@daemonitor/plugins 1.1.42 → 1.1.43

package/dist/plugins/monitoring/AdsensePlugin.js

@@ -32,8 +32,8 @@ export function reportStart(today) {
 }
 export function reportUrl(account, start, end, bySite = false) {
     const q = new URLSearchParams({ dateRange: "CUSTOM", reportingTimeZone: "ACCOUNT_TIME_ZONE", dimensions: "DATE" });
-    // DOMAIN_NAME, not OWNED_SITE_DOMAIN_NAME: the owned-site rows nest (archpaper.com
-    // contains www.archpaper.com and jobs.archpaper.com), so they double count.
+    // DOMAIN_NAME, not OWNED_SITE_DOMAIN_NAME: the owned-site rows nest (example.com
+    // contains www.example.com and jobs.example.com), so they double count.
     if (bySite)
         q.append("dimensions", "DOMAIN_NAME");
     for (const [k, v] of [["startDate", start], ["endDate", end]]) {
@@ -183,7 +183,7 @@ export function createAdsensePlugin() {
         }
         catch { /* totals only */ }
         return {
-            // The account's own name ("The Architect's Newspaper") labels the service.
+            // The account's own name labels the service.
             // It overrides the plugin's instance name, which only says "AdSense".
             ...(account.displayName ? { name: account.displayName } : {}),
             accountId: account.name,

package/dist/plugins/monitoring/Ga4Plugin.js

@@ -102,7 +102,7 @@ export function pagesRequest(startDate, exclude = []) {
 const bareHost = (h) => h.trim().toLowerCase().replace(/^www\./, "");
 /**
  * A pages report -> the most viewed pages per host. `/a` and `/a/` add up, and a
- * site name most titles end in (" | The Architect's Newspaper") comes off.
+ * site name most titles end in (" | Example Site") comes off.
  */
 export function parsePages(report) {
     const rows = (report?.rows || []).map((r) => ({

package/dist/plugins/monitoring/LogWatchPlugin.js

@@ -28,7 +28,7 @@ function parseLine(line) {
     const ips = tokens.filter((t) => IP_TOKEN.test(t));
     const ip = ips.length ? ips[ips.length - 1] : (tokens[0] || "");
     // A host in the leading field is what lets a SHARED access log (one file for
-    // every vhost, as on the misc box) still say WHICH site was hit. A plain
+    // every vhost) still say WHICH site was hit. A plain
     // combined line leads with the client IP instead, so only a non-IP first
     // token counts. When $host is itself an IP — a request made straight to the
     // origin address — there is no site name to report and "" is correct.
@@ -196,7 +196,7 @@ export function analyze(lines, cfg, windowSec, st, rules = []) {
     // batch/v1 finding so it leads.
     // Only call it a takeover when the login status is trustworthy for this site
     // AND the IP went on to load an admin screen successfully. Either half alone
-    // produced a false "account takeover" page on archpaper.com, 2026-08-23.
+    // would page a false "account takeover".
     const authed = (ip) => !st?.hideLogin && loginOkIps.has(ip) && adminOkIps.has(ip);
     for (const [ip, count] of batchIps) {
         if (authed(ip)) {

package/dist/plugins/monitoring/WordpressPlugin.js

@@ -4,7 +4,7 @@ import { readdir } from "node:fs/promises";
 import * as path from "node:path";
 import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 // WordPress security-posture plugin. Runs on the WP host (where the daemonitor
-// client already runs) and polls the state that the Archpaper intrusions moved
+// client already runs) and polls the state that WordPress intrusions tend to move
 // through: admin accounts, page statuses, must-use plugins, and the web user's
 // crontab. It emits raw observations only — severity and the new-admin /
 // admin-demotion DIFFS are decided server-side in the ingest handler
@@ -16,11 +16,11 @@ import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
 // is best-effort and isolated: one failing (e.g. crontab needs root) degrades
 // that one field to null, it never kills the poll.
 const pexec = promisify(execFile);
-// Service-account naming patterns seen in the Archpaper intrusions. Any admin
+// Service-account naming patterns common in WordPress intrusions. Any admin
 // whose login/email contains one of these (case-insensitive substring) is
 // flagged for escalation even before the new-admin diff fires.
 const DEFAULT_SERVICE_PATTERNS = [
-    "wpsvc", "wpengine", "bot", "svc", "researchlabs", "wordpress-svc",
+    "wpsvc", "wpengine", "bot", "svc", "wordpress-svc",
 ];
 const DEFAULT_CRITICAL_PAGES = ["login", "home", "index", "front-page"];
 function slug(s) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.42",
+  "version": "1.1.43",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",