Describe the bug

System: Ubuntu 24.04.4 LTS
Hyper-V Virtual Machine
Admin user (used sudo to raise perms to root for all steps)

I have Shannon all setup with my repo. and ran the following command (replaced my information with brackets of course)

./shannon start URL=https://<url_to_site>/ REPO=<repo_name> WORKSPACE=<workspace_name> OUTPUT=./reports

It ran through the install processes and reached 'resolving provenance for metadata file' step and then I was presented with the below error

file:///app/dist/config-parser.js:27
    throw new PentestError(`Failed to load configuration schema: ${errMsg}`, 'config', false, { schemaPath: '../configs/config-schema.json', originalError: errMsg });
          ^

PentestError: Failed to load configuration schema: EACCES: permission denied, open '/app/configs/config-schema.json'
    at file:///app/dist/config-parser.js:27:11 {
  type: 'config',
  retryable: false,
  context: {
    schemaPath: '../configs/config-schema.json',
    originalError: "EACCES: permission denied, open '/app/configs/config-schema.json'"
  },
  timestamp: '2026-03-04T18:31:17.231Z',
  code: undefined
}

Node.js v22.22.0

I am not sure what the issue is because the file config-schema.json does not exist within my /repos/<repo_name>/app/configs directory nor do I have a directory called dist within /repos/<repo_name>/app/ directory that the config-parser.js is specified to be located.

Steps to reproduce

1. git clone https://github.com/KeygraphHQ/shannon.git
2. cd shannon
3. I did Option B to create a .env file

• cat > .env << 'EOF'
• ANTHROPIC_API_KEY=<my_api_key_here>
• CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
• EOF

4. git clone https://github.com/<my_repo_information>git ./repos/<repo_name>
5. ./shannon start URL=https://<url_to_site>/ REPO=<repo_name> WORKSPACE=<workspace_name> OUTPUT=./reports

Expected behaviour

Not sure as this was my first time launching the application

Actual behaviour

It gave the above error as noted in the bug description. I also checked the /shannon/audit-logs directory and no logs of any kind are present in the directory and I do not see a workspace folder location, and the Temporal UI shows no workspace or failures or that anything ran at all. It did create the reports directory however that was empty as well.

Pre-submission checklist (required)

• I have searched the existing open issues and confirmed this bug has not already been reported.
• I am running the latest released version of shannon.

If applicable

• I have included relevant error messages, stack traces, or failure details.
• I have checked the audit logs and pasted the relevant errors.
• I have inspected the failed Temporal workflow run and included the failure reason.
• I have included clear steps to reproduce the issue.
• I have redacted any sensitive information (tokens, URLs, repo names).

Debugging details

root@:/home//shannon# ./shannon start URL=https://<url_to_site>/ REPO=<repo_name> WORKSPACE=<workspace_name> OUTPUT=./reports
Ensuring worker has correct output mount...
[+] Building 247.7s (31/31) FINISHED
=> [internal] load local bake definitions 0.0s
=> => reading from stdin 494B 0.0s
=> [internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 4.47kB 0.0s
=> [internal] load metadata for cgr.dev/chainguard/wolfi-base:latest 0.8s
=> [internal] load .dockerignore 0.0s
=> => transferring context: 702B 0.0s
=> [internal] load build context 0.5s
=> => transferring context: 28.47MB 0.5s
=> [builder 1/6] FROM cgr.dev/chainguard/wolfi-base:latest@sha256:74cc4315c1344a40a7ac1e7d1b8f26cc7dba2256791338c0f12e745be950a143 1.4s
=> => resolve cgr.dev/chainguard/wolfi-base:latest@sha256:74cc4315c1344a40a7ac1e7d1b8f26cc7dba2256791338c0f12e745be950a143 0.0s
=> => sha256:8b7b5281edc4c60abdd5b11639fc31a70145a71e9159adfb065613716727dcf9 2.84MB / 2.84MB 0.3s
=> => sha256:3f02fc482423f53d1d5bfdf6094776ebe0b7eba4617489f96d32e6c61ac92d92 417.24kB / 417.24kB 0.2s
=> => sha256:174181e727b5b4c457e5295d38bfa5f3cec95ead6109576c1612ba7b8570d829 3.21MB / 3.21MB 0.3s
=> => sha256:74cc4315c1344a40a7ac1e7d1b8f26cc7dba2256791338c0f12e745be950a143 1.02kB / 1.02kB 0.0s
=> => sha256:ce1659c1ce3a2d7c8e9f006a4a2481fad76f70357a1490d2bc66d0ee4d7368e1 2.50kB / 2.50kB 0.0s
=> => sha256:fc2127d0e0886a502a46849c1f0cf57bf228fb758d1d2df0109af69cf4028612 2.86kB / 2.86kB 0.0s
=> => extracting sha256:8b7b5281edc4c60abdd5b11639fc31a70145a71e9159adfb065613716727dcf9 0.1s
=> => sha256:1d53393b78f00c417dbc484afee224f386ba037746127e62a4bc86b6ad11daa1 172.00kB / 172.00kB 0.4s
=> => sha256:2a4da0691147ee88d0960b8ac8bda5481f91b115a20a0dcb9f30481401d91d36 132.03kB / 132.03kB 0.5s
=> => sha256:7c6e71c1fdfdf429844e25aad86441920641c0ba46466bc1d043556bfb81b24e 95.69kB / 95.69kB 0.4s
=> => extracting sha256:174181e727b5b4c457e5295d38bfa5f3cec95ead6109576c1612ba7b8570d829 0.1s
=> => sha256:a45907cabfcb964d4109679f34e2aa5b1fda1d0069e136002f2594df87afa35e 94.80kB / 94.80kB 0.5s
=> => sha256:3737345308ab6ef2397edb6064c974cefbb54eeac105eaccf8fbc9045eecc04d 62.49kB / 62.49kB 0.5s
=> => sha256:54bfed0539e5fed0528c4a701b804fc053fa1e08d40f64d8ad3e8e3fa11b2545 11.79kB / 11.79kB 0.7s
=> => extracting sha256:3f02fc482423f53d1d5bfdf6094776ebe0b7eba4617489f96d32e6c61ac92d92 0.0s
=> => extracting sha256:1d53393b78f00c417dbc484afee224f386ba037746127e62a4bc86b6ad11daa1 0.0s
=> => sha256:cdea145aa11554331de7d95b1834fd4f2a784fa573086475ff0d7c86d3abd020 2.87kB / 2.87kB 0.9s
=> => sha256:0059584e923812dbdcd7e503f926847f5b4ddcb6076e9d6a9b4f9dd3b555d5e9 13.83kB / 13.83kB 0.7s
=> => extracting sha256:2a4da0691147ee88d0960b8ac8bda5481f91b115a20a0dcb9f30481401d91d36 0.0s
=> => extracting sha256:7c6e71c1fdfdf429844e25aad86441920641c0ba46466bc1d043556bfb81b24e 0.0s
=> => extracting sha256:a45907cabfcb964d4109679f34e2aa5b1fda1d0069e136002f2594df87afa35e 0.0s
=> => extracting sha256:3737345308ab6ef2397edb6064c974cefbb54eeac105eaccf8fbc9045eecc04d 0.0s
=> => extracting sha256:54bfed0539e5fed0528c4a701b804fc053fa1e08d40f64d8ad3e8e3fa11b2545 0.0s
=> => extracting sha256:cdea145aa11554331de7d95b1834fd4f2a784fa573086475ff0d7c86d3abd020 0.0s
=> => extracting sha256:0059584e923812dbdcd7e503f926847f5b4ddcb6076e9d6a9b4f9dd3b555d5e9 0.0s
=> [builder 2/6] RUN apk update && apk add --no-cache build-base git curl wget ca-certificates libpcap-dev linux-headers 30.2s
=> [runtime 2/19] RUN apk update && apk add --no-cache git bash curl ca-certificates libpcap nmap nodejs-22 npm py 62.0s
=> [builder 3/6] RUN mkdir -p /go/bin 0.5s
=> [builder 4/6] RUN go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest 100.4s
=> [builder 5/6] RUN git clone --depth 1 https://github.com/urbanadventurer/WhatWeb.git /opt/whatweb && chmod +x /opt/whatweb/whatweb && gem ins 5.9s
=> [builder 6/6] RUN pip3 install --no-cache-dir schemathesis 10.6s
=> [runtime 3/19] COPY --from=builder /go/bin/subfinder /usr/local/bin/ 0.2s
=> [runtime 4/19] COPY --from=builder /opt/whatweb /opt/whatweb 0.5s
=> [runtime 5/19] COPY --from=builder /usr/local/bin/whatweb /usr/local/bin/whatweb 0.0s
=> [runtime 6/19] RUN gem install addressable 3.6s
=> [runtime 7/19] COPY --from=builder /usr/lib/python3./site-packages /usr/lib/python3.12/site-packages 1.3s
=> [runtime 8/19] COPY --from=builder /usr/bin/schemathesis /usr/bin/ 0.1s
=> [runtime 9/19] RUN addgroup -g 1001 pentest && adduser -u 1001 -G pentest -s /bin/bash -D pentest 0.2s
=> [runtime 10/19] WORKDIR /app 0.0s
=> [runtime 11/19] COPY package.json ./ 0.0s
=> [runtime 12/19] COPY mcp-server/package*.json ./mcp-server/ 0.1s
=> [runtime 13/19] RUN npm ci && cd mcp-server && npm ci && cd .. && npm cache clean --force 14.3s
=> [runtime 14/19] COPY . . 0.3s
=> [runtime 15/19] RUN cd mcp-server && npm run build && cd .. && npm run build 8.0s
=> [runtime 16/19] RUN npm prune --production && cd mcp-server && npm prune --production 3.2s
=> [runtime 17/19] RUN npm install -g @anthropic-ai/claude-code 3.6s
=> [runtime 18/19] RUN mkdir -p /app/sessions /app/deliverables /app/repos /app/configs && mkdir -p /tmp/.cache /tmp/.config /tmp/.npm && chmod 36.0s
=> [runtime 19/19] RUN git config --global user.email "agent@localhost" && git config --global user.name "Pentest Agent" && git config --global 0.3s
=> exporting to image 25.0s
=> => exporting layers 25.0s
=> => writing image sha256:fdcfce64ca9996e83c0c7e72a938467d458606968ad7c513a28f7db08e19eb49 0.0s
=> => naming to docker.io/library/shannon-worker 0.0s
=> resolving provenance for metadata file 0.0s
file:///app/dist/config-parser.js:27
throw new PentestError(Failed to load configuration schema: ${errMsg}, 'config', false, { schemaPath: '../configs/config-schema.json', originalError: errMsg });
^

PentestError: Failed to load configuration schema: EACCES: permission denied, open '/app/configs/config-schema.json'
at file:///app/dist/config-parser.js:27:11 {
type: 'config',
retryable: false,
context: {
schemaPath: '../configs/config-schema.json',
originalError: "EACCES: permission denied, open '/app/configs/config-schema.json'"
},
timestamp: '2026-03-04T18:31:17.231Z',
code: undefined
}

Node.js v22.22.0

Screenshots

Authentication method used

CLAUDE_CODE_OAUTH_TOKEN

Full ./shannon command with all flags used (with redactions)

./shannon start URL=https://<url_to_site>/ REPO=<repo_name> WORKSPACE=<workspace_name> OUTPUT=./reports

Are you using any experimental models or providers other than default Anthropic models?

No

If Yes, which one (model/provider)?

No response

OS (with version)

Ubuntu 24.04.4

Docker version ('docker -v')

29.2.1, build a5c7197

Additional context

No response