pre-recon fails but I can't figure out why.

[obones]

Hello,

I'm trying out shannon with the objective of doing a blackbox assessment of my web app and so expected to run it with just an URL.
As it turns out, the -r parameter is required so I gave it the folder where the backend (AWS Lambda) sources are located.

The process fails and I can see this in the log:

[2026-09-23 11:24:53] [pre-recon] bash: {"command":"cd /repos/api; ls -la; cat .gitignore; git ls-files --others --ignored --exclude-standard --directory | head -50; git ls-files | wc -l; git ls-files | head -300"}
[2026-09-23 11:24:53] [pre-recon] bash failed (1ms)
[2026-09-23 11:25:24] [pre-recon] [ERROR] AGENT_EXECUTION_FAILED (unknown, attempt 1, 36.3s, 4 turns)
[2026-09-23 11:25:24] [AGENT] pre-recon: Failed (AGENT_EXECUTION_FAILED) (36.3s, $0.2498)

What have I missed?

[DYNOSuprovo]

The 1ms failure on that command:

cd /repos/api; ls -la; cat .gitignore; git ls-files ...

almost always stems from one of two Git requirements inside Shannon's Docker container:

---

1. The mounted folder is not an initialized Git repository (Most Common)

Shannon's pre-recon phase uses git ls-files to discover routes, handlers, and configuration files.

If the folder you passed to -r is just a subfolder or extracted source folder that doesn't contain a .git directory, git ls-files exits immediately (1ms) with code 128:

fatal: not a git repository (or any of the parent directories): .git

Because the bash command chain fails on git ls-files, the pre-recon agent cannot catalog your codebase and aborts with AGENT_EXECUTION_FAILED.

Fix:
Ensure the folder you pass to -r is an initialized Git repository. If it is an isolated folder:

cd /path/to/your/backend-folder
git init
git add .
git commit -m "Initial commit for shannon scan"

---

2. Git "Dubious Ownership" inside Docker

Shannon runs in a Docker container where commands execute under a specific user (often root or a dedicated user).

In Git 2.35.2+, if the mounted volume /repos/api is owned by a different UID on your host machine than the user running inside the container, Git refuses to run commands in that directory:

fatal: detected dubious ownership in repository at '/repos/api'

Fix:
If running locally via Docker, you can ensure safe directory handling or mount the repository with matching permissions.

---

3. Running purely "Blackbox" (URL only)

Shannon is architected primarily as a white-box / hybrid grey-box security tester that correlates source code logic with runtime probes.

If you don't want or have source code and want to run against only the target URL, you can pass a dummy empty Git repo to satisfy the -r requirement:

mkdir /tmp/dummy-repo && cd /tmp/dummy-repo
git init
git commit --allow-empty -m "init"

Then pass -r /tmp/dummy-repo along with your target URL.

Initializing git in your backend source folder should get pre-recon past this step immediately! If this solves your problem, please consider marking this as the accepted answer.