@pensar/apex 2.3.0-canary.69bfb82f → 2.3.0-canary.7d0ff84a

package/build/{agent-xeze611p.js → agent-en3cf7ks.js}

@@ -4,19 +4,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-nz9t18bj.js";
+} from "./cli-8zeepea9.js";
 import"./cli-9fsre5pt.js";
-import"./cli-84zf1xh9.js";
-import"./cli-56zyg4kv.js";
-import"./cli-6d37md4z.js";
+import"./cli-2jmcpp2j.js";
+import"./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
 import"./cli-c8131c4q.js";
-import"./cli-j2xnatde.js";
-import"./cli-t3w55a46.js";
+import"./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0nhhne05.js";
-import"./cli-mfsnae61.js";
-import"./cli-x3dp6b1d.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/agent-fg3e80a5.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-7k9750yn.js";
+import"./cli-9fsre5pt.js";
+import"./cli-2jmcpp2j.js";
+import"./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
+import"./cli-c8131c4q.js";
+import"./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-9ck6hcgm.js → agent-xw0emp2e.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-56zyg4kv.js";
+} from "./cli-gkqya1mj.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-6d37md4z.js";
+} from "./cli-5n4q289y.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-j2xnatde.js";
-import"./cli-t3w55a46.js";
+} from "./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
 import {
   exports_external,
   init_zod
 } from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0nhhne05.js";
-import"./cli-mfsnae61.js";
-import"./cli-x3dp6b1d.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -68,7 +68,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
-- Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
+- Missing rate limiting / anti-automation: a modest burst (~20 requests) with no observed throttling, delays, or 429s is sufficient to demonstrate the gap. For endpoints with real-world side effects (sending email/SMS/push, creating tickets/notifications, contact/support/feedback forms, payments), as few as 2–3 attempts plus the observed response is sufficient — do NOT require volume-testing that would spam real recipients. Evidence must state exact request count, timing/distribution, and observed statuses.
 
 ### Common Low-Signal Patterns
 Reject these unless the submitted evidence demonstrates concrete harm:

package/build/{apps-z4t1t8vq.js → apps-nb93qqan.js}

@@ -1,4 +1,14 @@
 #!/usr/bin/env bun
+import"./cli-af4ntw65.js";
+import"./cli-ks3x11h1.js";
+import"./cli-r5htb0jx.js";
+import"./cli-fd7k577q.js";
+import"./cli-8zeepea9.js";
+import"./cli-r8hsdfaf.js";
+import"./cli-7k9750yn.js";
+import"./cli-8jaz2enb.js";
+import"./cli-9fsre5pt.js";
+import"./cli-2jmcpp2j.js";
 import {
   createApp,
   createEndpoint,
@@ -12,27 +22,17 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-phg6k6r3.js";
-import"./cli-b5fgnn98.js";
-import"./cli-5r9kv574.js";
-import"./cli-5kw8aevs.js";
-import"./cli-nz9t18bj.js";
-import"./cli-xtr26a9f.js";
-import"./cli-3v63bjde.js";
-import"./cli-x8a6x5qp.js";
-import"./cli-9fsre5pt.js";
-import"./cli-84zf1xh9.js";
-import"./cli-56zyg4kv.js";
-import"./cli-6d37md4z.js";
+} from "./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-j2xnatde.js";
-import"./cli-t3w55a46.js";
+import"./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0nhhne05.js";
-import"./cli-mfsnae61.js";
-import"./cli-x3dp6b1d.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-9y0h9cc2.js → auth-3yhq5eh3.js}

@@ -1,22 +1,23 @@
 #!/usr/bin/env bun
-import"./cli-phg6k6r3.js";
-import"./cli-b5fgnn98.js";
-import"./cli-5r9kv574.js";
-import"./cli-5kw8aevs.js";
-import"./cli-nz9t18bj.js";
-import"./cli-xtr26a9f.js";
-import"./cli-3v63bjde.js";
-import"./cli-x8a6x5qp.js";
+import"./cli-af4ntw65.js";
+import"./cli-ks3x11h1.js";
+import"./cli-r5htb0jx.js";
+import"./cli-fd7k577q.js";
+import"./cli-8zeepea9.js";
+import"./cli-r8hsdfaf.js";
+import"./cli-7k9750yn.js";
+import"./cli-8jaz2enb.js";
 import"./cli-9fsre5pt.js";
-import"./cli-84zf1xh9.js";
-import"./cli-56zyg4kv.js";
-import"./cli-6d37md4z.js";
+import"./cli-2jmcpp2j.js";
+import"./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-j2xnatde.js";
+import"./cli-pt68r0a9.js";
 import {
   createWorkspaceSelection,
   disconnect,
+  ensureValidToken,
   fetchWorkspaces,
   getPensarApiUrl,
   getPensarConsoleUrl,
@@ -28,15 +29,15 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-t3w55a46.js";
+} from "./cli-s7fwee5f.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-0nhhne05.js";
-import"./cli-mfsnae61.js";
-import"./cli-x3dp6b1d.js";
+} from "./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
 import {
   __require
 } from "./cli-8rxa073f.js";
@@ -85,7 +86,13 @@ Waiting for workspace selection...`);
 }
 async function login() {
   const appConfig = await config.get();
-  if (isConnected(appConfig)) {
+  const hasStoredCredentials = isConnected(appConfig);
+  const validToken = hasStoredCredentials ? await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  }) : null;
+  if (validToken) {
     console.log("Already connected to Pensar Console.");
     if (appConfig.workspaceSlug) {
       console.log(`  Workspace: ${appConfig.workspaceSlug}`);
@@ -95,6 +102,8 @@ Reconnect? (y/N): `);
     if (answer.toLowerCase() !== "y") {
       return;
     }
+  } else if (hasStoredCredentials) {
+    console.log("Your saved Pensar Console session has expired. Reconnecting.");
   }
   console.log(`
 Pensar Console — Managed Inference
@@ -228,6 +237,15 @@ async function status() {
     console.log("Not connected to Pensar Console.\n\nRun `pensar login` to connect.");
     return;
   }
+  const validToken = await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  });
+  if (!validToken) {
+    console.log("Your Pensar Console session has expired.\n\nRun `pensar login` to reconnect.");
+    return;
+  }
   if (!appConfig.accessToken && appConfig.pensarAPIKey && !appConfig.workspaceSlug) {
     try {
       const apiUrl = getPensarApiUrl();

package/build/authentication-abnrrx5d.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-r8hsdfaf.js";
+import"./cli-9fsre5pt.js";
+import"./cli-2jmcpp2j.js";
+import"./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
+import"./cli-c8131c4q.js";
+import"./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-zmwwqnkm.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-r5htb0jx.js";
+import"./cli-9fsre5pt.js";
+import"./cli-2jmcpp2j.js";
+import"./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
+import"./cli-c8131c4q.js";
+import"./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-byjp9njm.js → blackboxPentest-7desnj4h.js}

@@ -1,24 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-b5fgnn98.js";
-import"./cli-5r9kv574.js";
-import"./cli-5kw8aevs.js";
-import"./cli-nz9t18bj.js";
-import"./cli-3v63bjde.js";
-import"./cli-x8a6x5qp.js";
+} from "./cli-ks3x11h1.js";
+import"./cli-r5htb0jx.js";
+import"./cli-fd7k577q.js";
+import"./cli-8zeepea9.js";
+import"./cli-7k9750yn.js";
+import"./cli-8jaz2enb.js";
 import"./cli-9fsre5pt.js";
-import"./cli-84zf1xh9.js";
-import"./cli-56zyg4kv.js";
-import"./cli-6d37md4z.js";
+import"./cli-2jmcpp2j.js";
+import"./cli-gkqya1mj.js";
+import"./cli-5n4q289y.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-j2xnatde.js";
-import"./cli-t3w55a46.js";
+import"./cli-pt68r0a9.js";
+import"./cli-s7fwee5f.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0nhhne05.js";
-import"./cli-mfsnae61.js";
-import"./cli-x3dp6b1d.js";
+import"./cli-729r0ms5.js";
+import"./cli-kxsrmx74.js";
+import"./cli-2sf49904.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-84zf1xh9.js → cli-2jmcpp2j.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-56zyg4kv.js";
+} from "./cli-gkqya1mj.js";
 import {
   exports_external,
   init_zod

package/build/{cli-x3dp6b1d.js → cli-2sf49904.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.3.0-canary.69bfb82f"
+    version: "2.3.0-canary.7d0ff84a"
   };
 });
 

package/build/{cli-6d37md4z.js → cli-5n4q289y.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-j2xnatde.js";
+} from "./cli-pt68r0a9.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-0nhhne05.js → cli-729r0ms5.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-mfsnae61.js";
+} from "./cli-kxsrmx74.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-3v63bjde.js → cli-7k9750yn.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-56zyg4kv.js";
+} from "./cli-gkqya1mj.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-j2xnatde.js";
+} from "./cli-pt68r0a9.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-x8a6x5qp.js → cli-8jaz2enb.js}

@@ -2,11 +2,11 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-56zyg4kv.js";
+} from "./cli-gkqya1mj.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-j2xnatde.js";
+} from "./cli-pt68r0a9.js";
 import {
   exports_external,
   init_zod,

package/build/{cli-nz9t18bj.js → cli-8zeepea9.js}

@@ -5,7 +5,7 @@ import {
   createReportErrorTool,
   isMemoryEnabled,
   readPlan
-} from "./cli-56zyg4kv.js";
+} from "./cli-gkqya1mj.js";
 import {
   createLogger,
   hasToolCall,
@@ -13,7 +13,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-j2xnatde.js";
+} from "./cli-pt68r0a9.js";
 import {
   exports_external,
   init_zod
@@ -161,12 +161,21 @@ var SECTION_RATE_LIMITING = `Rate Limiting:
 - If you encounter rate limiting (HTTP 429), use exponential backoff before retrying
 - Use execute_command with "sleep N" where N increases: 5 seconds, then 30 seconds, then 120 seconds
 - After sleeping, retry the request. If rate limiting persists after 3 attempts, note it in your summary and move on to other objectives`;
-var SECTION_RATE_LIMITING_TESTING = `Testing for Rate Limiting Deficiencies:
-- When an objective involves testing for missing rate limiting or anti-automation controls, send a MINIMUM of 50 requests in rapid succession before concluding that no rate limiting exists. Fewer than 50 requests is not sufficient — rate limiting mechanisms may use sliding windows, IP quotas, or progressive delays that only trigger at higher volumes.
-- In your finding evidence, always state the EXACT number of requests sent, their distribution (e.g. "50 requests to /api/login over 10 seconds, all from a single IP"), and all HTTP status codes observed. Vague claims like "multiple requests" or "rapid requests" are insufficient.
-- Frame findings as "Insufficient Anti-Automation Controls" rather than definitively "No Rate Limiting" unless you sent 100+ requests without encountering any throttling, delays, or 429 responses. Even with no rate limiting, a throttled bot can bypass simple rate limits — the absence of CAPTCHA, device fingerprinting, or behavioral analysis is the broader concern.
+var SECTION_RATE_LIMITING_TESTING_ALLOWED = `Testing for Rate Limiting Deficiencies (AUTHORIZED):
+- The client has authorized rate-limit / anti-automation testing for this engagement. When an objective involves missing rate limiting or anti-automation controls, send a modest burst — on the order of 20 requests — in rapid succession, and stop as soon as you observe throttling, delays, or 429s. A handful is not enough to rule out rate limiting (sliding windows, IP quotas, and progressive delays only trigger above a few requests), but there is no need to send dozens or hundreds: ~20 requests without any throttling already demonstrates the gap.
+- In your finding evidence, always state the EXACT number of requests sent, their distribution (e.g. "20 requests to /api/login over 5 seconds, all from a single IP"), and all HTTP status codes observed. Vague claims like "multiple requests" or "rapid requests" are insufficient.
+- Frame findings as "Insufficient Anti-Automation Controls" rather than definitively "No Rate Limiting": even with no rate limiting, a throttled bot can bypass simple rate limits — the absence of CAPTCHA, device fingerprinting, or behavioral analysis is the broader concern.
 - Always note existing mitigations and their impact on exploitability. For example, if the target has account lockout after 5 failed attempts, this significantly limits credential stuffing even without IP-based rate limiting. Document what protections DO exist, not just what is missing.
-- When documenting rate limiting findings, clearly state what was tested (authentication endpoint, API endpoint, password reset, etc.) and how the test was conducted (sequential vs concurrent, single IP vs distributed, single account vs multiple accounts).`;
+- When documenting rate limiting findings, clearly state what was tested (authentication endpoint, API endpoint, password reset, etc.) and how the test was conducted (sequential vs concurrent, single IP vs distributed, single account vs multiple accounts).
+- The real-world side-effect rule below still applies: even when authorized, do not volume-test endpoints that deliver to real people.`;
+var SECTION_RATE_LIMITING_TESTING_BLOCKED = `Rate-Limit / Anti-Automation Testing (OUT OF SCOPE):
+- The client has NOT authorized rate-limit, anti-automation, or volumetric (light-DoS) testing for this engagement. Do NOT send request bursts, floods, or high-volume loops to probe for missing rate limiting, and do NOT script them (curl/loop scripts, concurrent request fans, etc.).
+- If you notice a likely-missing throttle in the course of normal testing, you may note it briefly from what you already observed — but do not generate additional load to prove it, and do not open a dedicated rate-limiting task. Absence of rate limiting is out of scope here.`;
+var SECTION_SIDE_EFFECT_SAFETY = `Real-World Side Effects — Prove Once, Never Loop:
+- Some endpoints cause a real-world side effect every time they succeed: sending email/SMS/push, creating tickets or notifications delivered to real people, submitting "contact"/support/feedback forms to a monitored inbox, or triggering payments. This rule applies REGARDLESS of whether rate-limit or destructive testing is authorized.
+- Prove any finding on such an endpoint with the fewest interactions possible — ideally ONE, and never more than 2-3. A single accepted/delivered submission plus the observed response is sufficient evidence.
+- NEVER loop, burst, fuzz at volume, or repeatedly submit to a live delivery endpoint — not to "confirm" a finding, and not to test anti-automation. Repeating it adds no confidence and spams real recipients.
+- If demonstrating a control gap would require volume against a live-delivery endpoint, describe the gap from the single observation instead of generating the volume.`;
 var SECTION_POC_PORTABILITY = `POC Script Portability Requirements:
 - POC scripts MUST be POSIX-compatible to ensure they work across different environments (macOS, Linux, Alpine, BusyBox)
 - Use grep -E (extended regex) or grep -o. NEVER use grep -P or grep -oP (Perl regex is not portable and will fail on macOS and BusyBox)
@@ -295,12 +304,10 @@ Guidelines:
 - When you have finished testing ALL objectives, call the response tool with a summary of your results. Do NOT call response until you have completed all testing.
 - In your response, include objectiveResults for EVERY objective: mark each as completed (true) if you thoroughly tested it and either found and documented a vulnerability OR conclusively determined the endpoint is not vulnerable to that attack. Mark as incomplete (false) if you were unable to fully test it (e.g., rate limited, timed out, need different approach). Also add NEW objectives you discovered during testing that should be tested in future runs (mark these as completed=false).
 - Do NOT write report files to scratchpad/ (no executive summaries, comprehensive reports, finding compilations, or vulnerability rollups). Reports are generated automatically from findings/. Use the response tool for your final summary.
-- Email Injection: For email injection findings, confirm the email was actually delivered and rendered as HTML. If you have email inbox access (email_get_message tool), retrieve the sent email to verify HTML rendering. If inbox access is unavailable, explicitly note in your evidence that rendering was not independently verified.
+- Email Injection: For email injection findings, confirm the email was actually delivered and rendered as HTML. If you have email inbox access (email_get_message tool), retrieve the sent email to verify HTML rendering. If inbox access is unavailable, explicitly note in your evidence that rendering was not independently verified. Send at most one or two test emails to confirm the flaw — a single delivered payload is sufficient proof. Do NOT repeatedly submit to a live "contact"/support/notification endpoint that delivers to a real inbox; one confirmation is enough.
 
 ${SECTION_RATE_LIMITING}
 
-${SECTION_RATE_LIMITING_TESTING}
-
 ${SECTION_DOCUMENT_VULNERABILITY_RULES}
 
 ${SECTION_MATERIALITY_GUIDANCE}
@@ -355,8 +362,6 @@ ${SECTION_MATERIALITY_GUIDANCE}
 
 ${SECTION_RATE_LIMITING}
 
-${SECTION_RATE_LIMITING_TESTING}
-
 ${SECTION_CREDENTIAL_DISCOVERY}
 
 ${SECTION_SECURITY_HEADERS_CORS}
@@ -391,8 +396,6 @@ ${SECTION_POC_PORTABILITY}
 
 ${SECTION_RATE_LIMITING}
 
-${SECTION_RATE_LIMITING_TESTING}
-
 ${SECTION_BROWSER_INTERACTION}
 
 ${SECTION_AUTHENTICATION}
@@ -431,8 +434,6 @@ ${SECTION_POC_PORTABILITY}
 
 ${SECTION_RATE_LIMITING}
 
-${SECTION_RATE_LIMITING_TESTING}
-
 ${SECTION_BROWSER_INTERACTION}
 
 ${SECTION_AUTHENTICATION}
@@ -447,22 +448,31 @@ ${SECTION_STATE_CHECKPOINTING}`;
 function destructiveSection(allow) {
   return allow ? SECTION_DESTRUCTIVE_ALLOWED : SECTION_DESTRUCTIVE_BLOCKED;
 }
+function rateLimitTestingSection(allow) {
+  return allow ? SECTION_RATE_LIMITING_TESTING_ALLOWED : SECTION_RATE_LIMITING_TESTING_BLOCKED;
+}
 function buildPentestSystemPrompt(session, role = "orchestrator") {
   const destructive = destructiveSection(session.config?.allowDestructiveActions);
+  const rateLimitTesting = rateLimitTestingSection(session.config?.allowRateLimitTesting);
+  const guardrails = `${destructive}
+
+${rateLimitTesting}
+
+${SECTION_SIDE_EFFECT_SAFETY}`;
   if (role === "orchestrator") {
     return `${PENTEST_SYSTEM_PROMPT_ORCHESTRATOR}
 
-${destructive}`;
+${guardrails}`;
   }
   const taskDriven = session.config?.taskDriven ?? false;
   const exfilMode = session.config?.exfilMode ?? false;
   const base = taskDriven ? exfilMode ? PENTEST_SYSTEM_PROMPT_TASK_DRIVEN_EXFIL : PENTEST_SYSTEM_PROMPT_TASK_DRIVEN : exfilMode ? PENTEST_SYSTEM_PROMPT_EXFIL : PENTEST_SYSTEM_PROMPT_BASE;
-  const withDestructive = `${base}
+  const withGuardrails = `${base}
 
-${destructive}`;
-  return session.config?.promptInjectionLibrarySource ? `${withDestructive}
+${guardrails}`;
+  return session.config?.promptInjectionLibrarySource ? `${withGuardrails}
 
-${SECTION_PROMPT_INJECTION}` : withDestructive;
+${SECTION_PROMPT_INJECTION}` : withGuardrails;
 }
 var SECTION_ORCHESTRATOR_DELEGATION = `Sub-Agent Delegation Rules:
 - You DO NOT call document_vulnerability directly. Findings are documented by the workers you spawn.