Changeset 3751893

Timestamp:

10/17/2026 12:24:00 PM (2 weeks ago)

Author:

heera

Message:

Update to version 1.51.9 from GitHub

Location:

agentimus

Files:

• tags/1.51.9 (copied) (copied from agentimus/trunk )
• tags/1.51.9/agentimus.php (modified) (2 diffs)
• tags/1.51.9/inc/Abilities/Registrar.php (modified) (1 diff)
• tags/1.51.9/inc/Admin.php (modified) (1 diff)
• tags/1.51.9/inc/Cloudflare/Client.php (modified) (1 diff)
• tags/1.51.9/inc/Cloudflare/Conflicts.php (modified) (8 diffs)
• tags/1.51.9/inc/Cloudflare/Module.php (modified) (6 diffs)
• tags/1.51.9/inc/Cloudflare/SpoofCheck.php (modified) (2 diffs)
• tags/1.51.9/inc/Cloudflare/Table.php (modified) (17 diffs)
• tags/1.51.9/readme.txt (modified) (3 diffs)
• tags/1.51.9/uninstall.php (modified) (1 diff)
• tags/1.51.9/vendor/composer/installed.php (modified) (2 diffs)
• trunk/agentimus.php (modified) (2 diffs)
• trunk/inc/Abilities/Registrar.php (modified) (1 diff)
• trunk/inc/Admin.php (modified) (1 diff)
• trunk/inc/Cloudflare/Client.php (modified) (1 diff)
• trunk/inc/Cloudflare/Conflicts.php (modified) (8 diffs)
• trunk/inc/Cloudflare/Module.php (modified) (6 diffs)
• trunk/inc/Cloudflare/SpoofCheck.php (modified) (2 diffs)
• trunk/inc/Cloudflare/Table.php (modified) (17 diffs)
• trunk/readme.txt (modified) (3 diffs)
• trunk/uninstall.php (modified) (1 diff)
• trunk/vendor/composer/installed.php (modified) (2 diffs)

agentimus/tags/1.51.9/agentimus.php

@@ -4 +4 @@
  * Plugin URI:        https://github.com/heera/agentimus
  * Description:       Make your site agent-ready (llms.txt, markdown, JSON-LD, a /.well-known discovery document, AI-crawl controls, agent-activity log) AND let the AI tools you use operate it over MCP — read your data and, opt-in, draft/edit/publish posts. Lightweight, no SEO bloat.
- * Version:           1.51.8
+ * Version:           1.51.9
  * Requires at least: 6.0
  * Requires PHP:      7.4
@@ -20 +20 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'AGENTIMUS_VERSION', '1.51.8' );
+define( 'AGENTIMUS_VERSION', '1.51.9' );
 define( 'AGENTIMUS_FILE', __FILE__ );
 define( 'AGENTIMUS_DIR', plugin_dir_path( __FILE__ ) );

agentimus/tags/1.51.9/inc/Abilities/Registrar.php

@@ -587 +587 @@
                                                         'origin'       => self::i( 'Requests that reached this server.' ),
                                                         'blocked'      => self::i( 'Requests the edge turned away without contacting this server.' ),
+                                                        'probes'       => self::i( 'Of the blocked requests, how many asked for a file no reader fetches (a .env, a .git folder, a wp-config copy): a scanner using this crawler\'s name. Never counted as the edge turning this crawler away.' ),
                                                         'served'       => self::i( 'Requests that got a page: a 2xx the edge let through, not counting /robots.txt reads. Passing the edge is not taking content — a request the origin answered 403 or 404 took nothing.' ),
                                                         'bytes'        => self::i(),

agentimus/tags/1.51.9/inc/Admin.php

@@ -993 +993 @@
                                 // ⭐ A security-only release gets ONE row (1.51.1): the fix is the
                                 // whole release, and there is one thing an owner may want to do.
-                                // ⭐ So does a one-fix release (1.51.8) — plain-permalink term pages
-                                // named in the log and the search screens.
+                                // ⭐ So does a one-fix release (1.51.9) — a scanner's probes no longer
+                                // raise the Cloudflare warning. ⛔ No company is named: the release
+                                // text names no specific bot (his ruling, 1.51.3 and 1.51.4).
                                 array(
-                                        'icon'  => 'page',
-                                        'title' => 'Tag Pages Named on Plain Permalinks',
-                                        'text'  => 'On a site with plain permalinks, the Request Log called every tag and category page Homepage. It now shows the tag or category name, here and in your search results.',
+                                        'icon'  => 'shield',
+                                        'title' => 'Scanners No Longer Trip the Cloudflare Warning',
+                                        'text'  => 'A scanner that used an AI crawler\'s name to look for secret files like .env could make it look as if Cloudflare was blocking that company. Those requests are now counted apart, and only real blocks raise the warning.',
                                 ),
                         ),

agentimus/tags/1.51.9/inc/Cloudflare/Client.php

@@ -215 +215 @@
 
         /**
+         * Hourly edge-refused requests for a window, one row per (hour, user agent,
+         * path) — the paths {@see Module::aggregate()} needs to tell a scanner's
+         * probe from a reader being turned away. The filter is the same "blocked"
+         * test as {@see blocked_sources()}. The paths are read here, classified in
+         * the poll and never stored: the table keeps only the count.
+         *
+         * @param string $token   API token, plaintext.
+         * @param string $zone_id Zone tag.
+         * @param int    $since   Window start, Unix UTC.
+         * @param int    $until   Window end, Unix UTC.
+         * @return array { rows?: array<int,array{hour:string,ua:string,path:string,requests:int}>, error?: string }
+         */
+        public function blocked_paths( $token, $zone_id, $since, $until ) {
+                $query = 'query ($zone: String!, $since: Time!, $until: Time!) {
+                        viewer {
+                                zones(filter: { zoneTag: $zone }) {
+                                        httpRequestsAdaptiveGroups(
+                                                limit: ' . self::GRAPHQL_LIMIT . ',
+                                                filter: { datetime_geq: $since, datetime_lt: $until, requestSource: "eyeball", edgeResponseStatus_in: [403, 429], originResponseStatus: 0 },
+                                                orderBy: [count_DESC]
+                                        ) {
+                                                count
+                                                dimensions { datetimeHour userAgent clientRequestPath }
+                                        }
+                                }
+                        }
+                }';
+
+                $out = $this->graphql( $token, $query, array(
+                        'zone'  => (string) $zone_id,
+                        'since' => gmdate( 'Y-m-d\TH:i:s\Z', (int) $since ),
+                        'until' => gmdate( 'Y-m-d\TH:i:s\Z', (int) $until ),
+                ) );
+                if ( isset( $out['error'] ) ) {
+                        return $out;
+                }
+
+                // The expected container, or it's an error — never "real empty data".
+                if ( ! isset( $out['json']['data']['viewer']['zones'][0]['httpRequestsAdaptiveGroups'] ) ) {
+                        return array( 'error' => __( 'Cloudflare returned an unexpected response shape.', 'agentimus' ) );
+                }
+
+                $rows = array();
+                foreach ( (array) $out['json']['data']['viewer']['zones'][0]['httpRequestsAdaptiveGroups'] as $g ) {
+                        if ( ! isset( $g['dimensions'] ) ) {
+                                continue;
+                        }
+                        $d      = (array) $g['dimensions'];
+                        $rows[] = array(
+                                'hour'     => (string) ( isset( $d['datetimeHour'] ) ? $d['datetimeHour'] : '' ),
+                                'ua'       => (string) ( isset( $d['userAgent'] ) ? $d['userAgent'] : '' ),
+                                'path'     => (string) ( isset( $d['clientRequestPath'] ) ? $d['clientRequestPath'] : '' ),
+                                'requests' => (int) ( isset( $g['count'] ) ? $g['count'] : 0 ),
+                        );
+                }
+
+                return array( 'rows' => $rows );
+        }
+
+        /**
          * Hourly /robots.txt requests for a window, in the same row shape as
          * {@see hourly_traffic()}. Those rows carry no path, so a crawler reading

agentimus/tags/1.51.9/inc/Cloudflare/Conflicts.php

@@ -62 +62 @@
          * the owner fixing the cause, instead of shouting for a week about history.
          *
-         * @param array      $crawlers Per-crawler totals: { ua, name, operator, requests, cached, origin, blocked, served }.
+         * @param array      $crawlers Per-crawler totals: { ua, name, operator, requests, cached, origin, blocked, probes?, served }.
          * @param array      $policy   The owner's declarations:
          *                             - ai_input (bool)        robots Content-Signal ai-input.
@@ -69 +69 @@
          *                             - allowed_agents (array) user-agent rules the OWNER allowed in the review queue.
          * @param int        $days     The window the totals cover, for the copy.
-         * @param array|null $recent   Last-24h per-crawler map { ua => { blocked, passed, served } }
+         * @param array|null $recent   Last-24h per-crawler map { ua => { blocked, probes?, passed, served } }
          *                             (see Table::recent()), or null to treat all
          *                             evidence as current.
@@ -94 +94 @@
                                         continue;
                                 }
-                                $blocked  = (int) $c['blocked'];
-                                $requests = (int) $c['requests'];
+                                // A blocked probe is no reader turned away ({@see refused()}) — and
+                                // no reading attempt either, so it leaves the share's base too.
+                                $blocked  = self::refused( $c );
+                                $requests = (int) $c['requests'] - self::probes( $c );
                                 $op       = (string) $c['operator'];
                                 if ( '' === $op || $blocked < self::MIN_BLOCKED || $blocked < $requests * self::MIN_BLOCKED_SHARE ) {
@@ -103 +105 @@
                                 // blocking fires — otherwise the fix already landed and the warning
                                 // would just be nagging about history.
-                                if ( null !== $recent && empty( $recent[ $token ]['blocked'] ) ) {
+                                if ( null !== $recent && ( ! isset( $recent[ $token ] ) || 0 === self::refused( $recent[ $token ] ) ) ) {
                                         continue;
                                 }
@@ -111 +113 @@
                                 $per_operator[ $op ]['blocked']  += $blocked;
                                 $per_operator[ $op ]['requests'] += $requests;
-                                $per_operator[ $op ]['recent']   += null !== $recent ? (int) $recent[ $token ]['blocked'] : 0;
+                                $per_operator[ $op ]['recent']   += null !== $recent ? self::refused( $recent[ $token ] ) : 0;
                         }
 
@@ -294 +296 @@
 
         /**
+         * The requests the edge turned away that were a READER being refused: the
+         * blocked count less the scanner probes in it ({@see Module::is_probe_path()}).
+         * A row stored before probes were counted has none, and counts as before.
+         *
+         * @param array $row Any totals row carrying `blocked` and optionally `probes`.
+         * @return int
+         */
+        public static function refused( array $row ) {
+                return max( 0, ( isset( $row['blocked'] ) ? (int) $row['blocked'] : 0 ) - self::probes( $row ) );
+        }
+
+        /**
+         * The scanner probes within a row's blocked count, never more than it.
+         *
+         * @param array $row Any totals row.
+         * @return int
+         */
+        private static function probes( array $row ) {
+                $blocked = isset( $row['blocked'] ) ? (int) $row['blocked'] : 0;
+                return min( $blocked, isset( $row['probes'] ) ? max( 0, (int) $row['probes'] ) : 0 );
+        }
+
+        /**
          * The slug an operator's warn conflict carries in its id
          * ("edge-blocks-<slug>"). One transform, shared with every reader that has
@@ -330 +355 @@
          * Pure — no DB, no time() — so it unit-tests standalone, like detect().
          *
-         * @param array  $daily    Day => ua => { requests, blocked, passed, served }, oldest first ({@see Table::daily()}).
+         * @param array  $daily    Day => ua => { requests, blocked, probes?, passed, served }, oldest first ({@see Table::daily()}).
          * @param string $id       The conflict id to date.
          * @param array  $operators ua => operator name, for the per-operator rollup a warn conflict uses.
@@ -367 +392 @@
                                         continue;
                                 }
-                                $sums['blocked']  += (int) $t['blocked'];
-                                $sums['requests'] += (int) $t['requests'];
+                                $sums['blocked']  += self::refused( $t );
+                                $sums['requests'] += (int) $t['requests'] - self::probes( $t );
                         }
                         return $sums['blocked'] >= self::MIN_BLOCKED

agentimus/tags/1.51.9/inc/Cloudflare/Module.php

@@ -152 +152 @@
                 $since  = $latest > 0 ? $latest - self::OVERLAP_SECONDS : $now - self::BACKFILL_SECONDS;
                 $since  = max( $since, $now - self::BACKFILL_SECONDS );
+                // ⛔ An hour stored before probes were counted keeps saying "no probes"
+                // until it is re-read — and the overlap only re-reads two hours, so a
+                // scanner's morning would go on firing the warning for a day and
+                // inflating the week for seven. Once, re-read everything Cloudflare
+                // still holds; a re-read hour replaces its row.
+                $backfill = ! get_option( Table::PROBES_OPTION );
+                if ( $backfill ) {
+                        $since = $now - self::BACKFILL_SECONDS;
+                }
 
                 while ( $since < $now ) {
@@ -164 +173 @@
                                 }
                         }
+                        if ( ! isset( $out['error'] ) ) {
+                                // Same rule for the blocked paths: without them every scanner probe
+                                // would be stored as a reader turned away.
+                                $paths = $this->client->blocked_paths( $token, $zone, $since, $until );
+                                if ( isset( $paths['error'] ) ) {
+                                        $out = $paths;
+                                }
+                        }
                         if ( isset( $out['error'] ) ) {
                                 // Keep the last good data; the panel shows the numbers' age and this note.
@@ -169 +186 @@
                                 return;
                         }
-                        Table::upsert( self::aggregate( (array) $out['rows'], (array) $robots['rows'] ) );
+                        Table::upsert( self::aggregate( (array) $out['rows'], (array) $robots['rows'], (array) $paths['rows'] ) );
                         $since = $until;
                 }
 
                 $this->settings->record_poll( '' );
+                if ( $backfill ) {
+                        update_option( Table::PROBES_OPTION, 1, false );
+                }
                 Table::prune();
 
@@ -200 +220 @@
          * answers 403 or 404 took nothing. The training notice counts this.
          *
+         * Within `blocked`, `probes` counts the requests for a path no reader asks
+         * for ({@see is_probe_path()}). ⛔⛔ A BLOCKED PROBE IS NOT A READER TURNED
+         * AWAY. On heera.it (2026-10-17) "Cloudflare is blocking Anthropic" and
+         * "…You.com" were one scanner on Google Cloud asking for .env files under
+         * both names, stopped by his own bad-paths rule — the third time after
+         * OpenAI (08-29, 09-17). Neither company publishes addresses to check, so
+         * the spoof check could only say "unknown"; the path says it plainly.
+         *
          * @param array $raw    Rows from Client::hourly_traffic().
          * @param array $robots Rows from Client::robots_fetches() for the same window.
+         * @param array $paths  Rows from Client::blocked_paths() for the same window.
          * @return array<int,array> Rows shaped for Table::upsert().
          */
-        public static function aggregate( array $raw, array $robots = array() ) {
+        public static function aggregate( array $raw, array $robots = array(), array $paths = array() ) {
                 $cached_statuses = array( 'hit', 'stale', 'updating', 'revalidated' );
                 $buckets         = array();
@@ -227 +256 @@
                                         'origin'   => 0,
                                         'blocked'  => 0,
+                                        'probes'   => 0,
                                         'served'   => 0,
                                         'bytes'    => 0,
@@ -257 +287 @@
                 }
 
+                foreach ( $paths as $row ) {
+                        $key = self::hour_key( (string) $row['hour'] ) . '|' . self::crawler_token( (string) $row['ua'] );
+                        if ( isset( $buckets[ $key ] ) && self::is_probe_path( (string) $row['path'] ) ) {
+                                $buckets[ $key ]['probes'] += (int) $row['requests'];
+                        }
+                }
+                // Two reads of the same window can disagree by a few requests; a probe
+                // count is a share of `blocked` and never more than it.
+                foreach ( $buckets as $key => $bucket ) {
+                        $buckets[ $key ]['probes'] = min( $bucket['probes'], $bucket['blocked'] );
+                }
+
                 return array_values( $buckets );
+        }
+
+        /**
+         * Whether a request path is a scanner's probe — a secret or a config file
+         * that no reader of the site, human or AI, ever asks for.
+         *
+         * Deliberately narrow: hidden files and folders (/.env, /.git/config,
+         * /.aws/credentials — every one except /.well-known/), anything ending in
+         * .env, wp-config.* copies, database dumps and editor backups, phpinfo, and
+         * Vite's /@fs/ file-read hole. An ordinary page, a feed or robots.txt is
+         * never a probe. Decoded first, so /admin%2F.env is caught like /admin/.env.
+         *
+         * @param string $path Request path, as Cloudflare reports it.
+         * @return bool
+         */
+        public static function is_probe_path( $path ) {
+                $path = strtolower( (string) $path );
+                for ( $i = 0; $i < 2 && false !== strpos( $path, '%' ); $i++ ) {
+                        $path = rawurldecode( $path );
+                }
+                $path = (string) strtok( $path, '?' );
+
+                foreach ( explode( '/', str_replace( '\\', '/', $path ) ) as $segment ) {
+                        if ( '' === $segment || '.' === $segment || '..' === $segment || '.well-known' === $segment ) {
+                                continue;
+                        }
+                        if ( '.' === $segment[0] || '@fs' === $segment || 0 === strpos( $segment, 'wp-config' ) || 0 === strpos( $segment, 'phpinfo' ) ) {
+                                return true;
+                        }
+                        if ( preg_match( '/\.(env|sql|bak|swp)$/', $segment ) ) {
+                                return true;
+                        }
+                }
+                return false;
         }
 

agentimus/tags/1.51.9/inc/Cloudflare/SpoofCheck.php

@@ -184 +184 @@
          * @param array $crawlers Rows with { ua, operator }.
          * @param array $policy   The declarations {@see Conflicts::detect()} takes.
-         * @param array $recent   ua => { blocked, passed } ({@see Table::recent()}).
+         * @param array $recent   ua => { blocked, probes?, passed } ({@see Table::recent()}).
          * @return array<string,int> operator => blocked requests.
          */
@@ -196 +196 @@
                         }
                         $out[ $op ] = ( isset( $out[ $op ] ) ? $out[ $op ] : 0 )
-                                + ( isset( $recent[ $ua ]['blocked'] ) ? (int) $recent[ $ua ]['blocked'] : 0 );
+                                + ( isset( $recent[ $ua ] ) ? Conflicts::refused( (array) $recent[ $ua ] ) : 0 );
                 }
                 return $out;

agentimus/tags/1.51.9/inc/Cloudflare/Table.php

@@ -3 +3 @@
  * Edge aggregates table — one row per (UTC hour, crawler), holding the counts
  * the panel shows: total edge requests, cache-served, origin-served, blocked
- * at the edge, and bytes out.
+ * at the edge (and how many of those were scanner probes), and bytes out.
  *
  * Cloudflare's Free plan forgets these numbers within days; this table is why
@@ -20 +20 @@
 
         /** @var string Schema version — bump on any structural change. */
-        const VERSION = '2';
+        const VERSION = '3';
 
         /** @var string Option recording the installed schema version. */
         const VERSION_OPTION = 'agentimus_edge_db_version';
+
+        /**
+         * @var string Option set once a poll has re-read the whole backfill window
+         * since probes began to be counted. Until then every stored hour reads as
+         * no probes, so the poll re-reads as far back as it can
+         * ({@see Module::run_poll()}). Keyed to the count, not the schema version:
+         * a site already at version 3 from a dev build needs it too.
+         */
+        const PROBES_OPTION = 'agentimus_edge_probes_backfilled';
 
         /** @var int Age-based retention (days). At ~15 crawlers × 24 rows/day this is small. */
@@ -75 +84 @@
                         origin int(10) unsigned NOT NULL DEFAULT 0,
                         blocked int(10) unsigned NOT NULL DEFAULT 0,
+                        probes int(10) unsigned NOT NULL DEFAULT 0,
                         served int(10) unsigned NOT NULL DEFAULT 0,
                         bytes bigint(20) unsigned NOT NULL DEFAULT 0,
@@ -85 +95 @@
                 // can silently skip an ADD COLUMN on a drifted schema, and stamping the
                 // version anyway would break every query forever.
-                foreach ( array( 'hour_at', 'ua', 'requests', 'cached', 'origin', 'blocked', 'served', 'bytes' ) as $column ) {
+                foreach ( array( 'hour_at', 'ua', 'requests', 'cached', 'origin', 'blocked', 'probes', 'served', 'bytes' ) as $column ) {
                         $found = $wpdb->get_var( $wpdb->prepare( "SHOW COLUMNS FROM $table LIKE %s", $column ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- table name from our own prefix helper.
                         if ( null === $found ) {
@@ -100 +110 @@
          * double-count).
          *
-         * @param array $rows Rows shaped { hour_at, ua, requests, cached, origin, blocked, served, bytes }.
+         * @param array $rows Rows shaped { hour_at, ua, requests, cached, origin, blocked, probes?, served, bytes }.
          * @return void
          */
@@ -112 +122 @@
                 foreach ( $rows as $row ) {
                         $values[] = $wpdb->prepare(
-                                '(%s,%s,%d,%d,%d,%d,%d,%d)',
+                                '(%s,%s,%d,%d,%d,%d,%d,%d,%d)',
                                 (string) $row['hour_at'],
                                 (string) $row['ua'],
@@ -119 +129 @@
                                 (int) $row['origin'],
                                 (int) $row['blocked'],
+                                isset( $row['probes'] ) ? (int) $row['probes'] : 0,
                                 (int) $row['served'],
                                 (int) $row['bytes']
@@ -124 +135 @@
                 }
                 $wpdb->query( // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- every tuple prepared above; table name is our own.
-                        "INSERT INTO $table (hour_at,ua,requests,cached,origin,blocked,served,bytes) VALUES " . implode( ',', $values ) . '
+                        "INSERT INTO $table (hour_at,ua,requests,cached,origin,blocked,probes,served,bytes) VALUES " . implode( ',', $values ) . '
                         ON DUPLICATE KEY UPDATE
                                 requests = VALUES(requests), cached = VALUES(cached), origin = VALUES(origin),
-                                blocked = VALUES(blocked), served = VALUES(served), bytes = VALUES(bytes)'
+                                blocked = VALUES(blocked), probes = VALUES(probes), served = VALUES(served), bytes = VALUES(bytes)'
                 );
         }
@@ -148 +159 @@
          *
          * @param int $days Window length in days.
-         * @return array<int,array{ua:string,requests:int,cached:int,origin:int,blocked:int,served:int,bytes:int}>
+         * @return array<int,array{ua:string,requests:int,cached:int,origin:int,blocked:int,probes:int,served:int,bytes:int}>
          */
         public static function summary( $days ) {
@@ -157 +168 @@
                         "SELECT ua,
                                 SUM(requests) AS requests, SUM(cached) AS cached, SUM(origin) AS origin,
-                                SUM(blocked) AS blocked, SUM(served) AS served, SUM(bytes) AS bytes
+                                SUM(blocked) AS blocked, SUM(probes) AS probes, SUM(served) AS served, SUM(bytes) AS bytes
                         FROM $table WHERE hour_at >= %s GROUP BY ua ORDER BY requests DESC",
                         $since
@@ -170 +181 @@
                                 'origin'   => (int) $row['origin'],
                                 'blocked'  => (int) $row['blocked'],
+                                'probes'   => (int) $row['probes'],
                                 'served'   => (int) $row['served'],
                                 'bytes'    => (int) $row['bytes'],
@@ -182 +194 @@
          *
          * @param int $hours Window length in hours.
-         * @return array<string,array{blocked:int,passed:int,served:int}> Keyed by crawler token.
+         * @return array<string,array{blocked:int,probes:int,passed:int,served:int}> Keyed by crawler token.
          */
         public static function recent( $hours ) {
@@ -189 +201 @@
                 $since = gmdate( 'Y-m-d H:i:s', time() - ( max( 1, (int) $hours ) * HOUR_IN_SECONDS ) );
                 $rows  = $wpdb->get_results( $wpdb->prepare( // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- our own table.
-                        "SELECT ua, SUM(blocked) AS blocked, SUM(cached) + SUM(origin) AS passed, SUM(served) AS served
+                        "SELECT ua, SUM(blocked) AS blocked, SUM(probes) AS probes, SUM(cached) + SUM(origin) AS passed, SUM(served) AS served
                         FROM $table WHERE hour_at >= %s GROUP BY ua",
                         $since
@@ -198 +210 @@
                         $out[ (string) $row['ua'] ] = array(
                                 'blocked' => (int) $row['blocked'],
+                                'probes'  => (int) $row['probes'],
                                 'passed'  => (int) $row['passed'],
                                 'served'  => (int) $row['served'],
@@ -222 +235 @@
          *
          * @param int $days How far back to read.
-         * @return array<string,array<string,array{requests:int,blocked:int,passed:int,served:int}>>
+         * @return array<string,array<string,array{requests:int,blocked:int,probes:int,passed:int,served:int}>>
          *         day (Y-m-d, UTC) => ua => totals.
          */
@@ -231 +244 @@
                 $rows  = $wpdb->get_results( $wpdb->prepare( // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- our own table.
                         "SELECT DATE(hour_at) AS day, ua,
-                                SUM(requests) AS requests, SUM(blocked) AS blocked,
+                                SUM(requests) AS requests, SUM(blocked) AS blocked, SUM(probes) AS probes,
                                 SUM(cached) + SUM(origin) AS passed, SUM(served) AS served
                         FROM $table WHERE hour_at >= %s GROUP BY day, ua ORDER BY day ASC",
@@ -242 +255 @@
                                 'requests' => (int) $row['requests'],
                                 'blocked'  => (int) $row['blocked'],
+                                'probes'   => (int) $row['probes'],
                                 'passed'   => (int) $row['passed'],
                                 'served'   => (int) $row['served'],

agentimus/tags/1.51.9/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.51.8
+Stable tag: 1.51.9
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -298 +298 @@
 
 == Changelog ==
+
+= 1.51.9 =
+* Fixed: the Cloudflare warning "Cloudflare is blocking [company], but your policy says allow" could fire when Cloudflare was only stopping a scanner that used an AI crawler's name to look for secret files such as ".env". A blocked request for a file no reader asks for is now counted as a probe and no longer counts toward that warning. The edge numbers still show every blocked request, and the first update re-checks the last three days, so a warning a scanner raised in that time clears the next time the numbers update.
 
 = 1.51.8 =
@@ -409 +412 @@
 == Upgrade Notice ==
 
+= 1.51.9 =
+The Cloudflare warning no longer counts scanners that use an AI crawler's name to look for secret files. Adds one column to the edge table. No breaking changes.
+
 = 1.51.8 =
 On sites with plain permalinks, tag and category pages are named correctly instead of "Homepage". No breaking changes.

agentimus/tags/1.51.9/uninstall.php

@@ -99 +99 @@
         delete_option( 'agentimus_cloudflare' );
         delete_option( 'agentimus_edge_db_version' );
+        delete_option( 'agentimus_edge_probes_backfilled' );
         delete_option( 'agentimus_edge_lock' );
         wp_clear_scheduled_hook( 'agentimus_edge_poll' );

agentimus/tags/1.51.9/vendor/composer/installed.php

@@ -2 +2 @@
     'root' => array(
         'name' => 'heera/agentimus',
-        'pretty_version' => '1.51.8',
-        'version' => '1.51.8.0',
-        'reference' => '2f7226fbcc2ef9982ef5a3756711a4e0a86a4655',
+        'pretty_version' => '1.51.9',
+        'version' => '1.51.9.0',
+        'reference' => 'b06236c81f3b4ab1aa387dfbe919014919239bad',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -21 +21 @@
         ),
         'heera/agentimus' => array(
-            'pretty_version' => '1.51.8',
-            'version' => '1.51.8.0',
-            'reference' => '2f7226fbcc2ef9982ef5a3756711a4e0a86a4655',
+            'pretty_version' => '1.51.9',
+            'version' => '1.51.9.0',
+            'reference' => 'b06236c81f3b4ab1aa387dfbe919014919239bad',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',

agentimus/trunk/agentimus.php

@@ -4 +4 @@
  * Plugin URI:        https://github.com/heera/agentimus
  * Description:       Make your site agent-ready (llms.txt, markdown, JSON-LD, a /.well-known discovery document, AI-crawl controls, agent-activity log) AND let the AI tools you use operate it over MCP — read your data and, opt-in, draft/edit/publish posts. Lightweight, no SEO bloat.
- * Version:           1.51.8
+ * Version:           1.51.9
  * Requires at least: 6.0
  * Requires PHP:      7.4
@@ -20 +20 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'AGENTIMUS_VERSION', '1.51.8' );
+define( 'AGENTIMUS_VERSION', '1.51.9' );
 define( 'AGENTIMUS_FILE', __FILE__ );
 define( 'AGENTIMUS_DIR', plugin_dir_path( __FILE__ ) );

agentimus/trunk/inc/Abilities/Registrar.php

@@ -587 +587 @@
                                                         'origin'       => self::i( 'Requests that reached this server.' ),
                                                         'blocked'      => self::i( 'Requests the edge turned away without contacting this server.' ),
+                                                        'probes'       => self::i( 'Of the blocked requests, how many asked for a file no reader fetches (a .env, a .git folder, a wp-config copy): a scanner using this crawler\'s name. Never counted as the edge turning this crawler away.' ),
                                                         'served'       => self::i( 'Requests that got a page: a 2xx the edge let through, not counting /robots.txt reads. Passing the edge is not taking content — a request the origin answered 403 or 404 took nothing.' ),
                                                         'bytes'        => self::i(),

agentimus/trunk/inc/Admin.php

@@ -993 +993 @@
                                 // ⭐ A security-only release gets ONE row (1.51.1): the fix is the
                                 // whole release, and there is one thing an owner may want to do.
-                                // ⭐ So does a one-fix release (1.51.8) — plain-permalink term pages
-                                // named in the log and the search screens.
+                                // ⭐ So does a one-fix release (1.51.9) — a scanner's probes no longer
+                                // raise the Cloudflare warning. ⛔ No company is named: the release
+                                // text names no specific bot (his ruling, 1.51.3 and 1.51.4).
                                 array(
-                                        'icon'  => 'page',
-                                        'title' => 'Tag Pages Named on Plain Permalinks',
-                                        'text'  => 'On a site with plain permalinks, the Request Log called every tag and category page Homepage. It now shows the tag or category name, here and in your search results.',
+                                        'icon'  => 'shield',
+                                        'title' => 'Scanners No Longer Trip the Cloudflare Warning',
+                                        'text'  => 'A scanner that used an AI crawler\'s name to look for secret files like .env could make it look as if Cloudflare was blocking that company. Those requests are now counted apart, and only real blocks raise the warning.',
                                 ),
                         ),

agentimus/trunk/inc/Cloudflare/Client.php

@@ -215 +215 @@
 
         /**
+         * Hourly edge-refused requests for a window, one row per (hour, user agent,
+         * path) — the paths {@see Module::aggregate()} needs to tell a scanner's
+         * probe from a reader being turned away. The filter is the same "blocked"
+         * test as {@see blocked_sources()}. The paths are read here, classified in
+         * the poll and never stored: the table keeps only the count.
+         *
+         * @param string $token   API token, plaintext.
+         * @param string $zone_id Zone tag.
+         * @param int    $since   Window start, Unix UTC.
+         * @param int    $until   Window end, Unix UTC.
+         * @return array { rows?: array<int,array{hour:string,ua:string,path:string,requests:int}>, error?: string }
+         */
+        public function blocked_paths( $token, $zone_id, $since, $until ) {
+                $query = 'query ($zone: String!, $since: Time!, $until: Time!) {
+                        viewer {
+                                zones(filter: { zoneTag: $zone }) {
+                                        httpRequestsAdaptiveGroups(
+                                                limit: ' . self::GRAPHQL_LIMIT . ',
+                                                filter: { datetime_geq: $since, datetime_lt: $until, requestSource: "eyeball", edgeResponseStatus_in: [403, 429], originResponseStatus: 0 },
+                                                orderBy: [count_DESC]
+                                        ) {
+                                                count
+                                                dimensions { datetimeHour userAgent clientRequestPath }
+                                        }
+                                }
+                        }
+                }';
+
+                $out = $this->graphql( $token, $query, array(
+                        'zone'  => (string) $zone_id,
+                        'since' => gmdate( 'Y-m-d\TH:i:s\Z', (int) $since ),
+                        'until' => gmdate( 'Y-m-d\TH:i:s\Z', (int) $until ),
+                ) );
+                if ( isset( $out['error'] ) ) {
+                        return $out;
+                }
+
+                // The expected container, or it's an error — never "real empty data".
+                if ( ! isset( $out['json']['data']['viewer']['zones'][0]['httpRequestsAdaptiveGroups'] ) ) {
+                        return array( 'error' => __( 'Cloudflare returned an unexpected response shape.', 'agentimus' ) );
+                }
+
+                $rows = array();
+                foreach ( (array) $out['json']['data']['viewer']['zones'][0]['httpRequestsAdaptiveGroups'] as $g ) {
+                        if ( ! isset( $g['dimensions'] ) ) {
+                                continue;
+                        }
+                        $d      = (array) $g['dimensions'];
+                        $rows[] = array(
+                                'hour'     => (string) ( isset( $d['datetimeHour'] ) ? $d['datetimeHour'] : '' ),
+                                'ua'       => (string) ( isset( $d['userAgent'] ) ? $d['userAgent'] : '' ),
+                                'path'     => (string) ( isset( $d['clientRequestPath'] ) ? $d['clientRequestPath'] : '' ),
+                                'requests' => (int) ( isset( $g['count'] ) ? $g['count'] : 0 ),
+                        );
+                }
+
+                return array( 'rows' => $rows );
+        }
+
+        /**
          * Hourly /robots.txt requests for a window, in the same row shape as
          * {@see hourly_traffic()}. Those rows carry no path, so a crawler reading

agentimus/trunk/inc/Cloudflare/Conflicts.php

@@ -62 +62 @@
          * the owner fixing the cause, instead of shouting for a week about history.
          *
-         * @param array      $crawlers Per-crawler totals: { ua, name, operator, requests, cached, origin, blocked, served }.
+         * @param array      $crawlers Per-crawler totals: { ua, name, operator, requests, cached, origin, blocked, probes?, served }.
          * @param array      $policy   The owner's declarations:
          *                             - ai_input (bool)        robots Content-Signal ai-input.
@@ -69 +69 @@
          *                             - allowed_agents (array) user-agent rules the OWNER allowed in the review queue.
          * @param int        $days     The window the totals cover, for the copy.
-         * @param array|null $recent   Last-24h per-crawler map { ua => { blocked, passed, served } }
+         * @param array|null $recent   Last-24h per-crawler map { ua => { blocked, probes?, passed, served } }
          *                             (see Table::recent()), or null to treat all
          *                             evidence as current.
@@ -94 +94 @@
                                         continue;
                                 }
-                                $blocked  = (int) $c['blocked'];
-                                $requests = (int) $c['requests'];
+                                // A blocked probe is no reader turned away ({@see refused()}) — and
+                                // no reading attempt either, so it leaves the share's base too.
+                                $blocked  = self::refused( $c );
+                                $requests = (int) $c['requests'] - self::probes( $c );
                                 $op       = (string) $c['operator'];
                                 if ( '' === $op || $blocked < self::MIN_BLOCKED || $blocked < $requests * self::MIN_BLOCKED_SHARE ) {
@@ -103 +105 @@
                                 // blocking fires — otherwise the fix already landed and the warning
                                 // would just be nagging about history.
-                                if ( null !== $recent && empty( $recent[ $token ]['blocked'] ) ) {
+                                if ( null !== $recent && ( ! isset( $recent[ $token ] ) || 0 === self::refused( $recent[ $token ] ) ) ) {
                                         continue;
                                 }
@@ -111 +113 @@
                                 $per_operator[ $op ]['blocked']  += $blocked;
                                 $per_operator[ $op ]['requests'] += $requests;
-                                $per_operator[ $op ]['recent']   += null !== $recent ? (int) $recent[ $token ]['blocked'] : 0;
+                                $per_operator[ $op ]['recent']   += null !== $recent ? self::refused( $recent[ $token ] ) : 0;
                         }
 
@@ -294 +296 @@
 
         /**
+         * The requests the edge turned away that were a READER being refused: the
+         * blocked count less the scanner probes in it ({@see Module::is_probe_path()}).
+         * A row stored before probes were counted has none, and counts as before.
+         *
+         * @param array $row Any totals row carrying `blocked` and optionally `probes`.
+         * @return int
+         */
+        public static function refused( array $row ) {
+                return max( 0, ( isset( $row['blocked'] ) ? (int) $row['blocked'] : 0 ) - self::probes( $row ) );
+        }
+
+        /**
+         * The scanner probes within a row's blocked count, never more than it.
+         *
+         * @param array $row Any totals row.
+         * @return int
+         */
+        private static function probes( array $row ) {
+                $blocked = isset( $row['blocked'] ) ? (int) $row['blocked'] : 0;
+                return min( $blocked, isset( $row['probes'] ) ? max( 0, (int) $row['probes'] ) : 0 );
+        }
+
+        /**
          * The slug an operator's warn conflict carries in its id
          * ("edge-blocks-<slug>"). One transform, shared with every reader that has
@@ -330 +355 @@
          * Pure — no DB, no time() — so it unit-tests standalone, like detect().
          *
-         * @param array  $daily    Day => ua => { requests, blocked, passed, served }, oldest first ({@see Table::daily()}).
+         * @param array  $daily    Day => ua => { requests, blocked, probes?, passed, served }, oldest first ({@see Table::daily()}).
          * @param string $id       The conflict id to date.
          * @param array  $operators ua => operator name, for the per-operator rollup a warn conflict uses.
@@ -367 +392 @@
                                         continue;
                                 }
-                                $sums['blocked']  += (int) $t['blocked'];
-                                $sums['requests'] += (int) $t['requests'];
+                                $sums['blocked']  += self::refused( $t );
+                                $sums['requests'] += (int) $t['requests'] - self::probes( $t );
                         }
                         return $sums['blocked'] >= self::MIN_BLOCKED

agentimus/trunk/inc/Cloudflare/Module.php

@@ -152 +152 @@
                 $since  = $latest > 0 ? $latest - self::OVERLAP_SECONDS : $now - self::BACKFILL_SECONDS;
                 $since  = max( $since, $now - self::BACKFILL_SECONDS );
+                // ⛔ An hour stored before probes were counted keeps saying "no probes"
+                // until it is re-read — and the overlap only re-reads two hours, so a
+                // scanner's morning would go on firing the warning for a day and
+                // inflating the week for seven. Once, re-read everything Cloudflare
+                // still holds; a re-read hour replaces its row.
+                $backfill = ! get_option( Table::PROBES_OPTION );
+                if ( $backfill ) {
+                        $since = $now - self::BACKFILL_SECONDS;
+                }
 
                 while ( $since < $now ) {
@@ -164 +173 @@
                                 }
                         }
+                        if ( ! isset( $out['error'] ) ) {
+                                // Same rule for the blocked paths: without them every scanner probe
+                                // would be stored as a reader turned away.
+                                $paths = $this->client->blocked_paths( $token, $zone, $since, $until );
+                                if ( isset( $paths['error'] ) ) {
+                                        $out = $paths;
+                                }
+                        }
                         if ( isset( $out['error'] ) ) {
                                 // Keep the last good data; the panel shows the numbers' age and this note.
@@ -169 +186 @@
                                 return;
                         }
-                        Table::upsert( self::aggregate( (array) $out['rows'], (array) $robots['rows'] ) );
+                        Table::upsert( self::aggregate( (array) $out['rows'], (array) $robots['rows'], (array) $paths['rows'] ) );
                         $since = $until;
                 }
 
                 $this->settings->record_poll( '' );
+                if ( $backfill ) {
+                        update_option( Table::PROBES_OPTION, 1, false );
+                }
                 Table::prune();
 
@@ -200 +220 @@
          * answers 403 or 404 took nothing. The training notice counts this.
          *
+         * Within `blocked`, `probes` counts the requests for a path no reader asks
+         * for ({@see is_probe_path()}). ⛔⛔ A BLOCKED PROBE IS NOT A READER TURNED
+         * AWAY. On heera.it (2026-10-17) "Cloudflare is blocking Anthropic" and
+         * "…You.com" were one scanner on Google Cloud asking for .env files under
+         * both names, stopped by his own bad-paths rule — the third time after
+         * OpenAI (08-29, 09-17). Neither company publishes addresses to check, so
+         * the spoof check could only say "unknown"; the path says it plainly.
+         *
          * @param array $raw    Rows from Client::hourly_traffic().
          * @param array $robots Rows from Client::robots_fetches() for the same window.
+         * @param array $paths  Rows from Client::blocked_paths() for the same window.
          * @return array<int,array> Rows shaped for Table::upsert().
          */
-        public static function aggregate( array $raw, array $robots = array() ) {
+        public static function aggregate( array $raw, array $robots = array(), array $paths = array() ) {
                 $cached_statuses = array( 'hit', 'stale', 'updating', 'revalidated' );
                 $buckets         = array();
@@ -227 +256 @@
                                         'origin'   => 0,
                                         'blocked'  => 0,
+                                        'probes'   => 0,
                                         'served'   => 0,
                                         'bytes'    => 0,
@@ -257 +287 @@
                 }
 
+                foreach ( $paths as $row ) {
+                        $key = self::hour_key( (string) $row['hour'] ) . '|' . self::crawler_token( (string) $row['ua'] );
+                        if ( isset( $buckets[ $key ] ) && self::is_probe_path( (string) $row['path'] ) ) {
+                                $buckets[ $key ]['probes'] += (int) $row['requests'];
+                        }
+                }
+                // Two reads of the same window can disagree by a few requests; a probe
+                // count is a share of `blocked` and never more than it.
+                foreach ( $buckets as $key => $bucket ) {
+                        $buckets[ $key ]['probes'] = min( $bucket['probes'], $bucket['blocked'] );
+                }
+
                 return array_values( $buckets );
+        }
+
+        /**
+         * Whether a request path is a scanner's probe — a secret or a config file
+         * that no reader of the site, human or AI, ever asks for.
+         *
+         * Deliberately narrow: hidden files and folders (/.env, /.git/config,
+         * /.aws/credentials — every one except /.well-known/), anything ending in
+         * .env, wp-config.* copies, database dumps and editor backups, phpinfo, and
+         * Vite's /@fs/ file-read hole. An ordinary page, a feed or robots.txt is
+         * never a probe. Decoded first, so /admin%2F.env is caught like /admin/.env.
+         *
+         * @param string $path Request path, as Cloudflare reports it.
+         * @return bool
+         */
+        public static function is_probe_path( $path ) {
+                $path = strtolower( (string) $path );
+                for ( $i = 0; $i < 2 && false !== strpos( $path, '%' ); $i++ ) {
+                        $path = rawurldecode( $path );
+                }
+                $path = (string) strtok( $path, '?' );
+
+                foreach ( explode( '/', str_replace( '\\', '/', $path ) ) as $segment ) {
+                        if ( '' === $segment || '.' === $segment || '..' === $segment || '.well-known' === $segment ) {
+                                continue;
+                        }
+                        if ( '.' === $segment[0] || '@fs' === $segment || 0 === strpos( $segment, 'wp-config' ) || 0 === strpos( $segment, 'phpinfo' ) ) {
+                                return true;
+                        }
+                        if ( preg_match( '/\.(env|sql|bak|swp)$/', $segment ) ) {
+                                return true;
+                        }
+                }
+                return false;
         }
 

agentimus/trunk/inc/Cloudflare/SpoofCheck.php

@@ -184 +184 @@
          * @param array $crawlers Rows with { ua, operator }.
          * @param array $policy   The declarations {@see Conflicts::detect()} takes.
-         * @param array $recent   ua => { blocked, passed } ({@see Table::recent()}).
+         * @param array $recent   ua => { blocked, probes?, passed } ({@see Table::recent()}).
          * @return array<string,int> operator => blocked requests.
          */
@@ -196 +196 @@
                         }
                         $out[ $op ] = ( isset( $out[ $op ] ) ? $out[ $op ] : 0 )
-                                + ( isset( $recent[ $ua ]['blocked'] ) ? (int) $recent[ $ua ]['blocked'] : 0 );
+                                + ( isset( $recent[ $ua ] ) ? Conflicts::refused( (array) $recent[ $ua ] ) : 0 );
                 }
                 return $out;

agentimus/trunk/inc/Cloudflare/Table.php

@@ -3 +3 @@
  * Edge aggregates table — one row per (UTC hour, crawler), holding the counts
  * the panel shows: total edge requests, cache-served, origin-served, blocked
- * at the edge, and bytes out.
+ * at the edge (and how many of those were scanner probes), and bytes out.
  *
  * Cloudflare's Free plan forgets these numbers within days; this table is why
@@ -20 +20 @@
 
         /** @var string Schema version — bump on any structural change. */
-        const VERSION = '2';
+        const VERSION = '3';
 
         /** @var string Option recording the installed schema version. */
         const VERSION_OPTION = 'agentimus_edge_db_version';
+
+        /**
+         * @var string Option set once a poll has re-read the whole backfill window
+         * since probes began to be counted. Until then every stored hour reads as
+         * no probes, so the poll re-reads as far back as it can
+         * ({@see Module::run_poll()}). Keyed to the count, not the schema version:
+         * a site already at version 3 from a dev build needs it too.
+         */
+        const PROBES_OPTION = 'agentimus_edge_probes_backfilled';
 
         /** @var int Age-based retention (days). At ~15 crawlers × 24 rows/day this is small. */
@@ -75 +84 @@
                         origin int(10) unsigned NOT NULL DEFAULT 0,
                         blocked int(10) unsigned NOT NULL DEFAULT 0,
+                        probes int(10) unsigned NOT NULL DEFAULT 0,
                         served int(10) unsigned NOT NULL DEFAULT 0,
                         bytes bigint(20) unsigned NOT NULL DEFAULT 0,
@@ -85 +95 @@
                 // can silently skip an ADD COLUMN on a drifted schema, and stamping the
                 // version anyway would break every query forever.
-                foreach ( array( 'hour_at', 'ua', 'requests', 'cached', 'origin', 'blocked', 'served', 'bytes' ) as $column ) {
+                foreach ( array( 'hour_at', 'ua', 'requests', 'cached', 'origin', 'blocked', 'probes', 'served', 'bytes' ) as $column ) {
                         $found = $wpdb->get_var( $wpdb->prepare( "SHOW COLUMNS FROM $table LIKE %s", $column ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- table name from our own prefix helper.
                         if ( null === $found ) {
@@ -100 +110 @@
          * double-count).
          *
-         * @param array $rows Rows shaped { hour_at, ua, requests, cached, origin, blocked, served, bytes }.
+         * @param array $rows Rows shaped { hour_at, ua, requests, cached, origin, blocked, probes?, served, bytes }.
          * @return void
          */
@@ -112 +122 @@
                 foreach ( $rows as $row ) {
                         $values[] = $wpdb->prepare(
-                                '(%s,%s,%d,%d,%d,%d,%d,%d)',
+                                '(%s,%s,%d,%d,%d,%d,%d,%d,%d)',
                                 (string) $row['hour_at'],
                                 (string) $row['ua'],
@@ -119 +129 @@
                                 (int) $row['origin'],
                                 (int) $row['blocked'],
+                                isset( $row['probes'] ) ? (int) $row['probes'] : 0,
                                 (int) $row['served'],
                                 (int) $row['bytes']
@@ -124 +135 @@
                 }
                 $wpdb->query( // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- every tuple prepared above; table name is our own.
-                        "INSERT INTO $table (hour_at,ua,requests,cached,origin,blocked,served,bytes) VALUES " . implode( ',', $values ) . '
+                        "INSERT INTO $table (hour_at,ua,requests,cached,origin,blocked,probes,served,bytes) VALUES " . implode( ',', $values ) . '
                         ON DUPLICATE KEY UPDATE
                                 requests = VALUES(requests), cached = VALUES(cached), origin = VALUES(origin),
-                                blocked = VALUES(blocked), served = VALUES(served), bytes = VALUES(bytes)'
+                                blocked = VALUES(blocked), probes = VALUES(probes), served = VALUES(served), bytes = VALUES(bytes)'
                 );
         }
@@ -148 +159 @@
          *
          * @param int $days Window length in days.
-         * @return array<int,array{ua:string,requests:int,cached:int,origin:int,blocked:int,served:int,bytes:int}>
+         * @return array<int,array{ua:string,requests:int,cached:int,origin:int,blocked:int,probes:int,served:int,bytes:int}>
          */
         public static function summary( $days ) {
@@ -157 +168 @@
                         "SELECT ua,
                                 SUM(requests) AS requests, SUM(cached) AS cached, SUM(origin) AS origin,
-                                SUM(blocked) AS blocked, SUM(served) AS served, SUM(bytes) AS bytes
+                                SUM(blocked) AS blocked, SUM(probes) AS probes, SUM(served) AS served, SUM(bytes) AS bytes
                         FROM $table WHERE hour_at >= %s GROUP BY ua ORDER BY requests DESC",
                         $since
@@ -170 +181 @@
                                 'origin'   => (int) $row['origin'],
                                 'blocked'  => (int) $row['blocked'],
+                                'probes'   => (int) $row['probes'],
                                 'served'   => (int) $row['served'],
                                 'bytes'    => (int) $row['bytes'],
@@ -182 +194 @@
          *
          * @param int $hours Window length in hours.
-         * @return array<string,array{blocked:int,passed:int,served:int}> Keyed by crawler token.
+         * @return array<string,array{blocked:int,probes:int,passed:int,served:int}> Keyed by crawler token.
          */
         public static function recent( $hours ) {
@@ -189 +201 @@
                 $since = gmdate( 'Y-m-d H:i:s', time() - ( max( 1, (int) $hours ) * HOUR_IN_SECONDS ) );
                 $rows  = $wpdb->get_results( $wpdb->prepare( // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- our own table.
-                        "SELECT ua, SUM(blocked) AS blocked, SUM(cached) + SUM(origin) AS passed, SUM(served) AS served
+                        "SELECT ua, SUM(blocked) AS blocked, SUM(probes) AS probes, SUM(cached) + SUM(origin) AS passed, SUM(served) AS served
                         FROM $table WHERE hour_at >= %s GROUP BY ua",
                         $since
@@ -198 +210 @@
                         $out[ (string) $row['ua'] ] = array(
                                 'blocked' => (int) $row['blocked'],
+                                'probes'  => (int) $row['probes'],
                                 'passed'  => (int) $row['passed'],
                                 'served'  => (int) $row['served'],
@@ -222 +235 @@
          *
          * @param int $days How far back to read.
-         * @return array<string,array<string,array{requests:int,blocked:int,passed:int,served:int}>>
+         * @return array<string,array<string,array{requests:int,blocked:int,probes:int,passed:int,served:int}>>
          *         day (Y-m-d, UTC) => ua => totals.
          */
@@ -231 +244 @@
                 $rows  = $wpdb->get_results( $wpdb->prepare( // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- our own table.
                         "SELECT DATE(hour_at) AS day, ua,
-                                SUM(requests) AS requests, SUM(blocked) AS blocked,
+                                SUM(requests) AS requests, SUM(blocked) AS blocked, SUM(probes) AS probes,
                                 SUM(cached) + SUM(origin) AS passed, SUM(served) AS served
                         FROM $table WHERE hour_at >= %s GROUP BY day, ua ORDER BY day ASC",
@@ -242 +255 @@
                                 'requests' => (int) $row['requests'],
                                 'blocked'  => (int) $row['blocked'],
+                                'probes'   => (int) $row['probes'],
                                 'passed'   => (int) $row['passed'],
                                 'served'   => (int) $row['served'],

agentimus/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.51.8
+Stable tag: 1.51.9
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -298 +298 @@
 
 == Changelog ==
+
+= 1.51.9 =
+* Fixed: the Cloudflare warning "Cloudflare is blocking [company], but your policy says allow" could fire when Cloudflare was only stopping a scanner that used an AI crawler's name to look for secret files such as ".env". A blocked request for a file no reader asks for is now counted as a probe and no longer counts toward that warning. The edge numbers still show every blocked request, and the first update re-checks the last three days, so a warning a scanner raised in that time clears the next time the numbers update.
 
 = 1.51.8 =
@@ -409 +412 @@
 == Upgrade Notice ==
 
+= 1.51.9 =
+The Cloudflare warning no longer counts scanners that use an AI crawler's name to look for secret files. Adds one column to the edge table. No breaking changes.
+
 = 1.51.8 =
 On sites with plain permalinks, tag and category pages are named correctly instead of "Homepage". No breaking changes.

agentimus/trunk/uninstall.php

@@ -99 +99 @@
         delete_option( 'agentimus_cloudflare' );
         delete_option( 'agentimus_edge_db_version' );
+        delete_option( 'agentimus_edge_probes_backfilled' );
         delete_option( 'agentimus_edge_lock' );
         wp_clear_scheduled_hook( 'agentimus_edge_poll' );

agentimus/trunk/vendor/composer/installed.php

@@ -2 +2 @@
     'root' => array(
         'name' => 'heera/agentimus',
-        'pretty_version' => '1.51.8',
-        'version' => '1.51.8.0',
-        'reference' => '2f7226fbcc2ef9982ef5a3756711a4e0a86a4655',
+        'pretty_version' => '1.51.9',
+        'version' => '1.51.9.0',
+        'reference' => 'b06236c81f3b4ab1aa387dfbe919014919239bad',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -21 +21 @@
         ),
         'heera/agentimus' => array(
-            'pretty_version' => '1.51.8',
-            'version' => '1.51.8.0',
-            'reference' => '2f7226fbcc2ef9982ef5a3756711a4e0a86a4655',
+            'pretty_version' => '1.51.9',
+            'version' => '1.51.9.0',
+            'reference' => 'b06236c81f3b4ab1aa387dfbe919014919239bad',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',