@keygraph/shannon 1.0.0-beta.2 → 1.1.0

package/dist/index.mjs

@@ -76,59 +76,30 @@ function isTemporalReady() {
 		"localhost:7233"
 	]).includes("SERVING");
 }
-/** Check if the router container is running and healthy. */
-function isRouterReady() {
-	return runOutput("docker", [
-		"inspect",
-		"--format",
-		"{{.State.Health.Status}}",
-		"shannon-router"
-	]) === "healthy";
-}
 /**
-* Ensure Temporal (and optionally router) are running via compose.
-* If Temporal is already up but router is needed and missing, starts router only.
+* Ensure Temporal is running via compose.
 */
-async function ensureInfra(useRouter) {
-	const temporalReady = isTemporalReady();
-	const routerNeeded = useRouter && !isRouterReady();
-	if (temporalReady && !routerNeeded) return;
-	const composeArgs = [
+async function ensureInfra() {
+	if (isTemporalReady()) return;
+	const composeFile = getComposeFile();
+	console.log("Starting Shannon infrastructure...");
+	execFileSync("docker", [
 		"compose",
 		"-f",
-		getComposeFile()
-	];
-	if (useRouter) composeArgs.push("--profile", "router");
-	composeArgs.push("up", "-d");
-	if (temporalReady && routerNeeded) console.log("Starting router...");
-	else console.log("Starting Shannon infrastructure...");
-	execFileSync("docker", composeArgs, { stdio: "inherit" });
-	if (!temporalReady) {
-		console.log("Waiting for Temporal to be ready...");
-		for (let i = 0; i < 30; i++) {
-			if (isTemporalReady()) {
-				console.log("Temporal is ready!");
-				break;
-			}
-			if (i === 29) {
-				console.error("Timeout waiting for Temporal");
-				process.exit(1);
-			}
-			await setTimeout$1(2e3);
-		}
-	}
-	if (routerNeeded) {
-		console.log("Waiting for router to be ready...");
-		for (let i = 0; i < 15; i++) {
-			if (isRouterReady()) {
-				console.log("Router is ready!");
-				return;
-			}
-			await setTimeout$1(2e3);
+		composeFile,
+		"up",
+		"-d"
+	], { stdio: "inherit" });
+	console.log("Waiting for Temporal to be ready...");
+	for (let i = 0; i < 30; i++) {
+		if (isTemporalReady()) {
+			console.log("Temporal is ready!");
+			return;
 		}
-		console.error("Timeout waiting for router");
-		process.exit(1);
+		await setTimeout$1(2e3);
 	}
+	console.error("Timeout waiting for Temporal");
+	process.exit(1);
 }
 /**
 * Build the worker image locally (local mode only).
@@ -180,37 +151,39 @@ function addHostFlag() {
 }
 /**
 * Spawn the worker container in detached mode and return the process.
+* When `opts.debug` is true, omits `--rm` so the container persists for log inspection.
 */
 function spawnWorker(opts) {
-	const args = [
-		"run",
-		"-d",
-		"--rm",
-		"--name",
-		opts.containerName,
-		"--network",
-		"shannon-net"
-	];
+	const args = ["run", "-d"];
+	if (!opts.debug) args.push("--rm");
+	args.push("--name", opts.containerName, "--network", "shannon-net");
 	args.push(...addHostFlag());
 	if (os.platform() === "linux" && process.getuid && process.getgid) args.push("-e", `SHANNON_HOST_UID=${process.getuid()}`, "-e", `SHANNON_HOST_GID=${process.getgid()}`);
 	args.push("-v", `${opts.workspacesDir}:/app/workspaces`);
-	args.push("-v", `${opts.repo.hostPath}:${opts.repo.containerPath}`);
+	args.push("-v", `${opts.repo.hostPath}:${opts.repo.containerPath}:ro`);
+	const workspacePath = path.join(opts.workspacesDir, opts.workspace);
+	args.push("-v", `${path.join(workspacePath, "deliverables")}:${opts.repo.containerPath}/.shannon/deliverables`);
+	args.push("-v", `${path.join(workspacePath, "scratchpad")}:${opts.repo.containerPath}/.shannon/scratchpad`);
+	args.push("-v", `${path.join(workspacePath, ".playwright-cli")}:${opts.repo.containerPath}/.shannon/.playwright-cli`);
 	if (opts.promptsDir) args.push("-v", `${opts.promptsDir}:/app/apps/worker/prompts:ro`);
 	if (opts.config) args.push("-v", `${opts.config.hostPath}:${opts.config.containerPath}:ro`);
 	if (opts.outputDir) args.push("-v", `${opts.outputDir}:/app/output`);
-	if (opts.credentialsDir) args.push("-v", `${opts.credentialsDir}:/app/credentials:ro`);
-	else if (opts.credentials) args.push("-v", `${opts.credentials}:/app/credentials/google-sa-key.json:ro`);
+	if (opts.credentials) args.push("-v", `${opts.credentials}:/app/credentials/google-sa-key.json:ro`);
 	args.push(...opts.envFlags);
-	args.push("--shm-size", "2gb", "--ipc", "host", "--security-opt", "seccomp=unconfined");
+	args.push("--shm-size", "2gb", "--security-opt", "seccomp=unconfined");
 	args.push(getWorkerImage(opts.version));
 	args.push("node", "apps/worker/dist/temporal/worker.js", opts.url, opts.repo.containerPath);
 	args.push("--task-queue", opts.taskQueue);
 	if (opts.config) args.push("--config", opts.config.containerPath);
 	if (opts.outputDir) args.push("--output", "/app/output");
-	if (opts.workspace) args.push("--workspace", opts.workspace);
+	args.push("--workspace", opts.workspace);
 	if (opts.pipelineTesting) args.push("--pipeline-testing");
 	return spawn("docker", args, {
-		stdio: "pipe",
+		stdio: [
+			"ignore",
+			"ignore",
+			"inherit"
+		],
 		...os.platform() === "win32" && { env: {
 			...process.env,
 			MSYS_NO_PATHCONV: "1"
@@ -240,8 +213,6 @@ function stopInfra(clean) {
 		"compose",
 		"-f",
 		getComposeFile(),
-		"--profile",
-		"router",
 		"down"
 	];
 	if (clean) args.push("-v");
@@ -318,16 +289,6 @@ function getCredentialsPath() {
 	return path.join(SHANNON_HOME$2, "google-sa-key.json");
 }
 /**
-* In dev mode, return the credentials directory if it exists and has files.
-* In npx mode, there is no credentials directory (single file mount instead).
-*/
-function getCredentialsDir() {
-	if (getMode() !== "local") return void 0;
-	const dir = path.resolve("credentials");
-	if (!fs.existsSync(dir)) return void 0;
-	return fs.readdirSync(dir).length > 0 ? dir : void 0;
-}
-/**
 * Initialize state directories.
 * Local mode: creates ./workspaces/ and ./credentials/
 * NPX mode: creates ~/.shannon/workspaces/
@@ -456,11 +417,6 @@ async function setup() {
 			{
 				value: "vertex",
 				label: "Claude via Google Vertex AI"
-			},
-			{
-				value: "router",
-				label: "Router",
-				hint: "experimental"
 			}
 		]
 	});
@@ -476,7 +432,6 @@ async function setupProvider(provider) {
 		case "custom_base_url": return setupCustomBaseUrl();
 		case "bedrock": return setupBedrock();
 		case "vertex": return setupVertex();
-		case "router": return setupRouter();
 	}
 }
 async function setupAnthropic() {
@@ -674,49 +629,6 @@ async function setupVertex() {
 		}
 	};
 }
-async function setupRouter() {
-	const routerProvider = await p.select({
-		message: "Router provider",
-		options: [{
-			value: "openai",
-			label: "OpenAI"
-		}, {
-			value: "openrouter",
-			label: "OpenRouter"
-		}]
-	});
-	if (p.isCancel(routerProvider)) return cancelAndExit();
-	const apiKey = await promptSecret(routerProvider === "openai" ? "Enter your OpenAI API key" : "Enter your OpenRouter API key");
-	let defaultModel;
-	if (routerProvider === "openai") {
-		const model = await p.select({
-			message: "Default model",
-			options: [{
-				value: "gpt-5.2",
-				label: "GPT-5.2"
-			}, {
-				value: "gpt-5-mini",
-				label: "GPT-5 Mini"
-			}]
-		});
-		if (p.isCancel(model)) return cancelAndExit();
-		defaultModel = `openai,${model}`;
-	} else {
-		const model = await p.select({
-			message: "Default model",
-			options: [{
-				value: "google/gemini-3-flash-preview",
-				label: "Google Gemini 3 Flash Preview"
-			}]
-		});
-		if (p.isCancel(model)) return cancelAndExit();
-		defaultModel = `openrouter,${model}`;
-	}
-	const router = { default: defaultModel };
-	if (routerProvider === "openai") router.openai_key = apiKey;
-	else router.openrouter_key = apiKey;
-	return { router };
-}
 async function promptSecret(message) {
 	const value = await p.password({
 		message,
@@ -804,21 +716,6 @@ const CONFIG_MAP = [
 		toml: "custom_base_url.auth_token",
 		type: "string"
 	},
-	{
-		env: "ROUTER_DEFAULT",
-		toml: "router.default",
-		type: "string"
-	},
-	{
-		env: "OPENAI_API_KEY",
-		toml: "router.openai_key",
-		type: "string"
-	},
-	{
-		env: "OPENROUTER_API_KEY",
-		toml: "router.openrouter_key",
-		type: "string"
-	},
 	{
 		env: "ANTHROPIC_SMALL_MODEL",
 		toml: "models.small",
@@ -917,13 +814,6 @@ function validateProviderFields(config, provider, errors) {
 			validateModelTiers(config, "vertex", errors);
 			break;
 		}
-		case "router": {
-			if (!keys.includes("default")) errors.push("[router] missing required key: default");
-			if (!keys.includes("openai_key") && !keys.includes("openrouter_key")) errors.push("[router] requires either openai_key or openrouter_key");
-			const models = config.models;
-			if (models && typeof models === "object" && Object.keys(models).length > 0) errors.push("[models] is not supported with [router]");
-			break;
-		}
 	}
 }
 /** Bedrock and Vertex require a [models] section with all three tiers. */
@@ -976,8 +866,7 @@ function validateConfig(config) {
 		"anthropic",
 		"custom_base_url",
 		"bedrock",
-		"vertex",
-		"router"
+		"vertex"
 	].filter((s) => {
 		const section = config[s];
 		return section && typeof section === "object" && Object.keys(section).length > 0;
@@ -1025,7 +914,6 @@ const FORWARD_VARS = [
 	"ANTHROPIC_API_KEY",
 	"ANTHROPIC_BASE_URL",
 	"ANTHROPIC_AUTH_TOKEN",
-	"ROUTER_DEFAULT",
 	"CLAUDE_CODE_OAUTH_TOKEN",
 	"CLAUDE_CODE_USE_BEDROCK",
 	"AWS_REGION",
@@ -1037,9 +925,7 @@ const FORWARD_VARS = [
 	"ANTHROPIC_SMALL_MODEL",
 	"ANTHROPIC_MEDIUM_MODEL",
 	"ANTHROPIC_LARGE_MODEL",
-	"CLAUDE_CODE_MAX_OUTPUT_TOKENS",
-	"OPENAI_API_KEY",
-	"OPENROUTER_API_KEY"
+	"CLAUDE_CODE_MAX_OUTPUT_TOKENS"
 ];
 /**
 * Load credentials into process.env.
@@ -1065,10 +951,6 @@ function buildEnvFlags() {
 	}
 	return flags;
 }
-/** Check if router credentials are present in the environment. */
-function isRouterConfigured() {
-	return !!(process.env.ROUTER_DEFAULT && (process.env.OPENAI_API_KEY || process.env.OPENROUTER_API_KEY));
-}
 /** Check if a custom Anthropic-compatible base URL is configured. */
 function isCustomBaseUrlConfigured() {
 	return !!(process.env.ANTHROPIC_BASE_URL && process.env.ANTHROPIC_AUTH_TOKEN);
@@ -1081,7 +963,6 @@ function detectProviders() {
 	if (isCustomBaseUrlConfigured()) providers.push("Custom Base URL");
 	if (process.env.CLAUDE_CODE_USE_BEDROCK === "1") providers.push("AWS Bedrock");
 	if (process.env.CLAUDE_CODE_USE_VERTEX === "1") providers.push("Google Vertex");
-	if (isRouterConfigured()) providers.push("Router");
 	return providers;
 }
 /**
@@ -1102,13 +983,10 @@ function validateCredentials() {
 		valid: true,
 		mode: "oauth"
 	};
-	if (isCustomBaseUrlConfigured()) {
-		process.env.ANTHROPIC_API_KEY = process.env.ANTHROPIC_AUTH_TOKEN;
-		return {
-			valid: true,
-			mode: "custom-base-url"
-		};
-	}
+	if (isCustomBaseUrlConfigured()) return {
+		valid: true,
+		mode: "custom-base-url"
+	};
 	if (process.env.CLAUDE_CODE_USE_BEDROCK === "1") {
 		const missing = [];
 		if (!process.env.AWS_REGION) missing.push("AWS_REGION");
@@ -1148,13 +1026,6 @@ function validateCredentials() {
 			mode: "vertex"
 		};
 	}
-	if (isRouterConfigured()) {
-		process.env.ANTHROPIC_API_KEY = "router-mode";
-		return {
-			valid: true,
-			mode: "router"
-		};
-	}
 	return {
 		valid: false,
 		mode: "api-key",
@@ -1218,14 +1089,6 @@ function resolveConfig(configArg) {
 		containerPath: `/app/configs/${path.basename(hostPath)}`
 	};
 }
-/**
-* Ensure the deliverables directory exists and is writable by the container user.
-*/
-function ensureDeliverables(repoHostPath) {
-	const deliverables = path.join(repoHostPath, "deliverables");
-	fs.mkdirSync(deliverables, { recursive: true });
-	fs.chmodSync(deliverables, 511);
-}
 //#endregion
 //#region src/splash.ts
 /**
@@ -1282,31 +1145,43 @@ async function start(args) {
 		console.error(`ERROR: ${creds.error}`);
 		process.exit(1);
 	}
-	const useRouter = args.router || isRouterConfigured();
 	const repo = resolveRepo(args.repo);
 	const config = args.config ? resolveConfig(args.config) : void 0;
-	ensureDeliverables(repo.hostPath);
 	const workspacesDir = getWorkspacesDir();
 	fs.mkdirSync(workspacesDir, { recursive: true });
 	fs.chmodSync(workspacesDir, 511);
-	if (useRouter) {
-		process.env.ANTHROPIC_BASE_URL = "http://shannon-router:3456";
-		process.env.ANTHROPIC_AUTH_TOKEN = "shannon-router-key";
-	}
 	ensureImage(args.version);
-	await ensureInfra(useRouter);
+	await ensureInfra();
 	const suffix = randomSuffix();
 	const taskQueue = `shannon-${suffix}`;
 	const containerName = `shannon-worker-${suffix}`;
 	const workspace = args.workspace ?? `${new URL(args.url).hostname.replace(/[^a-zA-Z0-9-]/g, "-")}_shannon-${Date.now()}`;
-	const credentialsDir = getCredentialsDir();
+	const workspacePath = path.join(workspacesDir, workspace);
+	fs.mkdirSync(workspacePath, { recursive: true });
+	fs.chmodSync(workspacePath, 511);
+	for (const dir of [
+		"deliverables",
+		"scratchpad",
+		".playwright-cli"
+	]) {
+		const dirPath = path.join(workspacePath, dir);
+		fs.mkdirSync(dirPath, { recursive: true });
+		fs.chmodSync(dirPath, 511);
+	}
+	const shannonDir = path.join(repo.hostPath, ".shannon");
+	for (const dir of [
+		"deliverables",
+		"scratchpad",
+		".playwright-cli"
+	]) fs.mkdirSync(path.join(shannonDir, dir), { recursive: true });
 	const credentialsPath = getCredentialsPath();
-	const hasCredentials = !credentialsDir && fs.existsSync(credentialsPath);
+	const hasCredentials = fs.existsSync(credentialsPath);
+	if (hasCredentials) process.env.GOOGLE_APPLICATION_CREDENTIALS = "/app/credentials/google-sa-key.json";
 	const outputDir = args.output ? path.resolve(args.output) : void 0;
 	if (outputDir) fs.mkdirSync(outputDir, { recursive: true });
 	const promptsDir = isLocal() ? path.resolve("apps/worker/prompts") : void 0;
 	displaySplash(isLocal() ? void 0 : args.version);
-	spawnWorker({
+	const proc = spawnWorker({
 		version: args.version,
 		url: args.url,
 		repo,
@@ -1315,16 +1190,20 @@ async function start(args) {
 		containerName,
 		envFlags: buildEnvFlags(),
 		...config && { config },
-		...credentialsDir && { credentialsDir },
 		...hasCredentials && { credentials: credentialsPath },
 		...promptsDir && { promptsDir },
 		...outputDir && { outputDir },
-		...workspace && { workspace },
-		...args.pipelineTesting && { pipelineTesting: true }
-	}).on("error", (err) => {
-		console.error(`Failed to start worker: ${err.message}`);
-		process.exit(1);
+		workspace,
+		...args.pipelineTesting && { pipelineTesting: true },
+		...args.debug && { debug: true }
 	});
+	if (await new Promise((resolve) => {
+		proc.once("exit", (code) => resolve(code ?? 1));
+		proc.once("error", (err) => {
+			console.error(`Failed to start worker: ${err.message}`);
+			resolve(1);
+		});
+	}) !== 0) process.exit(1);
 	const sessionJson = path.join(workspacesDir, workspace, "session.json");
 	const isResume = fs.existsSync(sessionJson);
 	let initialResumeCount = 0;
@@ -1351,7 +1230,7 @@ async function start(args) {
 				started = true;
 				workflowId = resumeAttempts.at(-1)?.workflowId ?? session.session?.originalWorkflowId ?? "";
 				process.stdout.write("\r\x1B[K");
-				printInfo(args, useRouter, workspace, workflowId, repo.hostPath, workspacesDir);
+				printInfo(args, workspace, workflowId, repo.hostPath, workspacesDir);
 				return;
 			}
 		} catch {}
@@ -1366,6 +1245,7 @@ async function start(args) {
 		try {
 			execFileSync("docker", ["stop", containerName], { stdio: "pipe" });
 		} catch {}
+		if (args.debug) printDebugHint(containerName);
 	};
 	process.on("SIGINT", () => {
 		cleanup();
@@ -1377,7 +1257,14 @@ async function start(args) {
 	});
 	process.on("exit", cleanup);
 }
-function printInfo(args, routerActive, workspace, workflowId, repoPath, workspacesDir) {
+function printDebugHint(containerName) {
+	console.log("");
+	console.log(`  Worker container preserved: ${containerName}`);
+	console.log(`    Inspect logs: docker logs ${containerName}`);
+	console.log(`    Remove:       docker rm ${containerName}`);
+	console.log("");
+}
+function printInfo(args, workspace, workflowId, repoPath, workspacesDir) {
 	const logsCmd = isLocal() ? `./shannon logs ${workspace}` : `npx @keygraph/shannon logs ${workspace}`;
 	const reportsPath = path.join(workspacesDir, workspace);
 	console.log(`  Target:     ${args.url}`);
@@ -1385,7 +1272,6 @@ function printInfo(args, routerActive, workspace, workflowId, repoPath, workspac
 	console.log(`  Workspace:  ${workspace}`);
 	if (args.config) console.log(`  Config:     ${path.resolve(args.config)}`);
 	if (args.pipelineTesting) console.log("  Mode:       Pipeline Testing");
-	if (routerActive) console.log("  Router:     Enabled");
 	console.log("");
 	console.log("  Monitor:");
 	if (workflowId) console.log(`    Web UI:  http://localhost:8233/namespaces/default/workflows/${workflowId}`);
@@ -1533,7 +1419,7 @@ Options for 'start':
   -o, --output <path>       Copy deliverables to this directory after run
   -w, --workspace <name>    Named workspace (auto-resumes if exists)
       --pipeline-testing    Use minimal prompts for fast testing
-      --router              Route requests through claude-code-router
+      --debug               Preserve worker container after exit for log inspection
 
 Examples:
   ${prefix} start -u https://example.com -r ${mode === "local" ? "my-repo" : "./my-repo"}
@@ -1553,7 +1439,7 @@ function parseStartArgs(argv) {
 	let workspace;
 	let output;
 	let pipelineTesting = false;
-	let router = false;
+	let debug = false;
 	for (let i = 0; i < argv.length; i++) {
 		const arg = argv[i];
 		const next = argv[i + 1];
@@ -1596,8 +1482,8 @@ function parseStartArgs(argv) {
 			case "--pipeline-testing":
 				pipelineTesting = true;
 				break;
-			case "--router":
-				router = true;
+			case "--debug":
+				debug = true;
 				break;
 			default:
 				console.error(`Unknown option: ${arg}`);
@@ -1614,7 +1500,7 @@ function parseStartArgs(argv) {
 		url,
 		repo,
 		pipelineTesting,
-		router,
+		debug,
 		...config && { config },
 		...workspace && { workspace },
 		...output && { output }

package/infra/compose.yml

@@ -19,32 +19,5 @@ services:
       retries: 10
       start_period: 30s
 
-  router:
-    image: node:20-slim
-    container_name: shannon-router
-    profiles: ["router"]
-    command: >
-      sh -c "apt-get update && apt-get install -y gettext-base &&
-             npm install -g @musistudio/claude-code-router &&
-             mkdir -p /root/.claude-code-router &&
-             envsubst < /config/router-config.json > /root/.claude-code-router/config.json &&
-             ccr start"
-    ports:
-      - "127.0.0.1:3456:3456"
-    volumes:
-      - ./router-config.json:/config/router-config.json:ro
-    environment:
-      - HOST=0.0.0.0
-      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
-      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
-      - ROUTER_DEFAULT=${ROUTER_DEFAULT:-openai,gpt-4o}
-    healthcheck:
-      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3456/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-
 volumes:
   temporal-data:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keygraph/shannon",
-  "version": "1.0.0-beta.2",
+  "version": "1.1.0",
   "description": "Shannon - Autonomous white-box AI pentester for web applications and APIs by Keygraph",
   "type": "module",
   "main": "dist/index.mjs",
@@ -15,7 +15,7 @@
     "@clack/prompts": "^1.1.0",
     "chokidar": "^5.0.0",
     "dotenv": "^17.3.1",
-    "smol-toml": "^1.6.0"
+    "smol-toml": "^1.6.1"
   },
   "keywords": [
     "security",
@@ -40,7 +40,7 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "tsdown": "^0.21.2"
+    "tsdown": "^0.21.5"
   },
   "scripts": {
     "build": "tsdown",

package/infra/router-config.json

@@ -1,31 +0,0 @@
-{
-  "HOST": "0.0.0.0",
-  "APIKEY": "shannon-router-key",
-  "LOG": true,
-  "LOG_LEVEL": "info",
-  "NON_INTERACTIVE_MODE": true,
-  "API_TIMEOUT_MS": 600000,
-  "Providers": [
-    {
-      "name": "openai",
-      "api_base_url": "https://api.openai.com/v1/chat/completions",
-      "api_key": "$OPENAI_API_KEY",
-      "models": ["gpt-5.2", "gpt-5-mini"],
-      "transformer": {
-        "use": [["maxcompletiontokens", { "max_completion_tokens": 16384 }]]
-      }
-    },
-    {
-      "name": "openrouter",
-      "api_base_url": "https://openrouter.ai/api/v1/chat/completions",
-      "api_key": "$OPENROUTER_API_KEY",
-      "models": ["google/gemini-3-flash-preview"],
-      "transformer": {
-        "use": ["openrouter"]
-      }
-    }
-  ],
-  "Router": {
-    "default": "$ROUTER_DEFAULT"
-  }
-}