KeyHunter parser v10 + 18 scanners + tests (synthetic fixtures only, no keys/db/tokens)

lane_keeper.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+cd /root/keyhunter
+# v7.11: flock — check-then-act guards are not atomic; concurrent invocations
+# (cron + manual) both seeing 0 would double-spawn. -n: second instance exits.
+# v7.13: spawns MUST close fd 200 (200>&-) — an inherited lock fd held by the
+# 39 long-lived lanes/validator would keep the flock forever and silently
+# disable every subsequent keeper tick (Sentinel). Lock outside world-writable
+# /tmp; verify between ticks with: flock -n data/lane_keeper.lock -c true.
+exec 200>/root/keyhunter/data/lane_keeper.lock
+flock -n 200 || exit 0
+# v7.10: one-generation .out rotate at 8MB — PYTHONUNBUFFERED made logs grow
+# between respawns; keep .1 as evidence (Sentinel).
+for _lf in data/*_eternal.out; do
+  if [ -f "$_lf" ] && [ "$(stat -c %s "$_lf" 2>/dev/null || echo 0)" -gt 8388608 ]; then
+    cp "$_lf" "$_lf.1" && : > "$_lf"  # copytruncate NOT mv: lanes hold O_APPEND
+    # FDs — mv would leave the writer appending to .1 while .out goes stale
+  fi
+done
+# jenkins/dockerhub also renamed to .disabled in canon (off the glob entirely);
+# this list guards stale copies that may linger on the VPS.
+# sourcegraph PAUSED pending user decision (Sentinel flag): continuous Chrome-UA
+# WAF-bypass from the shared VPS IP; yield 6 unvalidated matches (GOOGLE-heavy,
+# 89%-DEAD family). Resume = remove from DISABLED + tighter caps (SLEEP>=600,
+# lower MAX_ITEMS) — or retire. Safer unattended default: paused.
+DISABLED="jenkins_eternal.py dockerhub_eternal.py sourcegraph_eternal.py"
+for f in *_eternal.py; do
+  case " $DISABLED " in *" $f "*) continue;; esac
+  pgrep -f "$f" > /dev/null || {
+    # v7.6: bare-filename pgrep also matches the stagger wrapper (no double-start
+    # when keeper runs twice within 30s); .out truncated per respawn (bounded,
+    # shows only current incarnation)
+    : > "data/${f%.py}.out"
+    setsid nohup bash -c "sleep $((RANDOM % 30)); exec env PYTHONUNBUFFERED=1 python3 '$f'" >> "data/${f%.py}.out" 2>&1 < /dev/null 200>&- &
+    echo "$(date '+%F %T') respawn $f" >> data/lane_keeper.log
+  }
+done
+# v7.1: keep the eternal validator alive with VISIBLE logs.
+# v7.12: ANCHORED interpreter guard — a lingering `bash -c` wrapper's cmdline
+# mentions validator_loop.py and would satisfy any substring guard while the
+# real interpreter is dead (silent no-respawn, observed at bg_168/169).
+# ^python3 matches only the interpreter; keeper's env-startup execs, so the
+# cmdline is exactly "python3 validator_loop.py". Starters MUST use this
+# relative form; pkill keeps the bracket form '[v]alidator_loop\.py'.
+pgrep -f "^python3 (.* )?validator_loop\.py" > /dev/null || {  # flag-tolerant anchor (python3 -u / env forms)
+  setsid nohup env PYTHONUNBUFFERED=1 python3 validator_loop.py >> data/validator_loop.log 2>&1 < /dev/null 200>&- &
+  echo "$(date '+%F %T') respawn validator_loop.py" >> data/lane_keeper.log
+}