@keygraph/shannon 1.0.0-beta.1

package/dist/index.mjs

@@ -0,0 +1,1711 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync, spawn } from "node:child_process";
+import crypto from "node:crypto";
+import os from "node:os";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { watch } from "chokidar";
+import * as p from "@clack/prompts";
+import { parse, stringify } from "smol-toml";
+import dotenv from "dotenv";
+//#region src/mode.ts
+let cachedMode;
+function getMode() {
+	if (cachedMode !== void 0) return cachedMode;
+	cachedMode = process.env.SHANNON_LOCAL === "1" ? "local" : "npx";
+	return cachedMode;
+}
+function isLocal() {
+	return getMode() === "local";
+}
+//#endregion
+//#region src/docker.ts
+/**
+* Docker orchestration — compose lifecycle, network, image pull/build, worker spawning.
+*
+* Local mode: builds locally, uses docker-compose.yml from repo root, mounts prompts.
+* NPX mode: pulls from Docker Hub, uses bundled compose.yml.
+*/
+const __dirname$1 = path.dirname(fileURLToPath(import.meta.url));
+const NPX_IMAGE_REPO = "keygraph/shannon";
+const DEV_IMAGE = "shannon-worker";
+function getWorkerImage(version) {
+	return getMode() === "local" ? DEV_IMAGE : `${NPX_IMAGE_REPO}:${version}`;
+}
+function getComposeFile() {
+	return getMode() === "local" ? path.resolve("docker-compose.yml") : path.resolve(__dirname$1, "..", "infra", "compose.yml");
+}
+/** Generate an 8-char random hex suffix for container/queue names. */
+function randomSuffix() {
+	return crypto.randomBytes(4).toString("hex");
+}
+/** Run a command silently, return true if it succeeds. */
+function runQuiet(cmd, args) {
+	try {
+		execFileSync(cmd, args, { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Run a command and return stdout, or empty string on failure. */
+function runOutput(cmd, args) {
+	try {
+		return execFileSync(cmd, args, {
+			stdio: "pipe",
+			encoding: "utf-8"
+		}).trim();
+	} catch {
+		return "";
+	}
+}
+/**
+* Check if Temporal is running and healthy.
+*/
+function isTemporalReady() {
+	return runOutput("docker", [
+		"exec",
+		"shannon-temporal",
+		"temporal",
+		"operator",
+		"cluster",
+		"health",
+		"--address",
+		"localhost:7233"
+	]).includes("SERVING");
+}
+/** Check if the router container is running and healthy. */
+function isRouterReady() {
+	return runOutput("docker", [
+		"inspect",
+		"--format",
+		"{{.State.Health.Status}}",
+		"shannon-router"
+	]) === "healthy";
+}
+/**
+* Ensure Temporal (and optionally router) are running via compose.
+* If Temporal is already up but router is needed and missing, starts router only.
+*/
+async function ensureInfra(useRouter) {
+	const temporalReady = isTemporalReady();
+	const routerNeeded = useRouter && !isRouterReady();
+	if (temporalReady && !routerNeeded) return;
+	const composeArgs = [
+		"compose",
+		"-f",
+		getComposeFile()
+	];
+	if (useRouter) composeArgs.push("--profile", "router");
+	composeArgs.push("up", "-d");
+	if (temporalReady && routerNeeded) console.log("Starting router...");
+	else console.log("Starting Shannon infrastructure...");
+	execFileSync("docker", composeArgs, { stdio: "inherit" });
+	if (!temporalReady) {
+		console.log("Waiting for Temporal to be ready...");
+		for (let i = 0; i < 30; i++) {
+			if (isTemporalReady()) {
+				console.log("Temporal is ready!");
+				break;
+			}
+			if (i === 29) {
+				console.error("Timeout waiting for Temporal");
+				process.exit(1);
+			}
+			await setTimeout$1(2e3);
+		}
+	}
+	if (routerNeeded) {
+		console.log("Waiting for router to be ready...");
+		for (let i = 0; i < 15; i++) {
+			if (isRouterReady()) {
+				console.log("Router is ready!");
+				return;
+			}
+			await setTimeout$1(2e3);
+		}
+		console.error("Timeout waiting for router");
+		process.exit(1);
+	}
+}
+/**
+* Build the worker image locally (local mode only).
+*/
+function buildImage(noCache) {
+	console.log(`Building ${DEV_IMAGE}...`);
+	const args = ["build"];
+	if (noCache) args.push("--no-cache");
+	args.push("-t", DEV_IMAGE, ".");
+	execFileSync("docker", args, { stdio: "inherit" });
+	console.log(`Build complete: ${DEV_IMAGE}`);
+}
+/**
+* Ensure the worker image is available.
+* Local mode: auto-builds if missing. NPX mode: pulls from Docker Hub.
+*/
+function ensureImage(version) {
+	const image = getWorkerImage(version);
+	if (runQuiet("docker", [
+		"image",
+		"inspect",
+		image
+	])) return;
+	if (getMode() === "local") {
+		console.log("Worker image not found, building...");
+		buildImage(false);
+	} else {
+		console.log(`Pulling ${image}...`);
+		try {
+			execFileSync("docker", ["pull", image], { stdio: "inherit" });
+		} catch {
+			console.error(`\nERROR: Failed to pull ${image}`);
+			console.error("The image may not be available for your platform yet.");
+			console.error("Check https://hub.docker.com/r/keygraph/shannon for available tags.");
+			process.exit(1);
+		}
+		pruneOldImages(version);
+	}
+}
+/**
+* Detect if --add-host is needed (Linux without Podman).
+* macOS has host.docker.internal built in.
+*/
+function addHostFlag() {
+	if (os.platform() === "linux") {
+		if (!runQuiet("which", ["podman"])) return ["--add-host", "host.docker.internal:host-gateway"];
+	}
+	return [];
+}
+/**
+* Spawn the worker container in detached mode and return the process.
+*/
+function spawnWorker(opts) {
+	const args = [
+		"run",
+		"-d",
+		"--rm",
+		"--name",
+		opts.containerName,
+		"--network",
+		"shannon-net"
+	];
+	args.push(...addHostFlag());
+	if (os.platform() === "linux" && process.getuid && process.getgid) args.push("-e", `SHANNON_HOST_UID=${process.getuid()}`, "-e", `SHANNON_HOST_GID=${process.getgid()}`);
+	args.push("-v", `${opts.workspacesDir}:/app/workspaces`);
+	args.push("-v", `${opts.repo.hostPath}:${opts.repo.containerPath}`);
+	if (opts.promptsDir) args.push("-v", `${opts.promptsDir}:/app/apps/worker/prompts:ro`);
+	if (opts.config) args.push("-v", `${opts.config.hostPath}:${opts.config.containerPath}:ro`);
+	if (opts.outputDir) args.push("-v", `${opts.outputDir}:/app/output`);
+	if (opts.credentialsDir) args.push("-v", `${opts.credentialsDir}:/app/credentials:ro`);
+	else if (opts.credentials) args.push("-v", `${opts.credentials}:/app/credentials/google-sa-key.json:ro`);
+	args.push(...opts.envFlags);
+	args.push("--shm-size", "2gb", "--ipc", "host", "--security-opt", "seccomp=unconfined");
+	args.push(getWorkerImage(opts.version));
+	args.push("node", "apps/worker/dist/temporal/worker.js", opts.url, opts.repo.containerPath);
+	args.push("--task-queue", opts.taskQueue);
+	if (opts.config) args.push("--config", opts.config.containerPath);
+	if (opts.outputDir) args.push("--output", "/app/output");
+	if (opts.workspace) args.push("--workspace", opts.workspace);
+	if (opts.pipelineTesting) args.push("--pipeline-testing");
+	return spawn("docker", args, {
+		stdio: "pipe",
+		...os.platform() === "win32" && { env: {
+			...process.env,
+			MSYS_NO_PATHCONV: "1"
+		} }
+	});
+}
+/**
+* Stop all running shannon-worker-* containers.
+*/
+function stopWorkers() {
+	const workers = runOutput("docker", [
+		"ps",
+		"-q",
+		"--filter",
+		"name=shannon-worker-"
+	]);
+	if (!workers) return;
+	const ids = workers.split("\n").filter(Boolean);
+	console.log("Stopping worker containers...");
+	execFileSync("docker", ["stop", ...ids], { stdio: "inherit" });
+}
+/**
+* Tear down the compose stack.
+*/
+function stopInfra(clean) {
+	const args = [
+		"compose",
+		"-f",
+		getComposeFile(),
+		"--profile",
+		"router",
+		"down"
+	];
+	if (clean) args.push("-v");
+	execFileSync("docker", args, { stdio: "inherit" });
+}
+/**
+* Pull the worker image matching the current CLI version.
+*/
+function pullImage(version) {
+	const image = getWorkerImage(version);
+	console.log(`Pulling ${image}...`);
+	try {
+		execFileSync("docker", ["pull", image], { stdio: "inherit" });
+	} catch {
+		console.error(`\nERROR: Failed to pull ${image}`);
+		console.error("Check https://hub.docker.com/r/keygraph/shannon for available tags.");
+		process.exit(1);
+	}
+	pruneOldImages(version);
+}
+/**
+* Remove old keygraph/shannon images that don't match the current version.
+*/
+function pruneOldImages(currentVersion) {
+	const output = runOutput("docker", [
+		"images",
+		NPX_IMAGE_REPO,
+		"--format",
+		"{{.Tag}}"
+	]);
+	if (!output) return;
+	const currentTag = currentVersion;
+	const stale = output.split("\n").filter((tag) => tag && tag !== currentTag);
+	for (const tag of stale) runQuiet("docker", ["rmi", `${NPX_IMAGE_REPO}:${tag}`]);
+}
+/**
+* List running worker containers.
+*/
+function listRunningWorkers() {
+	return runOutput("docker", [
+		"ps",
+		"--filter",
+		"name=shannon-worker-",
+		"--format",
+		"table {{.Names}}	{{.Status}}	{{.RunningFor}}"
+	]);
+}
+//#endregion
+//#region src/commands/build.ts
+/**
+* `shannon build` command — build the worker Docker image locally.
+* Only available in local mode (running from cloned repository).
+*/
+function build(noCache) {
+	if (!isLocal()) {
+		console.error("ERROR: Build is only available when running from the Shannon repository");
+		console.error("  (Dockerfile not found in current directory)");
+		console.error("");
+		console.error("For npx usage, run: shannon update");
+		process.exit(1);
+	}
+	buildImage(noCache);
+}
+//#endregion
+//#region src/home.ts
+/**
+* Shannon state directory management.
+*
+* Local mode (cloned repo): uses ./workspaces/, ./credentials/
+* NPX mode: uses ~/.shannon/workspaces/, ~/.shannon/
+*/
+const SHANNON_HOME$2 = path.join(os.homedir(), ".shannon");
+function getConfigFile() {
+	return path.join(SHANNON_HOME$2, "config.toml");
+}
+function getWorkspacesDir() {
+	return getMode() === "local" ? path.resolve("workspaces") : path.join(SHANNON_HOME$2, "workspaces");
+}
+/**
+* Resolve the Vertex credentials file path.
+*
+* Checks GOOGLE_APPLICATION_CREDENTIALS env var first (may be set by TOML resolver),
+* then falls back to mode-appropriate default location.
+*/
+function getCredentialsPath() {
+	const envPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (envPath && fs.existsSync(envPath)) return path.resolve(envPath);
+	if (getMode() === "local") return path.resolve("credentials", "google-sa-key.json");
+	return path.join(SHANNON_HOME$2, "google-sa-key.json");
+}
+/**
+* In dev mode, return the credentials directory if it exists and has files.
+* In npx mode, there is no credentials directory (single file mount instead).
+*/
+function getCredentialsDir() {
+	if (getMode() !== "local") return void 0;
+	const dir = path.resolve("credentials");
+	if (!fs.existsSync(dir)) return void 0;
+	return fs.readdirSync(dir).length > 0 ? dir : void 0;
+}
+/**
+* Initialize state directories.
+* Local mode: creates ./workspaces/ and ./credentials/
+* NPX mode: creates ~/.shannon/workspaces/
+*/
+function initHome() {
+	if (getMode() === "local") {
+		fs.mkdirSync(path.resolve("workspaces"), { recursive: true });
+		fs.mkdirSync(path.resolve("credentials"), { recursive: true });
+	} else fs.mkdirSync(path.join(SHANNON_HOME$2, "workspaces"), { recursive: true });
+}
+//#endregion
+//#region src/commands/logs.ts
+/**
+* `shannon logs` command — tail a workspace's workflow log.
+*
+* Uses chokidar for reliable cross-platform file watching and
+* bounded synchronous reads to prevent duplicate output.
+*/
+const COMPLETION_PATTERN = /^Workflow (COMPLETED|FAILED)$/m;
+/** Read a byte range from a file and return it as a UTF-8 string. */
+function readRange(filePath, start, end) {
+	const length = end - start;
+	const buffer = Buffer.alloc(length);
+	const fd = fs.openSync(filePath, "r");
+	try {
+		fs.readSync(fd, buffer, 0, length, start);
+	} finally {
+		fs.closeSync(fd);
+	}
+	return buffer.toString("utf-8");
+}
+/** Resolve a workspace ID to its workflow.log path, or exit with an error. */
+function resolveLogFile(workspaceId) {
+	const workspacesDir = getWorkspacesDir();
+	const directPath = path.join(workspacesDir, workspaceId, "workflow.log");
+	if (fs.existsSync(directPath)) return directPath;
+	const resumeBase = workspaceId.replace(/_resume_\d+$/, "");
+	if (resumeBase !== workspaceId) {
+		const resumePath = path.join(workspacesDir, resumeBase, "workflow.log");
+		if (fs.existsSync(resumePath)) return resumePath;
+	}
+	const namedBase = workspaceId.replace(/_shannon-\d+$/, "");
+	if (namedBase !== workspaceId) {
+		const namedPath = path.join(workspacesDir, namedBase, "workflow.log");
+		if (fs.existsSync(namedPath)) return namedPath;
+	}
+	console.error(`ERROR: Workflow log not found for: ${workspaceId}`);
+	console.error("");
+	console.error("Possible causes:");
+	console.error("  - Workflow hasn't started yet");
+	console.error("  - Workspace ID is incorrect");
+	console.error("");
+	console.error("Check the Temporal Web UI at http://localhost:8233 for workflow details");
+	process.exit(1);
+}
+function logs(workspaceId) {
+	const logFile = resolveLogFile(workspaceId);
+	let position = 0;
+	/**
+	* Output any new content appended since the last read.
+	* Returns true when the workflow completion marker is detected.
+	*/
+	function flush() {
+		try {
+			const { size } = fs.statSync(logFile);
+			if (size <= position) return false;
+			const data = readRange(logFile, position, size);
+			process.stdout.write(data);
+			position = size;
+			return COMPLETION_PATTERN.test(data);
+		} catch {
+			return true;
+		}
+	}
+	console.log(`Tailing workflow log: ${logFile}`);
+	if (flush()) process.exit(0);
+	const watcher = watch(logFile, { persistent: true });
+	const shutdown = () => {
+		watcher.close().finally(() => process.exit(0));
+		setTimeout(() => process.exit(0), 1e3).unref();
+	};
+	watcher.on("change", () => {
+		if (flush()) shutdown();
+	});
+	process.on("SIGINT", shutdown);
+}
+//#endregion
+//#region src/config/writer.ts
+/** TOML config writer for ~/.shannon/config.toml. */
+/** Write the config to ~/.shannon/config.toml with 0o600 permissions. */
+function saveConfig(config) {
+	const configPath = getConfigFile();
+	const dir = path.dirname(configPath);
+	fs.mkdirSync(dir, { recursive: true });
+	const content = stringify(config);
+	fs.writeFileSync(configPath, content, { mode: 384 });
+}
+//#endregion
+//#region src/commands/setup.ts
+/**
+* `shn setup` — interactive TUI wizard for one-time credential configuration.
+*
+* Walks the user through selecting a provider and entering credentials,
+* then persists everything to ~/.shannon/config.toml with 0o600 permissions.
+*/
+const SHANNON_HOME$1 = path.join(os.homedir(), ".shannon");
+async function setup() {
+	p.intro("Shannon Setup");
+	const provider = await p.select({
+		message: "Select your AI provider",
+		options: [
+			{
+				value: "anthropic",
+				label: "Claude Direct",
+				hint: "recommended"
+			},
+			{
+				value: "custom_base_url",
+				label: "Custom Base URL",
+				hint: "proxies, gateways"
+			},
+			{
+				value: "bedrock",
+				label: "Claude via AWS Bedrock"
+			},
+			{
+				value: "vertex",
+				label: "Claude via Google Vertex AI"
+			},
+			{
+				value: "router",
+				label: "Router",
+				hint: "experimental"
+			}
+		]
+	});
+	if (p.isCancel(provider)) return cancelAndExit();
+	saveConfig(await setupProvider(provider));
+	const configPath = path.join(SHANNON_HOME$1, "config.toml");
+	p.log.success(`Configuration saved to ${configPath}`);
+	p.outro("Run `npx @keygraph/shannon start` to begin a scan.");
+}
+async function setupProvider(provider) {
+	switch (provider) {
+		case "anthropic": return setupAnthropic();
+		case "custom_base_url": return setupCustomBaseUrl();
+		case "bedrock": return setupBedrock();
+		case "vertex": return setupVertex();
+		case "router": return setupRouter();
+	}
+}
+async function setupAnthropic() {
+	const authMethod = await p.select({
+		message: "Authentication method",
+		options: [{
+			value: "api_key",
+			label: "API Key"
+		}, {
+			value: "oauth",
+			label: "OAuth Token"
+		}]
+	});
+	if (p.isCancel(authMethod)) return cancelAndExit();
+	const config = {};
+	if (authMethod === "oauth") config.anthropic = { oauth_token: await promptSecret("Enter your OAuth token") };
+	else config.anthropic = { api_key: await promptSecret("Enter your Anthropic API key") };
+	const customizeModels = await p.confirm({
+		message: "Do you want to change the default models?\n    Small  - claude-haiku-4-5-20251001\n    Medium - claude-sonnet-4-6\n    Large  - claude-opus-4-6",
+		initialValue: false
+	});
+	if (p.isCancel(customizeModels)) return cancelAndExit();
+	if (customizeModels) {
+		const small = await p.text({
+			message: "Small model ID",
+			initialValue: "claude-haiku-4-5-20251001",
+			validate: required("Small model ID is required")
+		});
+		if (p.isCancel(small)) return cancelAndExit();
+		const medium = await p.text({
+			message: "Medium model ID",
+			initialValue: "claude-sonnet-4-6",
+			validate: required("Medium model ID is required")
+		});
+		if (p.isCancel(medium)) return cancelAndExit();
+		const large = await p.text({
+			message: "Large model ID",
+			initialValue: "claude-opus-4-6",
+			validate: required("Large model ID is required")
+		});
+		if (p.isCancel(large)) return cancelAndExit();
+		config.models = {
+			small,
+			medium,
+			large
+		};
+	}
+	return config;
+}
+async function setupCustomBaseUrl() {
+	const baseUrl = await p.text({
+		message: "Endpoint URL",
+		placeholder: "https://your-proxy.example.com",
+		validate: (value) => {
+			if (!value) return "Endpoint URL is required";
+			try {
+				new URL(value);
+			} catch {
+				return "Must be a valid URL";
+			}
+		}
+	});
+	if (p.isCancel(baseUrl)) return cancelAndExit();
+	const config = { custom_base_url: {
+		base_url: baseUrl,
+		auth_token: await promptSecret("Enter the auth token for the custom endpoint")
+	} };
+	const customizeModels = await p.confirm({
+		message: "Do you want to change the default models?\n    Small  - claude-haiku-4-5-20251001\n    Medium - claude-sonnet-4-6\n    Large  - claude-opus-4-6",
+		initialValue: false
+	});
+	if (p.isCancel(customizeModels)) return cancelAndExit();
+	if (customizeModels) {
+		const small = await p.text({
+			message: "Small model ID",
+			initialValue: "claude-haiku-4-5-20251001",
+			validate: required("Small model ID is required")
+		});
+		if (p.isCancel(small)) return cancelAndExit();
+		const medium = await p.text({
+			message: "Medium model ID",
+			initialValue: "claude-sonnet-4-6",
+			validate: required("Medium model ID is required")
+		});
+		if (p.isCancel(medium)) return cancelAndExit();
+		const large = await p.text({
+			message: "Large model ID",
+			initialValue: "claude-opus-4-6",
+			validate: required("Large model ID is required")
+		});
+		if (p.isCancel(large)) return cancelAndExit();
+		config.models = {
+			small,
+			medium,
+			large
+		};
+	}
+	return config;
+}
+async function setupBedrock() {
+	const region = await p.text({
+		message: "AWS Region",
+		placeholder: "us-east-1",
+		validate: required("AWS Region is required")
+	});
+	if (p.isCancel(region)) return cancelAndExit();
+	const token = await promptSecret("Enter your AWS Bearer Token");
+	const small = await p.text({
+		message: "Small model ID",
+		placeholder: "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+		validate: required("Small model ID is required")
+	});
+	if (p.isCancel(small)) return cancelAndExit();
+	const medium = await p.text({
+		message: "Medium model ID",
+		placeholder: "us.anthropic.claude-sonnet-4-6",
+		validate: required("Medium model ID is required")
+	});
+	if (p.isCancel(medium)) return cancelAndExit();
+	const large = await p.text({
+		message: "Large model ID",
+		placeholder: "us.anthropic.claude-opus-4-6",
+		validate: required("Large model ID is required")
+	});
+	if (p.isCancel(large)) return cancelAndExit();
+	return {
+		bedrock: {
+			use: true,
+			region,
+			token
+		},
+		models: {
+			small,
+			medium,
+			large
+		}
+	};
+}
+async function setupVertex() {
+	const region = await p.text({
+		message: "Google Cloud region",
+		placeholder: "us-east5",
+		validate: required("Region is required")
+	});
+	if (p.isCancel(region)) return cancelAndExit();
+	const projectId = await p.text({
+		message: "GCP Project ID",
+		validate: required("Project ID is required")
+	});
+	if (p.isCancel(projectId)) return cancelAndExit();
+	p.log.info("Select the path to your GCP Service Account JSON key file.");
+	const keySourcePath = await p.path({
+		message: "Service Account JSON key file",
+		validate: (value) => {
+			if (!value) return "Path is required";
+			if (!fs.existsSync(value)) return "File not found";
+			if (!value.endsWith(".json")) return "Must be a .json file";
+		}
+	});
+	if (p.isCancel(keySourcePath)) return cancelAndExit();
+	const destPath = path.join(SHANNON_HOME$1, "google-sa-key.json");
+	fs.mkdirSync(SHANNON_HOME$1, { recursive: true });
+	fs.copyFileSync(keySourcePath, destPath);
+	fs.chmodSync(destPath, 384);
+	p.log.success(`Key copied to ${destPath} (permissions: 0600)`);
+	const models = await p.group({
+		small: () => p.text({
+			message: "Small model ID",
+			placeholder: "claude-haiku-4-5@20251001",
+			validate: required("Small model ID is required")
+		}),
+		medium: () => p.text({
+			message: "Medium model ID",
+			placeholder: "claude-sonnet-4-6",
+			validate: required("Medium model ID is required")
+		}),
+		large: () => p.text({
+			message: "Large model ID",
+			placeholder: "claude-opus-4-6",
+			validate: required("Large model ID is required")
+		})
+	});
+	if (p.isCancel(models)) return cancelAndExit();
+	return {
+		vertex: {
+			use: true,
+			region,
+			project_id: projectId,
+			key_path: destPath
+		},
+		models: {
+			small: models.small,
+			medium: models.medium,
+			large: models.large
+		}
+	};
+}
+async function setupRouter() {
+	const routerProvider = await p.select({
+		message: "Router provider",
+		options: [{
+			value: "openai",
+			label: "OpenAI"
+		}, {
+			value: "openrouter",
+			label: "OpenRouter"
+		}]
+	});
+	if (p.isCancel(routerProvider)) return cancelAndExit();
+	const apiKey = await promptSecret(routerProvider === "openai" ? "Enter your OpenAI API key" : "Enter your OpenRouter API key");
+	let defaultModel;
+	if (routerProvider === "openai") {
+		const model = await p.select({
+			message: "Default model",
+			options: [{
+				value: "gpt-5.2",
+				label: "GPT-5.2"
+			}, {
+				value: "gpt-5-mini",
+				label: "GPT-5 Mini"
+			}]
+		});
+		if (p.isCancel(model)) return cancelAndExit();
+		defaultModel = `openai,${model}`;
+	} else {
+		const model = await p.select({
+			message: "Default model",
+			options: [{
+				value: "google/gemini-3-flash-preview",
+				label: "Google Gemini 3 Flash Preview"
+			}]
+		});
+		if (p.isCancel(model)) return cancelAndExit();
+		defaultModel = `openrouter,${model}`;
+	}
+	const router = { default: defaultModel };
+	if (routerProvider === "openai") router.openai_key = apiKey;
+	else router.openrouter_key = apiKey;
+	return { router };
+}
+async function promptSecret(message) {
+	const value = await p.password({
+		message,
+		validate: required(`${message.replace(/^Enter /, "")} is required`)
+	});
+	if (p.isCancel(value)) return cancelAndExit();
+	return value;
+}
+function required(errorMessage) {
+	return (value) => {
+		if (!value) return errorMessage;
+	};
+}
+function cancelAndExit() {
+	p.cancel("Setup cancelled.");
+	process.exit(0);
+}
+//#endregion
+//#region src/config/resolver.ts
+/**
+* Configuration resolver with environment-first, TOML-fallback precedence.
+*
+* Priority: process.env > ~/.shannon/config.toml
+* Env var names match .env.example exactly; TOML uses nested sections.
+*/
+/** Maps every supported env var to its TOML path (section.key) and expected type. */
+const CONFIG_MAP = [
+	{
+		env: "CLAUDE_CODE_MAX_OUTPUT_TOKENS",
+		toml: "core.max_tokens",
+		type: "number"
+	},
+	{
+		env: "ANTHROPIC_API_KEY",
+		toml: "anthropic.api_key",
+		type: "string"
+	},
+	{
+		env: "CLAUDE_CODE_OAUTH_TOKEN",
+		toml: "anthropic.oauth_token",
+		type: "string"
+	},
+	{
+		env: "CLAUDE_CODE_USE_BEDROCK",
+		toml: "bedrock.use",
+		type: "boolean"
+	},
+	{
+		env: "AWS_REGION",
+		toml: "bedrock.region",
+		type: "string"
+	},
+	{
+		env: "AWS_BEARER_TOKEN_BEDROCK",
+		toml: "bedrock.token",
+		type: "string"
+	},
+	{
+		env: "CLAUDE_CODE_USE_VERTEX",
+		toml: "vertex.use",
+		type: "boolean"
+	},
+	{
+		env: "CLOUD_ML_REGION",
+		toml: "vertex.region",
+		type: "string"
+	},
+	{
+		env: "ANTHROPIC_VERTEX_PROJECT_ID",
+		toml: "vertex.project_id",
+		type: "string"
+	},
+	{
+		env: "GOOGLE_APPLICATION_CREDENTIALS",
+		toml: "vertex.key_path",
+		type: "string"
+	},
+	{
+		env: "ANTHROPIC_BASE_URL",
+		toml: "custom_base_url.base_url",
+		type: "string"
+	},
+	{
+		env: "ANTHROPIC_AUTH_TOKEN",
+		toml: "custom_base_url.auth_token",
+		type: "string"
+	},
+	{
+		env: "ROUTER_DEFAULT",
+		toml: "router.default",
+		type: "string"
+	},
+	{
+		env: "OPENAI_API_KEY",
+		toml: "router.openai_key",
+		type: "string"
+	},
+	{
+		env: "OPENROUTER_API_KEY",
+		toml: "router.openrouter_key",
+		type: "string"
+	},
+	{
+		env: "ANTHROPIC_SMALL_MODEL",
+		toml: "models.small",
+		type: "string"
+	},
+	{
+		env: "ANTHROPIC_MEDIUM_MODEL",
+		toml: "models.medium",
+		type: "string"
+	},
+	{
+		env: "ANTHROPIC_LARGE_MODEL",
+		toml: "models.large",
+		type: "string"
+	}
+];
+/** Read a nested TOML value by dotted path (e.g. "anthropic.api_key"). */
+function getTomlValue(config, path) {
+	const [section, key] = path.split(".");
+	if (!section || !key) return void 0;
+	const sectionObj = config[section];
+	if (!sectionObj || typeof sectionObj !== "object") return void 0;
+	const value = sectionObj[key];
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "boolean") return value ? "1" : "0";
+	return String(value);
+}
+/** Parse the global TOML config file, returning null if it doesn't exist. */
+function loadTOML() {
+	const configPath = getConfigFile();
+	if (!fs.existsSync(configPath)) return null;
+	if (process.platform !== "win32") {
+		const mode = fs.statSync(configPath).mode;
+		if (mode & 63) {
+			const actual = (mode & 511).toString(8).padStart(3, "0");
+			console.error(`\nInsecure permissions (${actual}) on ${configPath}. Run: chmod 600 ${configPath}\n`);
+			process.exit(1);
+		}
+	}
+	try {
+		return parse(fs.readFileSync(configPath, "utf-8"));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(`\nFailed to parse ${configPath}: ${message}`);
+		console.error(`\nRun 'npx @keygraph/shannon setup' to reconfigure.\n`);
+		process.exit(1);
+	}
+}
+/** Build a lookup of allowed keys per section from CONFIG_MAP. */
+function buildSchema() {
+	const schema = /* @__PURE__ */ new Map();
+	for (const mapping of CONFIG_MAP) {
+		const [section, key] = mapping.toml.split(".");
+		if (!section || !key) continue;
+		let keys = schema.get(section);
+		if (!keys) {
+			keys = /* @__PURE__ */ new Map();
+			schema.set(section, keys);
+		}
+		keys.set(key, mapping.type);
+	}
+	return schema;
+}
+/** Check that a provider section has all required fields and dependencies. */
+function validateProviderFields(config, provider, errors) {
+	const section = config[provider];
+	if (!section) return;
+	const keys = Object.keys(section);
+	switch (provider) {
+		case "anthropic":
+			if (!keys.includes("api_key") && !keys.includes("oauth_token")) errors.push("[anthropic] requires either api_key or oauth_token");
+			break;
+		case "custom_base_url": {
+			const missing = ["base_url", "auth_token"].filter((k) => !keys.includes(k));
+			if (missing.length > 0) errors.push(`[custom_base_url] missing required keys: ${missing.join(", ")}`);
+			break;
+		}
+		case "bedrock": {
+			const missing = [
+				"use",
+				"region",
+				"token"
+			].filter((k) => !keys.includes(k));
+			if (missing.length > 0) errors.push(`[bedrock] missing required keys: ${missing.join(", ")}`);
+			validateModelTiers(config, "bedrock", errors);
+			break;
+		}
+		case "vertex": {
+			const missing = [
+				"use",
+				"region",
+				"project_id",
+				"key_path"
+			].filter((k) => !keys.includes(k));
+			if (missing.length > 0) errors.push(`[vertex] missing required keys: ${missing.join(", ")}`);
+			validateModelTiers(config, "vertex", errors);
+			break;
+		}
+		case "router": {
+			if (!keys.includes("default")) errors.push("[router] missing required key: default");
+			if (!keys.includes("openai_key") && !keys.includes("openrouter_key")) errors.push("[router] requires either openai_key or openrouter_key");
+			const models = config.models;
+			if (models && typeof models === "object" && Object.keys(models).length > 0) errors.push("[models] is not supported with [router]");
+			break;
+		}
+	}
+}
+/** Bedrock and Vertex require a [models] section with all three tiers. */
+function validateModelTiers(config, provider, errors) {
+	const models = config.models;
+	if (!models || typeof models !== "object") {
+		errors.push(`[${provider}] requires a [models] section with small, medium, and large`);
+		return;
+	}
+	const missing = [
+		"small",
+		"medium",
+		"large"
+	].filter((k) => !Object.keys(models).includes(k));
+	if (missing.length > 0) errors.push(`[models] missing required keys for ${provider}: ${missing.join(", ")}`);
+}
+/**
+* Validate a parsed TOML config against the known schema.
+* Returns an array of human-readable error messages (empty = valid).
+*/
+function validateConfig(config) {
+	const schema = buildSchema();
+	const errors = [];
+	for (const [section, sectionObj] of Object.entries(config)) {
+		const allowedKeys = schema.get(section);
+		if (!allowedKeys) {
+			const known = [...schema.keys()].join(", ");
+			errors.push(`Unknown section [${section}]. Valid sections: ${known}`);
+			continue;
+		}
+		if (!sectionObj || typeof sectionObj !== "object") {
+			errors.push(`[${section}] must be a table, got ${typeof sectionObj}`);
+			continue;
+		}
+		for (const [key, value] of Object.entries(sectionObj)) {
+			const expectedType = allowedKeys.get(key);
+			if (!expectedType) {
+				const known = [...allowedKeys.keys()].join(", ");
+				errors.push(`Unknown key "${key}" in [${section}]. Valid keys: ${known}`);
+				continue;
+			}
+			if (typeof value !== expectedType) {
+				errors.push(`[${section}].${key} must be ${expectedType}, got ${typeof value}`);
+				continue;
+			}
+			if (typeof value === "string" && value.trim() === "") errors.push(`[${section}].${key} must not be empty`);
+		}
+	}
+	const present = [
+		"anthropic",
+		"custom_base_url",
+		"bedrock",
+		"vertex",
+		"router"
+	].filter((s) => {
+		const section = config[s];
+		return section && typeof section === "object" && Object.keys(section).length > 0;
+	});
+	if (present.length > 1) errors.push(`Multiple providers configured: [${present.join("], [")}]. Only one provider section is allowed at a time`);
+	const singleProvider = present.length === 1 ? present[0] : void 0;
+	if (singleProvider) validateProviderFields(config, singleProvider, errors);
+	return errors;
+}
+/**
+* Resolve all config values into process.env (npx mode only).
+*
+* For each mapped variable: if not already set in the environment,
+* look it up in ~/.shannon/config.toml and inject it into process.env.
+* Local mode uses .env exclusively — TOML is skipped.
+* Exits with an error if the TOML contains unknown or invalid keys.
+*/
+function resolveConfig$1() {
+	if (getMode() === "local") return;
+	const toml = loadTOML();
+	if (!toml) return;
+	const errors = validateConfig(toml);
+	if (errors.length > 0) {
+		console.error("\nInvalid configuration:");
+		for (const err of errors) console.error(`  - ${err}`);
+		console.error(`\nRun 'shn setup' to reconfigure.\n`);
+		process.exit(1);
+	}
+	for (const mapping of CONFIG_MAP) {
+		if (process.env[mapping.env]) continue;
+		const value = getTomlValue(toml, mapping.toml);
+		if (value) process.env[mapping.env] = value;
+	}
+}
+//#endregion
+//#region src/env.ts
+/**
+* Environment variable loading and credential validation.
+*
+* Local mode: loads ./.env via dotenv.
+* NPX mode: fills gaps from ~/.shannon/config.toml (no .env).
+*/
+/** Environment variables forwarded to worker containers. */
+const FORWARD_VARS = [
+	"ANTHROPIC_API_KEY",
+	"ANTHROPIC_BASE_URL",
+	"ANTHROPIC_AUTH_TOKEN",
+	"ROUTER_DEFAULT",
+	"CLAUDE_CODE_OAUTH_TOKEN",
+	"CLAUDE_CODE_USE_BEDROCK",
+	"AWS_REGION",
+	"AWS_BEARER_TOKEN_BEDROCK",
+	"CLAUDE_CODE_USE_VERTEX",
+	"CLOUD_ML_REGION",
+	"ANTHROPIC_VERTEX_PROJECT_ID",
+	"GOOGLE_APPLICATION_CREDENTIALS",
+	"ANTHROPIC_SMALL_MODEL",
+	"ANTHROPIC_MEDIUM_MODEL",
+	"ANTHROPIC_LARGE_MODEL",
+	"CLAUDE_CODE_MAX_OUTPUT_TOKENS",
+	"OPENAI_API_KEY",
+	"OPENROUTER_API_KEY"
+];
+/**
+* Load credentials into process.env.
+* Local mode: loads ./.env via dotenv.
+* NPX mode: fills gaps from ~/.shannon/config.toml.
+* Exported env vars always take precedence in both modes.
+*/
+function loadEnv() {
+	if (getMode() === "local") dotenv.config({
+		path: ".env",
+		quiet: true
+	});
+	else resolveConfig$1();
+}
+/**
+* Build `-e KEY=VALUE` flags for docker run, only for set variables.
+*/
+function buildEnvFlags() {
+	const flags = ["-e", "TEMPORAL_ADDRESS=shannon-temporal:7233"];
+	for (const key of FORWARD_VARS) {
+		const value = process.env[key];
+		if (value) flags.push("-e", `${key}=${value}`);
+	}
+	return flags;
+}
+/** Check if router credentials are present in the environment. */
+function isRouterConfigured() {
+	return !!(process.env.ROUTER_DEFAULT && (process.env.OPENAI_API_KEY || process.env.OPENROUTER_API_KEY));
+}
+/** Check if a custom Anthropic-compatible base URL is configured. */
+function isCustomBaseUrlConfigured() {
+	return !!(process.env.ANTHROPIC_BASE_URL && process.env.ANTHROPIC_AUTH_TOKEN);
+}
+/** Detect which providers are configured via environment variables. */
+function detectProviders() {
+	const providers = [];
+	if (process.env.ANTHROPIC_API_KEY) providers.push("Anthropic API key");
+	if (process.env.CLAUDE_CODE_OAUTH_TOKEN) providers.push("Anthropic OAuth");
+	if (isCustomBaseUrlConfigured()) providers.push("Custom Base URL");
+	if (process.env.CLAUDE_CODE_USE_BEDROCK === "1") providers.push("AWS Bedrock");
+	if (process.env.CLAUDE_CODE_USE_VERTEX === "1") providers.push("Google Vertex");
+	if (isRouterConfigured()) providers.push("Router");
+	return providers;
+}
+/**
+* Validate that exactly one authentication method is configured.
+*/
+function validateCredentials() {
+	const providers = detectProviders();
+	if (providers.length > 1) return {
+		valid: false,
+		mode: "api-key",
+		error: `Multiple providers detected: ${providers.join(", ")}. Only one provider can be active at a time.`
+	};
+	if (process.env.ANTHROPIC_API_KEY) return {
+		valid: true,
+		mode: "api-key"
+	};
+	if (process.env.CLAUDE_CODE_OAUTH_TOKEN) return {
+		valid: true,
+		mode: "oauth"
+	};
+	if (isCustomBaseUrlConfigured()) {
+		process.env.ANTHROPIC_API_KEY = process.env.ANTHROPIC_AUTH_TOKEN;
+		return {
+			valid: true,
+			mode: "custom-base-url"
+		};
+	}
+	if (process.env.CLAUDE_CODE_USE_BEDROCK === "1") {
+		const missing = [];
+		if (!process.env.AWS_REGION) missing.push("AWS_REGION");
+		if (!process.env.AWS_BEARER_TOKEN_BEDROCK) missing.push("AWS_BEARER_TOKEN_BEDROCK");
+		if (!process.env.ANTHROPIC_SMALL_MODEL) missing.push("ANTHROPIC_SMALL_MODEL");
+		if (!process.env.ANTHROPIC_MEDIUM_MODEL) missing.push("ANTHROPIC_MEDIUM_MODEL");
+		if (!process.env.ANTHROPIC_LARGE_MODEL) missing.push("ANTHROPIC_LARGE_MODEL");
+		if (missing.length > 0) return {
+			valid: false,
+			mode: "bedrock",
+			error: `Bedrock mode requires: ${missing.join(", ")}`
+		};
+		return {
+			valid: true,
+			mode: "bedrock"
+		};
+	}
+	if (process.env.CLAUDE_CODE_USE_VERTEX === "1") {
+		const missing = [];
+		if (!process.env.CLOUD_ML_REGION) missing.push("CLOUD_ML_REGION");
+		if (!process.env.ANTHROPIC_VERTEX_PROJECT_ID) missing.push("ANTHROPIC_VERTEX_PROJECT_ID");
+		if (!process.env.ANTHROPIC_SMALL_MODEL) missing.push("ANTHROPIC_SMALL_MODEL");
+		if (!process.env.ANTHROPIC_MEDIUM_MODEL) missing.push("ANTHROPIC_MEDIUM_MODEL");
+		if (!process.env.ANTHROPIC_LARGE_MODEL) missing.push("ANTHROPIC_LARGE_MODEL");
+		if (missing.length > 0) return {
+			valid: false,
+			mode: "vertex",
+			error: `Vertex AI mode requires: ${missing.join(", ")}`
+		};
+		if (!process.env.GOOGLE_APPLICATION_CREDENTIALS) return {
+			valid: false,
+			mode: "vertex",
+			error: "Vertex AI mode requires GOOGLE_APPLICATION_CREDENTIALS"
+		};
+		return {
+			valid: true,
+			mode: "vertex"
+		};
+	}
+	if (isRouterConfigured()) {
+		process.env.ANTHROPIC_API_KEY = "router-mode";
+		return {
+			valid: true,
+			mode: "router"
+		};
+	}
+	return {
+		valid: false,
+		mode: "api-key",
+		error: getMode() === "local" ? `No credentials found. Set ANTHROPIC_API_KEY in .env or export it.` : `Authentication not configured. Export variables or run 'npx @keygraph/shannon setup'.`
+	};
+}
+//#endregion
+//#region src/paths.ts
+/**
+* Path resolution for --repo and --config arguments.
+*
+* Local mode supports bare repo names (e.g. "my-repo" → ./repos/my-repo).
+* Both modes resolve relative paths against CWD.
+*/
+/**
+* Resolve --repo to absolute path and container mount.
+* Dev mode: bare names (no / or . prefix) check ./repos/<name> first.
+*/
+function resolveRepo(repoArg) {
+	let hostPath;
+	if (isLocal() && !repoArg.startsWith("/") && !repoArg.startsWith(".")) {
+		const barePath = path.resolve("repos", repoArg);
+		if (fs.existsSync(barePath)) hostPath = barePath;
+		else {
+			console.error(`ERROR: Repository not found at ./repos/${repoArg}`);
+			console.error("");
+			console.error("Place your target repository under the ./repos/ directory,");
+			console.error("or pass an absolute/relative path: -r /path/to/repo");
+			process.exit(1);
+		}
+	} else hostPath = path.resolve(repoArg);
+	if (!fs.existsSync(hostPath)) {
+		console.error(`ERROR: Repository not found: ${hostPath}`);
+		process.exit(1);
+	}
+	if (!fs.statSync(hostPath).isDirectory()) {
+		console.error(`ERROR: Not a directory: ${hostPath}`);
+		process.exit(1);
+	}
+	const basename = path.basename(hostPath);
+	return {
+		hostPath,
+		containerPath: `/repos/${basename}`
+	};
+}
+/**
+* Resolve --config to absolute path and container mount.
+*/
+function resolveConfig(configArg) {
+	const hostPath = path.resolve(configArg);
+	if (!fs.existsSync(hostPath)) {
+		console.error(`ERROR: Config file not found: ${hostPath}`);
+		process.exit(1);
+	}
+	if (!fs.statSync(hostPath).isFile()) {
+		console.error(`ERROR: Not a file: ${hostPath}`);
+		process.exit(1);
+	}
+	return {
+		hostPath,
+		containerPath: `/app/configs/${path.basename(hostPath)}`
+	};
+}
+/**
+* Ensure the deliverables directory exists and is writable by the container user.
+*/
+function ensureDeliverables(repoHostPath) {
+	const deliverables = path.join(repoHostPath, "deliverables");
+	fs.mkdirSync(deliverables, { recursive: true });
+	fs.chmodSync(deliverables, 511);
+}
+//#endregion
+//#region src/splash.ts
+/**
+* Splash screen display — pure terminal output, no npm dependencies.
+*/
+function displaySplash(version) {
+	const GOLD = "\x1B[38;2;244;197;66m";
+	const CYAN = "\x1B[36;1m";
+	const WHITE = "\x1B[1;37m";
+	const GRAY = "\x1B[0;37m";
+	const YELLOW = "\x1B[1;33m";
+	const RESET = "\x1B[0m";
+	const B = `${CYAN}\u2551${RESET}`;
+	const S67 = " ".repeat(67);
+	const HR = "═".repeat(67);
+	const lines = [
+		"",
+		`  ${CYAN}\u2554${HR}\u2557${RESET}`,
+		`  ${B}${S67}${B}`,
+		`  ${B}  ${GOLD}\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557${RESET}  ${B}`,
+		`  ${B}  ${GOLD}\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551${RESET}  ${B}`,
+		`  ${B}  ${GOLD}\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551${RESET}  ${B}`,
+		`  ${B}  ${GOLD}\u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551${RESET}  ${B}`,
+		`  ${B}  ${GOLD}\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551${RESET}  ${B}`,
+		`  ${B}  ${GOLD}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D${RESET}  ${B}`,
+		`  ${B}${S67}${B}`,
+		`  ${B}              ${CYAN}\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557${RESET}               ${B}`,
+		`  ${B}              ${CYAN}\u2551${RESET}  ${WHITE}AI Penetration Testing Framework${RESET}  ${CYAN}\u2551${RESET}               ${B}`,
+		`  ${B}              ${CYAN}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D${RESET}               ${B}`,
+		`  ${B}${S67}${B}`
+	];
+	if (version) {
+		const verStr = `v${version}`;
+		const verPadLeft = Math.floor((67 - verStr.length) / 2);
+		const verPadRight = 67 - verStr.length - verPadLeft;
+		lines.push(`  ${B}${" ".repeat(verPadLeft)}${GRAY}${verStr}${RESET}${" ".repeat(verPadRight)}${B}`);
+	}
+	lines.push(`  ${B}${S67}${B}`, `  ${B}                    ${YELLOW}\uD83D\uDD10 DEFENSIVE SECURITY ONLY \uD83D\uDD10${RESET}                  ${B}`, `  ${B}${S67}${B}`, `  ${CYAN}\u255A${HR}\u255D${RESET}`, "");
+	console.log(lines.join("\n"));
+}
+//#endregion
+//#region src/commands/start.ts
+/**
+* `shannon start` command — launch a pentest scan.
+*
+* Handles both local mode (local build, ./workspaces/, mounted prompts)
+* and npx mode (Docker Hub pull, ~/.shannon/).
+*/
+async function start(args) {
+	initHome();
+	loadEnv();
+	const creds = validateCredentials();
+	if (!creds.valid) {
+		console.error(`ERROR: ${creds.error}`);
+		process.exit(1);
+	}
+	const useRouter = args.router || isRouterConfigured();
+	const repo = resolveRepo(args.repo);
+	const config = args.config ? resolveConfig(args.config) : void 0;
+	ensureDeliverables(repo.hostPath);
+	const workspacesDir = getWorkspacesDir();
+	fs.mkdirSync(workspacesDir, { recursive: true });
+	fs.chmodSync(workspacesDir, 511);
+	if (useRouter) {
+		process.env.ANTHROPIC_BASE_URL = "http://shannon-router:3456";
+		process.env.ANTHROPIC_AUTH_TOKEN = "shannon-router-key";
+	}
+	ensureImage(args.version);
+	await ensureInfra(useRouter);
+	const suffix = randomSuffix();
+	const taskQueue = `shannon-${suffix}`;
+	const containerName = `shannon-worker-${suffix}`;
+	const workspace = args.workspace ?? `${new URL(args.url).hostname.replace(/[^a-zA-Z0-9-]/g, "-")}_shannon-${Date.now()}`;
+	const credentialsDir = getCredentialsDir();
+	const credentialsPath = getCredentialsPath();
+	const hasCredentials = !credentialsDir && fs.existsSync(credentialsPath);
+	const outputDir = args.output ? path.resolve(args.output) : void 0;
+	if (outputDir) fs.mkdirSync(outputDir, { recursive: true });
+	const promptsDir = isLocal() ? path.resolve("apps/worker/prompts") : void 0;
+	displaySplash(isLocal() ? void 0 : args.version);
+	spawnWorker({
+		version: args.version,
+		url: args.url,
+		repo,
+		workspacesDir,
+		taskQueue,
+		containerName,
+		envFlags: buildEnvFlags(),
+		...config && { config },
+		...credentialsDir && { credentialsDir },
+		...hasCredentials && { credentials: credentialsPath },
+		...promptsDir && { promptsDir },
+		...outputDir && { outputDir },
+		...workspace && { workspace },
+		...args.pipelineTesting && { pipelineTesting: true }
+	}).on("error", (err) => {
+		console.error(`Failed to start worker: ${err.message}`);
+		process.exit(1);
+	});
+	const sessionJson = path.join(workspacesDir, workspace, "session.json");
+	const isResume = fs.existsSync(sessionJson);
+	let initialResumeCount = 0;
+	if (isResume) try {
+		initialResumeCount = JSON.parse(fs.readFileSync(sessionJson, "utf-8")).session?.resumeAttempts?.length ?? 0;
+	} catch {}
+	process.stdout.write("Waiting for workflow to start...");
+	let workflowId = "";
+	let started = false;
+	let attempts = 0;
+	const pollInterval = setInterval(() => {
+		attempts++;
+		if (attempts > 60) {
+			clearInterval(pollInterval);
+			process.stdout.write("\n");
+			console.error("Timeout waiting for workflow to start");
+			process.exit(1);
+		}
+		try {
+			const session = JSON.parse(fs.readFileSync(sessionJson, "utf-8"));
+			const resumeAttempts = session.session?.resumeAttempts ?? [];
+			if (isResume ? resumeAttempts.length > initialResumeCount : !!session.session?.originalWorkflowId) {
+				clearInterval(pollInterval);
+				started = true;
+				workflowId = resumeAttempts.at(-1)?.workflowId ?? session.session?.originalWorkflowId ?? "";
+				process.stdout.write("\r\x1B[K");
+				printInfo(args, useRouter, workspace, workflowId, repo.hostPath, workspacesDir);
+				return;
+			}
+		} catch {}
+		process.stdout.write(".");
+	}, 2e3);
+	let cleaned = false;
+	const cleanup = () => {
+		if (cleaned || started) return;
+		cleaned = true;
+		clearInterval(pollInterval);
+		console.log(`\nStopping worker ${containerName}...`);
+		try {
+			execFileSync("docker", ["stop", containerName], { stdio: "pipe" });
+		} catch {}
+	};
+	process.on("SIGINT", () => {
+		cleanup();
+		process.exit(0);
+	});
+	process.on("SIGTERM", () => {
+		cleanup();
+		process.exit(0);
+	});
+	process.on("exit", cleanup);
+}
+function printInfo(args, routerActive, workspace, workflowId, repoPath, workspacesDir) {
+	const logsCmd = isLocal() ? `./shannon logs ${workspace}` : `npx @keygraph/shannon logs ${workspace}`;
+	const reportsPath = path.join(workspacesDir, workspace);
+	console.log(`  Target:     ${args.url}`);
+	console.log(`  Repository: ${repoPath}`);
+	console.log(`  Workspace:  ${workspace}`);
+	if (args.config) console.log(`  Config:     ${path.resolve(args.config)}`);
+	if (args.pipelineTesting) console.log("  Mode:       Pipeline Testing");
+	if (routerActive) console.log("  Router:     Enabled");
+	console.log("");
+	console.log("  Monitor:");
+	if (workflowId) console.log(`    Web UI:  http://localhost:8233/namespaces/default/workflows/${workflowId}`);
+	else console.log("    Web UI:  http://localhost:8233");
+	console.log(`    Logs:    ${logsCmd}`);
+	console.log("");
+	console.log("  Output:");
+	console.log(`    Reports: ${reportsPath}/`);
+	console.log("");
+}
+//#endregion
+//#region src/commands/status.ts
+/**
+* `shannon status` command — show running workers and Temporal health.
+*/
+function status() {
+	const temporalUp = isTemporalReady();
+	console.log(`Temporal: ${temporalUp ? "running" : "not running"}`);
+	if (temporalUp) console.log("  Web UI: http://localhost:8233");
+	console.log("");
+	const workers = listRunningWorkers();
+	if (workers) {
+		console.log("Workers:");
+		console.log(workers);
+	} else console.log("Workers: none running");
+}
+//#endregion
+//#region src/commands/stop.ts
+/**
+* `shannon stop` command — stop workers and infrastructure.
+*/
+async function stop(clean) {
+	if (clean) {
+		const confirmed = await p.confirm({ message: "This will stop all running scans and remove the Temporal data. Continue?" });
+		if (p.isCancel(confirmed) || !confirmed) {
+			p.cancel("Aborted.");
+			process.exit(0);
+		}
+	}
+	stopWorkers();
+	stopInfra(clean);
+}
+//#endregion
+//#region src/commands/uninstall.ts
+/**
+* `shn uninstall` command — remove ~/.shannon/ after confirmation (npx only).
+*/
+const SHANNON_HOME = path.join(os.homedir(), ".shannon");
+async function uninstall() {
+	p.intro("Shannon Uninstall");
+	if (!fs.existsSync(SHANNON_HOME)) {
+		p.log.info("Nothing to remove. Shannon is not configured on this machine.");
+		p.outro("Done.");
+		return;
+	}
+	const confirmed = await p.confirm({ message: "This will permanently remove all past scan data, saved configurations, and API keys. Continue?" });
+	if (p.isCancel(confirmed) || !confirmed) {
+		p.cancel("Aborted.");
+		process.exit(0);
+	}
+	stopWorkers();
+	stopInfra(false);
+	fs.rmSync(SHANNON_HOME, {
+		recursive: true,
+		force: true
+	});
+	p.log.success("All Shannon data has been removed.");
+	p.outro("Shannon has been uninstalled. Run `npx @keygraph/shannon setup` to start fresh.");
+}
+//#endregion
+//#region src/commands/update.ts
+/**
+* `shannon update` command — pull the worker image matching the current CLI version.
+*/
+function update(version) {
+	pullImage(version);
+	console.log("Update complete.");
+}
+//#endregion
+//#region src/commands/workspaces.ts
+/**
+* `shannon workspaces` command — list all workspaces.
+*/
+function workspaces(version) {
+	const workspacesDir = getWorkspacesDir();
+	const image = getWorkerImage(version);
+	try {
+		execFileSync("docker", [
+			"run",
+			"--rm",
+			"-v",
+			`${workspacesDir}:/app/workspaces`,
+			"-e",
+			"WORKSPACES_DIR=/app/workspaces",
+			image,
+			"node",
+			"apps/worker/dist/temporal/workspaces.js"
+		], {
+			stdio: "inherit",
+			...os.platform() === "win32" && { env: {
+				...process.env,
+				MSYS_NO_PATHCONV: "1"
+			} }
+		});
+	} catch {
+		console.error("ERROR: Failed to list workspaces. Is the Docker image available?");
+		console.error(`  Run: docker pull ${image}`);
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/index.ts
+/**
+* Shannon CLI — AI Penetration Testing Framework
+*
+* Unified CLI supporting two modes:
+*   Local mode: Run from cloned repo — builds locally, mounts prompts, uses ./workspaces/
+*   NPX mode:   Run via npx — pulls from Docker Hub, uses ~/.shannon/
+*
+* Mode is auto-detected based on presence of Dockerfile + docker-compose.yml + prompts/
+* in the current working directory.
+*/
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function getVersion() {
+	try {
+		const pkgPath = path.join(__dirname, "..", "package.json");
+		return JSON.parse(fs.readFileSync(pkgPath, "utf-8")).version || "1.0.0";
+	} catch {
+		return "1.0.0";
+	}
+}
+function showHelp() {
+	const mode = getMode();
+	const prefix = mode === "local" ? "./shannon" : "npx @keygraph/shannon";
+	console.log(`
+Shannon - AI Penetration Testing Framework
+
+Usage:${mode === "local" ? "" : `
+  ${prefix} setup                                       Configure credentials`}
+  ${prefix} start --url <url> --repo <path> [options]   Start a pentest scan
+  ${prefix} stop [--clean]                               Stop all containers
+  ${prefix} workspaces                                   List all workspaces
+  ${prefix} logs <workspace>                             Tail workflow log
+  ${prefix} status                                       Show running workers${mode === "local" ? `
+  ${prefix} build [--no-cache]                           Build worker image` : `
+  ${prefix} update                                       Pull latest image
+  ${prefix} uninstall                                    Remove ~/.shannon/ and all data`}
+  ${prefix} info                                         Show splash screen
+  ${prefix} help                                         Show this help
+
+Options for 'start':
+  -u, --url <url>           Target URL (required)
+  -r, --repo <path>         Repository path${mode === "local" ? " or bare name" : ""} (required)
+  -c, --config <path>       Configuration file (YAML)
+  -o, --output <path>       Copy deliverables to this directory after run
+  -w, --workspace <name>    Named workspace (auto-resumes if exists)
+      --pipeline-testing    Use minimal prompts for fast testing
+      --router              Route requests through claude-code-router
+
+Examples:
+  ${prefix} start -u https://example.com -r ${mode === "local" ? "my-repo" : "./my-repo"}
+  ${prefix} start -u https://example.com -r /path/to/repo -c config.yaml -w q1-audit
+  ${prefix} logs q1-audit
+  ${prefix} stop --clean
+${mode === "local" ? `
+State directory: ./workspaces/` : `
+State directory: ~/.shannon/`}
+Monitor workflows at http://localhost:8233
+`);
+}
+function parseStartArgs(argv) {
+	let url = "";
+	let repo = "";
+	let config;
+	let workspace;
+	let output;
+	let pipelineTesting = false;
+	let router = false;
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		const next = argv[i + 1];
+		switch (arg) {
+			case "-u":
+			case "--url":
+				if (next && !next.startsWith("-")) {
+					url = next;
+					i++;
+				}
+				break;
+			case "-r":
+			case "--repo":
+				if (next && !next.startsWith("-")) {
+					repo = next;
+					i++;
+				}
+				break;
+			case "-c":
+			case "--config":
+				if (next && !next.startsWith("-")) {
+					config = next;
+					i++;
+				}
+				break;
+			case "-w":
+			case "--workspace":
+				if (next && !next.startsWith("-")) {
+					workspace = next;
+					i++;
+				}
+				break;
+			case "-o":
+			case "--output":
+				if (next && !next.startsWith("-")) {
+					output = next;
+					i++;
+				}
+				break;
+			case "--pipeline-testing":
+				pipelineTesting = true;
+				break;
+			case "--router":
+				router = true;
+				break;
+			default:
+				console.error(`Unknown option: ${arg}`);
+				console.error(`Run "${getMode() === "local" ? "./shannon" : "npx @keygraph/shannon"} help" for usage`);
+				process.exit(1);
+		}
+	}
+	if (!url || !repo) {
+		console.error("ERROR: --url and --repo are required");
+		console.error(`Usage: ${getMode() === "local" ? "./shannon" : "npx @keygraph/shannon"} start -u <url> -r <path>`);
+		process.exit(1);
+	}
+	return {
+		url,
+		repo,
+		pipelineTesting,
+		router,
+		...config && { config },
+		...workspace && { workspace },
+		...output && { output }
+	};
+}
+const args = process.argv.slice(2);
+const command = args[0];
+switch (command) {
+	case "start":
+		await start({
+			...parseStartArgs(args.slice(1)),
+			version: getVersion()
+		});
+		break;
+	case "stop":
+		stop(args.includes("--clean"));
+		break;
+	case "logs": {
+		const workspaceId = args[1];
+		if (!workspaceId) {
+			console.error("ERROR: Workspace ID is required");
+			console.error(`Usage: ${getMode() === "local" ? "./shannon" : "npx @keygraph/shannon"} logs <workspace>`);
+			process.exit(1);
+		}
+		logs(workspaceId);
+		break;
+	}
+	case "workspaces":
+		workspaces(getVersion());
+		break;
+	case "status":
+		status();
+		break;
+	case "setup":
+		if (getMode() === "local") {
+			console.error("ERROR: setup is only available in npx mode. In local mode, use .env");
+			process.exit(1);
+		}
+		setup();
+		break;
+	case "build":
+		build(args.includes("--no-cache"));
+		break;
+	case "update":
+		update(getVersion());
+		break;
+	case "uninstall":
+		if (getMode() === "local") {
+			console.error("ERROR: uninstall is only available in npx mode.");
+			process.exit(1);
+		}
+		uninstall();
+		break;
+	case "info":
+		displaySplash(getMode() === "local" ? void 0 : getVersion());
+		break;
+	case "help":
+	case "--help":
+	case "-h":
+	case void 0:
+		showHelp();
+		break;
+	default:
+		console.error(`Unknown command: ${command}`);
+		showHelp();
+		process.exit(1);
+}
+//#endregion
+export {};