spinuptui 0.20.1 → 0.21.1

package/src/lib/uptimeKuma.ts

@@ -41,6 +41,7 @@ export interface KumaBeat {
   time: string
   msg?: string
   ping?: number | null
+  important?: boolean // true on a status-transition row (Kuma's own "important events" flag)
 }
 
 // A notification provider as configured in Kuma (Settings → Notifications) —
@@ -66,6 +67,23 @@ interface Ack {
 const ACK_TIMEOUT_MS = 15_000
 const CONNECT_TIMEOUT_MS = 10_000
 
+// engine.io wraps most transport failures in a TransportError whose `.message`
+// is a fixed literal ("websocket error") with the real reason tucked away in
+// `.description`; a few failure modes (a WebSocket constructor throwing
+// synchronously — seen from Bun's net/tls shim on cert issues) skip that
+// wrapper and hand us a bare Error whose `.message` can be empty. Walk every
+// place a reason might live rather than trusting `.message` alone, so a
+// connect failure never renders as a bare trailing colon.
+function describeConnectError(e: unknown): string {
+  const err = e as { message?: string; description?: unknown; code?: string } | undefined
+  if (err?.message) return err.message
+  const desc = err?.description
+  if (desc instanceof Error && desc.message) return desc.message
+  if (typeof desc === "string" && desc) return desc
+  if (err?.code) return err.code
+  return String(e)
+}
+
 // 32 chars, [A-Za-z0-9] — same shape the Kuma UI generates for push monitors.
 // (Kuma stores whatever the client sends; the token is chosen client-side.)
 export function genPushToken(): string {
@@ -154,7 +172,10 @@ export class KumaClient {
 
   static async connect(url: string): Promise<KumaClient> {
     const base = url.replace(/\/+$/, "")
-    const socket = io(base, { transports: ["websocket"], reconnection: false, timeout: CONNECT_TIMEOUT_MS })
+    // Polling as a fallback (not websocket-only): a reverse proxy/CDN in front of
+    // Kuma that doesn't forward the WebSocket Upgrade headers otherwise hard-fails
+    // the connection outright instead of degrading gracefully.
+    const socket = io(base, { transports: ["websocket", "polling"], reconnection: false, timeout: CONNECT_TIMEOUT_MS })
     const client = new KumaClient(socket)
     await new Promise<void>((resolve, reject) => {
       const t = setTimeout(() => {
@@ -168,7 +189,7 @@ export class KumaClient {
       socket.once("connect_error", (e: Error) => {
         clearTimeout(t)
         socket.disconnect()
-        reject(new KumaError(`Couldn't reach Uptime Kuma at ${base}: ${e.message}`))
+        reject(new KumaError(`Couldn't reach Uptime Kuma at ${base}: ${describeConnectError(e)}`))
       })
     })
     return client
@@ -403,6 +424,27 @@ export function redisPushMonitorPayload(name: string, pushToken: string): Record
   }
 }
 
+// The server-wide PHP-fatal sentinel: one per server (like the Redis sentinel),
+// fed by a root-level cron that greps every site's error.log/debug.log for new
+// "PHP Fatal error" lines — catches PHP dying behind a still-warm page cache,
+// which the plain up/down and fingerprint monitors sleep straight through.
+// Unlike every other monitor kind, a down beat's `msg` carries a comma-separated
+// list of the actual site domain(s) that fataled (this monitor's own domain is
+// just the server's vanity anchor, not the site that's actually broken).
+export function fatalPushMonitorPayload(name: string, pushToken: string): Record<string, unknown> {
+  return {
+    type: "push",
+    name,
+    pushToken,
+    description: "Server-wide PHP fatal sentinel: a root cron greps every site's error/debug log each minute for new PHP fatals and reports up/down. `msg` on a down beat lists the affected domain(s).",
+    interval: 60,
+    retryInterval: 60,
+    maxretries: 2,
+    upsideDown: false,
+    accepted_statuscodes: ["200-299"],
+  }
+}
+
 // The front-page fingerprint monitor (site monitoring Phase 1): a `keyword`
 // monitor asserting the front page still carries the template-identity string
 // calibration derived (lib/siteFingerprint.ts). Catches "the page cache is
@@ -453,6 +495,53 @@ export async function registerFingerprintMonitor(
   return kuma.addMonitor(fingerprintMonitorPayload(name, url, opts.keyword, opts.interval))
 }
 
+// The cache-bypass monitor (site monitoring blind-spot fix, part 2): a plain
+// http monitor on the front page, but with a Cookie header that forces
+// SpinupWP's nginx to bypass the page cache — the same bypass siteDoctor.ts
+// already uses and has verified live. Unlike the health/fingerprint monitors,
+// this actually exercises PHP on every check, so it's deliberately opt-in
+// (not automatic) and meant for a much looser interval than either of those.
+export function bypassMonitorPayload(name: string, url: string, interval: number): Record<string, unknown> {
+  return {
+    type: "http",
+    name,
+    url,
+    method: "GET",
+    interval,
+    retryInterval: 60,
+    resendInterval: 0,
+    maxretries: 2,
+    timeout: 48,
+    accepted_statuscodes: ["200-299"],
+    expiryNotification: false, // the plain health monitor already owns cert expiry
+    ignoreTls: false,
+    upsideDown: false,
+    maxredirects: 10,
+    headers: JSON.stringify({ Cookie: "wordpress_no_cache=1" }),
+  }
+}
+
+// Adopt-or-EDIT-or-create, same philosophy as registerFingerprintMonitor:
+// recalibrating the interval updates the existing row in place so history and
+// notification wiring survive.
+export async function registerBypassMonitor(
+  kuma: KumaClient,
+  domain: string,
+  opts: { proto: "http" | "https"; interval: number; knownId?: number | null },
+): Promise<number> {
+  const name = `${domain} cache-bypass`
+  const url = `${opts.proto}://${domain}/`
+  const monitors = await kuma.getMonitors()
+  const byId = new Map(monitors.map((m) => [m.id, m]))
+  const existingId = (opts.knownId != null && byId.has(opts.knownId) ? opts.knownId : undefined) ?? monitors.find((m) => m.name === name)?.id
+  if (existingId != null) {
+    const full = await kuma.getMonitor(existingId)
+    await kuma.editMonitor({ ...full, type: "http", url, interval: opts.interval, headers: JSON.stringify({ Cookie: "wordpress_no_cache=1" }) })
+    return existingId
+  }
+  return kuma.addMonitor(bypassMonitorPayload(name, url, opts.interval))
+}
+
 // Adopt-or-create the monitors for one domain — THE single implementation shared
 // by the vanity wizard's monitor step and the `m` overlay's add/repair, so the
 // two paths cannot drift. Rules:
@@ -464,8 +553,24 @@ export async function registerFingerprintMonitor(
 export async function registerMonitors(
   kuma: KumaClient,
   domain: string,
-  opts: { proto: "http" | "https"; healthzPath: string; wantPush: boolean; wantRedis?: boolean; known?: KumaMonitorRef | null; pushToken?: string | null },
-): Promise<{ healthId: number; pushId?: number; pushToken?: string; redisId?: number; redisToken?: string }> {
+  opts: {
+    proto: "http" | "https"
+    healthzPath: string
+    wantPush: boolean
+    wantRedis?: boolean
+    wantFatal?: boolean
+    known?: KumaMonitorRef | null
+    pushToken?: string | null
+  },
+): Promise<{
+  healthId: number
+  pushId?: number
+  pushToken?: string
+  redisId?: number
+  redisToken?: string
+  fatalId?: number
+  fatalToken?: string
+}> {
   const monitors = await kuma.getMonitors()
   const byId = new Map(monitors.map((m) => [m.id, m]))
   const byName = new Map(monitors.map((m) => [m.name, m]))
@@ -482,7 +587,12 @@ export async function registerMonitors(
   const existingRedis = opts.wantRedis && live(known.redisId) == null ? byName.get(`${domain} redis`) : undefined
   if (existingRedis?.pushToken) redisToken = existingRedis.pushToken
 
-  const [healthId, pushId, redisId] = await Promise.all([
+  // Same independent-token story as Redis — its own push URL, its own cron line.
+  let fatalToken = known.fatalToken ?? genPushToken()
+  const existingFatal = opts.wantFatal && live(known.fatalId) == null ? byName.get(`${domain} php-fatal`) : undefined
+  if (existingFatal?.pushToken) fatalToken = existingFatal.pushToken
+
+  const [healthId, pushId, redisId, fatalId] = await Promise.all([
     (async () => live(known.healthId) ?? byName.get(domain)?.id ?? (await kuma.addMonitor(healthMonitorPayload(domain, `${opts.proto}://${domain}${opts.healthzPath}`))))(),
     (async () => {
       if (!opts.wantPush) return undefined
@@ -492,6 +602,10 @@ export async function registerMonitors(
       if (!opts.wantRedis) return undefined
       return live(known.redisId) ?? existingRedis?.id ?? (await kuma.addMonitor(redisPushMonitorPayload(`${domain} redis`, redisToken)))
     })(),
+    (async () => {
+      if (!opts.wantFatal) return undefined
+      return live(known.fatalId) ?? existingFatal?.id ?? (await kuma.addMonitor(fatalPushMonitorPayload(`${domain} php-fatal`, fatalToken)))
+    })(),
   ])
   return {
     healthId,
@@ -499,6 +613,8 @@ export async function registerMonitors(
     pushToken: opts.wantPush ? pushToken : undefined,
     redisId,
     redisToken: opts.wantRedis ? redisToken : undefined,
+    fatalId,
+    fatalToken: opts.wantFatal ? fatalToken : undefined,
   }
 }
 

package/src/lib/vanitySite.ts

@@ -6,8 +6,10 @@
 // docs/vanity-site/index.php is the design reference; keep the two in sync.
 
 import { resolve4 } from "node:dns/promises"
+import type { Server } from "../api/types.ts"
 import { SSH_OPTS, sshPort, runProcess, meaningfulError, remoteDocRoot } from "./dbBackup.ts"
 import { pushUrl, LOAD_PUSH_SCALE } from "./uptimeKuma.ts"
+import { runSudoServerOp } from "./ssh.ts"
 
 // The vanity convention: the site living at the server's own hostname. Every
 // feature that special-cases vanity sites (full monitoring, page re-seed) keys
@@ -295,3 +297,75 @@ export async function seedVanityPushCron(t: PushCronTarget): Promise<{ ok: boole
   if (r.code !== 0) return { ok: false, error: meaningfulError(r.stderr, "Couldn't install the heartbeat cron over SSH.") }
   return { ok: true }
 }
+
+const FATAL_CRON_MARKER = "spinup-kuma-fatal"
+const FATAL_SCRIPT_PATH = "/root/spinup-fatal-check.sh"
+const FATAL_INSTALLED_MARKER = "===FATALCRON_INSTALLED"
+
+// Server-wide PHP-fatal sentinel (site monitoring blind-spot fix): SpinupWP's
+// page cache keeps serving `/` even while PHP is fataling on anything the
+// cache doesn't already have — the plain up/down and fingerprint monitors
+// never touch broken PHP as long as the cache stays warm (verified against a
+// real 2026-07-07 incident that sat undetected for 54 of its 68 minutes).
+//
+// Runs as ROOT (via sudo) because it globs every site on the box: a site's
+// own user can't even list `/sites` (confirmed live), let alone read a
+// sibling site's logs once logrotate recreates them `640 root adm`. One
+// monitor covers the whole server rather than one per site, to avoid Kuma
+// "monitor bloat" — a down beat's `msg` carries the actual affected
+// domain(s), since THIS monitor's own name is just the server's vanity
+// anchor, not the site that's actually broken.
+//
+// A PHP fatal can land in either logs/error.log (nginx) or logs/debug.log
+// (WordPress's own log, populated when WP_DEBUG_LOG is on) depending on that
+// site's config — verified live: the real incident above is in debug.log,
+// not error.log. Both are checked for every site.
+const FATAL_CHECK_SCRIPT = `#!/bin/bash
+STATE_DIR=/root/.spinup-fatal-state
+mkdir -p "$STATE_DIR"
+FOUND=""
+for site_dir in /sites/*/; do
+  domain=$(basename "$site_dir")
+  for logname in error.log debug.log; do
+    logfile="\${site_dir}logs/\${logname}"
+    [ -f "$logfile" ] || continue
+    state_file="$STATE_DIR/\${domain}__\${logname}.offset"
+    prev=$(cat "$state_file" 2>/dev/null || echo 0)
+    cur=$(stat -c %s "$logfile" 2>/dev/null || echo 0)
+    [ "$cur" -lt "$prev" ] && prev=0
+    if [ "$cur" -gt "$prev" ] && tail -c +"$((prev + 1))" "$logfile" | grep -q "PHP Fatal error"; then
+      FOUND="\${FOUND:+$FOUND,}$domain"
+    fi
+    echo "$cur" > "$state_file"
+  done
+done
+if [ -n "$FOUND" ]; then
+  curl -fsS --max-time 20 "__PUSH_URL__?status=down&msg=$FOUND" >/dev/null 2>&1
+else
+  curl -fsS --max-time 20 "__PUSH_URL__?status=up&msg=fatal-check-ok" >/dev/null 2>&1
+fi
+`
+
+// Adopt-or-refresh: writes the check script (push URL baked in) and installs
+// the one-line-per-minute crontab entry that invokes it, in ROOT's crontab.
+// Idempotent, same strip-marked-line-then-append idiom as seedVanityPushCron.
+export async function seedFatalMonitorCron(
+  server: Server,
+  opts: { sudoUser: string; sudoPassword: string; kumaUrl: string; pushToken: string },
+): Promise<{ ok: boolean; error?: string }> {
+  const push = pushUrl(opts.kumaUrl, opts.pushToken)
+  const script = FATAL_CHECK_SCRIPT.replace(/__PUSH_URL__/g, push)
+  const scriptB64 = Buffer.from(script, "utf8").toString("base64")
+  return runSudoServerOp(
+    server,
+    { sudoUser: opts.sudoUser, sudoPassword: opts.sudoPassword },
+    () =>
+      [
+        `printf '%s' '${scriptB64}' | base64 -d > ${FATAL_SCRIPT_PATH}`,
+        `chmod +x ${FATAL_SCRIPT_PATH}`,
+        `( crontab -l 2>/dev/null | grep -v -e '${FATAL_CRON_MARKER}' ; echo '* * * * * ${FATAL_SCRIPT_PATH} >/dev/null 2>&1 # ${FATAL_CRON_MARKER}' ) | crontab -`,
+        `echo ${FATAL_INSTALLED_MARKER}`,
+      ].join("\n"),
+    FATAL_INSTALLED_MARKER,
+  )
+}

package/src/ui/Header.tsx

@@ -28,7 +28,13 @@ const SUBTITLES: Record<Route, string> = {
 
 export function Header() {
   const { route, servers, sites, loading, lastUpdated, updateInfo, newServerJob, vanityJob, cloneJob, cloneServer, kumaStatus } = useStore()
-  const kumaDown = [...kumaStatus.values()].filter((s) => s.up === false).length
+  // Name the domain(s) when there are few enough to fit the header row; fall
+  // back to a bare count once there are too many to list safely. Deliberately
+  // still just the plain up/down signal (kumaStatus.up) — not expanding what
+  // counts as "down" here, only how it's displayed.
+  const downDomains = [...kumaStatus.entries()].filter(([, s]) => s.up === false).map(([domain]) => domain)
+  const kumaDown = downDomains.length
+  const kumaDownLabel = kumaDown === 0 ? "" : kumaDown <= 2 ? `${downDomains.map((d) => truncate(d, 24)).join(", ")} down` : `${kumaDown} monitors down`
   const updateReady = updateInfo?.updateAvailable ?? false
   const building = isNewServerInFlight(newServerJob)
   // The sshkey step is the one that waits on the USER (add your key, confirm in
@@ -103,7 +109,9 @@ export function Header() {
           </box>
         )}
         {/* Uptime Kuma: only bad news earns header space — silence when all up. */}
-        {kumaDown > 0 && <text content={`  ▼ ${kumaDown} monitor${kumaDown === 1 ? "" : "s"} down  `} fg={theme.bad} style={{ flexShrink: 0 }} wrapMode="none" />}
+        {kumaDown > 0 && (
+          <text content={`  ▼ ${kumaDownLabel} — 4 to find ${kumaDown === 1 ? "it" : "them"}  `} fg={theme.bad} style={{ flexShrink: 0 }} wrapMode="none" />
+        )}
         {loading && <Spinner interval={100} />}
         <text content={`  ${servers.length} servers · ${sites.length} sites  `} fg={theme.textDim} style={{ flexShrink: 0 }} />
         <text content={lastUpdated ? `updated ${timeAgo(lastUpdated.toISOString())}` : "loading…"} fg={theme.textFaint} style={{ flexShrink: 0 }} />

package/src/ui/store.tsx

@@ -40,8 +40,8 @@ import {
 } from "../lib/providers.ts"
 import { ProvidersCache, type VerifiedConn } from "../lib/providersCache.ts"
 import { recordProviderFor, type DnsRecord, type RecordResult } from "../lib/dnsRecords.ts"
-import { deriveSiteUser, seedVanityIndex, seedVanityPushCron, probeServerRedis, aRecordResolves, isVanityPair } from "../lib/vanitySite.ts"
-import { withKuma, KumaClient, registerMonitors, registerFingerprintMonitor, setMonitorNotifications, genPushToken, rotatePushToken, retargetHealthKeyMonitors, LOAD_PUSH_SCALE } from "../lib/uptimeKuma.ts"
+import { deriveSiteUser, seedVanityIndex, seedVanityPushCron, seedFatalMonitorCron, probeServerRedis, aRecordResolves, isVanityPair } from "../lib/vanitySite.ts"
+import { withKuma, KumaClient, registerMonitors, registerFingerprintMonitor, registerBypassMonitor, setMonitorNotifications, genPushToken, rotatePushToken, retargetHealthKeyMonitors, LOAD_PUSH_SCALE } from "../lib/uptimeKuma.ts"
 import { deriveFingerprint } from "../lib/siteFingerprint.ts"
 import type { StoredProviders } from "../config.ts"
 import { fetchRebootInfo, grantSiteSshKey, revokeSiteSshKey, verifySudo, ensureSpinupKey, listPersonalKeys, keyBody, type RebootInfo } from "../lib/ssh.ts"
@@ -219,6 +219,14 @@ export interface KumaDomainStatus {
   // The server's Redis sentinel (vanity domains only): false = the cron reports
   // Redis unreachable while the server itself is beating fine.
   redisUp: boolean | null
+  // The server-wide PHP-fatal sentinel (vanity domains only): false = a new
+  // fatal was detected on some site on this server (see the down beat's own
+  // message for which one — this field is just "is anything on fire").
+  fatalUp: boolean | null
+  // The cache-bypass monitor (regular sites, opt-in): false = PHP couldn't
+  // render a fresh request even with the page cache skipped — distinct from
+  // `up`, which a warm cache can keep green even when this is failing.
+  bypassUp: boolean | null
 }
 
 // Clone a server to a new server (backlog item 5). Five server-level steps wrapping
@@ -538,6 +546,7 @@ interface StoreValue extends DataState {
   clearVanity: () => void
   vanityHealthKeyFor: (domain: string) => string | null // key baked into the seeded page's ?format=json mode
   kumaConfigured: boolean // an Uptime Kuma connection exists (config or env)
+  kumaUrl: string | null // base URL for deep-linking to a monitor's own Kuma page
   kumaSite: Site | null // site whose Kuma overlay (m) is open
   setKumaSite: (s: Site | null) => void
   kumaOps: Map<number, KumaOp> // in-flight/settled monitor setups, by site id
@@ -547,6 +556,8 @@ interface StoreValue extends DataState {
   startVanityReseed: (site: Site) => void // refresh an existing vanity page (no Kuma needed)
   startKumaRotate: (site: Site) => void // rotate the push token + health key (vanity; old URLs die immediately)
   startFingerprintSetup: (site: Site, intervalSec: number) => void // calibrate + register the front-page fingerprint monitor
+  startBypassMonitorSetup: (site: Site, intervalSec: number) => void // register (or recalibrate) the opt-in cache-bypass monitor
+  removeSiteMonitor: (site: Site, kind: "fingerprint" | "bypass") => void // delete an opt-in per-site monitor (front page / cache bypass only)
   fetchKumaAlerts: (site: Site) => Promise<{ ok: true; providers: KumaAlertProvider[]; monitorIds: number[] } | { ok: false; error: string }> // live read of provider/attachment state
   toggleKumaAlert: (site: Site, providerId: number, on: boolean, monitorIds: number[]) => Promise<{ ok: true } | { ok: false; error: string }>
   clearKumaOp: (siteId: number) => void // forget a settled op so the overlay opens fresh
@@ -2947,7 +2958,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
           // very maintenance windows we create around reboots).
           const beatUp = (s: number) => s !== 0
           for (const [domain, ref] of Object.entries(cfgRef.current.kumaMonitors)) {
-            const status: KumaDomainStatus = { up: null, uptime24: null, responseBeats: [], loadBeats: [], lastLoad: null, fingerprintUp: null, redisUp: null }
+            const status: KumaDomainStatus = { up: null, uptime24: null, responseBeats: [], loadBeats: [], lastLoad: null, fingerprintUp: null, redisUp: null, fatalUp: null, bypassUp: null }
             if (ref.healthId && byId.has(ref.healthId)) {
               const beats = kuma.beatsFor(ref.healthId)
               const last = beats[beats.length - 1]
@@ -2974,6 +2985,16 @@ export function StoreProvider({ children }: { children: ReactNode }) {
               const last = beats[beats.length - 1]
               status.redisUp = last ? beatUp(last.status) : null
             }
+            if (ref.fatalId && byId.has(ref.fatalId)) {
+              const beats = kuma.beatsFor(ref.fatalId)
+              const last = beats[beats.length - 1]
+              status.fatalUp = last ? beatUp(last.status) : null
+            }
+            if (ref.bypassId && byId.has(ref.bypassId)) {
+              const beats = kuma.beatsFor(ref.bypassId)
+              const last = beats[beats.length - 1]
+              status.bypassUp = last ? beatUp(last.status) : null
+            }
             map.set(domain, status)
           }
           return map
@@ -3106,13 +3127,22 @@ export function StoreProvider({ children }: { children: ReactNode }) {
             wantRedis = probe.ok
             if (!probe.ok) redisNote = probe.error ?? "Redis sentinel skipped."
           }
+          // The PHP-fatal sentinel is also server-wide (it globs every site's
+          // logs), but unlike Redis it needs ROOT — a regular site user can't
+          // even list /sites (confirmed live). Only offer it when sudo is
+          // already connected for this server; otherwise skip quietly rather
+          // than blocking the rest of setup, and say what unlocks it.
+          const sudoReady = isVanity && !!server && isSudoConnected(server.id)
+          const wantFatal = sudoReady
+          let fatalNote: string | null = null
+          if (isVanity && server && !sudoReady) fatalNote = "PHP-fatal sentinel skipped — connect sudo (S) first, then re-run to add it."
           setOp({ status: "running", detail: "Registering monitors in Uptime Kuma…" })
           const known = cfgRef.current.kumaMonitors[domain] ?? {}
           // Monitor over the protocol the site actually serves — an https monitor
           // on an http-only site would be permanently down.
           const proto = site.https?.enabled ? "https" : "http"
           const { result, jwt } = await withKuma(conn, (kuma) =>
-            registerMonitors(kuma, domain, { proto, healthzPath: isVanity ? "/?healthz" : "/", wantPush: isVanity, wantRedis, known }),
+            registerMonitors(kuma, domain, { proto, healthzPath: isVanity ? "/?healthz" : "/", wantPush: isVanity, wantRedis, wantFatal, known }),
           )
           persistKumaAuth(conn, jwt)
           persistKumaMonitors(domain, {
@@ -3122,16 +3152,28 @@ export function StoreProvider({ children }: { children: ReactNode }) {
             pushToken: result.pushToken ?? known.pushToken,
             redisId: result.redisId ?? known.redisId,
             redisToken: result.redisToken ?? known.redisToken,
+            fatalId: result.fatalId ?? known.fatalId,
+            fatalToken: result.fatalToken ?? known.fatalToken,
           })
           if (isVanity && result.pushId && result.pushToken && server) {
             setOp({ status: "running", detail: "Installing the heartbeat cron…" })
             const cron = await seedVanityPushCron({ ...ssh, kumaUrl: conn.url, pushToken: result.pushToken, redisToken: result.redisId != null ? (result.redisToken ?? known.redisToken ?? null) : null })
             if (!cron.ok) throw new Error(cron.error || "Couldn't install the heartbeat cron.")
           }
+          if (sudoReady && server && result.fatalId && result.fatalToken) {
+            setOp({ status: "running", detail: "Installing the PHP-fatal check (sudo)…" })
+            const sudoUser = sudoUsers.get(server.id) ?? ""
+            const sudoPassword = sudoPwRef.current.get(server.id) ?? ""
+            const fatalCron = await seedFatalMonitorCron(server, { sudoUser, sudoPassword, kumaUrl: conn.url, pushToken: result.fatalToken })
+            if (!fatalCron.ok) {
+              if (/password was rejected|password is required|can't run sudo|couldn't connect/i.test(fatalCron.error ?? "")) disconnectSudo(server.id)
+              fatalNote = `PHP-fatal sentinel skipped — ${fatalCron.error ?? "couldn't install the cron."}`
+            }
+          }
           setOp({
             status: "done",
             detail: isVanity
-              ? `Monitors live: healthz checks + load graph${result.redisId != null ? " + Redis sentinel" : ""} (cron beating every minute).${redisNote ? ` ${redisNote}` : ""}`
+              ? `Monitors live: healthz checks + load graph${result.redisId != null ? " + Redis sentinel" : ""}${result.fatalId != null && !fatalNote ? " + PHP-fatal sentinel" : ""} (cron beating every minute).${redisNote ? ` ${redisNote}` : ""}${fatalNote ? ` ${fatalNote}` : ""}`
               : "Monitor live: homepage checks + certificate-expiry alerts.",
           })
         } catch (err) {
@@ -3140,7 +3182,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
       }
       void run()
     },
-    [servers, reseedVanityPage, persistKumaAuth, persistKumaMonitors],
+    [servers, reseedVanityPage, persistKumaAuth, persistKumaMonitors, isSudoConnected, sudoUsers, disconnectSudo],
   )
 
   // Calibrate + register the front-page fingerprint monitor (site monitoring
@@ -3186,6 +3228,76 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     [persistKumaAuth, persistKumaMonitors],
   )
 
+  // Register (or recalibrate) the per-site cache-bypass monitor (site
+  // monitoring blind-spot fix, part 2): opt-in, deliberately a much looser
+  // interval than health/fingerprint since it forces a real PHP render on
+  // every check, unlike those two which are served straight from cache.
+  const startBypassMonitorSetup = useCallback(
+    (site: Site, intervalSec: number) => {
+      const conn = cfgRef.current.uptimeKuma
+      if (!conn || isDevMode()) return
+      const setOp = (op: KumaOp) => setKumaOps((prev) => new Map(prev).set(site.id, op))
+      const run = async () => {
+        try {
+          const domain = site.domain
+          const proto = site.https?.enabled ? "https" : "http"
+          const known = cfgRef.current.kumaMonitors[domain] ?? {}
+          setOp({ status: "running", detail: "Registering the cache-bypass monitor…" })
+          const { result: bypassId, jwt } = await withKuma(conn, (kuma) =>
+            registerBypassMonitor(kuma, domain, { proto, interval: intervalSec, knownId: known.bypassId }),
+          )
+          persistKumaAuth(conn, jwt)
+          persistKumaMonitors(domain, { ...known, bypassId })
+          const win = intervalSec % 3600 === 0 ? `${intervalSec / 3600}h` : `${Math.round(intervalSec / 60)}m`
+          setOp({ status: "done", detail: `Cache-bypass check live — forces a fresh render every ${win}, bypassing the page cache.` })
+        } catch (err) {
+          setOp({ status: "error", detail: "", error: (err as Error).message })
+        }
+      }
+      void run()
+    },
+    [persistKumaAuth, persistKumaMonitors],
+  )
+
+  // Remove an opt-in per-site monitor (front-page fingerprint or cache-bypass)
+  // — deliberately NOT offered for health/push/redis/fatal, which are all
+  // re-derived automatically on the next `a`/`R` press (no persisted opt-out
+  // exists for them yet), so "removing" one there would just silently
+  // reappear. These two are genuinely opt-in: pressing `a` after removal
+  // just reopens the picker, nothing re-creates them on its own.
+  const removeSiteMonitor = useCallback(
+    (site: Site, kind: "fingerprint" | "bypass") => {
+      const conn = cfgRef.current.uptimeKuma
+      if (!conn || isDevMode()) return
+      const setOp = (op: KumaOp) => setKumaOps((prev) => new Map(prev).set(site.id, op))
+      const run = async () => {
+        try {
+          const domain = site.domain
+          const known = cfgRef.current.kumaMonitors[domain] ?? {}
+          const id = kind === "fingerprint" ? known.fingerprintId : known.bypassId
+          const label = kind === "fingerprint" ? "Front-page" : "Cache-bypass"
+          if (id == null) return setOp({ status: "done", detail: "Already removed." })
+          setOp({ status: "running", detail: `Removing the ${label.toLowerCase()} monitor…` })
+          const { jwt } = await withKuma(conn, (kuma) => kuma.deleteMonitor(id))
+          persistKumaAuth(conn, jwt)
+          const next = { ...known }
+          if (kind === "fingerprint") {
+            delete next.fingerprintId
+            delete next.fingerprint
+          } else {
+            delete next.bypassId
+          }
+          persistKumaMonitors(domain, next)
+          setOp({ status: "done", detail: `${label} monitor removed.` })
+        } catch (err) {
+          setOp({ status: "error", detail: "", error: (err as Error).message })
+        }
+      }
+      void run()
+    },
+    [persistKumaAuth, persistKumaMonitors],
+  )
+
   // Load the alert wiring for one site: every notification provider configured
   // in Kuma, and whether each is attached to this site's Spinup monitors. The
   // view calls this on demand (`n` in the overlay) — it's a live read, not
@@ -4083,6 +4195,9 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     clearVanity,
     vanityHealthKeyFor,
     kumaConfigured: !isDevMode() && cfgRef.current.uptimeKuma != null,
+    // Base URL for deep-linking straight to a monitor's own Kuma page
+    // (`${kumaUrl}/dashboard/${id}`) — null in Dev Mode / when unconfigured.
+    kumaUrl: !isDevMode() ? (cfgRef.current.uptimeKuma?.url ?? null) : null,
     kumaSite,
     setKumaSite,
     kumaOps,
@@ -4092,6 +4207,8 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     startVanityReseed,
     startKumaRotate,
     startFingerprintSetup,
+    startBypassMonitorSetup,
+    removeSiteMonitor,
     fetchKumaAlerts,
     toggleKumaAlert,
     clearKumaOp,