fix: temporal issue and SELinux host failure on startup

[dejely]

Fixes: #288

[shiwanijha938]

Shannon → VS Code Copilot migration PoC — same 5-phase pipeline, zero infrastructure. Full details in file comment on docker.ts.

[shiwanijha938]

💡 Shannon → VS Code Copilot: Migrating the Full Agent Stack to Native IDE Customization

While this PR hardens the Docker/CLI infrastructure, I wanted to share a parallel proof-of-concept that removes the infrastructure dependency entirely by migrating Shannon's multi-agent architecture to VS Code GitHub Copilot Customization primitives.

---

The Migration Map

Shannon Component	VS Code Copilot Primitive	What Was Built
Orchestrator + Specialist Agents	.github/agents/*.agent.md	14 agents: pentest-orchestrator, pre-recon, recon, 5× vuln-analysis, 5× exploit, report
Skill Methodology Libraries	.github/skills/*/SKILL.md	5 skills: llm-sast-scanner, vuln-analysis, exploit-execution, security-recon, security-reporting
Safety + Format Rules	.github/instructions/*.instructions.md	deliverable-format (report structure), exploit-safety (ethical boundaries + scope lock)
Workflow Triggers	.github/prompts/*.prompt.md	run-pentest, vuln-scan-only, generate-report
Scope + Safety Guards	.github/hooks/	pentest-safety.json + validate-pentest-scope.py

---

How It Works

• Agents load automatically when invoked with @agent-name in Copilot Chat — Shannon's pentest-orchestrator delegates to the same specialist chain (injection → XSS → auth → SSRF → authz → exploit → report)
• Skills are SKILL.md files with 34-class SAST references — Copilot loads them on-demand for context-aware methodology
• Instructions apply globally to enforce deliverable format and prevent out-of-scope exploitation
• Prompts are one-click workflow starters — run-pentest.prompt.md launches the full 5-phase pipeline
• Hooks run validate-pentest-scope.py before any exploit phase to verify target is in scope

---

Proof: VulnCMS Full Pentest in VS Code

5-phase pentest on a Node.js + Python CMS — 42 findings, 18 Critical — conducted entirely inside VS Code Copilot with zero Docker / CLI dependency.

• CF-001: Unauthenticated RCE (4 vectors) — ✅ Proven live
• CF-002: Admin auth bypass via isAdmin=true cookie — ✅ Proven live
• CF-003: Full credential + SSN dump unauthenticated — ✅ Proven live
• CF-004: SSRF → internal secret exfiltration — ✅ Proven live
• CF-005: LFI → all hardcoded secrets disclosed — ✅ Proven live
• 14× SQL injection, stored XSS, pickle RCE, eval() RCE, node-serialize RCE

---

Shannon CLI vs. VS Code Copilot

	Shannon CLI	VS Code Copilot
Infrastructure	Docker Compose + Temporal	None
Agent orchestration	Temporal workflows	Copilot @agent routing
Skill loading	Hardcoded in worker	On-demand SKILL.md
Safety enforcement	SHANNON_DISABLE_SPENDING_GUARD flag	hooks/pentest-safety.json
Deliverable output	.shannon/deliverables/	.shannon/deliverables/ (same path)
Setup time	npx keygraph-shannon + Docker	Zero — ships with repo

---

The .github/ folder as shipped in the Shannon repo already contains everything needed to make this work. Shannon's agent methodology is essentially VS Code Copilot customization — just expressed as Docker workers instead of .agent.md files. This PR's infrastructure fixes remain valuable for full autonomous runs, but the VS Code path gives teams an instant on-ramp with no ops overhead.