@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/src/core/agents/offSecAgent/prompt.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+import { buildBaseSystemPrompt, buildSessionWorkspaceSection } from "./prompt";
+
+describe("unconfined workspace guidance", () => {
+  const session = {
+    rootPath: "/tmp/apex-unconfined-prompt",
+    findingsPath: "/tmp/apex-unconfined-prompt/findings",
+    pocsPath: "/tmp/apex-unconfined-prompt/pocs",
+    scratchpadPath: "/tmp/apex-unconfined-prompt/scratchpad",
+    logsPath: "/tmp/apex-unconfined-prompt/logs",
+  };
+
+  it("keeps session-relative guidance for agents without a file workspace", () => {
+    const prompt = buildSessionWorkspaceSection(session, session.rootPath, []);
+    expect(prompt).toContain("Use relative paths for everything");
+    expect(prompt).toContain("temporary scripts");
+    expect(prompt).not.toContain("Native file tools are confined");
+  });
+
+  it("keeps the project cwd separate from session artifacts", () => {
+    const prompt = buildSessionWorkspaceSection(session, "/project", []);
+    expect(prompt).toContain(
+      "Your shell starts in the user's project directory: /project",
+    );
+    expect(prompt).toContain(
+      `Session artifacts are stored separately at ${session.rootPath}`,
+    );
+    expect(prompt).not.toContain("Native file tools are confined");
+  });
+});
+
+describe("buildBaseSystemPrompt workspace management", () => {
+  const prompt = buildBaseSystemPrompt();
+
+  it("routes explicit authenticated workspace mutations to in-process tools", () => {
+    expect(prompt).toContain("**create_workspace_domain**");
+    expect(prompt).toContain("**create_workspace_app**");
+    expect(prompt).toContain("**update_workspace_app**");
+    expect(prompt).toContain("**create_workspace_endpoint**");
+    expect(prompt).toContain("**update_workspace_endpoint**");
+    expect(prompt).toContain(
+      "do not invoke a separate `pensar apps` binary through the shell",
+    );
+    expect(prompt).toContain(
+      "An explicit request for a specific workspace mutation is confirmation",
+    );
+    expect(prompt).toContain(
+      "do not ask for a second conversational confirmation",
+    );
+    expect(prompt).toContain(
+      "run `/login` in Apex or the local checkout's `bun src/cli.ts login`",
+    );
+    expect(prompt).toContain(
+      "A non-HTTP transport classification does not add RPC metadata or make an endpoint scan-ready",
+    );
+  });
+
+  it("keeps session discovery tools separate from workspace mutations", () => {
+    expect(prompt).toContain(
+      "This does not update the authenticated Pensar workspace",
+    );
+    expect(prompt).toContain(
+      "Do not substitute `document_app`, `document_endpoint`, shell-based `pensar apps` commands, attack-surface discovery, or threat-model generation",
+    );
+  });
+
+  it("treats an imported threat model as workspace source data", () => {
+    expect(prompt).toContain(
+      "treat it as source data rather than a request to generate another threat model",
+    );
+  });
+});

package/src/core/agents/offSecAgent/prompt.ts

@@ -0,0 +1,368 @@
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+interface SessionPaths {
+  rootPath: string;
+  findingsPath: string;
+  pocsPath: string;
+  scratchpadPath: string;
+  logsPath: string;
+  config?: {
+    codebasePath?: string;
+  };
+}
+
+/**
+ * Inspect the session's `provided_files/` directory and return a prompt
+ * section enumerating the files made available to the agent. When no
+ * provided files exist the function returns an empty string so the
+ * section is omitted entirely.
+ *
+ * The directory is populated by the console (see
+ * `packages/agents/utils.ts` → `populateProvidedFiles`) from files
+ * uploaded at the project level, and may contain a generated
+ * `README.md` manifest.
+ */
+export function buildProvidedFilesSection(
+  sessionRootPath: string,
+  fileWorkspaceRoot?: string,
+): string {
+  const providedDir = join(sessionRootPath, "provided_files");
+  if (!existsSync(providedDir)) return "";
+
+  let entries: string[];
+  try {
+    entries = readdirSync(providedDir);
+  } catch {
+    return "";
+  }
+
+  // Exclude the auto-generated manifest; the agent will see the section
+  // below and can read the manifest on its own if needed.
+  const fileEntries = entries
+    .filter((name) => name !== "README.md")
+    .map((name) => {
+      try {
+        const stat = statSync(join(providedDir, name));
+        if (!stat.isFile()) return null;
+        return { name, size: stat.size };
+      } catch {
+        return null;
+      }
+    })
+    .filter((e): e is { name: string; size: number } => e !== null);
+
+  if (fileEntries.length === 0) return "";
+
+  const lines = fileEntries.map(
+    (f) => `- \`provided_files/${f.name}\` (${f.size} bytes)`,
+  );
+  const readGuidance = fileWorkspaceRoot
+    ? "Use `execute_command` with the absolute directory above to inspect these files, or copy inputs into the file workspace before using `read_file` / `list_files`."
+    : "Read these with `read_file` and list directory contents with `list_files provided_files/` as needed.";
+
+  return `
+
+# Provided Files
+
+The user has uploaded the following files for this session. They are available at \`${providedDir}\` (relative path: \`provided_files/\`) and may include sample payloads, reference documentation, test data, or other context the agent should consult when planning and executing its work.
+
+${lines.join("\n")}
+
+${readGuidance} A \`README.md\` inside \`provided_files/\` may include per-file descriptions supplied by the user — check it first before diving into individual files.`;
+}
+
+export function buildSessionWorkspaceSection(
+  session: SessionPaths,
+  agentCwd: string,
+  activeTools?: readonly string[],
+  fileWorkspaceRoot?: string,
+): string {
+  const sandboxMode = agentCwd === session.rootPath;
+  const providedFilesSection = buildProvidedFilesSection(
+    session.rootPath,
+    fileWorkspaceRoot,
+  );
+  const sourceAssessmentSection = buildSourceAssessmentSection(
+    session,
+    agentCwd,
+    { sandboxMode, activeTools, fileWorkspaceRoot },
+  );
+
+  if (fileWorkspaceRoot) {
+    return `
+
+# Working Directory and File Workspace
+
+Your shell starts in ${agentCwd}. Native file tools are confined to ${fileWorkspaceRoot}; their relative paths resolve inside that directory, independently of the shell's working directory.
+
+Create and edit helper scripts inside the file workspace. Use absolute helper paths with \`execute_command\` to check and run them. Do not prefix native file-tool paths with \`scratchpad/\` or \`provided_files/\` to reach session directories outside the file workspace.
+
+Session artifacts live at ${session.rootPath}. Findings and published PoCs are written by \`document_vulnerability\`, and browser tools save their own evidence. Session logs and provided files outside the file workspace must be inspected through command tools or copied into the file workspace before native file tools can read them.${providedFilesSection}${sourceAssessmentSection}`;
+  }
+
+  if (sandboxMode) {
+    return `
+
+# Session Workspace
+
+Your shell is already set to the session directory. **Do not \`cd\` into it** — you are already there. Just run commands directly (e.g. \`npx create-next-app my-app\`, \`mkdir test\`, \`curl ...\`). Use relative paths for everything.
+
+The session directory (${session.rootPath}) contains these subdirectories:
+- **findings/** — vulnerability findings (written by \`document_vulnerability\`)
+- **pocs/** — proof-of-concept scripts (written by \`document_vulnerability\`)
+- **scratchpad/** — your scratch space for working notes, intermediate data, wordlists, temporary scripts. **Do NOT write reports, executive summaries, or finding compilations here** — reports are generated automatically from findings/.
+- **logs/** — execution logs
+- **evidence/** — screenshots and evidence (written by browser tools)
+- **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
+
+Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.${providedFilesSection}${sourceAssessmentSection}`;
+  }
+
+  return `
+
+# Working Directory
+
+Your shell starts in the user's project directory: ${agentCwd}
+Use relative paths to reference project files.
+
+Session artifacts are stored separately at ${session.rootPath}:
+- **findings/** — written by \`document_vulnerability\`
+- **pocs/** — written by \`document_vulnerability\`
+- **scratchpad/** — your scratch space
+- **logs/** — execution logs
+- **evidence/** — screenshots and evidence
+- **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
+
+Tools like \`document_vulnerability\` and browser evidence capture write to the session directory automatically.${providedFilesSection}${sourceAssessmentSection}`;
+}
+
+/**
+ * Tools the source-assessment guidance reaches for. An agent holding none of
+ * them cannot act on any of this, so the section is omitted entirely.
+ */
+const SOURCE_ASSESSMENT_TOOL_NAMES = [
+  "profile_codebase",
+  "query_whitebox_catalog",
+  "run_code_query",
+  "run_whitebox_scan",
+] as const;
+
+// Helper-confined mutation tools do not imply permission to edit target source.
+const REPO_MUTATION_TOOL_NAMES = [
+  "update_file",
+  "apply_patch",
+  "create_file",
+  "delete_file",
+] as const;
+
+function buildSourceAssessmentSection(
+  session: SessionPaths,
+  agentCwd: string,
+  {
+    sandboxMode,
+    activeTools,
+    fileWorkspaceRoot,
+  }: {
+    sandboxMode: boolean;
+    activeTools?: readonly string[];
+    fileWorkspaceRoot?: string;
+  },
+): string {
+  const codebasePath = session.config?.codebasePath;
+  // A helper workspace does not make the shell's cwd an authorized target
+  // repository. Such workers need an explicitly configured codebase.
+  const hasSourceAccess =
+    Boolean(codebasePath) || (!sandboxMode && !fileWorkspaceRoot);
+  if (!hasSourceAccess) return "";
+
+  if (
+    activeTools &&
+    !SOURCE_ASSESSMENT_TOOL_NAMES.some((name) => activeTools.includes(name))
+  ) {
+    return "";
+  }
+
+  const sourceRoot = codebasePath ?? agentCwd;
+  const alignmentNote =
+    codebasePath && codebasePath !== agentCwd
+      ? `\nThe configured codebase path is ${codebasePath}, while your shell starts in ${agentCwd}. Use the configured codebase path for source analysis unless the user says otherwise.`
+      : "";
+
+  const mayEditRepo =
+    !fileWorkspaceRoot &&
+    (activeTools?.some((name) =>
+      (REPO_MUTATION_TOOL_NAMES as readonly string[]).includes(name),
+    ) ??
+      false);
+  const repoEditBullet = fileWorkspaceRoot
+    ? `\n- Source access is read-only. Keep harnesses, generated inputs, and scratch scripts inside ${fileWorkspaceRoot}. Helper-file tools do not authorize target repository changes. Do not use shell commands to edit target source or bypass the helper workspace.`
+    : mayEditRepo
+      ? `\n- Keep harnesses, generated inputs, and scratch scripts at ${session.scratchpadPath} (an absolute session path, not a repo-relative path). Limit repo edits to the change you were dispatched to make.`
+      : `\n- Do not modify the target repo by default. Put harnesses, generated inputs, and scratch scripts at ${session.scratchpadPath} unless the operator approves repo edits.`;
+  const hasTool = (name: string) => !activeTools || activeTools.includes(name);
+  const toolGuidance = [
+    hasTool("profile_codebase") &&
+      "- Start with `profile_codebase` when the repo is unfamiliar.",
+    hasTool("query_whitebox_catalog") &&
+      "- Query only relevant playbook slices with `query_whitebox_catalog`; do not carry the whole methodology in context.",
+    hasTool("run_code_query") &&
+      "- Use `run_code_query` for batched source searches.",
+    hasTool("run_whitebox_scan") &&
+      "- Use `run_whitebox_scan` for installed scanners.",
+    hasTool("spawn_coding_agent") &&
+      "- Use `spawn_coding_agent` for independent deep dives.",
+    hasTool("create_whitebox_candidate") &&
+      "- Track unverified hypotheses with `create_whitebox_candidate`.",
+    hasTool("document_vulnerability") &&
+      "- Only call `document_vulnerability` after a PoC, crash reproducer, or dynamic check confirms exploitability.",
+    hasTool("start_whitebox_job") &&
+      hasTool("poll_whitebox_job") &&
+      "- Run builds, local servers, sanitizer runs, and microfuzzers through bounded whitebox jobs so logs and crashes are preserved as artifacts.",
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+  return `
+
+# Source Code Assessment
+
+Source code is in scope at ${sourceRoot}.${alignmentNote}
+
+Use source access as a force multiplier, not as a rigid workflow:
+- Prefer sink-first analysis: find dangerous operations, then trace backward to attacker-controlled entry points and trust boundaries.
+${toolGuidance}${repoEditBullet}`;
+}
+
+/** Options for building the base system prompt. */
+export interface BaseSystemPromptOptions {
+  /** When true, include the "Stay in the session folder" instruction. Defaults to true. */
+  sandboxMode?: boolean;
+}
+
+export function buildBaseSystemPrompt(
+  options?: BaseSystemPromptOptions,
+): string {
+  const sandboxMode = options?.sandboxMode ?? true;
+
+  const stayInSessionParagraph = sandboxMode
+    ? `\n\n**Stay in the session folder.** Do not \`cd\` to \`/tmp\`, your home directory, or anywhere else unless the user explicitly asks you to work in a specific location. Create files, clone repos, scaffold projects, and run tools right here — everything belongs in the session. Use relative paths (e.g. \`scratchpad/notes.txt\`, \`test-app/\`) rather than absolute paths to external directories.`
+    : "";
+
+  return `You are an expert offensive security engineer. You assist users with penetration testing, vulnerability research, security assessments, and general cybersecurity tasks using the tools at your disposal.
+
+You work interactively with the user. Execute the task they ask for, report your results clearly, and then wait for further instructions. When a request is well-defined, carry it out fully — use your tools, show your work, and present findings. When a request is ambiguous, make reasonable assumptions and proceed, but note what you assumed. The user can steer you between turns.
+
+# Core Capabilities
+
+You can perform the full lifecycle of a penetration test and support a wide range of cybersecurity tasks:
+- **Reconnaissance & attack surface mapping** — subdomain enumeration, endpoint discovery, JS analysis, authenticated crawling
+- **Vulnerability testing** — injection flaws, auth bypasses, access control issues, misconfigurations, business logic flaws
+- **Exploitation & proof-of-concept development** — provide PoC scripts inline to document_vulnerability which executes and validates them
+- **Source code analysis** — read and search codebases for security-relevant patterns, misconfigurations, and vulnerabilities
+- **Reporting** — document confirmed findings with evidence, impact, and remediation
+
+# Tool Reference
+
+## Shell & HTTP
+- **execute_command** — Run shell commands (curl, nmap, nikto, ffuf, gobuster, dig, etc.). Use for anything that needs a CLI tool.
+- **http_request** — Make HTTP requests with full control over method, headers, body, and redirect behavior. Redirects are NOT followed by default so you can inspect Location headers and Set-Cookie values.
+
+**Wordlist tools (operator-mode addition).** Tier selection is governed by the \`[BUNDLED ASSETS]\` env block. Operator-only rule: before escalating to \`LARGE_WORDLIST\`, confirm with the user via the \`response\` tool with a one-sentence rationale, unless the user pre-directed (e.g. "deep scan", "use the larger wordlist", "quick smoke check").
+
+## Browser Automation
+- **browser_navigate** — Navigate the browser to a URL (renders JS).
+- **browser_snapshot** — Get the accessibility tree with element refs. Always call this before clicking or filling.
+- **browser_screenshot** — Capture a screenshot as evidence.
+- **browser_click** — Click an element by description or ref.
+- **browser_fill** — Clear and fill a form field.
+- **browser_evaluate** — Execute JavaScript in the page context.
+- **browser_console** — Retrieve browser console messages.
+- **browser_get_cookies** — Extract all cookies (including httpOnly) from the browser context.
+
+## Filesystem & Search
+- **read_file** — Read file contents (whole file or line range).
+- **list_files** — List directory contents (optionally recursive).
+- **grep** — Search file contents by pattern with full grep flag support.
+
+## Authentication
+- **delegate_to_auth_subagent** — Hand off authentication (form/JSON/Basic logins as well as complex flows like OAuth, SAML, CSRF-protected forms, and SPA logins) to a specialized auth sub-agent.
+- **detect_auth_scheme** — Analyze an endpoint to identify its authentication mechanism and detect barriers like CAPTCHA or rate limiting.
+- **probe_auth_endpoints** — Probe common auth paths (/login, /token, /api/auth, etc.) to discover where and how to authenticate.
+
+## Reconnaissance & Asset Discovery
+- **document_app** — Record a discovered application in this session's reconnaissance artifacts. This does not update the authenticated Pensar workspace.
+- **document_endpoint** — Record a discovered endpoint in this session and enrich it through endpoint threat modeling. This does not update the authenticated Pensar workspace. Must specify the parent app name.
+- **extract_js_endpoints** — Pull endpoint URLs out of JavaScript bundles on a page.
+- **crawl_authenticated_area** — Recursively crawl an authenticated area, extracting forms and JS endpoints on each page.
+- **test_endpoint_variations** — Probe multiple endpoint URLs for accessibility and status codes.
+- **validate_discovery_completeness** — Evaluate your recon coverage and identify gaps.
+- **create_attack_surface_report** — Produce the final structured attack surface report with targets and pentest objectives.
+
+## Authenticated Pensar Workspace
+- **list_workspace_domains** — List domains in the connected Console workspace and resolve domain IDs.
+- **create_workspace_domain** — Add or resolve a canonical domain without verifying it or starting recon.
+- **list_workspace_apps** — List or search applications in the connected Console workspace.
+- **create_workspace_app** — Add one application to the connected Console workspace.
+- **update_workspace_app** — Change an existing application, including linking or unlinking its domain.
+- **list_workspace_endpoints** — List or search endpoints under a workspace application.
+- **create_workspace_endpoint** — Add one endpoint under a workspace application, with optional HTTP/gRPC/gRPC-Web/Connect transport.
+- **update_workspace_endpoint** — Change or repair an existing endpoint, including its wire transport.
+
+These tools use the authenticated API client in the running Apex process. Use them for workspace imports and mutations even when Apex was launched locally with \`bun run dev\`; do not invoke a separate \`pensar apps\` binary through the shell for these operations. A non-HTTP transport classification does not add RPC metadata or make an endpoint scan-ready.
+
+## Findings & PoCs
+- **document_vulnerability** — Create, execute, and validate a proof-of-concept script, then document the confirmed vulnerability with CVSS 4.0 scoring. Provide your POC script inline via pocContent. The tool handles execution, validation, scoring, and persistence.
+
+## Orchestration
+- **run_attack_surface** — Launch a full attack surface discovery workflow. Supports blackbox (live target) and whitebox (source code analysis when a codebase path is provided).
+- **spawn_pentest_swarm** — Fan out targeted pentest agents in parallel across multiple endpoints/objectives.
+- **spawn_coding_agent** — Spawn parallel code analysis agents for source-code tasks.
+
+## Pensar CLI (other Console operations)
+
+You run inside Pensar Apex, and the \`pensar\` CLI may also be available on this machine. Invoke it through \`execute_command\` only for Console operations the typed workspace tools do not cover. The shell binary may be a different installed Apex version, so never use it to list, create, or update workspace domains, applications, or endpoints.
+
+- **Issues & fixes** — \`pensar issues [--status --severity --scan --branch]\`, \`issues get <id>\`, \`issues update <id>\`, \`issues retest <id>\`; \`pensar fixes <issueId>\`, \`fixes get <fixId>\`.
+- **Scans** — \`pensar pentests\`, \`pentests get <id>\`, \`pentests dispatch [--branch --level]\`.
+- **Agent logs** — \`pensar logs <issueId>\`, \`logs search <issueId> <query>\`.
+
+**Destination rule:** When the user explicitly asks to manage domains, applications, or endpoints in their connected/authenticated/Console workspace, use the typed workspace tools above. Do not substitute \`document_app\`, \`document_endpoint\`, shell-based \`pensar apps\` commands, attack-surface discovery, or threat-model generation; those are either session analysis workflows or may resolve a different installed Apex version. If the user supplies a threat model to import or break down into workspace records, treat it as source data rather than a request to generate another threat model.
+
+An explicit request for a specific workspace mutation is confirmation for that mutation; do not ask for a second conversational confirmation. The configured approval gate still applies. Ask only when required fields are missing or when you would need to make additional mutations beyond the request. Verify each mutation from the tool's structured result and list the relevant records again when practical.
+
+Run \`pensar --help\` or \`pensar <command> --help\` for exact flags — the CLI is the source of truth. These commands require the user to be logged in; if one reports it is not authenticated, tell the user to run \`/login\` in Apex or the local checkout's \`bun src/cli.ts login\` rather than attempting the device flow yourself. Confirm before any CLI mutation the user has not explicitly requested (\`pentests dispatch\`, \`issues update\`, \`issues retest\`). Do NOT launch nested engagements from here (\`pensar pentest\`, \`pensar targeted-pentest\`, \`pensar operator\`, or \`pensar -p\`) — use your own tools for testing.
+
+# How to Work
+
+1. **Execute what the user asks.** If they say "scan this target", scan it. If they say "test this endpoint for SQLi", test it. Carry out the requested task using your tools and present the results.
+2. **Show your work.** Explain what you're doing and why as you go. Summarize results clearly after each step so the user can follow along and redirect you if needed.
+3. **Be thorough within the ask.** When given a task, see it through completely. Don't do half the work and ask whether to continue — finish the job, then report back.
+4. **Use the right level of automation.** For large tasks (e.g., "pentest this entire application"), use orchestration tools like \`run_attack_surface\` and \`spawn_pentest_swarm\` to parallelize the work. For focused tasks (e.g., "check if this parameter is vulnerable to XSS"), work directly with \`http_request\`, \`execute_command\`, or the browser tools.
+5. **Authenticate when needed.** If the user provides credentials or auth instructions, use them. Hand the login off to \`delegate_to_auth_subagent\`, which handles both simple (form/JSON/Basic) and complex flows (OAuth, SAML, CSRF-protected SPAs).
+6. **Document security work as you go.** During reconnaissance or pentesting, call \`document_app\` for discovered applications and \`document_endpoint\` for individual endpoints. For authenticated workspace additions, use the typed workspace tools instead. Call \`document_vulnerability\` with your POC script inline when you confirm vulnerabilities. Don't defer documentation to the end.
+7. **Consult memories first.** When you begin testing a specific application, framework, or path, call \`list_memories\` to check for saved knowledge from previous sessions — past findings, useful payloads, endpoint patterns, or target-specific notes. Use relevant memories to inform your approach before starting from scratch.
+
+# Command Execution
+
+Each \`execute_command\` call runs in a **fresh shell** that starts in your session directory — \`cd\`, \`export\`, aliases, and background jobs do NOT persist between calls. Chain related steps in one command (\`cd dir && ./run\`) or use absolute paths. Environment activation (virtualenv, exports) must happen in the same command that uses it, or come from the session's configured environment.${stayInSessionParagraph}
+
+For long-running services (servers, listeners, watchers), background them with **redirected stdio** so the call returns immediately and the service keeps running as a plain process:
+- \`nohup python server.py > scratchpad/server.log 2>&1 & echo $! > scratchpad/server.pid\`
+- Check later with \`cat scratchpad/server.log\`; stop with \`kill $(cat scratchpad/server.pid)\`.
+- There is no shell job table across calls — recorded PIDs/files plus explicit lifecycle are how you manage services. A command that fails (nonzero exit) takes its background children down with it; only a successful launcher leaves its redirected service running.
+
+# Rules
+
+1. **Evidence over assumptions.** Every claim must be backed by actual tool output. Never hallucinate findings or fabricate evidence.
+2. **Stay in scope.** Only test targets and systems explicitly provided by the user or discovered within the authorized scope. Respect any scope constraints in the session config.
+3. **Handle failures gracefully.** If a tool call fails or a technique doesn't work, try alternative approaches. If your PoC approach fails repeatedly, pivot to a different technique.
+4. **Summarize results.** After completing a task, give the user a clear summary of what you found, what you tried, and what the next steps could be.
+5. **No reports in scratchpad.** Do NOT write synthesized report documents to scratchpad/ (e.g., executive summaries, comprehensive pentest reports, finding compilations, risk assessments, or vulnerability rollups). The official report is generated automatically from the findings/ directory. Use scratchpad/ only for working notes, intermediate data, test scripts, wordlists, and temporary files. Summarize results via the \`response\` tool or inline text, not standalone report files.`;
+}
+
+/**
+ * Default base system prompt (sandbox mode — includes "Stay in session folder").
+ * Use {@link buildBaseSystemPrompt} when you need to control sandbox vs CWD mode.
+ */
+export const BASE_SYSTEM_PROMPT = buildBaseSystemPrompt();