Shannon is an autonomous, white-box AI penetration testing platform that orchestrates multi-agent workflows via Temporal to analyze source code, identify attack vectors, and execute real exploits against running web applications. The system is structured as a pnpm monorepo with two primary applications: a CLI (`apps/cli`) that provides the user-facing interface for launching scans, and a worker (`apps/worker`) that runs the actual pentest pipeline inside Docker containers. The architecture follows a multi-agent pipeline pattern with 13 specialized agents (pre-recon, recon, 5 vulnerability analyzers, 5 exploiters, and a report generator) coordinated through Temporal workflows for reliability and resumability. The codebase demonstrates strong software engineering practices with a clear separation of concerns between Temporal orchestration (activities/workflows), pure domain logic (services), and infrastructure concerns. The worker implements a sophisticated DI container pattern, comprehensive audit logging with crash-safe append-only streams, and a custom error classification system that maps errors to Temporal retry behavior. The system supports multiple LLM providers (Anthropic direct, AWS Bedrock, Google Vertex AI, custom proxies) and implements defense-in-depth billing detection, git checkpointing for workspace rollback, and parallel agent execution with mutex-protected shared state. Key architectural strengths include the deterministic renderer pattern (MCP tool calls → markdown without LLM in the loop), the injectable provider interfaces for extensibility, and the sophisticated session management that enables resumable workspaces. The codebase uses TypeScript with strict compiler options, implements a Result type for explicit error handling, and maintains comprehensive type definitions. The CI/CD pipeline includes semantic releases, Docker image signing with cosign, and multi-platform builds. The system processes vulnerability queues through Zod-validated structured outputs and maintains forensic audit trails of all agent executions with timing, cost, and model metadata.
Postiz is a full-stack, open-source social media scheduling and publishing platform that supports 30+ platforms (Instagram, TikTok, LinkedIn, YouTube, X, Facebook, etc.). The system is built as a pnpm monorepo with four main applications: a Next.js frontend (App Router), a NestJS backend REST API, a Temporal-based workflow orchestrator for reliable post publishing and token refresh, and a Chrome extension for cookie-based authentication. It also includes a CLI app, a public SDK (@postiz/node), and a shared libraries layer for business logic, database access (Prisma + PostgreSQL), and integrations. Key architectural patterns include an abstract social provider base class (SocialAbstract) that all platform integrations extend, a Temporal v1.8+ workflow engine with versioned posting workflows (v1.0.1 through v1.0.8), an upload factory abstracting local and Cloudflare storage, an MCP server for AI agent tools (scheduling, content generation via LangGraph), a plug/auto-reply system, and a short-link abstraction with multiple providers. The frontend uses Zustand for state management, SWR for data fetching, CopilotKit for AI textarea integration, and Mantine/Tailwind for UI. The system handles OAuth flows, subscription billing via Stripe, team collaboration, webhooks, and admin monitoring. The codebase demonstrates strong engineering with reusable abstractions for social integrations, storage, email, and short-linking, though it carries some technical debt from organic growth (multiple workflow versions, hardcoded strings, and suppressed TypeScript strictness).