mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-10-10 18:13:57 +02:00
feat: Shannon 3.0 Agentic SAST (#433)
* feat(worker): add agentic static analysis Add the ten-stage Agentic SAST pipeline, confined repository tools, model runtime, prompt templates, and SARIF export. Make retries, repair sessions, reduced coverage, usage accounting, and model-output drift durable across Temporal replay and resume. Keep retry diagnostics in their actionable closed vocabulary. Package the Mantis-derived license material with the prompts that require it. * feat(worker): deduplicate static and runtime findings before exploitation Parse Agentic SAST SARIF into typed observations, enrich and route those observations, and reconcile them with pentest findings before exploitation. Publish deterministic exploitation queues with stable lineage, exact-path Git commits, retry-safe manifests, named drop reasons, and confined task formation. Reject duplicate producer IDs before commit and adopt either legal provenance shape after a lost acknowledgement. * feat(config)!: replace vuln_classes with agentic_sast Wire Agentic SAST and reconciliation into the main pipeline, persist their durable state, and add the Miscellaneous finding and exploitation lane. Make scan completion, cancellation, partial outcomes, resume identity, and report recovery use the integrated final workflow contract. Introduce the atomic finalization, ordering, renumbering, compaction, and output services that workflow calls. Keep completed Miscellaneous work and report drafts idempotent across resume, preserve public main's default-on exploit SARIF behavior, and describe stage-fallback candidates without claiming they were exported. BREAKING CHANGE: `vuln_classes` has been removed. Configs containing it now fail validation, and all five core pentest classes run on every scan. Workspaces created by Shannon 2.x cannot be resumed. Finish or discard in-flight scans before upgrading, then start a new workspace name. * perf: overlap static analysis and the Miscellaneous lane with the pentest Run Agentic SAST alongside vulnerability analysis and run Miscellaneous exploitation alongside the specialist exploitation lanes. Keep reconciliation dependent on the completed static-analysis result while preserving parallel work everywhere that has no data dependency. * feat(cli)!: default the scan target and add a JSON error contract List local scans, resolve the active or most recent workspace automatically, and make logs, status, and stop use one canonical scan identity. Add stable machine-readable failures, richer status output, explicit help errors, and seven-day Temporal retention. Treat absent Temporal pending-activity failures as absent whether the decoder represents them as `null` or missing. BREAKING CHANGE: `status --json` now returns a fixed `failureMessage`. Read `partialReasons`, `agenticSast`, and `workflow.log` for diagnostic detail. * feat(logging): trace tool calls and write a log per agent Record complete tool-call arguments in the workflow log and project each agent's events into its own durable log. Add agent listing and agent-specific log tailing while preserving byte-exact output and draining log handles before activities return. * feat(worker): standardize severity and reporting guidance in exploit prompts Give every exploit agent the same status, confidence, severity-reasoning, report-writing, credential-handling, and scope contract. Apply the same task-formation and SAST-enrichment procedure to the Miscellaneous lane. * feat(worker): disclose scan coverage and make reporting auditable Build on the retry-safe finalization foundation to preserve correct identities, source locations, scan dates, partial-coverage limitations, and consistent report JSON, Markdown, SARIF, and PDF output. Report Agentic SAST, reconciliation wall-clock time, stage usage, retry spend, and background work without duplicate or hardcoded totals. Keep report findings canonical, drop cross-class restatements, name enrichment losses, and render the executive-summary narrative in the PDF. * chore(license): attribute Mantis and Pi and refresh the docs Add the final Mantis and Pi notices, license copies, acknowledgements, and residual copyright updates. Update the README, maintained documentation, contributor guidance, and hand-maintained mirrors to describe Agentic SAST, reconciliation, the Miscellaneous lane, current CLI behavior, and the final release contract. Correct stale workspace and container guidance and annotate long-standing internals for maintainers. * fix(logging): treat a slash as a word separator in agent labels * feat(cli)!: rebuild scan status around model work - show Capella stages beneath the concurrent Agentic SAST phase - attach reconciliation time to the class row it feeds - hide completed bookkeeping and the duplicate miscellaneous wrapper - carry validated child-workflow progress into durable parent state - derive the terminal tree and status JSON from the same phase shape BREAKING CHANGE: `status --json` replaces phase `parallel` with `children` and `meta`, adds phase summaries and notes plus agent attachment fields, and removes the `analysis-engines` and `operational-work` phases. * fix(report): drop the empty Critical Findings section from the PDF summary * fix(sast): align Capella export with the submit-time code-path contract The export gate required every code_paths entry to be file:line, but submit only requires the primary sink to be file:line and accepts bare trace steps. A single malformed trace step therefore dropped an otherwise-valid finding at export. - add isValidPrimaryCodePath as the one shared primary-sink contract - validate only the primary at export; buildResult already drops unusable steps - route the submit-time validator through the same helper so the two cannot drift * feat(sast): tolerate hygiene-only Capella reductions instead of going partial A reduction only makes a run partial when it loses real coverage or a whole finding. Malformed model output, salvaged turn-limit work, and rejected duplicate verdicts are recorded as evidence but no longer flip the run to partial. - add reductionIsTolerable: partial only when genuine-loss counts are nonzero - drive runCapella's partial reasons and display coverage off non-tolerable ones - keep every reduction in agenticSast.reductions so nothing is lost as evidence * feat(logging): record the provider reason for a failed agent turn A failed provider turn collapsed to AGENT_EXECUTION_FAILED/unknown with the underlying reason discarded, so a model-side rejection or safeguard was indistinguishable from a transport fault in the error log. - add safeProviderTurnDetails: write bounded, non-sensitive fields (provider, model, responseId, stop reason, tool-in-flight, category, retryable) to error.log - gate a sanitized errorMessage snippet behind SHANNON_DEBUG_PROVIDER_ERRORS, off by default - forward SHANNON_DEBUG_PROVIDER_ERRORS from the CLI into the worker container * fix(cli): keep shannon logs tailing through a Temporal blip - End the interactive tail on the log's own terminal marker or Ctrl-C, so a transient Temporal outage no longer aborts the command with exit 1. - Rebuild the memoized Temporal client after a failed poll: a wedged gRPC channel was cached forever, so "retrying…" could never reconnect. - Keep start --follow (CI) bounded — a genuinely dead Temporal still fails the run instead of hanging. * fix(worker): correct PDF finding reporting - Render OWASP category, authentication state, and remediation - Omit the redundant per-finding exploited status - Preserve canonical category and field ordering across report modes - Continue Proof of Impact numbering across embedded code blocks - Wrap long PDF code lines without changing canonical report content * fix: attribute a reconciliation failure to exploitation only - Stop marking a class's vulnerability-analysis agent failed when that agent succeeded and only reconciliation failed; the status tree now renders the analysis row completed and the exploitation row failed - Consume the worker's failedReconciliations signal in the CLI, which the mirrored PipelineState already declared but never read - Correct the class_reconciliation_failed message, which claimed the class's analysis results were still in the report when the class is excluded from it * fix(pi): give each task sub-session its own resource loader to prevent stale extension ctx * fix(prompts): scope exploit agents to in-band proof, mark OOB-only findings blocked * fix(cli): reject a shell credential that shadows a gateway config.toml key * fix(cli): make scan shutdown verifiable - preselect and persist workflow identity before worker launch - cancel first, then verify bounded Temporal termination - reconcile Docker workers with Temporal open workflows - fail closed on stale images and unavailable lifecycle state - mark cancellation only after confirmed shutdown * feat(cli): prompt for setup on a bare npx invocation with no credentials * fix(cli): don't blame anthropic when no credentials are configured at all * chore(release): bump beta base version to 3.0.0 * feat(cli): show a 'start your first scan' box in help on a TTY * docs: refresh README and platform overview for Shannon 3.0 - lead with the 3.0 launch note and rewrite key capabilities around security code analysis, the rebuilt terminal experience, native CI/CD, and PDF/SARIF - recast the editions table as Shannon Open Source against the Keygraph Enterprise Platform, stating open source is not a trial edition - rewrite the platform overview around exhaustive agentic SAST, canonical findings, automated remediation, targeted verification, and governance - add five product screenshots under assets/keygraph-platform/, referenced relative to docs/ * docs: add the Shannon naming section and swap in the 3.0 demo GIF - explain the Claude Shannon information-theory origin under "What is Shannon?" - point "Shannon in Action" at the 3.0 recording in assets/Shannon3GIF.gif Both taken from the README half of #438. * docs: document CI/CD integrations and the reconciled analysis pipeline - add a CI/CD Integrations section covering the official GitHub Action and GitLab component, pipeline artifacts, and exploit-only severity gates - redraw the architecture section as a Mermaid flow: agentic code analysis and recon feed finding reconciliation, then exploitation and reporting - describe open-source code analysis as a multi-stage agentic workflow and reserve parsed-code CPGs and exhaustive verification for Enterprise - sharpen the privacy wording: results stay local, but model requests carry source context to whichever endpoint you configure - drop the "not recommended" framing on local models and add a section on why Shannon complements rather than replaces human pentesters - regenerate llms-full.txt from the updated README and docs * docs: add the Photoview benchmark across three models - Add a "Shannon in Action" table for Photoview 2.4.0 runs on DeepSeek v4 Flash, Grok 4.6, and Claude Opus 5, each linking its PDF report and SARIF output - Store the per-model reports under benchmark/ - Link the (forthcoming) benchmark writeup from the section intro * docs: add the Shannon vs XBOW/Aikido Photoview benchmark writeup - Add docs/shannon-xbow-aikido-benchmark.md with methodology, per-model cost/coverage tables, and links to each model's report and SARIF - Link the writeup from the README "Shannon in Action" section * docs: link the benchmark announcement discussion from the README * fix(readme): restore theme-aware banner, badge, and buttons * feat!: trigger the Shannon 3.0 major release --------- Co-authored-by: ezl-keygraph <ezhil@keygraph.io>
This commit is contained in:
Arjun Malleswaranandezl-keygraph authored and GitHub committed
1 parent
6108de3cfc
commit
9767ebe633
267 files changed
+127389
-3268
No files matched your search
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env node
|
||||
|
||||
// Copyright (C) 2025 Keygraph, Inc.
|
||||
// Copyright (C) 2026 Keygraph, Inc.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License version 3
|
||||
@@ -18,8 +18,9 @@
|
||||
*
|
||||
* Options:
|
||||
* --task-queue <name> Task queue name (required, unique per scan)
|
||||
* --workflow-id <id> Workflow ID selected by the Shannon CLI
|
||||
* --config <path> Configuration file path
|
||||
* --output <path> Output directory for workspaces
|
||||
* --output <path> Stable mounted path for final customer report copies
|
||||
* --workspace <name> Resume from existing workspace
|
||||
* --pipeline-testing Use minimal prompts for fast testing
|
||||
*
|
||||
@@ -27,24 +28,69 @@
|
||||
* TEMPORAL_ADDRESS - Temporal server address (default: localhost:7233)
|
||||
*/
|
||||
|
||||
import fs from 'node:fs';
|
||||
import path from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { Client, Connection, type WorkflowHandle, WorkflowNotFoundError } from '@temporalio/client';
|
||||
import { bundleWorkflowCode, NativeConnection, Worker } from '@temporalio/worker';
|
||||
import dotenv from 'dotenv';
|
||||
import { DEFAULT_MODEL_SPEC } from '../ai/models.js';
|
||||
import { capellaTerminalStageLabel, isCapellaSafeFailureMessage } from '../ai/sast/capella/safe-failures.js';
|
||||
import { capellaActivities, mergeActivityRegistries } from '../ai/sast/capella/temporal/registry.js';
|
||||
import { CAPELLA_FORMAT_VERSION, CAPELLA_PROMPT_SET_VERSION } from '../ai/sast/capella/types.js';
|
||||
import { summarizeOperationalMetrics } from '../audit/operational-summary.js';
|
||||
import { sanitizeHostname } from '../audit/utils.js';
|
||||
import { parseConfig } from '../config-parser.js';
|
||||
import { distributeConfig, parseConfig } from '../config-parser.js';
|
||||
import { deliverablesDir, resolveSessionJsonPath } from '../paths.js';
|
||||
import { isProviderFailureCategory } from '../types/errors.js';
|
||||
import {
|
||||
ASSEMBLED_REPORT_PDF_FILENAME,
|
||||
deliverablesDir,
|
||||
FINAL_REPORT_PDF_FILENAME,
|
||||
resolveSessionJsonPath,
|
||||
} from '../paths.js';
|
||||
import type { VulnClass } from '../types/config.js';
|
||||
ACCEPTED_CAPELLA_FAILURE_STAGES,
|
||||
isPartialReason,
|
||||
projectPartialReasons,
|
||||
SAFE_RUN_STATE_MESSAGES,
|
||||
workspaceExploitMismatchMessage,
|
||||
} from '../types/run-state.js';
|
||||
import { fileExists, readJson } from '../utils/file-io.js';
|
||||
import * as activities from './activities.js';
|
||||
import type { PipelineInput, PipelineProgress, PipelineState } from './shared.js';
|
||||
import {
|
||||
assembleReportActivity,
|
||||
checkExploitationQueue,
|
||||
compactReportFindings,
|
||||
finalizeReportOutputs,
|
||||
initDeliverableGit,
|
||||
initializeDurableScanState,
|
||||
initializeReportProgress,
|
||||
loadResumeState,
|
||||
logPhaseTransition,
|
||||
logWorkflowComplete,
|
||||
persistCanonicalReportProgress,
|
||||
persistFinalizedReportProgress,
|
||||
persistMiscellaneousOutcome,
|
||||
recordResumeAttempt,
|
||||
registerResumeAttempt,
|
||||
renumberClassFindings,
|
||||
restoreGitCheckpoint,
|
||||
runAuthExploitAgent,
|
||||
runAuthenticationValidation,
|
||||
runAuthVulnAgent,
|
||||
runAuthzExploitAgent,
|
||||
runAuthzVulnAgent,
|
||||
runInjectionExploitAgent,
|
||||
runInjectionVulnAgent,
|
||||
runMiscellaneousExploitAgent,
|
||||
runPreflightValidation,
|
||||
runPreReconAgent,
|
||||
runReconAgent,
|
||||
runReportAgent,
|
||||
runSsrfExploitAgent,
|
||||
runSsrfVulnAgent,
|
||||
runXssExploitAgent,
|
||||
runXssVulnAgent,
|
||||
saveCheckpoint,
|
||||
surfaceReportOutputs,
|
||||
syncCodePathDenyRules,
|
||||
syncPlaywrightStealthConfig,
|
||||
} from './activities.js';
|
||||
import { createReconciliationActivityRegistry } from './reconcile-activities.js';
|
||||
import type { AgenticSastInput, PipelineInput, PipelineProgress, PipelineState } from './shared.js';
|
||||
|
||||
dotenv.config();
|
||||
|
||||
@@ -52,14 +98,152 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||||
|
||||
const PROGRESS_QUERY = 'getProgress';
|
||||
|
||||
/** Accept only a code shaped like a stable error code, or a known provider-failure category; anything else is treated as absent rather than printed. */
|
||||
function safeFailureCode(value: string | undefined): string | undefined {
|
||||
if (value !== undefined && (/^[A-Z][A-Z0-9_]{0,63}$/u.test(value) || isProviderFailureCategory(value))) {
|
||||
return value;
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
|
||||
/** Re-derive a printable line from the closed partial-reason projection instead of trusting the workflow-returned view directly, so a malformed reason prints nothing rather than something wrong. */
|
||||
function safePartialReasonMessage(reason: PipelineState['partialReasons'][number]): string | undefined {
|
||||
if (reason.code === 'agentic_sast_reduced') return 'Agentic SAST completed with reduced coverage.';
|
||||
const candidate = {
|
||||
code: reason.code,
|
||||
...(reason.vulnerabilityClass !== undefined && { vulnerabilityClass: reason.vulnerabilityClass }),
|
||||
...(reason.stage !== undefined && { stage: reason.stage }),
|
||||
...(reason.reductionReason !== undefined && { reductionReason: reason.reductionReason }),
|
||||
...(reason.omittedCount !== undefined && { omittedCount: reason.omittedCount }),
|
||||
...(reason.consideredCount !== undefined && { consideredCount: reason.consideredCount }),
|
||||
...(reason.classifiedCount !== undefined && { classifiedCount: reason.classifiedCount }),
|
||||
...(reason.affectedBatchCount !== undefined && { affectedBatchCount: reason.affectedBatchCount }),
|
||||
};
|
||||
if (!isPartialReason(candidate)) return undefined;
|
||||
return projectPartialReasons([candidate])[0]?.message;
|
||||
}
|
||||
|
||||
// The ordinary activity names. This frozen list is one of three that together form the
|
||||
// registered activity set the CLI status reader mirrors: the Capella names in
|
||||
// ai/sast/capella/temporal/activity-types.ts and the reconciliation names in
|
||||
// reconcile-activity-types.ts are the other two. Adding or removing an activity means
|
||||
// updating both this list and the `pentestActivities` object below, or the load-time check
|
||||
// throws.
|
||||
export const PENTEST_ACTIVITY_NAMES = Object.freeze([
|
||||
'runPreReconAgent',
|
||||
'runReconAgent',
|
||||
'runInjectionVulnAgent',
|
||||
'runXssVulnAgent',
|
||||
'runAuthVulnAgent',
|
||||
'runAuthzVulnAgent',
|
||||
'runSsrfVulnAgent',
|
||||
'runInjectionExploitAgent',
|
||||
'runXssExploitAgent',
|
||||
'runAuthExploitAgent',
|
||||
'runAuthzExploitAgent',
|
||||
'runSsrfExploitAgent',
|
||||
'runMiscellaneousExploitAgent',
|
||||
'runReportAgent',
|
||||
'runPreflightValidation',
|
||||
'runAuthenticationValidation',
|
||||
'initDeliverableGit',
|
||||
'syncPlaywrightStealthConfig',
|
||||
'syncCodePathDenyRules',
|
||||
'initializeDurableScanState',
|
||||
'persistMiscellaneousOutcome',
|
||||
'initializeReportProgress',
|
||||
'renumberClassFindings',
|
||||
'assembleReportActivity',
|
||||
'compactReportFindings',
|
||||
'persistCanonicalReportProgress',
|
||||
'finalizeReportOutputs',
|
||||
'persistFinalizedReportProgress',
|
||||
'surfaceReportOutputs',
|
||||
'checkExploitationQueue',
|
||||
'loadResumeState',
|
||||
'restoreGitCheckpoint',
|
||||
'registerResumeAttempt',
|
||||
'recordResumeAttempt',
|
||||
'logPhaseTransition',
|
||||
'logWorkflowComplete',
|
||||
'saveCheckpoint',
|
||||
] as const);
|
||||
|
||||
export const pentestActivities = Object.freeze({
|
||||
runPreReconAgent,
|
||||
runReconAgent,
|
||||
runInjectionVulnAgent,
|
||||
runXssVulnAgent,
|
||||
runAuthVulnAgent,
|
||||
runAuthzVulnAgent,
|
||||
runSsrfVulnAgent,
|
||||
runInjectionExploitAgent,
|
||||
runXssExploitAgent,
|
||||
runAuthExploitAgent,
|
||||
runAuthzExploitAgent,
|
||||
runSsrfExploitAgent,
|
||||
runMiscellaneousExploitAgent,
|
||||
runReportAgent,
|
||||
runPreflightValidation,
|
||||
runAuthenticationValidation,
|
||||
initDeliverableGit,
|
||||
syncPlaywrightStealthConfig,
|
||||
syncCodePathDenyRules,
|
||||
initializeDurableScanState,
|
||||
persistMiscellaneousOutcome,
|
||||
initializeReportProgress,
|
||||
renumberClassFindings,
|
||||
assembleReportActivity,
|
||||
compactReportFindings,
|
||||
persistCanonicalReportProgress,
|
||||
finalizeReportOutputs,
|
||||
persistFinalizedReportProgress,
|
||||
surfaceReportOutputs,
|
||||
checkExploitationQueue,
|
||||
loadResumeState,
|
||||
restoreGitCheckpoint,
|
||||
registerResumeAttempt,
|
||||
recordResumeAttempt,
|
||||
logPhaseTransition,
|
||||
logWorkflowComplete,
|
||||
saveCheckpoint,
|
||||
});
|
||||
|
||||
const registeredPentestNames = Object.keys(pentestActivities).sort();
|
||||
const expectedPentestNames = [...PENTEST_ACTIVITY_NAMES].sort();
|
||||
if (
|
||||
registeredPentestNames.length !== expectedPentestNames.length ||
|
||||
registeredPentestNames.some((name, index) => name !== expectedPentestNames[index])
|
||||
) {
|
||||
throw new Error('Pentest activity registry does not match its frozen ordinary activity contract');
|
||||
}
|
||||
|
||||
export interface ProductionActivityBindings {
|
||||
readonly repositoryPath: string;
|
||||
readonly webUrl: string;
|
||||
readonly workspacesDir: string;
|
||||
}
|
||||
|
||||
/** Compose the frozen ordinary, Capella, and reconciliation activity namespaces. */
|
||||
export function createProductionActivityRegistry(bindings: ProductionActivityBindings): Readonly<object> {
|
||||
const reconciliationActivities = createReconciliationActivityRegistry({
|
||||
repositoryPath: bindings.repositoryPath,
|
||||
deliverablesDir: deliverablesDir(bindings.repositoryPath),
|
||||
workspacesDir: bindings.workspacesDir,
|
||||
webUrl: bindings.webUrl,
|
||||
});
|
||||
return mergeActivityRegistries(pentestActivities, capellaActivities, reconciliationActivities);
|
||||
}
|
||||
|
||||
// === CLI Argument Parsing ===
|
||||
|
||||
interface CliArgs {
|
||||
webUrl: string;
|
||||
repoPath: string;
|
||||
taskQueue: string;
|
||||
workflowId?: string;
|
||||
configPath?: string;
|
||||
outputPath?: string;
|
||||
customerOutputPath?: string;
|
||||
pipelineTestingMode: boolean;
|
||||
resumeFromWorkspace?: string;
|
||||
}
|
||||
@@ -71,8 +255,10 @@ function showUsage(): void {
|
||||
console.log(' node dist/temporal/worker.js <webUrl> <repoPath> --task-queue <name> [options]\n');
|
||||
console.log('Options:');
|
||||
console.log(' --task-queue <name> Task queue name (required)');
|
||||
console.log(' --workflow-id <id> Workflow ID selected by the Shannon CLI');
|
||||
console.log(' --config <path> Configuration file path');
|
||||
console.log(' --workspace <name> Resume from existing workspace');
|
||||
console.log(' --output <path> Stable mounted path for final customer report copies');
|
||||
console.log(' --pipeline-testing Use minimal prompts for fast testing\n');
|
||||
}
|
||||
|
||||
@@ -85,8 +271,9 @@ function parseCliArgs(argv: string[]): CliArgs {
|
||||
let webUrl: string | undefined;
|
||||
let repoPath: string | undefined;
|
||||
let taskQueue: string | undefined;
|
||||
let workflowId: string | undefined;
|
||||
let configPath: string | undefined;
|
||||
let outputPath: string | undefined;
|
||||
let customerOutputPath: string | undefined;
|
||||
let pipelineTestingMode = false;
|
||||
let resumeFromWorkspace: string | undefined;
|
||||
|
||||
@@ -98,6 +285,12 @@ function parseCliArgs(argv: string[]): CliArgs {
|
||||
taskQueue = nextArg;
|
||||
i++;
|
||||
}
|
||||
} else if (arg === '--workflow-id') {
|
||||
const nextArg = argv[i + 1];
|
||||
if (nextArg && !nextArg.startsWith('-')) {
|
||||
workflowId = nextArg;
|
||||
i++;
|
||||
}
|
||||
} else if (arg === '--config') {
|
||||
const nextArg = argv[i + 1];
|
||||
if (nextArg && !nextArg.startsWith('-')) {
|
||||
@@ -107,7 +300,7 @@ function parseCliArgs(argv: string[]): CliArgs {
|
||||
} else if (arg === '--output') {
|
||||
const nextArg = argv[i + 1];
|
||||
if (nextArg && !nextArg.startsWith('-')) {
|
||||
outputPath = nextArg;
|
||||
customerOutputPath = nextArg;
|
||||
i++;
|
||||
}
|
||||
} else if (arg === '--workspace') {
|
||||
@@ -143,9 +336,10 @@ function parseCliArgs(argv: string[]): CliArgs {
|
||||
webUrl,
|
||||
repoPath,
|
||||
taskQueue,
|
||||
...(workflowId && { workflowId }),
|
||||
pipelineTestingMode,
|
||||
...(configPath && { configPath }),
|
||||
...(outputPath && { outputPath }),
|
||||
...(customerOutputPath && { customerOutputPath }),
|
||||
...(resumeFromWorkspace && { resumeFromWorkspace }),
|
||||
};
|
||||
}
|
||||
@@ -158,16 +352,32 @@ interface SessionJson {
|
||||
webUrl: string;
|
||||
originalWorkflowId?: string;
|
||||
resumeAttempts?: Array<{ workflowId: string }>;
|
||||
status?: 'in-progress' | 'completed' | 'failed' | 'cancelled' | 'partial';
|
||||
};
|
||||
metrics: {
|
||||
total_cost_usd: number;
|
||||
};
|
||||
durableScanState?: {
|
||||
schema_version?: unknown;
|
||||
exploit?: unknown;
|
||||
};
|
||||
}
|
||||
|
||||
function isValidWorkspaceName(name: string): boolean {
|
||||
return /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(name);
|
||||
}
|
||||
|
||||
function escapeRegExp(value: string): string {
|
||||
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
||||
}
|
||||
|
||||
/** Accept a CLI-owned ID only when it preserves this launch branch's public naming contract. */
|
||||
function selectWorkflowId(requested: string | undefined, fallback: string, expected: RegExp): string {
|
||||
if (requested === undefined) return fallback;
|
||||
if (!expected.test(requested)) throw new Error('Invalid workflow identity supplied by the Shannon CLI');
|
||||
return requested;
|
||||
}
|
||||
|
||||
interface WorkspaceResolution {
|
||||
workflowId: string;
|
||||
sessionId: string;
|
||||
@@ -216,10 +426,15 @@ async function terminateExistingWorkflows(client: Client, workspaceName: string)
|
||||
return terminated;
|
||||
}
|
||||
|
||||
async function resolveWorkspace(client: Client, args: CliArgs): Promise<WorkspaceResolution> {
|
||||
async function resolveWorkspace(client: Client, args: CliArgs, expectedExploit: boolean): Promise<WorkspaceResolution> {
|
||||
if (!args.resumeFromWorkspace) {
|
||||
const hostname = sanitizeHostname(args.webUrl);
|
||||
const workflowId = `${hostname}_shannon-${Date.now()}`;
|
||||
const fallback = `${hostname}_shannon-${Date.now()}`;
|
||||
const workflowId = selectWorkflowId(
|
||||
args.workflowId,
|
||||
fallback,
|
||||
new RegExp(`^${escapeRegExp(hostname)}_shannon-\\d+$`),
|
||||
);
|
||||
return {
|
||||
workflowId,
|
||||
sessionId: workflowId,
|
||||
@@ -233,6 +448,19 @@ async function resolveWorkspace(client: Client, args: CliArgs): Promise<Workspac
|
||||
const workspaceExists = await fileExists(sessionPath);
|
||||
|
||||
if (workspaceExists) {
|
||||
const session = await readJson<SessionJson>(sessionPath);
|
||||
if (session.session.webUrl !== args.webUrl) {
|
||||
throw new Error(
|
||||
'This workspace was created for a different target URL, so it cannot be resumed against this one. Check -u, or start a new scan with a different -w name.',
|
||||
);
|
||||
}
|
||||
if (session.durableScanState?.schema_version !== 1 || typeof session.durableScanState.exploit !== 'boolean') {
|
||||
throw new Error(SAFE_RUN_STATE_MESSAGES.CorruptedSessionError);
|
||||
}
|
||||
if (session.durableScanState.exploit !== expectedExploit) {
|
||||
throw new Error(workspaceExploitMismatchMessage(session.durableScanState.exploit));
|
||||
}
|
||||
|
||||
console.log('=== RESUME MODE ===');
|
||||
console.log(`Workspace: ${workspace}\n`);
|
||||
|
||||
@@ -241,16 +469,9 @@ async function resolveWorkspace(client: Client, args: CliArgs): Promise<Workspac
|
||||
console.log(`Terminated ${terminatedWorkflows.length} previous scan(s)\n`);
|
||||
}
|
||||
|
||||
const session = await readJson<SessionJson>(sessionPath);
|
||||
if (session.session.webUrl !== args.webUrl) {
|
||||
console.error('ERROR: URL mismatch with workspace');
|
||||
console.error(` Workspace URL: ${session.session.webUrl}`);
|
||||
console.error(` Provided URL: ${args.webUrl}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const fallback = `${workspace}_resume_${Date.now()}`;
|
||||
return {
|
||||
workflowId: `${workspace}_resume_${Date.now()}`,
|
||||
workflowId: selectWorkflowId(args.workflowId, fallback, new RegExp(`^${escapeRegExp(workspace)}_resume_\\d+$`)),
|
||||
sessionId: workspace,
|
||||
isResume: true,
|
||||
terminatedWorkflows,
|
||||
@@ -258,7 +479,7 @@ async function resolveWorkspace(client: Client, args: CliArgs): Promise<Workspac
|
||||
}
|
||||
|
||||
if (!isValidWorkspaceName(workspace)) {
|
||||
console.error(`ERROR: Invalid workspace name: "${workspace}"`);
|
||||
console.error('ERROR: Invalid workspace name.');
|
||||
console.error(' Must be 1-128 characters, alphanumeric/hyphens/underscores, starting with alphanumeric');
|
||||
process.exit(1);
|
||||
}
|
||||
@@ -268,7 +489,12 @@ async function resolveWorkspace(client: Client, args: CliArgs): Promise<Workspac
|
||||
|
||||
// If the workspace name already looks like a CLI-generated ID
|
||||
// (ends with _shannon-<digits>), use it directly to avoid double _shannon- suffixes
|
||||
const workflowId = /_shannon-\d+$/.test(workspace) ? workspace : `${workspace}_shannon-${Date.now()}`;
|
||||
const fallback = /_shannon-\d+$/.test(workspace) ? workspace : `${workspace}_shannon-${Date.now()}`;
|
||||
const expected =
|
||||
fallback === workspace
|
||||
? new RegExp(`^${escapeRegExp(workspace)}$`)
|
||||
: new RegExp(`^${escapeRegExp(workspace)}_shannon-\\d+$`);
|
||||
const workflowId = selectWorkflowId(args.workflowId, fallback, expected);
|
||||
|
||||
return {
|
||||
workflowId,
|
||||
@@ -281,7 +507,7 @@ async function resolveWorkspace(client: Client, args: CliArgs): Promise<Workspac
|
||||
// === Pipeline Input Construction ===
|
||||
|
||||
interface OrchestrationConfig {
|
||||
vulnClasses?: VulnClass[];
|
||||
agenticSast?: AgenticSastInput;
|
||||
exploit?: boolean;
|
||||
}
|
||||
|
||||
@@ -289,16 +515,26 @@ async function loadOrchestrationConfig(configPath: string | undefined): Promise<
|
||||
if (!configPath) return {};
|
||||
try {
|
||||
const config = await parseConfig(configPath);
|
||||
const distributed = distributeConfig(config);
|
||||
const codePathAvoids = distributed.avoid.filter((rule) => rule.type === 'code_path').map((rule) => rule.value);
|
||||
const codePathFocus = distributed.focus.filter((rule) => rule.type === 'code_path').map((rule) => rule.value);
|
||||
|
||||
return {
|
||||
...(config.vuln_classes && config.vuln_classes.length > 0 && { vulnClasses: [...config.vuln_classes] }),
|
||||
...(config.exploit !== undefined && { exploit: config.exploit === 'true' }),
|
||||
...(distributed.agenticSast && {
|
||||
agenticSast: {
|
||||
codePathAvoids,
|
||||
codePathFocus,
|
||||
modelSpec: process.env.SHANNON_AI_MODEL?.trim() || DEFAULT_MODEL_SPEC,
|
||||
capellaFormatVersion: CAPELLA_FORMAT_VERSION,
|
||||
promptSetVersion: CAPELLA_PROMPT_SET_VERSION,
|
||||
},
|
||||
}),
|
||||
exploit: distributed.exploit,
|
||||
};
|
||||
} catch (error) {
|
||||
// A broken config must fail the run, not silently fall back to empty
|
||||
// defaults that quietly change scope (vuln classes, exploit, retries).
|
||||
const message = error instanceof Error ? error.message : String(error);
|
||||
console.error(`Failed to parse config ${configPath}: ${message}`);
|
||||
console.error('Worker configuration could not be loaded. Reference code: CONFIG_VALIDATION_FAILED');
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
@@ -317,7 +553,8 @@ function buildPipelineInput(
|
||||
...(args.pipelineTestingMode && { pipelineTestingMode: args.pipelineTestingMode }),
|
||||
...(workspace.isResume && args.resumeFromWorkspace && { resumeFromWorkspace: args.resumeFromWorkspace }),
|
||||
...(workspace.terminatedWorkflows.length > 0 && { terminatedWorkflows: workspace.terminatedWorkflows }),
|
||||
...(orchestration.vulnClasses && { vulnClasses: orchestration.vulnClasses }),
|
||||
...(args.customerOutputPath !== undefined && { customerOutputPath: args.customerOutputPath }),
|
||||
...(orchestration.agenticSast !== undefined && { agenticSast: orchestration.agenticSast }),
|
||||
...(orchestration.exploit !== undefined && { exploit: orchestration.exploit }),
|
||||
};
|
||||
}
|
||||
@@ -332,8 +569,11 @@ async function waitForWorkflowResult(
|
||||
try {
|
||||
const progress = await handle.query<PipelineProgress>(PROGRESS_QUERY);
|
||||
const elapsed = Math.floor(progress.elapsedMs / 1000);
|
||||
const expectedCount = progress.expectedAgents.length;
|
||||
// Agentic SAST runs alongside the phase above, so the line names it while it is working.
|
||||
const agenticSast = progress.agenticSast.status === 'running' ? ' | Agentic SAST: running' : '';
|
||||
console.log(
|
||||
`[${elapsed}s] Phase: ${progress.currentPhase || 'unknown'} | Agent: ${progress.currentAgent || 'none'} | Completed: ${progress.completedAgents.length}/13`,
|
||||
`[${elapsed}s] Phase: ${progress.currentPhase || 'unknown'} | Agent: ${progress.currentAgent || 'none'} | Completed: ${progress.completedAgents.length + progress.skippedAgents.length}/${expectedCount}${agenticSast}`,
|
||||
);
|
||||
} catch {
|
||||
// Workflow may have completed
|
||||
@@ -344,12 +584,56 @@ async function waitForWorkflowResult(
|
||||
const result = await handle.result();
|
||||
clearInterval(progressInterval);
|
||||
|
||||
console.log('\nPipeline completed successfully!');
|
||||
// The returned workflow state distinguishes completed, partial, and cancelled runs;
|
||||
// each prints its own terminal line so degradation is never labelled as full success.
|
||||
if (result.status === 'partial') {
|
||||
console.log('\nScan completed with gaps (partial). The reasons are listed below.');
|
||||
for (const reason of result.partialReasons) {
|
||||
const message = safePartialReasonMessage(reason);
|
||||
if (message !== undefined) console.log(` - ${message}`);
|
||||
}
|
||||
// The reason above says a class of coverage degraded; these three name the sanitized
|
||||
// agentic-SAST failure behind it, under the same labels every other surface uses.
|
||||
if (result.agenticSast.status === 'failed') {
|
||||
const stage = ACCEPTED_CAPELLA_FAILURE_STAGES.includes(result.agenticSast.failedStage)
|
||||
? capellaTerminalStageLabel(result.agenticSast.failedStage)
|
||||
: 'orchestration';
|
||||
const message = isCapellaSafeFailureMessage(result.agenticSast.error)
|
||||
? result.agenticSast.error
|
||||
: 'An agentic SAST step failed.';
|
||||
console.log(` Agentic SAST stopped at: ${stage}`);
|
||||
console.log(` What happened: ${message}`);
|
||||
const code = safeFailureCode(result.agenticSast.errorCode);
|
||||
if (code !== undefined) {
|
||||
console.log(` Reference code (for a bug report): ${code}`);
|
||||
}
|
||||
}
|
||||
} else if (result.status === 'cancelled') {
|
||||
console.log('\nScan cancelled before it finished.');
|
||||
} else {
|
||||
console.log('\nScan completed.');
|
||||
}
|
||||
if (result.summary) {
|
||||
console.log(`Duration: ${Math.floor(result.summary.totalDurationMs / 1000)}s`);
|
||||
console.log(`Agents completed: ${result.summary.agentCount}`);
|
||||
console.log(`Agents resolved: ${result.summary.agentCount}`);
|
||||
// Agentic SAST is not an agent, so it is absent from the count above; name it so its spend in
|
||||
// Run cost is accounted for. The failure detail, if any, already printed above.
|
||||
if (result.agenticSast.status === 'succeeded') {
|
||||
const sastGroup = summarizeOperationalMetrics(result.operationalMetrics).find(
|
||||
(group) => group.key === 'agentic-sast',
|
||||
);
|
||||
const cost = sastGroup === undefined || sastGroup.costUsd === null ? 'N/A' : `$${sastGroup.costUsd.toFixed(4)}`;
|
||||
const duration = sastGroup === undefined ? '0s' : `${Math.floor(sastGroup.durationMs / 1000)}s`;
|
||||
const coverage = result.agenticSast.coverage === 'reduced' ? ' — reduced coverage' : '';
|
||||
console.log(`Agentic SAST: completed (${duration}, ${cost})${coverage}`);
|
||||
} else if (result.agenticSast.status === 'failed') {
|
||||
console.log('Agentic SAST: failed');
|
||||
}
|
||||
console.log(`Total turns: ${result.summary.totalTurns}`);
|
||||
console.log(`Run cost: $${result.summary.totalCostUsd.toFixed(4)}`);
|
||||
if (result.summary.usageAccountingComplete === false) {
|
||||
console.log('Cost is incomplete — some background work is not included in this total.');
|
||||
}
|
||||
|
||||
if (workspace.isResume) {
|
||||
try {
|
||||
@@ -362,46 +646,13 @@ async function waitForWorkflowResult(
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
} catch {
|
||||
clearInterval(progressInterval);
|
||||
console.error('\nPipeline failed:', error);
|
||||
console.error('\nScan failed. Reference code: WORKFLOW_FAILED');
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
// === Deliverables Copy ===
|
||||
|
||||
function copyDeliverables(repoPath: string, outputPath: string): void {
|
||||
const outputDir = deliverablesDir(repoPath);
|
||||
if (!fs.existsSync(outputDir)) {
|
||||
console.log('No deliverables directory found, skipping copy');
|
||||
return;
|
||||
}
|
||||
|
||||
const files = fs.readdirSync(outputDir);
|
||||
if (files.length === 0) {
|
||||
console.log('No deliverables to copy');
|
||||
return;
|
||||
}
|
||||
|
||||
fs.mkdirSync(outputPath, { recursive: true });
|
||||
|
||||
for (const file of files) {
|
||||
if (file === '.git') continue;
|
||||
const src = path.join(outputDir, file);
|
||||
const dest = path.join(outputPath, file);
|
||||
fs.cpSync(src, dest, { recursive: true });
|
||||
}
|
||||
|
||||
// Surface the report under its human-facing name alongside the raw deliverables
|
||||
const assembledPdf = path.join(outputDir, ASSEMBLED_REPORT_PDF_FILENAME);
|
||||
if (fs.existsSync(assembledPdf)) {
|
||||
fs.copyFileSync(assembledPdf, path.join(outputPath, FINAL_REPORT_PDF_FILENAME));
|
||||
}
|
||||
|
||||
console.log(`Copied ${files.length} deliverable(s) to ${outputPath}`);
|
||||
}
|
||||
|
||||
// === Main Entry Point ===
|
||||
|
||||
async function run(): Promise<void> {
|
||||
@@ -417,30 +668,40 @@ async function run(): Promise<void> {
|
||||
const client = new Client({ connection: clientConnection });
|
||||
|
||||
try {
|
||||
// 3. Bundle workflows and create worker on per-invocation task queue
|
||||
// 3. Validate orchestration and resume state before terminating any workflow.
|
||||
const orchestration = await loadOrchestrationConfig(args.configPath);
|
||||
const workspace = await resolveWorkspace(client, args, orchestration.exploit ?? true);
|
||||
|
||||
// 4. Bundle workflows and create the worker with the collision-checked activity registry.
|
||||
console.log('Preparing scan...');
|
||||
const workflowBundle = await bundleWorkflowCode({
|
||||
workflowsPath: path.join(__dirname, 'workflows.js'),
|
||||
});
|
||||
|
||||
const productionActivities = createProductionActivityRegistry({
|
||||
repositoryPath: args.repoPath,
|
||||
webUrl: args.webUrl,
|
||||
workspacesDir: path.resolve('./workspaces'),
|
||||
});
|
||||
// args.taskQueue is generated fresh per scan (see resolveWorkspace), so Temporal can only
|
||||
// ever route this worker's activities to this scan's own container: an activity task from
|
||||
// an older or unrelated scan can never execute against the repo mounted here.
|
||||
const worker = await Worker.create({
|
||||
connection,
|
||||
namespace: 'default',
|
||||
workflowBundle,
|
||||
activities,
|
||||
activities: productionActivities,
|
||||
taskQueue: args.taskQueue,
|
||||
maxConcurrentActivityTaskExecutions: 25,
|
||||
});
|
||||
|
||||
// 4. Resolve workspace and build pipeline input
|
||||
const workspace = await resolveWorkspace(client, args);
|
||||
const orchestration = await loadOrchestrationConfig(args.configPath);
|
||||
// 5. Build the fixed-scope pipeline input.
|
||||
const input = buildPipelineInput(args, workspace, orchestration);
|
||||
|
||||
// 5. Start worker polling in the background
|
||||
// 6. Start worker polling in the background.
|
||||
const workerDone = worker.run();
|
||||
|
||||
// 6. Submit workflow to the same task queue
|
||||
// 7. Submit workflow to the same task queue.
|
||||
const handle = await client.workflow.start<(input: PipelineInput) => Promise<PipelineState>>(
|
||||
'pentestPipelineWorkflow',
|
||||
{
|
||||
@@ -450,15 +711,10 @@ async function run(): Promise<void> {
|
||||
},
|
||||
);
|
||||
|
||||
// 7. Wait for workflow result
|
||||
// 8. Wait for workflow result.
|
||||
await waitForWorkflowResult(handle, workspace);
|
||||
|
||||
// 8. Copy deliverables to output directory
|
||||
if (args.outputPath) {
|
||||
copyDeliverables(args.repoPath, args.outputPath);
|
||||
}
|
||||
|
||||
// 9. Shut down worker gracefully
|
||||
// 9. Shut down worker gracefully. Final customer copies are workflow-owned.
|
||||
worker.shutdown();
|
||||
await workerDone;
|
||||
} finally {
|
||||
@@ -467,7 +723,10 @@ async function run(): Promise<void> {
|
||||
}
|
||||
}
|
||||
|
||||
run().catch((err) => {
|
||||
console.error('Worker failed:', err);
|
||||
process.exit(1);
|
||||
});
|
||||
const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : undefined;
|
||||
if (invokedPath === fileURLToPath(import.meta.url)) {
|
||||
run().catch(() => {
|
||||
console.error('Worker failed. Reference code: WORKER_FAILED');
|
||||
process.exit(1);
|
||||
});
|
||||
}
|
||||
Reference in new issue
Block a user