@daemonitor/plugins 1.0.3 → 1.1.1

package/dist/plugins/monitoring/PM2Plugin.js

@@ -1,48 +1,68 @@
-import pm2 from "pm2";
-import { MonitoringPlugin } from "../../lib/MonitoringPlugin.js";
-export class PM2Plugin extends MonitoringPlugin {
-    constructor() {
-        super("pm2", "PM2", "PM2 Monitoring Plugin");
-    }
-    async setup() {
-        return new Promise((resolve, reject) => {
-            try {
-                pm2.connect(async (err) => {
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// Factory function to create PM2 plugin
+export function createPM2Plugin() {
+    // Create plugin state
+    let pm2Instance = null;
+    let refreshTimer = null;
+    // Define setup function
+    const setupFn = async (plugin) => {
+        try {
+            // First, check if PM2 is available globally (injected by the client-test)
+            if (global.pm2Library) {
+                console.log("Using globally provided PM2 instance");
+                pm2Instance = global.pm2Library;
+            }
+            else {
+                // Otherwise use dynamic import approach which is ESM friendly
+                try {
+                    const pm2Module = await import('pm2');
+                    pm2Instance = pm2Module.default || pm2Module;
+                    // If import fails, try CommonJS require as fallback
+                    if (!pm2Instance) {
+                        try {
+                            // @ts-ignore - Dynamically require pm2
+                            pm2Instance = require('pm2');
+                        }
+                        catch (requireErr) {
+                            console.error("Failed to require PM2:", requireErr);
+                            throw new Error(`Neither import nor require could load pm2: ${requireErr.message}`);
+                        }
+                    }
+                }
+                catch (err) {
+                    console.error("Failed to import PM2:", err);
+                    throw new Error(`PM2 import failed: ${err.message}`);
+                }
+            }
+            // Return a promise for the PM2 connection
+            return new Promise((resolve, reject) => {
+                pm2Instance.connect((err) => {
                     if (err) {
-                        console.error(err);
+                        console.error("PM2 connection failed:", err);
                         reject(err);
                     }
                     else {
                         resolve();
                     }
                 });
-            }
-            catch (e) {
-                console.error("ERROR", e);
-                reject(e);
-            }
-        });
-    }
-    async refresh() {
+            });
+        }
+        catch (e) {
+            console.error("PM2Plugin setup error:", e);
+            throw e;
+        }
+    };
+    // Define refresh function
+    const refreshFn = async (plugin) => {
+        if (!pm2Instance) {
+            console.error("PM2 instance not initialized");
+            return;
+        }
         const instanceCounts = {};
-        pm2.list(async (err, list) => {
+        pm2Instance.list(async (err, list) => {
             if (!err) {
                 for (const p of list) {
-                    let { pid, name, pm_id, monit,
-                    // exit_code,
-                    // prev_restart_delay,
-                    // versioning,
-                    // axm_dynamic,
-                    // axm_actions,
-                    // merge_logs,
-                    // vizion,
-                    // instance_var,
-                    // pmx,
-                    // automation,
-                    // treekill,
-                    // windowsHide,
-                    // kill_retry_time
-                     } = p;
+                    let { pid, name, pm_id, monit, } = p;
                     if (instanceCounts[name] === undefined) {
                         instanceCounts[name] = 0;
                     }
@@ -69,18 +89,26 @@ export class PM2Plugin extends MonitoringPlugin {
                         status,
                         pm_uptime,
                     };
-                    await this.send(payload, instance_id);
+                    await plugin.send(payload, instance_id);
                 }
             }
             else {
                 console.error(err);
             }
         });
-    }
-    async monitor() {
-        this.refreshTimer = setInterval(this.refresh.bind(this), this.config.refreshInterval || 5000);
-    }
-    async teardown() {
-        clearInterval(this.refreshTimer);
-    }
+    };
+    // Define monitor function
+    const monitorFn = async (plugin) => {
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config.refreshInterval || 5000);
+    };
+    // Define teardown function
+    const teardownFn = async (plugin) => {
+        if (refreshTimer) {
+            clearInterval(refreshTimer);
+        }
+    };
+    // Create and return the plugin
+    return createMonitoringPlugin("pm2", "PM2", "PM2 Monitoring Plugin", setupFn, monitorFn, refreshFn, teardownFn);
 }
+// Export a default factory function for plugin loader
+export default createPM2Plugin;

package/dist/plugins/monitoring/WebsitePlugin.js

@@ -1,46 +1,209 @@
-import { MonitoringPlugin } from "../../lib/MonitoringPlugin.js";
-export class WebsitePlugin extends MonitoringPlugin {
-    constructor() {
-        super("website", "Website", "Website Monitoring Plugin");
-    }
-    async setup() {
-        // no setup required
-        return Promise.resolve();
-    }
-    async refresh() {
-        const startTimestamp = Date.now();
-        const result = await fetch(this.config.url);
-        const endTimestamp = Date.now();
-        const text = await result.text();
-        const status = result.status;
-        const headers = result.headers;
-        const ok = result.ok;
-        const redirected = result.redirected;
-        const type = result.type;
-        const url = result.url;
-        const body = text;
-        const duration = endTimestamp - startTimestamp;
-        const expectedStrings = this.config.expectedStrings || [];
-        const unexpectedStrings = this.config.unexpectedStrings || [];
-        const hasAllExpectedStrings = expectedStrings.every(expectedString => body.indexOf(expectedString) !== -1);
-        const hasAnyUnexpectedStrings = unexpectedStrings.some(unexpectedString => body.indexOf(unexpectedString) !== -1);
-        await this.send({
-            status,
-            duration,
+import * as http from "node:http";
+import * as https from "node:https";
+import { URL } from "node:url";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// Low-level GET that can hit one host (`target`) while presenting a different
+// Host header. fetch() can't do this — Host is a forbidden header per the
+// Fetch spec and is silently dropped — so this uses Node's http/https
+// directly, which honors it.
+function rawGet(target, opts) {
+    return new Promise((resolve) => {
+        const start = Date.now();
+        let u;
+        try {
+            u = new URL(target);
+        }
+        catch {
+            resolve({ status: 0, body: "", duration: 0, error: `Invalid origin URL: ${target}` });
+            return;
+        }
+        for (const [k, v] of Object.entries(opts.query || {}))
+            u.searchParams.set(k, v);
+        const headers = { ...(opts.headers || {}) };
+        if (opts.host)
+            headers.Host = opts.host;
+        const lib = u.protocol === "http:" ? http : https;
+        const req = lib.request({
+            hostname: u.hostname,
+            port: u.port || (u.protocol === "http:" ? 80 : 443),
+            path: `${u.pathname}${u.search}`,
+            method: "GET",
             headers,
-            ok,
-            redirected,
-            type,
-            url,
-            body,
-            hasAllExpectedStrings,
-            hasAnyUnexpectedStrings
+            // Explicit servername pins TLS/SNI to the real connection
+            // target. Without it, Node derives SNI from headers.Host,
+            // which would validate the cert against the WRONG hostname
+            // (the public one, not the origin actually being dialed).
+            ...(u.protocol === "https:" ? { servername: u.hostname, rejectUnauthorized: !opts.insecure } : {}),
+        }, (res) => {
+            let body = "";
+            res.on("data", (c) => { body += c; });
+            res.on("end", () => resolve({ status: res.statusCode || 0, body, duration: Date.now() - start }));
         });
+        req.on("error", (err) => resolve({ status: 0, body: "", duration: Date.now() - start, error: err.message }));
+        const timeoutMs = opts.timeout || 10000;
+        req.setTimeout(timeoutMs, () => {
+            req.destroy();
+            resolve({ status: 0, body: "", duration: Date.now() - start, error: "timeout" });
+        });
+        req.end();
+    });
+}
+function evaluate(body, status, expected, unexpected, expectedStatusCode) {
+    // Report WHICH strings matched/went missing, not just booleans. For security
+    // checks (injected-script IOCs, webshell markers, defacement canaries) the
+    // alert is only actionable if it names the offending string — "IOC _ea_s
+    // matched" vs. an opaque "check failed". `unexpectedStrings` doubles as an
+    // IOC list; `expectedStrings` doubles as an integrity canary (its absence =
+    // possible defacement). Kept as substring matches (no regex) to preserve the
+    // existing config contract.
+    const missingExpected = expected.filter((s) => body.indexOf(s) === -1);
+    const matchedUnexpected = unexpected.filter((s) => body.indexOf(s) !== -1);
+    const hasAllExpectedStrings = missingExpected.length === 0;
+    const hasAnyUnexpectedStrings = matchedUnexpected.length > 0;
+    const statusOk = expectedStatusCode ? status === expectedStatusCode : status >= 200 && status < 400;
+    return { ok: statusOk && hasAllExpectedStrings && !hasAnyUnexpectedStrings, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected };
+}
+async function checkOrigin(ep) {
+    const oc = ep.origin;
+    const r = await rawGet(oc.url, {
+        host: oc.host,
+        headers: oc.headers,
+        query: oc.query,
+        insecure: oc.insecure,
+        timeout: oc.timeout ?? ep.timeout,
+    });
+    if (r.error) {
+        return { url: oc.url, host: oc.host, status: r.status, duration: r.duration, ok: false, error: r.error };
     }
-    async monitor() {
-        this.refreshTimer = setInterval(this.refresh.bind(this), this.config.refreshInterval || 5000);
-    }
-    async teardown() {
-        clearInterval(this.refreshTimer);
-    }
+    const { ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected } = evaluate(r.body, r.status, oc.expectedStrings ?? ep.expectedStrings ?? [], oc.unexpectedStrings ?? ep.unexpectedStrings ?? [], oc.expectedStatusCode ?? ep.expectedStatusCode);
+    return { url: oc.url, host: oc.host, status: r.status, duration: r.duration, ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected };
+}
+// HTTP uptime/content checks. Emits one client_state per endpoint, matching the
+// frontend `web`/`website` fleetAdapter case ({ url, name, ok, status, duration }).
+// Optionally two-tiered: the public URL (through Cloudflare/CDN) plus a direct
+// origin check, nested under `origin`, so a CDN masking an origin outage still
+// surfaces as a warning even while the public site keeps serving fine.
+export function createWebsitePlugin() {
+    let refreshTimer = null;
+    const check = async (plugin, ep) => {
+        const start = Date.now();
+        const label = ep.name || ep.url;
+        const uid = `web-${(ep.name || ep.url).replace(/[^a-zA-Z0-9_.-]+/g, "-")}`;
+        let publicResult;
+        try {
+            const ctrl = new AbortController();
+            const t = ep.timeout ? setTimeout(() => ctrl.abort(), ep.timeout) : null;
+            const res = await fetch(ep.url, { signal: ctrl.signal, redirect: "follow" });
+            if (t)
+                clearTimeout(t);
+            const body = await res.text();
+            const duration = Date.now() - start;
+            const { ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected } = evaluate(body, res.status, ep.expectedStrings || [], ep.unexpectedStrings || [], ep.expectedStatusCode);
+            publicResult = {
+                name: label,
+                url: res.url || ep.url,
+                status: res.status,
+                duration,
+                ok,
+                redirected: res.redirected,
+                hasAllExpectedStrings,
+                hasAnyUnexpectedStrings,
+                missingExpected,
+                matchedUnexpected,
+            };
+        }
+        catch (err) {
+            publicResult = {
+                name: label,
+                url: ep.url,
+                status: 0,
+                duration: Date.now() - start,
+                ok: false,
+                error: err.message,
+            };
+        }
+        const origin = ep.origin?.url ? await checkOrigin(ep) : undefined;
+        // `ok` stays the PUBLIC tier's own result — don't collapse it with
+        // origin.ok. The two tiers are different failure modes with different
+        // severity (public down = real outage; origin-only down = CDN masking
+        // a backend problem, still worth a warning). Collapsing them into one
+        // boolean loses that distinction downstream (ingest branches on
+        // `ok`/`origin.ok` separately to assign error vs warning).
+        await plugin.send({ ...publicResult, origin }, uid);
+    };
+    const localEndpointsOf = (plugin) => {
+        const cfg = plugin.config || {};
+        if (Array.isArray(cfg.endpoints))
+            return cfg.endpoints;
+        if (cfg.url) {
+            return [{
+                    name: cfg.name,
+                    url: cfg.url,
+                    expectedStrings: cfg.expectedStrings,
+                    unexpectedStrings: cfg.unexpectedStrings,
+                    expectedStatusCode: cfg.expectedStatusCode,
+                    timeout: cfg.timeout,
+                    origin: cfg.origin,
+                }];
+        }
+        return [];
+    };
+    // Server-managed endpoints: when the config carries a `configUrl` (the
+    // daemonitor /api/monitors/for-client endpoint) and this client's
+    // `systemKey`, monitors edited in the UI are pulled from there. The last
+    // successful fetch is cached so a transient network/API failure keeps the
+    // previous set running instead of silently dropping every check.
+    let lastRemote = null;
+    const remoteEndpointsOf = async (plugin) => {
+        const cfg = plugin.config || {};
+        const configUrl = cfg.configUrl;
+        const systemKey = cfg.systemKey;
+        if (!configUrl || !systemKey)
+            return null;
+        try {
+            const res = await fetch(configUrl, { headers: { "x-system-key": systemKey } });
+            if (!res.ok)
+                return lastRemote;
+            const body = await res.json();
+            const eps = Array.isArray(body?.endpoints) ? body.endpoints : [];
+            lastRemote = eps;
+            return eps;
+        }
+        catch {
+            return lastRemote;
+        }
+    };
+    const endpointsOf = async (plugin) => {
+        const local = localEndpointsOf(plugin);
+        const remote = await remoteEndpointsOf(plugin);
+        if (remote == null)
+            return local;
+        // Merge by name/url: server-managed monitors win, local-only ones
+        // (defined directly in the config file) are kept alongside.
+        const key = (e) => `${e.name || ""}|${e.url}`;
+        const merged = new Map();
+        for (const e of local)
+            merged.set(key(e), e);
+        for (const e of remote)
+            merged.set(key(e), e);
+        return [...merged.values()];
+    };
+    const refreshFn = async (plugin) => {
+        const eps = await endpointsOf(plugin);
+        for (const ep of eps) {
+            if (ep?.url)
+                await check(plugin, ep);
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("web", "web", "Website / HTTP uptime monitoring plugin", async () => { }, monitorFn, refreshFn, teardownFn);
 }
+export default createWebsitePlugin;

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -0,0 +1,248 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// WordPress security-posture plugin. Runs on the WP host (where the daemonitor
+// client already runs) and polls the state that the Archpaper intrusions moved
+// through: admin accounts, page statuses, must-use plugins, and the web user's
+// crontab. It emits raw observations only — severity and the new-admin /
+// admin-demotion DIFFS are decided server-side in the ingest handler
+// (clientstate/update.put.ts, case "wordpress"), so an agent restart can't reset
+// the baseline and let a change slip through.
+//
+// Collection is via WP-CLI + filesystem + crontab (no DB credentials, no extra
+// npm dependency) — mirroring MongoDBPlugin's shell-out pattern. Every collector
+// is best-effort and isolated: one failing (e.g. crontab needs root) degrades
+// that one field to null, it never kills the poll.
+const pexec = promisify(execFile);
+// Service-account naming patterns seen in the Archpaper intrusions. Any admin
+// whose login/email contains one of these (case-insensitive substring) is
+// flagged for escalation even before the new-admin diff fires.
+const DEFAULT_SERVICE_PATTERNS = [
+    "wpsvc", "wpengine", "bot", "svc", "researchlabs", "wordpress-svc",
+];
+const DEFAULT_CRITICAL_PAGES = ["login", "home", "index", "front-page"];
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+const MAXBUF = 8 * 1024 * 1024;
+// Run a command in the site's context — inside its LXC container when `lxc` is
+// set (via `sudo -n lxc exec <c> -- …`), else on the host (optionally as
+// `runAs`). Returns stdout, or throws — callers isolate their own failures.
+async function execInSite(site, argv, timeout = 15000) {
+    if (site.lxc) {
+        const lxcBin = site.lxcBin || "lxc";
+        const { stdout } = await pexec("sudo", ["-n", lxcBin, "exec", site.lxc, "--", ...argv], { timeout, maxBuffer: MAXBUF });
+        return stdout;
+    }
+    if (site.runAs) {
+        const { stdout } = await pexec("sudo", ["-n", "-u", site.runAs, ...argv], { timeout, maxBuffer: MAXBUF });
+        return stdout;
+    }
+    const { stdout } = await pexec(argv[0], argv.slice(1), { timeout, maxBuffer: MAXBUF });
+    return stdout;
+}
+// Run `wp <args>` in the site's context. Adds:
+//  --skip-plugins/--skip-themes so a plugin/theme's PHP notices don't get
+//    printed onto stdout ahead of the JSON and break the parse;
+//  --url when known (fixes wp-config reads of $_SERVER['SERVER_NAME']; also
+//    correct for multisite);
+//  --allow-root when running via `lxc exec` (that lands as root in the
+//    container, and WP-CLI refuses root without it).
+async function wp(site, args, timeout = 15000) {
+    const bin = site.wpCli || "wp";
+    const full = [...args, `--path=${site.path}`, "--skip-plugins", "--skip-themes"];
+    if (site.url)
+        full.push(`--url=${site.url}`);
+    if (site.lxc)
+        full.push("--allow-root");
+    return execInSite(site, [bin, ...full], timeout);
+}
+function parseJsonSafe(s, fallback) {
+    try {
+        const v = JSON.parse(s);
+        return v == null ? fallback : v;
+    }
+    catch {
+        return fallback;
+    }
+}
+async function collectSite(site) {
+    const label = site.name || path.basename(site.path || "") || "wordpress";
+    const servicePatterns = (site.servicePatterns || DEFAULT_SERVICE_PATTERNS).map((s) => s.toLowerCase());
+    const criticalPages = (site.criticalPages || DEFAULT_CRITICAL_PAGES).map((s) => s.toLowerCase());
+    const out = { name: label, site: label, url: site.url };
+    // 1. Current administrators (the rogue-admin / demotion signal set).
+    try {
+        const raw = await wp(site, ["user", "list", "--role=administrator", "--fields=ID,user_login,user_email,user_registered", "--format=json"]);
+        const admins = parseJsonSafe(raw, []).map((u) => ({
+            id: String(u.ID ?? ""),
+            login: String(u.user_login ?? ""),
+            email: String(u.user_email ?? ""),
+            registered: u.user_registered ?? null,
+        }));
+        out.admins = admins;
+        // Service-account-pattern admins — flagged locally so they surface even on
+        // the very first poll, before the server-side new-admin diff has a baseline.
+        out.suspiciousAdmins = admins
+            .filter((a) => servicePatterns.some((p) => a.login.toLowerCase().includes(p) || a.email.toLowerCase().includes(p)))
+            .map((a) => ({ login: a.login, email: a.email, reason: "service-account naming pattern" }));
+    }
+    catch (e) {
+        out.adminsError = String(e?.message || e).slice(0, 160);
+    }
+    // 2. WP core version (posture; latest-version comparison is done elsewhere).
+    try {
+        out.wpVersion = (await wp(site, ["core", "version"])).trim();
+    }
+    catch (e) {
+        out.wpVersionError = String(e?.message || e).slice(0, 160);
+    }
+    // 3. Trashed pages/posts — attackers hid the login/home page by trashing it.
+    try {
+        const raw = await wp(site, ["post", "list", "--post_status=trash", "--post_type=page,post", "--fields=ID,post_title,post_name,post_type", "--format=json"]);
+        const trashed = parseJsonSafe(raw, []).map((p) => ({
+            id: String(p.ID ?? ""),
+            title: String(p.post_title ?? ""),
+            slug: String(p.post_name ?? ""),
+            type: String(p.post_type ?? ""),
+        }));
+        out.trashedPages = trashed;
+        out.trashedCriticalPages = trashed.filter((p) => criticalPages.includes(p.slug.toLowerCase()) || criticalPages.includes(p.title.toLowerCase()));
+    }
+    catch (e) {
+        out.trashedError = String(e?.message || e).slice(0, 160);
+    }
+    // 4. mu-plugins auto-load with no UI to disable them — a favorite persistence
+    // spot. Report every .php and which ones aren't in the allowlist. Read via the
+    // container when the site is LXC (the path is inside the container's fs).
+    try {
+        const dir = path.join(site.path, "wp-content", "mu-plugins");
+        let entries;
+        if (site.lxc) {
+            // `ls -1` inside the container; empty/no-dir → treat as no mu-plugins.
+            const out2 = await execInSite(site, ["ls", "-1", dir], 8000).catch(() => "");
+            entries = out2.split("\n").map((s) => s.trim()).filter(Boolean);
+        }
+        else {
+            entries = await readdir(dir);
+        }
+        const php = entries.filter((f) => f.toLowerCase().endsWith(".php"));
+        out.muPlugins = php;
+        if (site.muPluginsAllowlist) {
+            const allow = new Set(site.muPluginsAllowlist);
+            out.unknownMuPlugins = php.filter((f) => !allow.has(f));
+        }
+    }
+    catch {
+        // no mu-plugins dir = fine; leave muPlugins undefined
+    }
+    // 5. Web user's crontab — www-data should almost never have one; the attacker
+    // used it to re-drop webshells every 5 min. Non-empty = alert. `crontab -u`
+    // needs privilege: try direct first, then `sudo -n` (the agent user typically
+    // has passwordless sudo). "no crontab for <user>" is the HEALTHY empty case,
+    // not an error — anything else (still denied) is a real collection failure.
+    const cronUser = site.cronUser || "www-data";
+    const readCron = async () => {
+        // LXC: the web user's crontab lives INSIDE the container (that's where the
+        // persistence would be dropped), so read it there.
+        if (site.lxc) {
+            try {
+                return await execInSite(site, ["crontab", "-l", "-u", cronUser], 8000);
+            }
+            catch (e2) {
+                const msg = String(e2?.stderr || e2?.message || "");
+                // "no crontab for" = empty (healthy). "cannot use this program" /
+                // "not allowed to use" = the user is denied crontab entirely
+                // (cron.deny / not in cron.allow) — that's GOOD posture (can't be used
+                // for persistence), not a collection failure. Treat both as clean.
+                if (/no crontab for|cannot use this program|not allowed to use/i.test(msg))
+                    return "";
+                throw e2;
+            }
+        }
+        try {
+            return (await pexec("crontab", ["-l", "-u", cronUser], { timeout: 8000 })).stdout;
+        }
+        catch (e) {
+            const msg = String(e?.stderr || e?.message || "");
+            if (/no crontab for/i.test(msg))
+                return ""; // empty is fine
+            if (/privileged|not permitted|not allowed|denied/i.test(msg)) {
+                // Retry under sudo; may itself throw "no crontab for" (empty) → catch.
+                try {
+                    return (await pexec("sudo", ["-n", "crontab", "-l", "-u", cronUser], { timeout: 8000 })).stdout;
+                }
+                catch (e2) {
+                    if (/no crontab for/i.test(String(e2?.stderr || e2?.message || "")))
+                        return "";
+                    throw e2;
+                }
+            }
+            throw e;
+        }
+    };
+    try {
+        const stdout = await readCron();
+        const lines = stdout.split("\n").filter((l) => l.trim() && !l.trim().startsWith("#"));
+        out.webUserCrontab = lines.join("\n") || null;
+        out.hasWebUserCrontab = lines.length > 0;
+        out.cronUser = cronUser;
+    }
+    catch (e) {
+        out.cronError = String(e?.stderr || e?.message || e).slice(0, 160);
+    }
+    return out;
+}
+export function createWordpressPlugin() {
+    let refreshTimer = null;
+    const sitesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        if (Array.isArray(cfg.sites) && cfg.sites.length)
+            return cfg.sites;
+        if (cfg.path) {
+            return [{
+                    name: cfg.name,
+                    path: cfg.path,
+                    url: cfg.url,
+                    wpCli: cfg.wpCli,
+                    runAs: cfg.runAs,
+                    lxc: cfg.lxc,
+                    lxcBin: cfg.lxcBin,
+                    cronUser: cfg.cronUser,
+                    muPluginsAllowlist: cfg.muPluginsAllowlist,
+                    criticalPages: cfg.criticalPages,
+                    servicePatterns: cfg.servicePatterns,
+                }];
+        }
+        return [];
+    };
+    const refreshFn = async (plugin) => {
+        const sites = sitesOf(plugin);
+        for (const site of sites) {
+            if (!site?.path)
+                continue;
+            try {
+                const data = await collectSite(site);
+                const uid = `wp-${slug(site.name || site.url || site.path)}`;
+                await plugin.send(data, uid);
+            }
+            catch (e) {
+                const uid = `wp-${slug(site.name || site.url || site.path)}`;
+                await plugin.send({ name: site.name || site.path, error: String(e?.message || e).slice(0, 160) }, uid);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 300000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("wordpress", "wordpress", "WordPress security-posture monitoring plugin", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createWordpressPlugin;

package/index.ts

@@ -0,0 +1,11 @@
+// Export core plugin utilities
+export { PluginConfigProvider } from "./lib/PluginConfigProvider"
+export { PluginManager } from "./lib/PluginManager"
+export { PluginLoader } from "./lib/PluginLoader"
+
+// Only export creation functions, not types
+export { createBasePlugin } from "./lib/BasePlugin"
+export { createMonitoringPlugin } from "./lib/MonitoringPlugin"
+
+// Export the PM2 plugin factory function
+export { createPM2Plugin } from "./plugins/monitoring/PM2Plugin"