Move the hightower skill from farhoodlabs/skills back into this repo
so the Hightower project owns its own agent-facing documentation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds a Helm chart under charts/hightower/ as an alternative to the
Flux/Kustomize deployment. Distributed via GitHub Pages (gh-pages branch).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Rename org references from farhoodliquor to farhoodlabs in CI workflows
and GHCR image tags
- Rewrite README for Hightower as API-driven K8s fork of Shannon
- Update CLAUDE.md to reflect API-only deployment model
- Delete docker-compose files (K8s only, no Docker Compose support)
- Delete shannon CLI entry point (API-only going forward)
- Move K8s manifests to farhoodlabs/hightower-infra
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds SKILL.md for the hightower pentest API. Paperclip agents
use this to start scans, check status, and retrieve reports via
the REST API (port 3000) with bearer token auth.
Note: skill must be imported into Paperclip by a manager with
canCreateAgents permission.
MCP server is overkill for this use case — all 5 MCP tools are
thin wrappers over the REST API. Paperclip agents should use the
REST API directly with bearer token auth instead.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Without --output, copyDeliverables() is skipped after the workflow finishes,
so the final report and all agent deliverables are lost when the emptyDir
volumes are cleaned up on pod exit.
Pass --output pointing to the workspace's deliverables/ subdir on the
workspaces PVC so files survive beyond the pod lifecycle.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Node mindy caches the :latest tag digest even with imagePullPolicy: Always.
Pinning to the SHA-tagged image forces a fresh pull on pod restart.
This image includes the pentest-user (UID 1001) securityContext fix.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Claude Code refuses --allow-dangerously-skip-permissions when running as root,
causing immediate exit with code 1. The worker image defines a "pentest" user
(UID/GID 1001), but K8s job specs override the entrypoint.sh that normally
switches to it. Adding a pod-level securityContext with runAsUser=1001 and
fsGroup=1001 fixes both the root-privilege rejection and PVC write access.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
BuildKit cache on self-hosted runner was stale — compiled JS still had
bitnami/git:2 despite source using alpine/git:latest. Adding no-cache:
true to force clean rebuilds until we can investigate the cache
invalidation issue.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The worker container overlay mounts (deliverables, scratchpad,
playwright-cli) failed because /repo is read-only and the overlay
mountpoints at /repo/.shannon/* didn't exist. The init container now
creates these directories after cloning the repo.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Biome reported unsorted imports and formatting issues in
apps/api/src/index.ts and apps/api/src/mcp/server.ts.
Auto-fixed via pnpm biome:fix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a Model Context Protocol server to apps/api/src/mcp/, exposing
five tools backed by scan-manager.ts:
- start_scan, get_scan, list_scans, cancel_scan, get_report
The MCP server runs on port 3100 (MCP_PORT env var) using
StreamableHTTPServerTransport from @modelcontextprotocol/sdk, alongside
the existing Hono API server.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add restart annotation to trigger Flux-driven rollout so the API picks
up the alpine/git init container fix (ef79ca2). Also add a deploy-manager
Role and RoleBinding so the farh-net:farh-net-paperclip SA can manage
deployments in the hightower namespace going forward.
Resolves FAR-112.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Ensures rollout restart pulls the latest image instead of using
the node's cached copy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CNPG already creates the temporal and temporal_visibility databases
via postInitSQL. The auto-setup container doesn't have CREATEDB
privilege, so set SKIP_DB_CREATE=true to skip that step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Single container that auto-creates and migrates the schema against
CNPG PostgreSQL. Built-in Web UI on 8233. No separate schema job,
ConfigMap, or UI deployment needed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace temporalio/temporal (SQLite dev server) with temporalio/server
backed by CNPG PostgreSQL (hightower-temporal-db)
- Add schema init Job using temporalio/admin-tools
- Add separate temporalio/ui deployment for the web dashboard
- Remove namespace.yaml — namespace is managed by the cluster repo
- Remove ensureNamespace() from K8s orchestrator
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Namespace, Temporal, router, PVCs, labels, and GHCR API image all
renamed from shannon-* to hightower-*. Upstream references preserved:
worker image (ghcr.io/farhoodliquor/shannon), .shannon/ dirs,
@shannon/worker package imports.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Renames API server, worker jobs, credentials secret, and workspaces
PVC to use the hightower prefix. Upstream Shannon names (namespace,
Temporal service, package imports, .shannon/ dir) are unchanged.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The temporalio/temporal image has `temporal` as its entrypoint.
Using `command` overrides the entrypoint entirely. Use `args` to
pass `server start-dev` to the existing entrypoint.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The temporalio/temporal:latest image no longer has a `server` binary.
The dev server is now in temporalio/cli with `temporal server start-dev`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Worker and API builds now run independently so a failure in one
doesn't block the other.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add apps/api/ — Hono REST API server for managing pentest scans via K8s Jobs
- POST/GET /api/scans, GET /api/scans/:id, cancel, report endpoints
- Bearer token auth, Temporal client integration, K8s Job builder
- Dockerfile, Kustomize manifests (Deployment, Service, RBAC)
- Add CLI orchestrator abstraction (docker.ts → Orchestrator interface)
- DockerOrchestrator and K8sOrchestrator implementations
- Backend detection via SHANNON_BACKEND env var or --backend flag
- Add CI workflow: type-check + lint on PR, build+push both images on main
- Switch all workflows to self-hosted runners (runners-farhoodliquor)
- Add shannon-api image build to release and release-beta workflows
- Add root infra/kustomization.yaml as Flux entry point
- Export PipelineProgress from @shannon/worker/pipeline
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- namespace, temporal server, workspaces PVC
- API server deployment, service, serviceaccount, RBAC
- Dev overlay
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: extract pipeline core for library consumption
* fix: chmod workspace directory for container write access
* fix: resolve playwright output dir relative to deliverables parent
* feat: add multi-provider LLM support via ProviderConfig
* fix: resolve model overrides via options.model, remove unused model env passthrough
* fix: use ANTHROPIC_AUTH_TOKEN for custom base URL and router auth
* fix: skip env-based credential validation when providerConfig is present
* fix: support large UID/GID values for AD/LDAP users in container
* feat: mount user repo as read-only with deliverables bind-mount overlay
* feat: add playground and .playwright-cli overlay mounts
* feat: add filesystem context to pipeline-testing prompts
* fix: use explicit REPO_PATH in filesystem prompt for clarity
* fix: update filesystem prompts with playground notes and absolute screenshot paths
* feat: namespace writable overlays under .shannon/ to avoid polluting host repo
* refactor: rename playground to scratchpad
* fix: redirect playwright-cli output to writable .shannon/ overlay
* fix: pre-create .shannon/ overlay mount points for Linux compatibility
* fix: exclude nested node_modules and dist from Docker build context
* fix: enforce LF line endings for shell scripts on Windows
- Add minimum-release-age=10080 (7 days) and ignore-scripts=true to .npmrc
- Upgrade pnpm from 10.12.1 to 10.33.0 (minimumReleaseAge requires >= 10.16.0)
- Document package installation age policy in CLAUDE.md
* feat: add structured outputs for vuln agent exploitation queues
Use Claude Agent SDK's native outputFormat to get schema-validated JSON
queue data from vulnerability analysis agents instead of relying on
save-deliverable tool calls for queue files.
- Add Zod schemas for all 5 vuln types (injection, xss, auth, ssrf, authz)
- Thread outputFormat through SDK call chain (executor → message handlers)
- Write structured_output to disk as queue JSON before validation
- Handle error_max_structured_output_retries as retryable failure
- Update vuln prompts to use structured output for queues
- Keep save-deliverable for markdown deliverables (unchanged)
* fix: correct structured output schema conversion for Claude Agent SDK
Use draft-07 target for z.toJSONSchema() instead of the default
draft-2020-12, which the SDK's AJV validator doesn't support. Update
pipeline-testing prompts to use structured output instead of raw JSON
responses.
* refactor: remove save-deliverable references for queues in vuln prompts
Queues are now captured via structured outputs, so vuln agents no longer
need to use save-deliverable for queue JSON. Removes references to
"structured response/output" phrasing and aligns all prompts to use
consistent "exploitation queue" terminology.
* refactor: remove queue support from save-deliverable
Queues are now produced via structured outputs, so save-deliverable no
longer needs queue-related code. Removes queue enum values, filename
mappings, JSON validation, and updates all prompt tool descriptions to
match the simplified CLI interface.
* fix: instruct vuln agents to save deliverable before exploitation queue
The structured output tool terminates the agent session when called.
Agents were calling it before saving their deliverable markdown,
causing output validation failures and unnecessary retries.
* refactor: remove explicit exploitation queue output instructions from vuln prompts
The Claude Agent SDK automatically captures structured output on the
last turn when outputFormat is set. Prompts explicitly telling agents
to produce the queue caused them to call StructuredOutput mid-session,
conflicting with the SDK mechanism and silently dropping the output.
Removed exploitation_queue_requirements sections and queue references
from conclusion triggers. Added note that the queue is captured
automatically. Updated Your Output to point to the deliverable markdown.
Gandalf the Greybeard
Chris Farhood