secator 0.17.0__tar.gz → 0.19.0__tar.gz

{secator-0.17.0 → secator-0.19.0}/.docker/build_all.sh

@@ -2,16 +2,28 @@
 
 # Define an array of distributions
 DISTROS=("alpine" "arch" "debian" "kali" "osx" "ubuntu")
+BUILDER=$(which docker || which podman || which buildah)
+
+if [ -z "$BUILDER" ]; then
+  echo "Error: No container builder found (docker, podman, or buildah required)"
+  exit 1
+fi
+
+echo "Using builder: $BUILDER"
+
+mkdir -p .docker/logs/
 
 # Function to build an image
 build_image() {
     local DISTRO=$1
     local DOCKERFILE=".docker/Dockerfile.${DISTRO}"
+    local STDOUT_LOG=".docker/logs/${DISTRO}.stdout"
+    local STDERR_LOG=".docker/logs/${DISTRO}.stderr"
     local IMAGE_NAME="secator-${DISTRO}"
 
     if [ -f "$DOCKERFILE" ]; then
         echo "🚀 Building $IMAGE_NAME using $DOCKERFILE..."
-        docker build -t "$IMAGE_NAME" -f "$DOCKERFILE" . && \
+        $BUILDER build -t "$IMAGE_NAME" -f "$DOCKERFILE" . > $STDOUT_LOG 2> $STDERR_LOG && \
         echo "✅ Successfully built $IMAGE_NAME" || \
         echo "❌ Failed to build $IMAGE_NAME"
     else

secator-0.19.0/.dockerignore

@@ -0,0 +1,4 @@
+.docker/logs
+.git
+.github
+.gitignore

{secator-0.17.0 → secator-0.19.0}/.gitignore

@@ -1,3 +1,6 @@
+# Build logs
+.docker/logs
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[cod]

{secator-0.17.0 → secator-0.19.0}/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.19.0](https://github.com/freelabz/secator/compare/v0.18.0...v0.19.0) (2025-10-23)
+
+
+### Features
+
+* add monitor thread ([#727](https://github.com/freelabz/secator/issues/727)) ([5377e77](https://github.com/freelabz/secator/commit/5377e77186c88b1331b7ddc4a5304a610ad3e253))
+
+## [0.18.0](https://github.com/freelabz/secator/compare/v0.17.0...v0.18.0) (2025-10-22)
+
+
+### Features
+
+* **workflow:** update user hunt ([#688](https://github.com/freelabz/secator/issues/688)) ([e4f3e29](https://github.com/freelabz/secator/commit/e4f3e294c1668c66ed893305b0147df37cb4453a))
+
+
+### Bug Fixes
+
+* broken sudo prompt because of os.setsid ([#722](https://github.com/freelabz/secator/issues/722)) ([5c77957](https://github.com/freelabz/secator/commit/5c77957cb78533b7e819c01c19de6e46eae0d2af))
+* bugs and warnings in task data ([#714](https://github.com/freelabz/secator/issues/714)) ([845415b](https://github.com/freelabz/secator/commit/845415bb337f77867d49be66bbd23eaf307e5848))
+* bup file flag ([#725](https://github.com/freelabz/secator/issues/725)) ([0622ef5](https://github.com/freelabz/secator/commit/0622ef509b1dc33996dd5e89aea5cd802160744d))
+* context propagation for subtasks ([#720](https://github.com/freelabz/secator/issues/720)) ([d636aa6](https://github.com/freelabz/secator/commit/d636aa66562fd030299fce20f3abaeca283eaf74))
+* **fping:** remove bad options, add new ones ([#713](https://github.com/freelabz/secator/issues/713)) ([4356b4f](https://github.com/freelabz/secator/commit/4356b4f120043e2f94973a9c0061345a06efaeda))
+* maigret version pin ([#721](https://github.com/freelabz/secator/issues/721)) ([488b5a1](https://github.com/freelabz/secator/commit/488b5a1b994e6d3dfadc409d09aaaeb93ff60fb4))
+* subfinder integration tests ([#724](https://github.com/freelabz/secator/issues/724)) ([8163152](https://github.com/freelabz/secator/commit/8163152efb09f3854ec9fa7125b16084eda4c98f))
+* wpscan errors and wordpress workflow ([#723](https://github.com/freelabz/secator/issues/723)) ([8ee32aa](https://github.com/freelabz/secator/commit/8ee32aacb1310cfb833bdcf696477ae29eb271c7))
+
 ## [0.17.0](https://github.com/freelabz/secator/compare/v0.16.5...v0.17.0) (2025-09-06)
 
 

{secator-0.17.0 → secator-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secator
-Version: 0.17.0
+Version: 0.19.0
 Summary: The pentester's swiss knife.
 Project-URL: Homepage, https://github.com/freelabz/secator
 Project-URL: Issues, https://github.com/freelabz/secator/issues

{secator-0.17.0 → secator-0.19.0}/helm/templates/redis-service.yaml

@@ -2,7 +2,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ .Values.redis.name }}
-  namespace: {{ .Values.namespace }}
 spec:
   type: ClusterIP
   ports:

{secator-0.17.0 → secator-0.19.0}/helm/templates/redis.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ .Values.redis.name }}
-  namespace: {{ .Values.namespace }}
 spec:
   selector:
     matchLabels:
@@ -13,10 +12,15 @@ spec:
     metadata:
       labels:
         app: redis
-    spec:
+    spec:      
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       containers:
       - name: {{ .Values.redis.name }}
         image: {{ .Values.redis.image }}
+        securityContext:
+{{- toYaml .Values.redis.securityContext | nindent 10 }}
+        resources:
+{{- toYaml .Values.redis.resources | nindent 10 }}
         ports:
         - containerPort: {{ .Values.redis.port }}
           name: client

secator-0.19.0/helm/templates/secator-manager.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ .Values.secatorManager.name }}
+  labels:
+    name: secator-manager
+spec:
+  automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+  containers:
+  - name: secator-manager
+    image: {{ .Values.secatorManager.image }}
+    securityContext:
+{{- toYaml .Values.secatorManager.securityContext | nindent 6 }}
+    resources: 
+{{- toYaml .Values.secatorManager.resources | nindent 6 }}
+    command: ["sleep"]
+    args: ["infinity"]
+    env:
+    - name: SECATOR_CELERY_BROKER_URL
+      value: "redis://{{ .Values.redis.name }}:{{ .Values.redis.port }}/0"
+    - name: SECATOR_CELERY_RESULT_BACKEND
+      value: "redis://{{ .Values.redis.name }}:{{ .Values.redis.port }}/0"

{secator-0.17.0 → secator-0.19.0}/helm/templates/secator-worker.yaml

@@ -2,8 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ .Values.secatorWorker.name }}
-  namespace: {{ .Values.namespace }}
 spec:
+  replicas: {{ .Values.secatorWorker.replicas }}
   selector:
     matchLabels:
       app: secator-worker
@@ -12,13 +12,18 @@ spec:
       labels:
         app: secator-worker
     spec:
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       containers:
       - name: {{ .Values.secatorWorker.name }}
         image: {{ .Values.secatorWorker.image }}
+        securityContext:
+{{- toYaml .Values.secatorWorker.securityContext | nindent 10 }}
+        resources: 
+{{- toYaml .Values.secatorWorker.resources | nindent 10 }}
         command: ["secator"]
         args: ["worker"]
         env:
         - name: SECATOR_CELERY_BROKER_URL
-          value: "redis://{{ .Values.redis.name }}:6379/0"
+          value: "redis://{{ .Values.redis.name }}:{{ .Values.redis.port }}/0"
         - name: SECATOR_CELERY_RESULT_BACKEND
-          value: "redis://{{ .Values.redis.name }}:6379/0"
+          value: "redis://{{ .Values.redis.name }}:{{ .Values.redis.port }}/0"

secator-0.19.0/helm/values.yaml

@@ -0,0 +1,58 @@
+# Default values for Secator
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# TODO: Create service accounts instead. Assess for RBAC. Add tooling for kubernetes to image, or side-car.
+# For instance, the secator Manager pod could have sufficient access to list/get/set worker replicas for scaling from
+# from the pod itself. Perhaps another add-on?
+automountServiceAccountToken: false
+
+secatorManager:
+  name: secator-manager
+  image: "freelabz/secator"
+  securityContext: {}
+
+  # resources: cpu/memory requests and limits for managers
+  resources: {}
+
+  # Empty if using default repository
+  repository:
+  # Empty if using tag "latest"
+  tag:
+
+secatorWorker:
+  name: secator-worker
+  image: "freelabz/secator"
+  securityContext: {}
+
+  # resources: cpu/memory requests and limits for workers
+  resources: {}
+  replicas: 1
+
+  # Empty if using default repository
+  repository:
+  # Empty if using tag "latest"
+  tag:
+
+redis:
+  name: redis
+  image: "redis:alpine"
+  # Run redis with least privilege.
+  securityContext:  
+    runAsUser: 999
+    runAsGroup: 1000
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+  # resources: cpu/memory requests and limits for redis
+  resources: {}
+
+  # Empty if using default repository
+  repository:
+  # Empty if using tag "latest"
+  tag:
+  replicas: 1
+  port: 6379

{secator-0.17.0 → secator-0.19.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = 'hatchling.build'
 
 [project]
 name = 'secator'
-version = "0.17.0"
+version = "0.19.0"
 authors = [{ name = 'FreeLabz', email = 'sales@freelabz.com' }]
 readme = 'README.md'
 description = "The pentester's swiss knife."

{secator-0.17.0 → secator-0.19.0}/secator/config.py

@@ -67,6 +67,8 @@ class Celery(StrictModel):
 	task_acks_late: bool = False
 	task_send_sent_event: bool = False
 	task_reject_on_worker_lost: bool = False
+	task_max_timeout: int = -1
+	task_memory_limit_mb: int = -1
 	worker_max_tasks_per_child: int = 20
 	worker_prefetch_multiplier: int = 1
 	worker_send_task_events: bool = False
@@ -100,7 +102,6 @@ class Security(StrictModel):
 	allow_local_file_access: bool = True
 	auto_install_commands: bool = True
 	force_source_install: bool = False
-	memory_limit_mb: int = -1
 
 
 class HTTP(StrictModel):
@@ -145,7 +146,7 @@ class Wordlists(StrictModel):
 	templates: Dict[str, str] = {
 		'bo0m_fuzz': 'https://raw.githubusercontent.com/Bo0oM/fuzz.txt/master/fuzz.txt',
 		'combined_subdomains': 'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/combined_subdomains.txt',  # noqa: E501
-		'directory_list_small': 'https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Discovery/Web-Content/directory-list-2.3-small.txt',  # noqa: E501
+		'directory_list_small': 'https://gist.githubusercontent.com/sl4v/c087e36164e74233514b/raw/c51a811c70bbdd87f4725521420cc30e7232b36d/directory-list-2.3-small.txt',  # noqa: E501
 	}
 	lists: Dict[str, List[str]] = {}
 

secator-0.19.0/secator/configs/workflows/user_hunt.yaml

@@ -0,0 +1,24 @@
+type: workflow
+name: user_hunt
+alias: userhunt
+description: User account search
+tags: [user_account]
+input_types:
+  - slug
+  - string
+  - email
+
+tasks:
+  _group/hunt_users:
+    maigret:
+      description: Hunt user accounts
+      targets_:
+        - type: target
+          field: name
+          condition: target.type != 'email'
+    h8mail:
+      description: Find password leaks
+      targets_:
+        - type: target
+          field: name
+          condition: target.type == 'email'

{secator-0.17.0 → secator-0.19.0}/secator/configs/workflows/wordpress.yaml

@@ -5,15 +5,28 @@ description: Wordpress vulnerability scan
 tags: [http, wordpress, vulnerability]
 input_types:
   - url
+  - ip
+  - host
+  - host:port
 
 tasks:
+  httpx:
+    description: URL probe
+    tech_detect: True
+
   _group/hunt_wordpress:
     nuclei:
       description: Nuclei Wordpress scan
       tags: [wordpress]
+      targets_:
+      - url.url
 
     wpscan:
       description: WPScan
+      targets_:
+      - url.url
 
     wpprobe:
       description: WPProbe
+      targets_:
+      - url.url

{secator-0.17.0 → secator-0.19.0}/secator/installer.py

@@ -150,7 +150,7 @@ class PackageInstaller:
 
 		# Installer cmd
 		cmd = distribution.pm_installer
-		if CONFIG.security.autoinstall_commands and IN_CELERY_WORKER_PROCESS:
+		if CONFIG.security.auto_install_commands and IN_CELERY_WORKER_PROCESS:
 			cmd = f'flock /tmp/install.lock {cmd}'
 		if getpass.getuser() != 'root':
 			cmd = f'sudo {cmd}'

{secator-0.17.0 → secator-0.19.0}/secator/output_types/stat.py

@@ -11,6 +11,7 @@ class Stat(OutputType):
 	pid: int
 	cpu: int
 	memory: int
+	memory_limit: int
 	net_conns: int = field(default=None, repr=True)
 	extra_data: dict = field(default_factory=dict)
 	_source: str = field(default='', repr=True, compare=False)
@@ -26,11 +27,15 @@ class Stat(OutputType):
 	_sort_by = ('name', 'pid')
 
 	def __str__(self) -> str:
-		return f'{self.name} [pid={self.pid}] [cpu={self.cpu:.2f}%] [memory={self.memory:.2f}%]'
+		return f'{self.name} ([bold]pid[/]:{self.pid}) ([bold]cpu[/]:{self.cpu:.2f}%) ([bold]memory[/]:{self.memory:.2f}MB / {self.memory_limit}MB)'  # noqa: E501
 
 	def __repr__(self) -> str:
-		s = rf'[dim yellow3]📊 {self.name} \[pid={self.pid}] \[cpu={self.cpu:.2f}%] \[memory={self.memory:.2f}%]'
+		s = rf'[dim yellow3]📊 {self.name} ([bold]pid[/]:{self.pid}) ([bold]cpu[/]:{self.cpu:.2f}%)'
+		s += rf' ([bold]memory[/]:{self.memory:.2f}MB'
+		if self.memory_limit != -1:
+			s += rf' / {self.memory_limit}MB'
+		s += ')'
 		if self.net_conns:
-			s += rf' \[connections={self.net_conns}]'
+			s += rf' ([bold]connections[/]:{self.net_conns})'
 		s += ' [/]'
 		return rich_to_ansi(s)

{secator-0.17.0 → secator-0.19.0}/secator/runners/_base.py

@@ -179,14 +179,14 @@ class Runner:
 		# Add prior results to runner results
 		self.debug(f'adding {len(results)} prior results to runner', sub='init')
 		if CONFIG.addons.mongodb.enabled:
-			self.debug('adding prior results from MongoDB', sub='init')
+			self.debug(f'loading {len(results)} results from MongoDB', sub='init')
 			from secator.hooks.mongodb import get_results
 			results = get_results(results)
 		for result in results:
 			self.add_result(result, print=False, output=False, hooks=False, queue=not self.has_parent)
 
 		# Determine inputs
-		self.debug(f'resolving inputs with dynamic opts ({len(self.dynamic_opts)})', obj=self.dynamic_opts, sub='init')
+		self.debug(f'resolving inputs with {len(self.dynamic_opts)} dynamic opts', obj=self.dynamic_opts, sub='init')
 		self.inputs = [inputs] if not isinstance(inputs, list) else inputs
 		self.inputs = list(set(self.inputs))
 		targets = [Target(name=target) for target in self.inputs]
@@ -463,12 +463,11 @@ class Runner:
 		if item._uuid and item._uuid in self.uuids:
 			return
 
-		# Keep existing ancestor id in context
-		ancestor_id = item._context.get('ancestor_id', None)
-
-		# Set context
-		item._context.update(self.context)
-		item._context['ancestor_id'] = ancestor_id or self.ancestor_id
+		# Update context with runner info
+		ctx = item._context.copy()
+		item._context = self.context.copy()
+		item._context.update(ctx)
+		item._context['ancestor_id'] = ctx.get('ancestor_id') or self.ancestor_id
 
 		# Set uuid
 		if not item._uuid:
@@ -756,6 +755,7 @@ class Runner:
 			'last_updated_db': self.last_updated_db,
 			'context': self.context,
 			'errors': [e.toDict() for e in self.errors],
+			'warnings': [w.toDict() for w in self.warnings],
 		})
 		return data
 
@@ -788,8 +788,6 @@ class Runner:
 					continue
 				result = hook(self, *args)
 				self.debug('hook success', obj={'name': hook_type, 'fun': fun}, sub=sub, verbose='item' in sub)  # noqa: E501
-				if isinstance(result, Error):
-					self.add_result(result, hooks=False)
 			except Exception as e:
 				self.debug('hook failed', obj={'name': hook_type, 'fun': fun}, sub=sub)  # noqa: E501
 				error = Error.from_exception(e, message=f'Hook "{fun}" execution failed')

{secator-0.17.0 → secator-0.19.0}/secator/runners/command.py

@@ -2,11 +2,13 @@ import copy
 import getpass
 import logging
 import os
+import queue
 import re
 import shlex
 import signal
 import subprocess
 import sys
+import threading
 
 from time import time
 
@@ -178,6 +180,13 @@ class Command(Runner):
 		# Process
 		self.process = None
 
+		# Monitor thread (lazy initialization)
+		self.monitor_thread = None
+		self.monitor_stop_event = None
+		self.monitor_queue = None
+		self.process_start_time = None
+		# self.retry_count = 0  # TODO: remove this
+
 		# Sudo
 		self.requires_sudo = False
 
@@ -205,6 +214,13 @@ class Command(Runner):
 			item_loaders.append(instance_func)
 		self.item_loaders = item_loaders
 
+	def _init_monitor_objects(self):
+		"""Initialize monitor thread objects when needed (lazy initialization)."""
+		if self.monitor_stop_event is None:
+			self.monitor_stop_event = threading.Event()
+		if self.monitor_queue is None:
+			self.monitor_queue = queue.Queue()
+
 	def toDict(self):
 		res = super().toDict()
 		res.update({
@@ -419,10 +435,13 @@ class Command(Runner):
 			self.print_command()
 
 			# Check for sudo requirements and prepare the password if needed
-			sudo_password, error = self._prompt_sudo(self.cmd)
-			if error:
-				yield Error(message=error)
-				return
+			sudo_required = re.search(r'\bsudo\b', self.cmd)
+			sudo_password = None
+			if sudo_required:
+				sudo_password, error = self._prompt_sudo(self.cmd)
+				if error:
+					yield Error(message=error)
+					return
 
 			# Prepare cmds
 			command = self.cmd if self.shell else shlex.split(self.cmd)
@@ -440,7 +459,7 @@ class Command(Runner):
 			# Output and results
 			self.return_code = 0
 			self.killed = False
-			self.memory_limit_mb = CONFIG.security.memory_limit_mb
+			self.memory_limit_mb = CONFIG.celery.task_memory_limit_mb
 
 			# Run the command using subprocess
 			env = os.environ
@@ -450,11 +469,18 @@ class Command(Runner):
 				stdout=subprocess.PIPE,
 				stderr=subprocess.STDOUT,
 				universal_newlines=True,
-				preexec_fn=os.setsid,
+				preexec_fn=os.setsid if not sudo_required else None,
 				shell=self.shell,
 				env=env,
 				cwd=self.cwd)
 
+			# Initialize monitor objects and start monitor thread
+			self._init_monitor_objects()
+			self.process_start_time = time()
+			self.monitor_stop_event.clear()
+			self.monitor_thread = threading.Thread(target=self._monitor_process, daemon=True)
+			self.monitor_thread.start()
+
 			# If sudo password is provided, send it to stdin
 			if sudo_password:
 				self.process.stdin.write(f"{sudo_password}\n")
@@ -466,6 +492,7 @@ class Command(Runner):
 				if not line:
 					break
 				yield from self.process_line(line)
+				yield from self.process_monitor_queue()
 
 			# Run hooks after cmd has completed successfully
 			result = self.run_hooks('on_cmd_done', sub='end')
@@ -475,11 +502,6 @@ class Command(Runner):
 		except FileNotFoundError as e:
 			yield from self.handle_file_not_found(e)
 
-		except MemoryError as e:
-			self.debug(f'{self.unique_name}: {type(e).__name__}.', sub='end')
-			self.stop_process(exit_ok=True, sig=signal.SIGTERM)
-			yield Warning(message=f'Memory limit {self.memory_limit_mb}MB reached for {self.unique_name}')
-
 		except BaseException as e:
 			self.debug(f'{self.unique_name}: {type(e).__name__}.', sub='end')
 			self.stop_process()
@@ -529,13 +551,16 @@ class Command(Runner):
 		if self.no_process:
 			return
 
-		# Yield command stats (CPU, memory, conns ...)
-		# TODO: enable stats support with timer
-		if self.last_updated_stat and (time() - self.last_updated_stat) < CONFIG.runners.stat_update_frequency:
+	def process_monitor_queue(self):
+		"""Process and yield any queued items from monitor thread."""
+		if self.monitor_queue is None:
 			return
-
-		yield from self.stats(self.memory_limit_mb)
-		self.last_updated_stat = time()
+		while not self.monitor_queue.empty():
+			try:
+				monitor_item = self.monitor_queue.get_nowait()
+				yield monitor_item
+			except queue.Empty:
+				break
 
 	def print_description(self):
 		"""Print description"""
@@ -582,6 +607,100 @@ class Command(Runner):
 		if exit_ok:
 			self.exit_ok = True
 
+	def _stop_monitor_thread(self):
+		"""Stop monitor thread."""
+		if self.monitor_thread and self.monitor_thread.is_alive() and self.monitor_stop_event:
+			self.monitor_stop_event.set()
+			self.monitor_thread.join(timeout=2.0)
+
+	def _monitor_process(self):
+		"""Monitor thread that checks process health and kills if necessary."""
+		last_stats_time = 0
+
+		while not self.monitor_stop_event.is_set():
+			if not self.process or not self.process.pid:
+				break
+
+			try:
+				current_time = time()
+				self.debug('Collecting monitor items', sub='monitor')
+
+				# Collect and queue stats at regular intervals
+				if (current_time - last_stats_time) >= CONFIG.runners.stat_update_frequency:
+					stats_items = list(self._collect_stats())
+					for stat_item in stats_items:
+						if self.monitor_queue is not None:
+							self.monitor_queue.put(stat_item)
+					last_stats_time = current_time
+
+					# Check memory usage from collected stats
+					if self.memory_limit_mb and self.memory_limit_mb != -1:
+						total_mem = sum(stat_item.extra_data.get('memory_info', {}).get('rss', 0) / 1024 / 1024 for stat_item in stats_items)  # noqa: E501
+						if total_mem > self.memory_limit_mb:
+							warning = Warning(message=f'Memory limit {self.memory_limit_mb}MB exceeded (actual: {total_mem:.2f}MB)')
+							if self.monitor_queue is not None:
+								self.monitor_queue.put(warning)
+							self.stop_process(exit_ok=True, sig=signal.SIGTERM)
+							break
+
+				# Check execution time
+				if self.process_start_time and CONFIG.celery.task_max_timeout != -1:
+					elapsed_time = current_time - self.process_start_time
+					if elapsed_time > CONFIG.celery.task_max_timeout:
+						warning = Warning(message=f'Task timeout {CONFIG.celery.task_max_timeout}s exceeded')
+						if self.monitor_queue is not None:
+							self.monitor_queue.put(warning)
+						self.stop_process(exit_ok=True, sig=signal.SIGTERM)
+						break
+
+				# Check retry count
+				# TODO: remove this
+				# if CONFIG.celery.task_max_retries and self.retry_count >= CONFIG.celery.task_max_retries:
+				# 	warning = Warning(message=f'Max retries {CONFIG.celery.task_max_retries} exceeded (actual: {self.retry_count})')
+				# 	self.monitor_queue.put(warning)
+				# 	self.stop_process(exit_ok=False, sig=signal.SIGTERM)
+				# 	break
+
+			except Exception as e:
+				self.debug(f'Monitor thread error: {e}', sub='monitor')
+				warning = Warning(message=f'Monitor thread error: {e}')
+				if self.monitor_queue is not None:
+					self.monitor_queue.put(warning)
+				break
+
+			# Sleep for a short interval before next check (stat update frequency)
+			self.monitor_stop_event.wait(CONFIG.runners.stat_update_frequency)
+
+	def _collect_stats(self):
+		"""Collect stats about the current running process, if any."""
+		if not self.process or not self.process.pid:
+			return
+		proc = psutil.Process(self.process.pid)
+		stats = Command.get_process_info(proc, children=True)
+		total_mem = 0
+		for info in stats:
+			name = info['name']
+			pid = info['pid']
+			cpu_percent = info['cpu_percent']
+			# mem_percent = info['memory_percent']
+			mem_rss = round(info['memory_info']['rss'] / 1024 / 1024, 2)
+			total_mem += mem_rss
+			self.debug(f'{name} {pid} {mem_rss}MB', sub='monitor')
+			net_conns = info.get('net_connections') or []
+			extra_data = {k: v for k, v in info.items() if k not in ['cpu_percent', 'memory_percent', 'net_connections']}
+			yield Stat(
+				name=name,
+				pid=pid,
+				cpu=cpu_percent,
+				memory=mem_rss,
+				memory_limit=self.memory_limit_mb,
+				net_conns=len(net_conns),
+				extra_data=extra_data
+			)
+		# self.debug(f'Total mem: {total_mem}MB, memory limit: {self.memory_limit_mb}', sub='monitor')
+		# if self.memory_limit_mb and self.memory_limit_mb != -1 and total_mem > self.memory_limit_mb:
+		# 	raise MemoryError(f'Memory limit {self.memory_limit_mb}MB reached for {self.unique_name}')
+
 	def stats(self, memory_limit_mb=None):
 		"""Gather stats about the current running process, if any."""
 		if not self.process or not self.process.pid:
@@ -596,7 +715,7 @@ class Command(Runner):
 			mem_percent = info['memory_percent']
 			mem_rss = round(info['memory_info']['rss'] / 1024 / 1024, 2)
 			total_mem += mem_rss
-			self.debug(f'{name} {pid} {mem_rss}MB', sub='stats')
+			self.debug(f'process: {name} pid: {pid} memory: {mem_rss}MB', sub='stats')
 			net_conns = info.get('net_connections') or []
 			extra_data = {k: v for k, v in info.items() if k not in ['cpu_percent', 'memory_percent', 'net_connections']}
 			yield Stat(
@@ -688,7 +807,7 @@ class Command(Runner):
 				['sudo', '-S', '-p', '', 'true'],
 				input=sudo_password + "\n",
 				text=True,
-				capture_output=True
+				capture_output=True,
 			)
 			if result.returncode == 0:
 				return sudo_password, None  # Password is correct
@@ -698,6 +817,8 @@ class Command(Runner):
 
 	def _wait_for_end(self):
 		"""Wait for process to finish and process output and return code."""
+		self._stop_monitor_thread()
+		yield from self.process_monitor_queue()
 		if not self.process:
 			return
 		for line in self.process.stdout.readlines():