@daemonitor/plugins 1.1.0 → 1.1.2

package/dist/lib/processes.js

@@ -0,0 +1,36 @@
+// Aggregate named service processes (nginx, php-fpm, db, …) from `ps` output.
+// Used for host processes (OSPlugin) and per-container processes (LxcPlugin via
+// `lxc exec … ps`). MEM (rss) is exact; CPU is `ps` %cpu, which is the average
+// over each process's lifetime — a rough indicator for long-running daemons.
+// The command whose output parseProcesses() expects (headerless: comm rss pcpu).
+export const PS_CMD = "ps -eo comm=,rss=,pcpu=";
+const WATCH = [
+    { key: "nginx", test: (c) => c.startsWith("nginx") },
+    { key: "php-fpm", test: (c) => /^php-?fpm/i.test(c) },
+    { key: "mysql", test: (c) => c.startsWith("mysqld") || c.startsWith("mariadbd") },
+    { key: "postgres", test: (c) => c.startsWith("postgres") },
+    { key: "redis", test: (c) => c.startsWith("redis-server") || c.startsWith("redis") },
+    { key: "node", test: (c) => c.startsWith("node") },
+];
+export function parseProcesses(out) {
+    const agg = new Map();
+    for (const line of String(out || "").split("\n")) {
+        // Last two whitespace-separated tokens are rss + pcpu; the rest is comm
+        // (which may itself contain spaces/slashes, e.g. node process titles).
+        const m = line.trim().match(/^(.+?)\s+(\d+)\s+([\d.]+)$/);
+        if (!m)
+            continue;
+        const comm = m[1].trim();
+        const w = WATCH.find((x) => x.test(comm));
+        if (!w)
+            continue;
+        const cur = agg.get(w.key) || { name: w.key, count: 0, cpu: 0, mem: 0 };
+        cur.count++;
+        cur.cpu += Number(m[3]) || 0;
+        cur.mem += (Number(m[2]) || 0) * 1024; // rss KiB -> bytes
+        agg.set(w.key, cur);
+    }
+    return Array.from(agg.values())
+        .map((p) => ({ ...p, cpu: Math.round(p.cpu * 10) / 10 }))
+        .sort((a, b) => b.mem - a.mem);
+}

package/dist/plugins/index.js

@@ -4,6 +4,9 @@ import { createDockerPlugin } from "./monitoring/DockerPlugin";
 import { createLxcPlugin } from "./monitoring/LxcPlugin";
 import { createOSPlugin } from "./monitoring/OSPlugin";
 import { createWebsitePlugin } from "./monitoring/WebsitePlugin";
+import { createWordpressPlugin } from "./monitoring/WordpressPlugin";
+import { createLogWatchPlugin } from "./monitoring/LogWatchPlugin";
+import { createNetScanPlugin } from "./monitoring/NetScanPlugin";
 // In future, implement other plugin factory functions using the same pattern
 // import { createOSPlugin } from "./monitoring/OSPlugin"
 // import { createMongoDBPlugin } from "./monitoring/MongoDBPlugin"
@@ -19,6 +22,9 @@ export default {
     Lxc: createLxcPlugin,
     OS: createOSPlugin,
     Website: createWebsitePlugin,
+    Wordpress: createWordpressPlugin,
+    Logwatch: createLogWatchPlugin,
+    Netscan: createNetScanPlugin,
     // CloudflarePlugin: createCloudflarePlugin,
     // EwelinkPlugin: createEwelinkPlugin,
     // MongoDBPlugin: createMongoDBPlugin,

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -0,0 +1,212 @@
+import { stat, open } from "node:fs/promises";
+import * as path from "node:path";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// Cap a single tail read so a rotated-in giant file (or fromStart on a large
+// log) can't blow up memory — read at most the last MAX_READ bytes.
+const MAX_READ = 5 * 1024 * 1024;
+// Field-position TOLERANT parsing. Log layouts vary a lot across these hosts:
+//   • standard combined:   `1.2.3.4 - - [t] "GET / HTTP/1.1" 200 ...`
+//   • vhost-first:          `example.com - 1.2.3.4 - - [t] "GET / HTTP/1.1" 200`
+//   • CF combined_with_host: `host - <edge_ip> - <cf_connecting_ip> - - [t] "GET .." "200"`
+// So neither the IP column NOR the status quoting is fixed. We therefore:
+//   1. pull the request + status from the quoted "$request" run (status may be
+//      bare or quoted → allow an optional leading quote), and
+//   2. take the LAST IP token BEFORE the `[timestamp]` as the client. That is
+//      the real requester in every layout here: when Cloudflare's
+//      $http_cf_connecting_ip is present it is logged AFTER $remote_addr (the CF
+//      edge), so "last IP" is the visitor, not the edge; when it's absent there
+//      is a single IP ($remote_addr) and "last" == "only".
+const REQ = /"([A-Z]+)\s+([^ "]+)[^"]*"\s+"?(\d{3})/;
+const IP_TOKEN = /^(?:(?:\d{1,3}\.){3}\d{1,3}|(?:[0-9a-fA-F]{0,4}:){2,}[0-9a-fA-F]{0,4})$/;
+function parseLine(line) {
+    const rq = REQ.exec(line);
+    if (!rq)
+        return null;
+    const br = line.indexOf("[");
+    const pre = br > 0 ? line.slice(0, br) : line;
+    const tokens = pre.split(/\s+/);
+    const ips = tokens.filter((t) => IP_TOKEN.test(t));
+    const ip = ips.length ? ips[ips.length - 1] : (tokens.find(Boolean) || "");
+    return { ip, method: rq[1], path: rq[2], status: Number(rq[3]), ua: "" };
+}
+const SUSPICIOUS_QUERY = /(?:^|[?&])(c|k|cmd|exec|e|q|f|file|dir|download|0|1|a)=/i;
+const BASE64_BLOB = /[A-Za-z0-9+/]{40,}={0,2}/;
+const UPLOADS_PHP = /\/wp-content\/uploads\/.*\.php$/i;
+const PLUGIN_PHP = /\/wp-content\/(?:plugins|mu-plugins)\/.*\.php$/i;
+const BATCH_PATH = /^\/wp-json\/batch\/v1|rest_route=\/?batch\/v1/i;
+// Read new bytes since last offset, advancing state. Handles rotation (file
+// shrank → restart at 0) and partial trailing lines (buffered in remainder).
+async function readNew(source, st) {
+    let size;
+    try {
+        size = (await stat(source.path)).size;
+    }
+    catch {
+        return []; // file missing this cycle; try again next tick
+    }
+    if (!st.inited) {
+        st.offset = source.fromStart ? 0 : size;
+        st.remainder = "";
+        st.inited = true;
+    }
+    if (size < st.offset) {
+        // Truncated or rotated in place.
+        st.offset = 0;
+        st.remainder = "";
+    }
+    if (size <= st.offset)
+        return []; // nothing new
+    let start = st.offset;
+    if (size - start > MAX_READ)
+        start = size - MAX_READ; // bound the read
+    const len = size - start;
+    const buf = Buffer.allocUnsafe(len);
+    const fh = await open(source.path, "r");
+    try {
+        await fh.read(buf, 0, len, start);
+    }
+    finally {
+        await fh.close();
+    }
+    st.offset = size;
+    const text = st.remainder + buf.toString("utf8");
+    const lines = text.split("\n");
+    st.remainder = lines.pop() ?? ""; // last element is a partial line (no newline)
+    return lines;
+}
+function analyze(lines, cfg, windowSec) {
+    const burstThreshold = cfg.xmlrpcBurstThreshold ?? 20;
+    const batchIps = new Map(); // ip → count of batch/v1 → 207
+    const loginOkIps = new Set(); // ip with POST wp-login → 302
+    const xmlrpcByIp = new Map(); // ip → POST xmlrpc count
+    const webshell = new Map(); // pathNoQuery → sample
+    let total = 0;
+    for (const line of lines) {
+        const e = parseLine(line);
+        if (!e)
+            continue;
+        total++;
+        const qIdx = e.path.indexOf("?");
+        const pathNoQuery = qIdx === -1 ? e.path : e.path.slice(0, qIdx);
+        const query = qIdx === -1 ? "" : e.path.slice(qIdx + 1);
+        if ((BATCH_PATH.test(e.path) || pathNoQuery === "/wp-json/batch/v1") && e.status === 207) {
+            batchIps.set(e.ip, (batchIps.get(e.ip) || 0) + 1);
+        }
+        if (pathNoQuery === "/wp-login.php" && e.method === "POST" && e.status === 302) {
+            loginOkIps.add(e.ip);
+        }
+        if (pathNoQuery === "/xmlrpc.php" && e.method === "POST") {
+            xmlrpcByIp.set(e.ip, (xmlrpcByIp.get(e.ip) || 0) + 1);
+        }
+        // A .php under uploads is never legitimate; under a plugin dir it's only
+        // suspicious with a command-style or base64 query (webshell invocation).
+        // BUT only a SUCCESSFUL (2xx) response means the PHP actually executed —
+        // every WP site is probed constantly for my.php / academy.php / etc., and
+        // those hits 404 (not there) or 403 (WAF-blocked). Alerting on the probes
+        // is pure noise; alert only when the shell actually RAN.
+        const executed = e.status >= 200 && e.status < 300;
+        const isUploadsPhp = UPLOADS_PHP.test(pathNoQuery);
+        const isPluginShell = PLUGIN_PHP.test(pathNoQuery) && (SUSPICIOUS_QUERY.test(query) || BASE64_BLOB.test(query));
+        if ((isUploadsPhp || isPluginShell) && executed) {
+            const cur = webshell.get(pathNoQuery) || { ip: e.ip, count: 0 };
+            cur.count++;
+            webshell.set(pathNoQuery, cur);
+        }
+    }
+    const findings = [];
+    // Correlation is the highest-signal event — flag it before the standalone
+    // batch/v1 finding so it leads.
+    for (const [ip, count] of batchIps) {
+        if (loginOkIps.has(ip)) {
+            findings.push({
+                rule: "batch-then-login", key: `batch-login:${ip}`, severity: "error", ip,
+                path: "/wp-json/batch/v1",
+                title: "WP2Shell: exploit + admin login",
+                detail: `${ip}: batch/v1 exploit (${count}×) followed by a successful wp-login (HTTP 302) — likely account takeover`,
+            });
+        }
+        else {
+            findings.push({
+                rule: "wp-batch-207", key: `batchv1:${ip}`, severity: "error", ip,
+                path: "/wp-json/batch/v1",
+                title: "WP2Shell batch/v1 exploit",
+                detail: `${ip}: POST /wp-json/batch/v1 → 207 (${count}×) — near-zero false positives`,
+            });
+        }
+    }
+    for (const [p, v] of webshell) {
+        findings.push({
+            rule: "webshell-exec", key: `webshell:${p}`, severity: "error", ip: v.ip, path: p,
+            title: "Webshell execution",
+            detail: `${v.ip} invoked ${p} (${v.count}×) — executable PHP in an upload/plugin path`,
+        });
+    }
+    for (const [ip, count] of xmlrpcByIp) {
+        if (count >= burstThreshold) {
+            findings.push({
+                rule: "xmlrpc-burst", key: `xmlrpc:${ip}`, severity: count >= burstThreshold * 5 ? "error" : "warning", ip,
+                path: "/xmlrpc.php",
+                title: "xmlrpc.php brute-force / amplification",
+                detail: `${ip}: ${count} POST /xmlrpc.php in ~${windowSec}s (threshold ${burstThreshold})`,
+            });
+        }
+    }
+    const counts = {
+        total,
+        batchV1: [...batchIps.values()].reduce((a, b) => a + b, 0),
+        xmlrpcPosts: [...xmlrpcByIp.values()].reduce((a, b) => a + b, 0),
+        webshellHits: [...webshell.values()].reduce((a, b) => a + b.count, 0),
+        loginSuccess: loginOkIps.size,
+    };
+    return { findings, counts };
+}
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+export function createLogWatchPlugin() {
+    let refreshTimer = null;
+    const states = new Map();
+    const sourcesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        if (Array.isArray(cfg.sources) && cfg.sources.length)
+            return cfg.sources;
+        if (cfg.path)
+            return [{ name: cfg.name, path: cfg.path, fromStart: cfg.fromStart }];
+        return [];
+    };
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const windowSec = Math.round((cfg.refreshInterval || 60000) / 1000);
+        for (const source of sourcesOf(plugin)) {
+            if (!source?.path)
+                continue;
+            const label = source.name || path.basename(source.path);
+            const uid = `log-${slug(source.name || source.path)}`;
+            let st = states.get(source.path);
+            if (!st) {
+                st = { offset: 0, remainder: "", inited: false };
+                states.set(source.path, st);
+            }
+            try {
+                const lines = await readNew(source, st);
+                const { findings, counts } = analyze(lines, cfg, windowSec);
+                await plugin.send({ name: label, source: label, path: source.path, window: windowSec, counts, findings }, uid);
+            }
+            catch (e) {
+                await plugin.send({ name: label, source: label, path: source.path, error: String(e?.message || e).slice(0, 160), findings: [] }, uid);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+        states.clear();
+    };
+    return createMonitoringPlugin("logwatch", "logwatch", "Access-log security watcher (WP2Shell / webshell / xmlrpc)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createLogWatchPlugin;

package/dist/plugins/monitoring/NetScanPlugin.js

@@ -0,0 +1,77 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// LAN device reachability monitor. Pings a configured list of devices (the
+// office infrastructure — switch, printers, APs, extenders, PBX, router, NAS,
+// phones — plus any hosts worth watching) and reports up/down + latency for
+// each. No credentials needed: pure ICMP. Richer per-device metrics (printer
+// toner/pages, switch ports) come from the companion SNMP plugin.
+//
+// One client_state per device (type "netdevice", uid net-<slug>), so each shows
+// as its own service and can be grouped (e.g. under "New York Office").
+const pexec = promisify(execFile);
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+// Ping via the system `ping` (works unprivileged in a host-network container).
+// Returns reachability + average RTT in ms. Never throws — an unreachable host
+// exits non-zero, which we read as down.
+async function pingHost(ip, count, timeout) {
+    try {
+        const { stdout } = await pexec("ping", ["-c", String(count), "-W", String(timeout), ip], {
+            timeout: (timeout * count + 2) * 1000,
+        });
+        // "rtt min/avg/max/mdev = 0.3/0.5/0.7/0.1 ms" (iputils) or a single "time=x ms"
+        const avg = stdout.match(/=\s*[\d.]+\/([\d.]+)\//);
+        const single = stdout.match(/time[=<]\s*([\d.]+)/);
+        const lossM = stdout.match(/([\d.]+)%\s*packet loss/);
+        const latency = avg ? parseFloat(avg[1]) : single ? parseFloat(single[1]) : undefined;
+        const loss = lossM ? parseFloat(lossM[1]) : undefined;
+        // 100% loss can still exit 0 on some ping builds — treat as down.
+        if (loss === 100)
+            return { up: false, latency: undefined, loss };
+        return { up: true, latency: latency != null ? Math.round(latency * 10) / 10 : undefined, loss };
+    }
+    catch {
+        return { up: false };
+    }
+}
+export function createNetScanPlugin() {
+    let refreshTimer = null;
+    const devicesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        return Array.isArray(cfg.devices) ? cfg.devices.filter((d) => d?.ip) : [];
+    };
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const count = cfg.pingCount || 2;
+        const timeout = cfg.pingTimeout || 2;
+        const devices = devicesOf(plugin);
+        // Ping all devices concurrently — a scan of ~dozens stays well under the
+        // refresh interval.
+        await Promise.all(devices.map(async (d) => {
+            const r = await pingHost(d.ip, count, timeout);
+            await plugin.send({
+                name: d.name,
+                ip: d.ip,
+                type: d.type || "host",
+                mac: d.mac,
+                up: r.up,
+                latency: r.latency,
+                loss: r.loss,
+                warnMs: d.warnMs ?? 200,
+            }, `net-${slug(d.name || d.ip)}`);
+        }));
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 30000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("netscan", "netscan", "LAN device reachability (ping) monitor", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createNetScanPlugin;

package/dist/plugins/monitoring/OSPlugin.js

@@ -1,6 +1,87 @@
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
 import { arch, cpus, freemem, hostname, loadavg, networkInterfaces, platform, release, totalmem, type, uptime, } from "os";
 import { readFileSync } from "fs";
+import { execSync } from "child_process";
+import { parseProcesses, PS_CMD } from "../../lib/processes";
+// Named service processes (nginx / php-fpm / db / …) running on the host.
+function collectProcesses() {
+    try {
+        return parseProcesses(execSync(PS_CMD, { encoding: "utf8", timeout: 5000 }));
+    }
+    catch {
+        return [];
+    }
+}
+// Pseudo / virtual filesystems that aren't real drives.
+const PSEUDO_FS = new Set([
+    "tmpfs", "devtmpfs", "squashfs", "overlay", "overlayfs", "aufs", "proc", "sysfs",
+    "cgroup", "cgroup2", "mqueue", "debugfs", "tracefs", "devpts", "ramfs", "nsfs",
+    "binfmt_misc", "configfs", "pstore", "efivarfs", "autofs", "fusectl", "securityfs",
+    "hugetlbfs", "none", "fuse.gvfsd-fuse", "fuse.portal", "fuse.snapfuse",
+]);
+// Real, physical/attached drives only. Shells out to `df` and filters out
+// pseudo filesystems, loop/snap mounts, and bind-mount duplicates.
+function collectDisks() {
+    try {
+        const darwin = platform() === "darwin";
+        // Linux: `-T` gives the fstype column; bytes via --block-size=1.
+        // macOS: no fstype flag, `-l` restricts to local filesystems.
+        const cmd = darwin ? "df -kl" : "df -PT --block-size=1";
+        const out = execSync(cmd, { encoding: "utf8", timeout: 5000 });
+        const raw = [];
+        for (const line of out.split("\n").slice(1)) {
+            const p = line.trim().split(/\s+/);
+            if (p.length < 6)
+                continue;
+            let device, fstype, total, used, free, mount;
+            if (darwin) {
+                // Filesystem 1K-blocks Used Avail Capacity iused ifree %iused Mounted-on
+                device = p[0];
+                fstype = "";
+                total = (Number(p[1]) || 0) * 1024;
+                used = (Number(p[2]) || 0) * 1024;
+                free = (Number(p[3]) || 0) * 1024;
+                mount = p.slice(8).join(" ");
+                if (!device.startsWith("/dev/"))
+                    continue;
+                // macOS/APFS spawns many synthetic /dev/diskNsM volumes. The real
+                // main-disk usage lives on the Data volume (the "/" snapshot reads
+                // near-empty); real external drives mount under /Volumes. Drop the
+                // rest (/System/Volumes/*, CoreSimulator, etc.).
+                if (mount === "/System/Volumes/Data")
+                    mount = "/";
+                else if (mount !== "/" && !mount.startsWith("/Volumes/"))
+                    continue;
+            }
+            else {
+                // Filesystem Type 1B-blocks Used Available Capacity Mounted-on
+                device = p[0];
+                fstype = p[1];
+                total = Number(p[2]) || 0;
+                used = Number(p[3]) || 0;
+                free = Number(p[4]) || 0;
+                mount = p.slice(6).join(" ");
+                if (PSEUDO_FS.has(fstype))
+                    continue;
+            }
+            if (total <= 0 || device === "overlay" || device === "none" || device.startsWith("/dev/loop"))
+                continue;
+            raw.push({ device, fstype, mount, total, used, free, pct: total ? Math.round((used / total) * 100) : 0 });
+        }
+        // Dedupe by mount, keeping the fullest entry — collapses bind mounts, and on
+        // macOS picks the real Data volume over the near-empty read-only "/" snapshot.
+        const byMount = new Map();
+        for (const d of raw) {
+            const cur = byMount.get(d.mount);
+            if (!cur || d.used > cur.used)
+                byMount.set(d.mount, d);
+        }
+        return Array.from(byMount.values()).sort((a, b) => b.pct - a.pct);
+    }
+    catch {
+        return [];
+    }
+}
 // True available memory: on Linux, os.freemem() returns MemFree, which excludes
 // reclaimable page cache and makes hosts look near-full. MemAvailable is the
 // kernel's estimate of memory obtainable without swapping. Fall back to freemem()
@@ -19,10 +100,39 @@ function availableMem() {
     }
     return freemem();
 }
-// Host OS metrics: cpu (from cpus().times), memory, load, uptime, addresses.
-// Matches the frontend `os` fleetAdapter case.
+// Cumulative rx/tx byte counters summed across real interfaces (Linux
+// /proc/net/dev). Loopback and virtual bridges (docker/veth/lxc/br-) are skipped
+// so the figure reflects actual host network traffic, not container-to-host
+// chatter. Returns null off Linux (rate is then omitted, not faked).
+function readNetTotals() {
+    if (platform() !== "linux")
+        return null;
+    try {
+        const data = readFileSync("/proc/net/dev", "utf8");
+        let rx = 0, tx = 0;
+        for (const line of data.split("\n")) {
+            const m = line.match(/^\s*([^:]+):\s*(.*)$/);
+            if (!m)
+                continue;
+            const iface = m[1].trim();
+            if (iface === "lo" || /^(veth|docker|br-|lxcbr|virbr|tap|tun)/.test(iface))
+                continue;
+            const cols = m[2].trim().split(/\s+/).map(Number);
+            rx += cols[0] || 0; // column 1 = rx bytes
+            tx += cols[8] || 0; // column 9 = tx bytes
+        }
+        return { rx, tx };
+    }
+    catch {
+        return null;
+    }
+}
+// Host OS metrics: cpu (from cpus().times), memory, disk, load, uptime,
+// addresses, and network throughput. Matches the frontend `os` fleetAdapter case.
 export function createOSPlugin() {
     let refreshTimer = null;
+    // Previous cumulative net counters, to derive a per-second rate across polls.
+    let prevNet = null;
     const collect = () => {
         const interfaces = networkInterfaces();
         const addresses = {};
@@ -33,11 +143,33 @@ export function createOSPlugin() {
             if (found)
                 addresses[key] = { address: found.address, netmask: found.netmask, mac: found.mac };
         }
+        // Network throughput: bytes/sec since the previous sample. The first poll
+        // has no baseline, so rate is omitted (undefined) rather than a bogus 0.
+        let network;
+        const totals = readNetTotals();
+        if (totals) {
+            const now = Date.now();
+            if (prevNet) {
+                const dt = (now - prevNet.ts) / 1000;
+                if (dt > 0) {
+                    network = {
+                        rxBytes: totals.rx,
+                        txBytes: totals.tx,
+                        rxRate: Math.max(0, Math.round((totals.rx - prevNet.rx) / dt)),
+                        txRate: Math.max(0, Math.round((totals.tx - prevNet.tx) / dt)),
+                    };
+                }
+            }
+            prevNet = { rx: totals.rx, tx: totals.tx, ts: now };
+        }
         return {
             addresses,
             totalmem: totalmem(),
             freemem: freemem(),
             available: availableMem(),
+            disks: collectDisks(),
+            processes: collectProcesses(),
+            network,
             loadavg: loadavg(),
             uptime: uptime(),
             hostname: hostname(),

package/dist/plugins/monitoring/WebsitePlugin.js

@@ -1,12 +1,95 @@
+import * as http from "node:http";
+import * as https from "node:https";
+import { URL } from "node:url";
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// Low-level GET that can hit one host (`target`) while presenting a different
+// Host header. fetch() can't do this — Host is a forbidden header per the
+// Fetch spec and is silently dropped — so this uses Node's http/https
+// directly, which honors it.
+function rawGet(target, opts) {
+    return new Promise((resolve) => {
+        const start = Date.now();
+        let u;
+        try {
+            u = new URL(target);
+        }
+        catch {
+            resolve({ status: 0, body: "", duration: 0, error: `Invalid origin URL: ${target}` });
+            return;
+        }
+        for (const [k, v] of Object.entries(opts.query || {}))
+            u.searchParams.set(k, v);
+        const headers = { ...(opts.headers || {}) };
+        if (opts.host)
+            headers.Host = opts.host;
+        const lib = u.protocol === "http:" ? http : https;
+        const req = lib.request({
+            hostname: u.hostname,
+            port: u.port || (u.protocol === "http:" ? 80 : 443),
+            path: `${u.pathname}${u.search}`,
+            method: "GET",
+            headers,
+            // Explicit servername pins TLS/SNI to the real connection
+            // target. Without it, Node derives SNI from headers.Host,
+            // which would validate the cert against the WRONG hostname
+            // (the public one, not the origin actually being dialed).
+            ...(u.protocol === "https:" ? { servername: u.hostname, rejectUnauthorized: !opts.insecure } : {}),
+        }, (res) => {
+            let body = "";
+            res.on("data", (c) => { body += c; });
+            res.on("end", () => resolve({ status: res.statusCode || 0, body, duration: Date.now() - start }));
+        });
+        req.on("error", (err) => resolve({ status: 0, body: "", duration: Date.now() - start, error: err.message }));
+        const timeoutMs = opts.timeout || 10000;
+        req.setTimeout(timeoutMs, () => {
+            req.destroy();
+            resolve({ status: 0, body: "", duration: Date.now() - start, error: "timeout" });
+        });
+        req.end();
+    });
+}
+function evaluate(body, status, expected, unexpected, expectedStatusCode) {
+    // Report WHICH strings matched/went missing, not just booleans. For security
+    // checks (injected-script IOCs, webshell markers, defacement canaries) the
+    // alert is only actionable if it names the offending string — "IOC _ea_s
+    // matched" vs. an opaque "check failed". `unexpectedStrings` doubles as an
+    // IOC list; `expectedStrings` doubles as an integrity canary (its absence =
+    // possible defacement). Kept as substring matches (no regex) to preserve the
+    // existing config contract.
+    const missingExpected = expected.filter((s) => body.indexOf(s) === -1);
+    const matchedUnexpected = unexpected.filter((s) => body.indexOf(s) !== -1);
+    const hasAllExpectedStrings = missingExpected.length === 0;
+    const hasAnyUnexpectedStrings = matchedUnexpected.length > 0;
+    const statusOk = expectedStatusCode ? status === expectedStatusCode : status >= 200 && status < 400;
+    return { ok: statusOk && hasAllExpectedStrings && !hasAnyUnexpectedStrings, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected };
+}
+async function checkOrigin(ep) {
+    const oc = ep.origin;
+    const r = await rawGet(oc.url, {
+        host: oc.host,
+        headers: oc.headers,
+        query: oc.query,
+        insecure: oc.insecure,
+        timeout: oc.timeout ?? ep.timeout,
+    });
+    if (r.error) {
+        return { url: oc.url, host: oc.host, status: r.status, duration: r.duration, ok: false, error: r.error };
+    }
+    const { ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected } = evaluate(r.body, r.status, oc.expectedStrings ?? ep.expectedStrings ?? [], oc.unexpectedStrings ?? ep.unexpectedStrings ?? [], oc.expectedStatusCode ?? ep.expectedStatusCode);
+    return { url: oc.url, host: oc.host, status: r.status, duration: r.duration, ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected };
+}
 // HTTP uptime/content checks. Emits one client_state per endpoint, matching the
 // frontend `web`/`website` fleetAdapter case ({ url, name, ok, status, duration }).
+// Optionally two-tiered: the public URL (through Cloudflare/CDN) plus a direct
+// origin check, nested under `origin`, so a CDN masking an origin outage still
+// surfaces as a warning even while the public site keeps serving fine.
 export function createWebsitePlugin() {
     let refreshTimer = null;
     const check = async (plugin, ep) => {
         const start = Date.now();
         const label = ep.name || ep.url;
         const uid = `web-${(ep.name || ep.url).replace(/[^a-zA-Z0-9_.-]+/g, "-")}`;
+        let publicResult;
         try {
             const ctrl = new AbortController();
             const t = ep.timeout ? setTimeout(() => ctrl.abort(), ep.timeout) : null;
@@ -15,44 +98,98 @@ export function createWebsitePlugin() {
                 clearTimeout(t);
             const body = await res.text();
             const duration = Date.now() - start;
-            const expected = ep.expectedStrings || [];
-            const unexpected = ep.unexpectedStrings || [];
-            const hasAllExpected = expected.every((s) => body.indexOf(s) !== -1);
-            const hasAnyUnexpected = unexpected.some((s) => body.indexOf(s) !== -1);
-            const statusOk = ep.expectedStatusCode ? res.status === ep.expectedStatusCode : res.ok;
-            const ok = statusOk && hasAllExpected && !hasAnyUnexpected;
-            await plugin.send({
+            const { ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected } = evaluate(body, res.status, ep.expectedStrings || [], ep.unexpectedStrings || [], ep.expectedStatusCode);
+            publicResult = {
                 name: label,
                 url: res.url || ep.url,
                 status: res.status,
                 duration,
                 ok,
                 redirected: res.redirected,
-                hasAllExpectedStrings: hasAllExpected,
-                hasAnyUnexpectedStrings: hasAnyUnexpected,
-            }, uid);
+                hasAllExpectedStrings,
+                hasAnyUnexpectedStrings,
+                missingExpected,
+                matchedUnexpected,
+            };
         }
         catch (err) {
-            await plugin.send({
+            publicResult = {
                 name: label,
                 url: ep.url,
                 status: 0,
                 duration: Date.now() - start,
                 ok: false,
                 error: err.message,
-            }, uid);
+            };
         }
+        const origin = ep.origin?.url ? await checkOrigin(ep) : undefined;
+        // `ok` stays the PUBLIC tier's own result — don't collapse it with
+        // origin.ok. The two tiers are different failure modes with different
+        // severity (public down = real outage; origin-only down = CDN masking
+        // a backend problem, still worth a warning). Collapsing them into one
+        // boolean loses that distinction downstream (ingest branches on
+        // `ok`/`origin.ok` separately to assign error vs warning).
+        await plugin.send({ ...publicResult, origin }, uid);
     };
-    const endpointsOf = (plugin) => {
+    const localEndpointsOf = (plugin) => {
         const cfg = plugin.config || {};
         if (Array.isArray(cfg.endpoints))
             return cfg.endpoints;
-        if (cfg.url)
-            return [{ name: cfg.name, url: cfg.url, expectedStrings: cfg.expectedStrings, unexpectedStrings: cfg.unexpectedStrings }];
+        if (cfg.url) {
+            return [{
+                    name: cfg.name,
+                    url: cfg.url,
+                    expectedStrings: cfg.expectedStrings,
+                    unexpectedStrings: cfg.unexpectedStrings,
+                    expectedStatusCode: cfg.expectedStatusCode,
+                    timeout: cfg.timeout,
+                    origin: cfg.origin,
+                }];
+        }
         return [];
     };
+    // Server-managed endpoints: when the config carries a `configUrl` (the
+    // daemonitor /api/monitors/for-client endpoint) and this client's
+    // `systemKey`, monitors edited in the UI are pulled from there. The last
+    // successful fetch is cached so a transient network/API failure keeps the
+    // previous set running instead of silently dropping every check.
+    let lastRemote = null;
+    const remoteEndpointsOf = async (plugin) => {
+        const cfg = plugin.config || {};
+        const configUrl = cfg.configUrl;
+        const systemKey = cfg.systemKey;
+        if (!configUrl || !systemKey)
+            return null;
+        try {
+            const res = await fetch(configUrl, { headers: { "x-system-key": systemKey } });
+            if (!res.ok)
+                return lastRemote;
+            const body = await res.json();
+            const eps = Array.isArray(body?.endpoints) ? body.endpoints : [];
+            lastRemote = eps;
+            return eps;
+        }
+        catch {
+            return lastRemote;
+        }
+    };
+    const endpointsOf = async (plugin) => {
+        const local = localEndpointsOf(plugin);
+        const remote = await remoteEndpointsOf(plugin);
+        if (remote == null)
+            return local;
+        // Merge by name/url: server-managed monitors win, local-only ones
+        // (defined directly in the config file) are kept alongside.
+        const key = (e) => `${e.name || ""}|${e.url}`;
+        const merged = new Map();
+        for (const e of local)
+            merged.set(key(e), e);
+        for (const e of remote)
+            merged.set(key(e), e);
+        return [...merged.values()];
+    };
     const refreshFn = async (plugin) => {
-        const eps = endpointsOf(plugin);
+        const eps = await endpointsOf(plugin);
         for (const ep of eps) {
             if (ep?.url)
                 await check(plugin, ep);

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -0,0 +1,248 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// WordPress security-posture plugin. Runs on the WP host (where the daemonitor
+// client already runs) and polls the state that the Archpaper intrusions moved
+// through: admin accounts, page statuses, must-use plugins, and the web user's
+// crontab. It emits raw observations only — severity and the new-admin /
+// admin-demotion DIFFS are decided server-side in the ingest handler
+// (clientstate/update.put.ts, case "wordpress"), so an agent restart can't reset
+// the baseline and let a change slip through.
+//
+// Collection is via WP-CLI + filesystem + crontab (no DB credentials, no extra
+// npm dependency) — mirroring MongoDBPlugin's shell-out pattern. Every collector
+// is best-effort and isolated: one failing (e.g. crontab needs root) degrades
+// that one field to null, it never kills the poll.
+const pexec = promisify(execFile);
+// Service-account naming patterns seen in the Archpaper intrusions. Any admin
+// whose login/email contains one of these (case-insensitive substring) is
+// flagged for escalation even before the new-admin diff fires.
+const DEFAULT_SERVICE_PATTERNS = [
+    "wpsvc", "wpengine", "bot", "svc", "researchlabs", "wordpress-svc",
+];
+const DEFAULT_CRITICAL_PAGES = ["login", "home", "index", "front-page"];
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+const MAXBUF = 8 * 1024 * 1024;
+// Run a command in the site's context — inside its LXC container when `lxc` is
+// set (via `sudo -n lxc exec <c> -- …`), else on the host (optionally as
+// `runAs`). Returns stdout, or throws — callers isolate their own failures.
+async function execInSite(site, argv, timeout = 15000) {
+    if (site.lxc) {
+        const lxcBin = site.lxcBin || "lxc";
+        const { stdout } = await pexec("sudo", ["-n", lxcBin, "exec", site.lxc, "--", ...argv], { timeout, maxBuffer: MAXBUF });
+        return stdout;
+    }
+    if (site.runAs) {
+        const { stdout } = await pexec("sudo", ["-n", "-u", site.runAs, ...argv], { timeout, maxBuffer: MAXBUF });
+        return stdout;
+    }
+    const { stdout } = await pexec(argv[0], argv.slice(1), { timeout, maxBuffer: MAXBUF });
+    return stdout;
+}
+// Run `wp <args>` in the site's context. Adds:
+//  --skip-plugins/--skip-themes so a plugin/theme's PHP notices don't get
+//    printed onto stdout ahead of the JSON and break the parse;
+//  --url when known (fixes wp-config reads of $_SERVER['SERVER_NAME']; also
+//    correct for multisite);
+//  --allow-root when running via `lxc exec` (that lands as root in the
+//    container, and WP-CLI refuses root without it).
+async function wp(site, args, timeout = 15000) {
+    const bin = site.wpCli || "wp";
+    const full = [...args, `--path=${site.path}`, "--skip-plugins", "--skip-themes"];
+    if (site.url)
+        full.push(`--url=${site.url}`);
+    if (site.lxc)
+        full.push("--allow-root");
+    return execInSite(site, [bin, ...full], timeout);
+}
+function parseJsonSafe(s, fallback) {
+    try {
+        const v = JSON.parse(s);
+        return v == null ? fallback : v;
+    }
+    catch {
+        return fallback;
+    }
+}
+async function collectSite(site) {
+    const label = site.name || path.basename(site.path || "") || "wordpress";
+    const servicePatterns = (site.servicePatterns || DEFAULT_SERVICE_PATTERNS).map((s) => s.toLowerCase());
+    const criticalPages = (site.criticalPages || DEFAULT_CRITICAL_PAGES).map((s) => s.toLowerCase());
+    const out = { name: label, site: label, url: site.url };
+    // 1. Current administrators (the rogue-admin / demotion signal set).
+    try {
+        const raw = await wp(site, ["user", "list", "--role=administrator", "--fields=ID,user_login,user_email,user_registered", "--format=json"]);
+        const admins = parseJsonSafe(raw, []).map((u) => ({
+            id: String(u.ID ?? ""),
+            login: String(u.user_login ?? ""),
+            email: String(u.user_email ?? ""),
+            registered: u.user_registered ?? null,
+        }));
+        out.admins = admins;
+        // Service-account-pattern admins — flagged locally so they surface even on
+        // the very first poll, before the server-side new-admin diff has a baseline.
+        out.suspiciousAdmins = admins
+            .filter((a) => servicePatterns.some((p) => a.login.toLowerCase().includes(p) || a.email.toLowerCase().includes(p)))
+            .map((a) => ({ login: a.login, email: a.email, reason: "service-account naming pattern" }));
+    }
+    catch (e) {
+        out.adminsError = String(e?.message || e).slice(0, 160);
+    }
+    // 2. WP core version (posture; latest-version comparison is done elsewhere).
+    try {
+        out.wpVersion = (await wp(site, ["core", "version"])).trim();
+    }
+    catch (e) {
+        out.wpVersionError = String(e?.message || e).slice(0, 160);
+    }
+    // 3. Trashed pages/posts — attackers hid the login/home page by trashing it.
+    try {
+        const raw = await wp(site, ["post", "list", "--post_status=trash", "--post_type=page,post", "--fields=ID,post_title,post_name,post_type", "--format=json"]);
+        const trashed = parseJsonSafe(raw, []).map((p) => ({
+            id: String(p.ID ?? ""),
+            title: String(p.post_title ?? ""),
+            slug: String(p.post_name ?? ""),
+            type: String(p.post_type ?? ""),
+        }));
+        out.trashedPages = trashed;
+        out.trashedCriticalPages = trashed.filter((p) => criticalPages.includes(p.slug.toLowerCase()) || criticalPages.includes(p.title.toLowerCase()));
+    }
+    catch (e) {
+        out.trashedError = String(e?.message || e).slice(0, 160);
+    }
+    // 4. mu-plugins auto-load with no UI to disable them — a favorite persistence
+    // spot. Report every .php and which ones aren't in the allowlist. Read via the
+    // container when the site is LXC (the path is inside the container's fs).
+    try {
+        const dir = path.join(site.path, "wp-content", "mu-plugins");
+        let entries;
+        if (site.lxc) {
+            // `ls -1` inside the container; empty/no-dir → treat as no mu-plugins.
+            const out2 = await execInSite(site, ["ls", "-1", dir], 8000).catch(() => "");
+            entries = out2.split("\n").map((s) => s.trim()).filter(Boolean);
+        }
+        else {
+            entries = await readdir(dir);
+        }
+        const php = entries.filter((f) => f.toLowerCase().endsWith(".php"));
+        out.muPlugins = php;
+        if (site.muPluginsAllowlist) {
+            const allow = new Set(site.muPluginsAllowlist);
+            out.unknownMuPlugins = php.filter((f) => !allow.has(f));
+        }
+    }
+    catch {
+        // no mu-plugins dir = fine; leave muPlugins undefined
+    }
+    // 5. Web user's crontab — www-data should almost never have one; the attacker
+    // used it to re-drop webshells every 5 min. Non-empty = alert. `crontab -u`
+    // needs privilege: try direct first, then `sudo -n` (the agent user typically
+    // has passwordless sudo). "no crontab for <user>" is the HEALTHY empty case,
+    // not an error — anything else (still denied) is a real collection failure.
+    const cronUser = site.cronUser || "www-data";
+    const readCron = async () => {
+        // LXC: the web user's crontab lives INSIDE the container (that's where the
+        // persistence would be dropped), so read it there.
+        if (site.lxc) {
+            try {
+                return await execInSite(site, ["crontab", "-l", "-u", cronUser], 8000);
+            }
+            catch (e2) {
+                const msg = String(e2?.stderr || e2?.message || "");
+                // "no crontab for" = empty (healthy). "cannot use this program" /
+                // "not allowed to use" = the user is denied crontab entirely
+                // (cron.deny / not in cron.allow) — that's GOOD posture (can't be used
+                // for persistence), not a collection failure. Treat both as clean.
+                if (/no crontab for|cannot use this program|not allowed to use/i.test(msg))
+                    return "";
+                throw e2;
+            }
+        }
+        try {
+            return (await pexec("crontab", ["-l", "-u", cronUser], { timeout: 8000 })).stdout;
+        }
+        catch (e) {
+            const msg = String(e?.stderr || e?.message || "");
+            if (/no crontab for/i.test(msg))
+                return ""; // empty is fine
+            if (/privileged|not permitted|not allowed|denied/i.test(msg)) {
+                // Retry under sudo; may itself throw "no crontab for" (empty) → catch.
+                try {
+                    return (await pexec("sudo", ["-n", "crontab", "-l", "-u", cronUser], { timeout: 8000 })).stdout;
+                }
+                catch (e2) {
+                    if (/no crontab for/i.test(String(e2?.stderr || e2?.message || "")))
+                        return "";
+                    throw e2;
+                }
+            }
+            throw e;
+        }
+    };
+    try {
+        const stdout = await readCron();
+        const lines = stdout.split("\n").filter((l) => l.trim() && !l.trim().startsWith("#"));
+        out.webUserCrontab = lines.join("\n") || null;
+        out.hasWebUserCrontab = lines.length > 0;
+        out.cronUser = cronUser;
+    }
+    catch (e) {
+        out.cronError = String(e?.stderr || e?.message || e).slice(0, 160);
+    }
+    return out;
+}
+export function createWordpressPlugin() {
+    let refreshTimer = null;
+    const sitesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        if (Array.isArray(cfg.sites) && cfg.sites.length)
+            return cfg.sites;
+        if (cfg.path) {
+            return [{
+                    name: cfg.name,
+                    path: cfg.path,
+                    url: cfg.url,
+                    wpCli: cfg.wpCli,
+                    runAs: cfg.runAs,
+                    lxc: cfg.lxc,
+                    lxcBin: cfg.lxcBin,
+                    cronUser: cfg.cronUser,
+                    muPluginsAllowlist: cfg.muPluginsAllowlist,
+                    criticalPages: cfg.criticalPages,
+                    servicePatterns: cfg.servicePatterns,
+                }];
+        }
+        return [];
+    };
+    const refreshFn = async (plugin) => {
+        const sites = sitesOf(plugin);
+        for (const site of sites) {
+            if (!site?.path)
+                continue;
+            try {
+                const data = await collectSite(site);
+                const uid = `wp-${slug(site.name || site.url || site.path)}`;
+                await plugin.send(data, uid);
+            }
+            catch (e) {
+                const uid = `wp-${slug(site.name || site.url || site.path)}`;
+                await plugin.send({ name: site.name || site.path, error: String(e?.message || e).slice(0, 160) }, uid);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 300000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("wordpress", "wordpress", "WordPress security-posture monitoring plugin", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createWordpressPlugin;

package/package.json

@@ -1,54 +1,50 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
-  "main": "index.ts",
+  "main": "dist/index.js",
   "type": "module",
   "scripts": {
     "build": "tsc",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "prepublishOnly": "npm run build"
   },
   "files": [
     "dist",
     "types"
   ],
   "exports": {
-    ".": "./index.ts",
-    "./lib/*": "./lib/*.ts",
-    "./plugins/*": "./plugins/*.ts"
+    ".": {
+      "types": "./types/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./lib/*": "./dist/lib/*.js",
+    "./plugins/*": "./dist/plugins/*.js"
   },
   "publishConfig": {
-    "access": "public",
-    "main": "dist/index.js",
-    "types": "types/index.d.ts",
-    "exports": {
-      ".": {
-        "types": "./types/index.d.ts",
-        "default": "./dist/index.js"
-      },
-      "./lib/*": "./dist/lib/*.js",
-      "./plugins/*": "./dist/plugins/*.js"
-    }
+    "access": "public"
   },
   "author": "",
   "license": "ISC",
   "packageManager": "pnpm@8.2.0",
   "devDependencies": {
+    "@types/node": "^26.1.1",
     "nuxt": "^3.15.4",
+    "typescript": "^5.8.3",
     "vue": "^3.5.13",
     "vue-router": "^4.5.0"
   },
   "dependencies": {
+    "@daemonitor/common": "^1.0.0",
     "dotenv": "^16.0.3",
     "ewelink-api": "^3.1.1",
     "node-machine-id": "^1.1.12",
     "ohmyfetch": "^0.4.21",
+    "pm2": "^6.0.5",
     "string-to-color": "^2.2.2",
     "ts-node": "^10.9.1",
-    "@daemonitor/common": "^1.0.0",
-    "tsconfig-paths": "^4.2.0",
-    "pm2": "^6.0.5"
+    "tsconfig-paths": "^4.2.0"
   },
   "repository": {
     "type": "git",

package/dist/nuxt.config.js

@@ -1 +0,0 @@
-export default defineNuxtConfig({});

package/dist/plugins/monitoring/CloudflarePlugin.js

@@ -1,84 +0,0 @@
-import { MonitoringPlugin } from "../../lib/MonitoringPlugin.js";
-/**
- * CloudflarePlugin - Receives push updates from Cloudflare Workers
- *
- * This plugin receives data directly from a client's Cloudflare Worker
- * rather than polling for it. The plugin sets up a monitoring endpoint,
- * and the Cloudflare Worker pushes data to this endpoint on a schedule.
- */
-export class CloudflarePlugin extends MonitoringPlugin {
-    lastReportedData = null;
-    lastReportTime = 0;
-    reportingKey;
-    maxDataAge;
-    constructor() {
-        super("cloudflare", "Cloudflare", "Cloudflare Deployment Monitoring Plugin (Push Mode)");
-        this.reportingKey = this.config.reportingKey;
-        this.maxDataAge = this.config.maxDataAge || 5 * 60 * 1000; // Default 5 minutes
-    }
-    async setup() {
-        if (!this.reportingKey) {
-            console.error("Cloudflare reporting key not provided");
-            return Promise.reject("Reporting key not provided");
-        }
-        // Register this instance to receive push updates
-        try {
-            // Normally this would make an API call to register this plugin instance
-            // to receive push updates from Cloudflare Workers with this reporting key
-            console.log(`Cloudflare plugin ready to receive push updates for key: ${this.reportingKey}`);
-            return Promise.resolve();
-        }
-        catch (error) {
-            console.error("Failed to register for Cloudflare push updates:", error);
-            return Promise.reject("Registration failed");
-        }
-    }
-    /**
-     * This method is called when data is pushed from a Cloudflare Worker
-     * It would typically be called by a webhook or socket connection
-     */
-    async receiveUpdate(data, key) {
-        // Verify the reporting key matches
-        if (key !== this.reportingKey) {
-            console.error("Invalid reporting key for Cloudflare update");
-            return;
-        }
-        this.lastReportedData = {
-            ...data,
-            receivedAt: Date.now()
-        };
-        this.lastReportTime = Date.now();
-        // Forward the data to the monitoring system
-        await this.send({
-            ...data,
-            timestamp: Date.now(),
-            status: "ok"
-        });
-    }
-    // This method checks if data is still fresh
-    async refresh() {
-        const now = Date.now();
-        const dataAge = now - this.lastReportTime;
-        // If we have data and it's still fresh, do nothing
-        if (this.lastReportedData && dataAge < this.maxDataAge) {
-            return;
-        }
-        // If data is stale or doesn't exist, report error status
-        await this.send({
-            timestamp: now,
-            error: `No data received in the last ${dataAge / 60000} minutes`,
-            status: "error",
-            lastReportTime: this.lastReportTime
-        });
-    }
-    async monitor() {
-        // Set up interval just to check for stale data
-        this.refreshTimer = setInterval(this.refresh.bind(this), this.config.refreshInterval || 60000 // Default to 1 minute
-        );
-    }
-    async teardown() {
-        // Unregister from receiving push updates
-        clearInterval(this.refreshTimer);
-        return Promise.resolve();
-    }
-}

package/dist/plugins/monitoring/EwelinkPlugin.js

@@ -1,63 +0,0 @@
-import ewelink from "ewelink-api";
-import * as dotenv from "dotenv";
-import { MonitoringPlugin } from "~/lib/MonitoringPlugin";
-dotenv.config();
-export class EwelinkPlugin extends MonitoringPlugin {
-    connection;
-    devices;
-    constructor() {
-        super("ewelink", "Ewelink", "Ewelink Addon");
-        this.name = "Ewelink";
-        this.description = "Ewelink Addon";
-    }
-    async setup() {
-        if (!process.env.EWELINK_EMAIL || !process.env.EWELINK_PASSWORD) {
-            console.error("EWELINK_EMAIL and EWELINK_PASSWORD environment variables must be set");
-            return Promise.reject();
-        }
-        this.connection = new ewelink({
-            email: process.env.EWELINK_EMAIL,
-            password: process.env.EWELINK_PASSWORD
-        });
-        this.refresh().then(() => {
-        });
-        return Promise.resolve();
-    }
-    async get(key) {
-        let [deviceName, propertiesString] = key.split(":");
-        deviceName = deviceName.toLowerCase();
-        const properties = propertiesString.split(",");
-        const device = this.devices?.find((d) => d.name.toLowerCase() === deviceName);
-        if (!device) {
-            return Promise.reject();
-        }
-        const values = {};
-        for (const property of properties) {
-            values[property] = device?.params[property];
-        }
-        return Promise.resolve(values);
-    }
-    async refresh() {
-        /* get all devices */
-        return this.connection.getDevices().then((devices) => {
-            if (Array.isArray(devices) && (Symbol.iterator in Object(devices))) {
-                this.devices = devices;
-                for (const device of this.devices) {
-                    this.send(device, device.deviceid);
-                }
-            }
-            else {
-                console.error("EwelinkPlugin: Invalid response from getDevices()", devices);
-            }
-        });
-    }
-    async monitor() {
-        this.refreshTimer = setInterval(this.refresh.bind(this), this.config.refreshInterval || 30000);
-    }
-    async teardown() {
-        clearInterval(this.refreshTimer);
-    }
-    async render() {
-        return this.devices;
-    }
-}

package/dist/plugins/monitoring/MongoDBPlugin.js

@@ -1,30 +0,0 @@
-import { MonitoringPlugin } from "../../lib/MonitoringPlugin.js";
-import { spawn } from "node:child_process";
-export class MongoDBPlugin extends MonitoringPlugin {
-    childProcess;
-    constructor() {
-        super("mongodb", "mongodb", "MongoDB Monitoring Plugin");
-    }
-    async setup() {
-        // no setup required
-        return Promise.resolve();
-    }
-    async refresh() {
-        // get mongodb db.serverStatus
-    }
-    async monitor() {
-        // this.refreshTimer = setInterval(this.refresh.bind(this), this.config.refreshInterval || 5000)
-        this.childProcess = spawn("mongostat", ["--json", "mongodb://localhost:27017", "10"]);
-        this.childProcess.stdout.on("data", (input) => {
-            const jsonObject = JSON.parse(input.toString());
-            if (!jsonObject["localhost:27017"]) {
-                return;
-            }
-            const data = jsonObject["localhost:27017"];
-            this.send(data, "mongodb-localhost:27017");
-        });
-    }
-    async teardown() {
-        this.childProcess.kill();
-    }
-}

package/index.ts

@@ -1,11 +0,0 @@
-// Export core plugin utilities
-export { PluginConfigProvider } from "./lib/PluginConfigProvider"
-export { PluginManager } from "./lib/PluginManager"
-export { PluginLoader } from "./lib/PluginLoader"
-
-// Only export creation functions, not types
-export { createBasePlugin } from "./lib/BasePlugin"
-export { createMonitoringPlugin } from "./lib/MonitoringPlugin"
-
-// Export the PM2 plugin factory function
-export { createPM2Plugin } from "./plugins/monitoring/PM2Plugin"