances || [];
+            const exclude = plugin.config?.exclude || [];
+            const host = hostname();
+            const now = Date.now();
+            const groups = new Map();
+            for (const inst of instances) {
+                const name = inst.name;
+                if (!name)
+                    continue;
+                if (only.length && !only.includes(name))
+                    continue;
+                if (exclude.includes(name))
+                    continue;
+                const running = String(inst.status || "").toLowerCase() === "running";
+                const st = inst.state || {};
+                // CPU %: delta of cumulative usage(ns) over wall time -> % of one core
+                const usage = Number(st.cpu?.usage) || 0;
+                let cpu = 0;
+                const p = prevCpu.get(name);
+                if (running && p && now > p.t) {
+                    const dUsage = usage - p.usage;
+                    const dWallNs = (now - p.t) * 1e6;
+                    if (dWallNs > 0 && dUsage >= 0)
+                        cpu = Math.round((dUsage / dWallNs) * 1000) / 10;
+                }
+                prevCpu.set(name, { usage, t: now });
+                const mem = Number(st.memory?.usage) || 0;
+                const memLimit = limitToBytes(inst.config?.["limits.memory"] || inst.expanded_config?.["limits.memory"]);
+                const memPercent = memLimit ? Math.round((mem / memLimit) * 1000) / 10 : 0;
+                const container = {
+                    id: name,
+                    name,
+                    service: "",
+                    image: inst.config?.["image.description"] || inst.type || "lxc",
+                    state: String(inst.status || "").toLowerCase(),
+                    status: inst.status || "",
+                    running,
+                    health: "",
+                    cpu,
+                    mem,
+                    memLimit,
+                    memPercent,
+                    restarts: 0,
+                    exitCode: 0,
+                };
+                // Grouping: a user.daemonitor.group config key, else the host.
+                const group = inst.config?.["user.daemonitor.group"] ||
+                    inst.expanded_config?.["user.daemonitor.group"] || host;
+                const arr = groups.get(group) || [];
+                arr.push(container);
+                groups.set(group, arr);
+            }
+            for (const [project, containers] of groups) {
+                const running = containers.filter((c) => c.running).length;
+                const payload = {
+                    name: project,
+                    engine: "lxc",
+                    host,
+                    project,
+                    running,
+                    total: containers.length,
+                    containers,
+                    timestamp: now,
+                };
+                await plugin.send(payload, `lxc-${project}`);
+            }
+        }
+        catch (err) {
+            console.error("lxc: refresh error:", err.message);
+        }
+    };
+    const monitorFn = async (plugin) => {
+        if (!available)
+            return;
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("lxc", "lxc", "LXC / LXD / Incus container monitoring plugin", setupFn, monitorFn, refreshFn, teardownFn);
+}
+export default createLxcPlugin;

package/dist/plugins/monitoring/NetScanPlugin.js

@@ -0,0 +1,77 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// LAN device reachability monitor. Pings a configured list of devices (the
+// office infrastructure — switch, printers, APs, extenders, PBX, router, NAS,
+// phones — plus any hosts worth watching) and reports up/down + latency for
+// each. No credentials needed: pure ICMP. Richer per-device metrics (printer
+// toner/pages, switch ports) come from the companion SNMP plugin.
+//
+// One client_state per device (type "netdevice", uid net-<slug>), so each shows
+// as its own service and can be grouped (e.g. under "New York Office").
+const pexec = promisify(execFile);
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+// Ping via the system `ping` (works unprivileged in a host-network container).
+// Returns reachability + average RTT in ms. Never throws — an unreachable host
+// exits non-zero, which we read as down.
+async function pingHost(ip, count, timeout) {
+    try {
+        const { stdout } = await pexec("ping", ["-c", String(count), "-W", String(timeout), ip], {
+            timeout: (timeout * count + 2) * 1000,
+        });
+        // "rtt min/avg/max/mdev = 0.3/0.5/0.7/0.1 ms" (iputils) or a single "time=x ms"
+        const avg = stdout.match(/=\s*[\d.]+\/([\d.]+)\//);
+        const single = stdout.match(/time[=<]\s*([\d.]+)/);
+        const lossM = stdout.match(/([\d.]+)%\s*packet loss/);
+        const latency = avg ? parseFloat(avg[1]) : single ? parseFloat(single[1]) : undefined;
+        const loss = lossM ? parseFloat(lossM[1]) : undefined;
+        // 100% loss can still exit 0 on some ping builds — treat as down.
+        if (loss === 100)
+            return { up: false, latency: undefined, loss };
+        return { up: true, latency: latency != null ? Math.round(latency * 10) / 10 : undefined, loss };
+    }
+    catch {
+        return { up: false };
+    }
+}
+export function createNetScanPlugin() {
+    let refreshTimer = null;
+    const devicesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        return Array.isArray(cfg.devices) ? cfg.devices.filter((d) => d?.ip) : [];
+    };
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const count = cfg.pingCount || 2;
+        const timeout = cfg.pingTimeout || 2;
+        const devices = devicesOf(plugin);
+        // Ping all devices concurrently — a scan of ~dozens stays well under the
+        // refresh interval.
+        await Promise.all(devices.map(async (d) => {
+            const r = await pingHost(d.ip, count, timeout);
+            await plugin.send({
+                name: d.name,
+                ip: d.ip,
+                type: d.type || "host",
+                mac: d.mac,
+                up: r.up,
+                latency: r.latency,
+                loss: r.loss,
+                warnMs: d.warnMs ?? 200,
+            }, `net-${slug(d.name || d.ip)}`);
+        }));
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 30000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("netscan", "netscan", "LAN device reachability (ping) monitor", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createNetScanPlugin;

package/dist/plugins/monitoring/OSPlugin.js

@@ -1,29 +1,175 @@
-import { arch, cpus, freemem, hostname, loadavg, networkInterfaces, platform, release, totalmem, type, uptime } from "os";
-import { MonitoringPlugin } from "../../lib/MonitoringPlugin.js";
-export class OSPlugin extends MonitoringPlugin {
-    constructor() {
-        super("os", "OS", "OS Monitoring Plugin");
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+import { arch, cpus, freemem, hostname, loadavg, networkInterfaces, platform, release, totalmem, type, uptime, } from "os";
+import { readFileSync } from "fs";
+import { execSync } from "child_process";
+import { parseProcesses, PS_CMD } from "../../lib/processes";
+// Named service processes (nginx / php-fpm / db / …) running on the host.
+function collectProcesses() {
+    try {
+        return parseProcesses(execSync(PS_CMD, { encoding: "utf8", timeout: 5000 }));
     }
-    async setup() {
-        // no setup required
-        return Promise.resolve();
+    catch {
+        return [];
     }
-    async refresh() {
+}
+// Pseudo / virtual filesystems that aren't real drives.
+const PSEUDO_FS = new Set([
+    "tmpfs", "devtmpfs", "squashfs", "overlay", "overlayfs", "aufs", "proc", "sysfs",
+    "cgroup", "cgroup2", "mqueue", "debugfs", "tracefs", "devpts", "ramfs", "nsfs",
+    "binfmt_misc", "configfs", "pstore", "efivarfs", "autofs", "fusectl", "securityfs",
+    "hugetlbfs", "none", "fuse.gvfsd-fuse", "fuse.portal", "fuse.snapfuse",
+]);
+// Real, physical/attached drives only. Shells out to `df` and filters out
+// pseudo filesystems, loop/snap mounts, and bind-mount duplicates.
+function collectDisks() {
+    try {
+        const darwin = platform() === "darwin";
+        // Linux: `-T` gives the fstype column; bytes via --block-size=1.
+        // macOS: no fstype flag, `-l` restricts to local filesystems.
+        const cmd = darwin ? "df -kl" : "df -PT --block-size=1";
+        const out = execSync(cmd, { encoding: "utf8", timeout: 5000 });
+        const raw = [];
+        for (const line of out.split("\n").slice(1)) {
+            const p = line.trim().split(/\s+/);
+            if (p.length < 6)
+                continue;
+            let device, fstype, total, used, free, mount;
+            if (darwin) {
+                // Filesystem 1K-blocks Used Avail Capacity iused ifree %iused Mounted-on
+                device = p[0];
+                fstype = "";
+                total = (Number(p[1]) || 0) * 1024;
+                used = (Number(p[2]) || 0) * 1024;
+                free = (Number(p[3]) || 0) * 1024;
+                mount = p.slice(8).join(" ");
+                if (!device.startsWith("/dev/"))
+                    continue;
+                // macOS/APFS spawns many synthetic /dev/diskNsM volumes. The real
+                // main-disk usage lives on the Data volume (the "/" snapshot reads
+                // near-empty); real external drives mount under /Volumes. Drop the
+                // rest (/System/Volumes/*, CoreSimulator, etc.).
+                if (mount === "/System/Volumes/Data")
+                    mount = "/";
+                else if (mount !== "/" && !mount.startsWith("/Volumes/"))
+                    continue;
+            }
+            else {
+                // Filesystem Type 1B-blocks Used Available Capacity Mounted-on
+                device = p[0];
+                fstype = p[1];
+                total = Number(p[2]) || 0;
+                used = Number(p[3]) || 0;
+                free = Number(p[4]) || 0;
+                mount = p.slice(6).join(" ");
+                if (PSEUDO_FS.has(fstype))
+                    continue;
+            }
+            if (total <= 0 || device === "overlay" || device === "none" || device.startsWith("/dev/loop"))
+                continue;
+            raw.push({ device, fstype, mount, total, used, free, pct: total ? Math.round((used / total) * 100) : 0 });
+        }
+        // Dedupe by mount, keeping the fullest entry — collapses bind mounts, and on
+        // macOS picks the real Data volume over the near-empty read-only "/" snapshot.
+        const byMount = new Map();
+        for (const d of raw) {
+            const cur = byMount.get(d.mount);
+            if (!cur || d.used > cur.used)
+                byMount.set(d.mount, d);
+        }
+        return Array.from(byMount.values()).sort((a, b) => b.pct - a.pct);
+    }
+    catch {
+        return [];
+    }
+}
+// True available memory: on Linux, os.freemem() returns MemFree, which excludes
+// reclaimable page cache and makes hosts look near-full. MemAvailable is the
+// kernel's estimate of memory obtainable without swapping. Fall back to freemem()
+// on non-Linux (or if /proc is unreadable).
+function availableMem() {
+    if (platform() === "linux") {
+        try {
+            const info = readFileSync("/proc/meminfo", "utf8");
+            const m = info.match(/^MemAvailable:\s+(\d+)\s*kB/m);
+            if (m)
+                return parseInt(m[1], 10) * 1024;
+        }
+        catch {
+            // fall through to freemem()
+        }
+    }
+    return freemem();
+}
+// Cumulative rx/tx byte counters summed across real interfaces (Linux
+// /proc/net/dev). Loopback and virtual bridges (docker/veth/lxc/br-) are skipped
+// so the figure reflects actual host network traffic, not container-to-host
+// chatter. Returns null off Linux (rate is then omitted, not faked).
+function readNetTotals() {
+    if (platform() !== "linux")
+        return null;
+    try {
+        const data = readFileSync("/proc/net/dev", "utf8");
+        let rx = 0, tx = 0;
+        for (const line of data.split("\n")) {
+            const m = line.match(/^\s*([^:]+):\s*(.*)$/);
+            if (!m)
+                continue;
+            const iface = m[1].trim();
+            if (iface === "lo" || /^(veth|docker|br-|lxcbr|virbr|tap|tun)/.test(iface))
+                continue;
+            const cols = m[2].trim().split(/\s+/).map(Number);
+            rx += cols[0] || 0; // column 1 = rx bytes
+            tx += cols[8] || 0; // column 9 = tx bytes
+        }
+        return { rx, tx };
+    }
+    catch {
+        return null;
+    }
+}
+// Host OS metrics: cpu (from cpus().times), memory, disk, load, uptime,
+// addresses, and network throughput. Matches the frontend `os` fleetAdapter case.
+export function createOSPlugin() {
+    let refreshTimer = null;
+    // Previous cumulative net counters, to derive a per-second rate across polls.
+    let prevNet = null;
+    const collect = () => {
         const interfaces = networkInterfaces();
         const addresses = {};
-        for (let [key, value] of Object.entries(interfaces)) {
-            if (value) {
-                let found = value.find(port => (port.family === "IPv4") && (port.internal !== true));
-                if (found) {
-                    let { address, netmask, mac } = found;
-                    addresses[key] = { address, netmask, mac };
+        for (const [key, value] of Object.entries(interfaces)) {
+            if (!value)
+                continue;
+            const found = value.find((p) => p.family === "IPv4" && p.internal !== true);
+            if (found)
+                addresses[key] = { address: found.address, netmask: found.netmask, mac: found.mac };
+        }
+        // Network throughput: bytes/sec since the previous sample. The first poll
+        // has no baseline, so rate is omitted (undefined) rather than a bogus 0.
+        let network;
+        const totals = readNetTotals();
+        if (totals) {
+            const now = Date.now();
+            if (prevNet) {
+                const dt = (now - prevNet.ts) / 1000;
+                if (dt > 0) {
+                    network = {
+                        rxBytes: totals.rx,
+                        txBytes: totals.tx,
+                        rxRate: Math.max(0, Math.round((totals.rx - prevNet.rx) / dt)),
+                        txRate: Math.max(0, Math.round((totals.tx - prevNet.tx) / dt)),
+                    };
                 }
             }
+            prevNet = { rx: totals.rx, tx: totals.tx, ts: now };
         }
-        await this.send({
+        return {
             addresses,
             totalmem: totalmem(),
             freemem: freemem(),
+            available: availableMem(),
+            disks: collectDisks(),
+            processes: collectProcesses(),
+            network,
             loadavg: loadavg(),
             uptime: uptime(),
             hostname: hostname(),
@@ -31,13 +177,26 @@ export class OSPlugin extends MonitoringPlugin {
             release: release(),
             type: type(),
             arch: arch(),
-            cpus: cpus()
-        });
-    }
-    async monitor() {
-        this.refreshTimer = setInterval(this.refresh.bind(this), this.config.refreshInterval || 5000);
-    }
-    async teardown() {
-        clearInterval(this.refreshTimer);
-    }
+            cpus: cpus(),
+        };
+    };
+    const refreshFn = async (plugin) => {
+        try {
+            await plugin.send({ name: hostname(), ...collect() }, "os");
+        }
+        catch (err) {
+            console.error("os: refresh error:", err.message);
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 30000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("os", "os", "Host OS monitoring plugin", async () => { }, monitorFn, refreshFn, teardownFn);
 }
+export default createOSPlugin;