Initial commit: ULPgrammer

- Core Telegram monitoring pipeline (scraper, processor, notifier, downloaders)
- Textual TUI frontend with thread-safe event bus
- SQLite persistence, severity scoring, dedup cache
- Fixed ULP parser: handles https:// truncation, port+path URLs, semicolon separator
- Test suite: 88 tests across scorer, cache, database, processor

config.py

@@ -0,0 +1,100 @@
+"""
+config.py — Loads and validates all settings from .env
+"""
+
+import os
+from pathlib import Path
+from dotenv import load_dotenv
+
+load_dotenv()
+
+# -- Timeouts --
+BOT_REPLY_TIMEOUT = 10
+
+# ─── Telegram credentials ────────────────────────────────────────────────────
+API_ID   = int(os.environ["API_ID"])
+API_HASH = os.environ["API_HASH"]
+BOT_TOKEN = os.environ["BOT_TOKEN"]
+NOTIFY_CHAT_ID = int(os.environ["NOTIFY_CHAT_ID"])
+SESSION_NAME = os.getenv("SESSION_NAME", "monitor_session")
+
+# ─── Target keywords ─────────────────────────────────────────────────────────
+# Add your org's domains, email patterns, IP ranges, known usernames, etc.
+# All patterns are case-insensitive regex.
+TARGET_KEYWORDS: list[str] = [
+    r"sanatorioaleman\.cl",
+    r"@sanatorioaleman\.cl",
+    # r"192\.168\.10\.",            # internal IP range example
+    # r"specificuser",              # known internal usernames
+]
+
+# ─── Channels to watch ───────────────────────────────────────────────────────
+# Use usernames (without @) or numeric channel IDs (-100xxxxxxxxxx)
+WATCHED_CHANNELS: list[str | int] = [
+    #-1002230225603,
+    "cloudxlog",
+    #-1001967030016, # daisycloud
+    #"berserklogs", # berserklogs
+    #"BorwitaFreeLogs", # borwita
+    -1002748707556, # darkcloud
+    -1001684073398, # BHF Cloud
+    -1003163621939, # Wich Love from R
+    -1003611713618, # Khazan Cloud
+    -1003328682684, # LogsPlanet
+    -1003204260194, # JDP
+    -1002828367761, # HesoyamCloud
+    -1003513974925, # Slurm Logs
+    -1003599300787, # Arhont Corp
+    -1002582513379, # OnlyLogs
+    -1002788333372, # Ickis Cloud
+    #-1001234567890,  # private channel by ID
+]
+
+# ─── File handling ───────────────────────────────────────────────────────────
+TEMP_DIR  = Path("./tmp")
+HITS_FILE = Path("./hits.txt")
+LOG_FILE  = Path("./logs/monitor.log")
+
+# Extensions to download and process
+ALLOWED_EXTENSIONS = {".txt", ".zip", ".7z", ".rar"}
+
+# Max file size to download (bytes). Default: 200 MB.
+# Very large files are skipped to avoid abuse of your session.
+MAX_FILE_SIZE = 4 * 1024 * 1024 * 1024  # 4 GB (Telegram Premium max)
+
+# ─── Archive passwords to try ────────────────────────────────────────────────
+ARCHIVE_PASSWORDS: list[bytes] = [
+    b"1234",
+    b"0000",
+    b"infected",
+    b"telegram",
+    b"password",
+    b"12345",
+    b"",
+    b"Borwita",
+    b"@WichLoveFromR",
+]
+
+# ─── Backfill settings ───────────────────────────────────────────────────────
+# How many historical messages to scan per channel on startup (0 = skip backfill)
+BACKFILL_LIMIT = 500
+
+# ─── tdl downloader settings ─────────────────────────────────────────────────
+# Namespace tdl was logged into.  Run `tdl login` with no -n flag → namespace
+# is "default".  Run `tdl login -n foo` → namespace is "foo".
+# Set to None to omit -n entirely (tdl will use "default" anyway).
+TDL_NAMESPACE: str | None = "ulpmon"
+
+# Parallel chunk workers per file (-t / --threads global flag)
+TDL_THREADS = 8
+
+# Max concurrent files per tdl invocation (-l / --limit global flag)
+TDL_PERFILE = 4
+
+# Max messages to batch into a single tdl invocation during backfill.
+# tdl handles the parallelism internally via -l and -t.
+TDL_AMOUNT = 4
+
+# Whether to use a Telegram takeout session for downloads (lower flood limits).
+# Takeout sessions are rate-limited differently — good for bulk backfill.
+TDL_TAKEOUT = True