Merge pull request #235 from BaaRai/docs/upstream-changelog

docs: credit the upstream and complete the unreleased changelog

CHANGELOG.md

@@ -6,11 +6,40 @@ All notable changes to this project are documented in this file. The format is b
 
 ### Added
 
-- **Noise profile at runtime**: System settings has a **Target noise** card. It sets the profile (`off`, `quiet`, `balanced`, `aggressive`) through the `noise_profile` setting, which takes precedence over `ARTEX_NOISE_PROFILE`. The change applies to the next WebFetch, http custom tool and enrich request, and to the next agent prompt, without a restart. The card also shows the per-host counters, which `GET /api/settings/noise` returns.
+- **Target noise governor**: one shared egress governor paces ARTEX's own HTTP requests (WebFetch, the http custom tools and the enrich probe) against a noise profile (`off` by default, `quiet`, `balanced`, `aggressive`): a per-host token bucket with jitter, per-host and global in-flight caps, 429/503 backoff, GET deduplication with a short cache, and a configurable target User-Agent (`ARTEX_TARGET_USER_AGENT`). Off is a strict passthrough (#205).
+- **Low-and-slow prompt block**: when a noise profile is set, the planner, worker, main agent and chat prompts carry the per-host limits of the profile and the exact rate or delay flags for nmap, nuclei, httpx, katana, ffuf, dalfox and sqlmap; with the profile off the prompts are unchanged (#212).
+- **Noise profile at runtime**: System settings has a **Target noise** card. It sets the profile (`off`, `quiet`, `balanced`, `aggressive`) through the `noise_profile` setting, which takes precedence over `ARTEX_NOISE_PROFILE`. The change applies to the next WebFetch, http custom tool and enrich request, and to the next agent prompt, without a restart. The card also shows the per-host counters, which `GET /api/settings/noise` returns (#233).
+- **Bash requests paced through the capture proxy**: with traffic capture on, the Bash proxy URL carries a marker userinfo. The recording proxy paces each request of a marked connection by the noise profile's per-host rate and jitter, and counts it, before it goes upstream. This applies inside CONNECT tunnels too. WebFetch, the http custom tools and enrich keep the unmarked URL and are not paced twice. The proxy now drops `Proxy-Authorization` from every request it forwards or records. This is best effort: only clients that honour the proxy are covered, with capture on (#234).
+- **Hierarchical budgets**, off by default: a task budget and a per-intent budget take the minimum of their own budget and the parent's remaining budget above the wrap-up reserve, planner calls count inside the task, and reaching the reserve forces a wrap-up (#206).
+- **Coverage ledger**: the worker records what it examined, ruled out or left open for each surface and risk class with `record_coverage`; gaps, unexamined classes and completeness appear in the planner context, `GET /api/tasks/{id}/coverage`, the coverage card and the Markdown report (#207).
+- **Closed-question judge**: the LLM fallback judge answers eight fixed questions that the code owns and the code takes the decision; every failure now leads to ask instead of allow, and the previous behaviour stays available as `llm_judge_mode = freeform` (#208).
+- **argv interception rules**: a new `match_type = argv` matches the parsed prefix of a Bash command exactly, and a pending Bash approval can create such a rule in one click; a code-owned denylist refuses programs where a prefix would allow arbitrary code (#210, #211).
+- **Scanner output ingestion**: `ingest_scan_output` parses nmap XML, nuclei JSONL, httpx JSONL and ffuf JSON, and writes assets and facts deterministically, so the model never reads the raw output (#214, #215).
+- **bbot ingestion**: a typed parser splits bbot JSONL events by `scope_distance`, only in-scope events go through `insert_assets`, and `ingest_bbot` reads the file line by line with a 64 KiB cap (#199, #200).
+- **Tool RAG**, off by default: when the bound tool list of an agent is large, only the subset relevant to the current intent is injected, as a projection that never adds or edits a tool (`ARTEX_TOOL_RAG`) (#204).
+- **Fact provenance**: `record_fact` takes a closed `source` enum (default `inference`) and every fact carries the server-set `origin`, both shown in `recent_facts`, `list_facts` and `expand_digest` (#194).
+- **Per-message nonce envelope**: agent- and target-derived fields reach the planner and worker user messages inside a code-owned data envelope with a random nonce per message; operator input stays outside it (#195).
+- **Intercept risk score and batch approval**: a deterministic risk score (low, medium, high) is shown on each pending approval, and up to 100 pending decisions can be settled in one call, each through the existing single-decision path (#232).
+- **`ask_operator` target warning**: a request whose question names a host or URL outside the goal targets is tagged as containing target-derived text (#197).
+- **Opt-in update banner**: `ARTEX_UPDATE_CHECK` makes the backend check the latest GitHub release at most once per 24 hours and the UI show a banner; off by default (#202).
+- **Release provenance**: release archives carry GitHub build provenance attestations and a CycloneDX SBOM (`gh attestation verify <zip> --repo BaaRai/ARTEX`); release notes are the matching `CHANGELOG.md` section (#219, #201).
 
 ### Changed
 
-- **Untrusted-output boundary is now on by default**: Norma frames tool results for the worker, planner, chat and main agent unless `ARTEX_UNTRUSTED_BOUNDARY` is set to `0`, `false`, `off` or `no`. It was opt-in via `ARTEX_UNTRUSTED_BOUNDARY=1` in 0.6.0 (#166).
+- **Untrusted-output boundary is now on by default**: Norma frames tool results for the worker, planner, chat and main agent unless `ARTEX_UNTRUSTED_BOUNDARY` is set to `0`, `false`, `off` or `no`. It was opt-in via `ARTEX_UNTRUSTED_BOUNDARY=1` in 0.6.0 (#166); the default flips here (#203).
+- **Versioned migrations**: the `db` package applies numbered `db/migrations/NNNN_slug.sql` files once, in order, under the schema advisory lock, and records a SHA-256 checksum in `schema_migrations`; missing, renamed, changed or out-of-order migrations fail closed (#226).
+- **Coverage graph performance**: the coverage graph batches its connector lookups (three queries instead of one per root and per company) and adds the partial index `idx_ts_icp`; on a task of about 3,000 assets the p50 dropped from 126 ms to 27 ms and the queries per call from 221 to 3 (#230).
+
+### Fixed
+
+- **Auto-scope hygiene**: auto `task_scope` rows count for coverage and untested assets only under a declared root, and direct coverage counts anchored assets through fact anchors only; the scope is described as "coverage scope, not enforced" (#196).
+- **Enrich HTTP probe**: it now dials through `intercept.PinnedDialer`, so the target gate applies and a probe without a target scope is refused (#198).
+- **Agent hook data races**: the eight package-level hooks are synchronised, so a second wire-up no longer races tasks that already read them (#227).
+
+### Security
+
+- **Secrets at rest**: the credential-bearing columns and settings (LLM API keys and proxy, task credentials, MCP server env, notification channel config, search and proxy settings), the exec spec of custom tools and the evidence snapshot heads are encrypted in PostgreSQL with AES-256-GCM (`enc:v1:`) using `ARTEX_SECRET_KEY`, else `keys/secret.key`; existing plaintext rows are backfilled once at startup, and a missing or wrong key while encrypted data exists refuses to start. This protects database dumps and backups, not a running instance (#213, #216, #217, #218).
+- **URL credentials are dropped before storage**: scan and bbot ingestion, the asset store and archive restore strip URL userinfo, so `https://user:pass@host/app` is stored and matched as `https://host/app` (#222, #223, #224).
 
 ## [0.6.0] - 2026-11-12
 

README.md

@@ -6,6 +6,8 @@
 
 **Autonomous penetration testing that keeps its receipts.**
 
+(upstream: [Autumn-27/ARTEX](https://github.com/Autumn-27), AGPL-3.0)
+
 Self-hosted multi-agent offensive security. A planner explores, workers run real tools,
 and every finding stays bound to the assets and HTTP traffic that prove it.
 
@@ -405,8 +407,13 @@ flight), `aggressive` = 20 req/s (burst 40, 4 in flight). A profile adds jitter,
 429/503 (honours `Retry-After`, bounded retries, GET/HEAD/OPTIONS only), deduplicates identical
 in-flight GETs and caches them briefly (60/30/10 s; never POST/PUT/PATCH/DELETE), and logs a
 per-host noise line each minute. `ARTEX_TARGET_USER_AGENT` sets a User-Agent on target requests
-that carry none. Bash-launched tools are not paced yet; the low-and-slow prompt block supplies
-their rate flags.
+that carry none. With traffic capture on, Bash commands that use the proxy (curl, wget,
+python-requests) are paced too, per host by the same rate and jitter, and counted in the same
+per-host lines. The in-flight caps, retries and cache apply only to ARTEX's own requests. This is
+best effort, not a security boundary. Raw scanners such as nmap are not paced, and neither is a
+command that bypasses the proxy (`--noproxy`, a removed proxy variable). With capture off,
+nothing launched from Bash is paced. The low-and-slow prompt block supplies the rate flags in
+every case.
 The **Target noise** card in System settings sets the profile at runtime (no restart) and shows the
 per-host counters; once saved, that setting takes precedence over `ARTEX_NOISE_PROFILE`.
 
@@ -688,6 +695,12 @@ Operational security properties:
 
 ---
 
+## About this fork
+
+This repository is the English translation and continuation of ARTEX, originally by [Autumn-27](https://github.com/Autumn-27). The upstream repository is no longer public, so the link points to the author profile. Changes in this fork are tracked in [CHANGELOG.md](CHANGELOG.md), under the same AGPL-3.0 license.
+
+---
+
 ## References and prior art
 
 - [Cairn](https://github.com/oritera/Cairn)

agent/noise_profile.go

@@ -64,6 +64,6 @@ func renderNoiseProfile(p egress.Profile) string {
 	fmt.Fprintf(&b, "- sqlmap: --delay=%s --threads=1\n", delaySec)
 	fmt.Fprintf(&b, "For any other tool, stay at or below %d requests per second per host, at most %s in flight, and at least %d ms between requests, using the tool's own rate or delay flag. Keep bbot within the same limits with its own rate settings, and do not enable active modules the program policy does not allow.\n", rps, inFlight, delayMS)
 	b.WriteString("Prefer passive and read-only checks; test one host at a time; do not run two scanners against the same host in parallel; on 429 or 503 stop and back off; never raise the rate to meet a deadline.\n")
-	b.WriteString("ARTEX paces its own WebFetch, http custom tool and enrich traffic with this profile, but commands launched through Bash are not paced: these flags are the only brake.\n")
+	b.WriteString("ARTEX paces its own WebFetch, http custom tool and enrich traffic with this profile. With traffic capture on, Bash commands that use the capture proxy (curl, wget, python-requests) are paced too, by rate and jitter; raw scanners such as nmap and commands that bypass the proxy are not. These flags remain the brake: do not rely on the proxy.\n")
 	return b.String()
 }

agent/noise_profile_test.go

@@ -41,7 +41,7 @@ func TestRenderNoiseProfileTable(t *testing.T) {
 			fmt.Sprintf("- dalfox scan: --rate-limit %d --workers %d", c.rps, c.conc),
 			fmt.Sprintf("- sqlmap: --delay=%s --threads=1", c.sql),
 			fmt.Sprintf("at least %d ms between requests", c.delay),
-			"commands launched through Bash are not paced",
+			"ARTEX paces its own WebFetch, http custom tool and enrich traffic with this profile. With traffic capture on, Bash commands that use the capture proxy (curl, wget, python-requests) are paced too, by rate and jitter; raw scanners such as nmap and commands that bypass the proxy are not. These flags remain the brake: do not rely on the proxy.",
 		} {
 			if !strings.Contains(got, want) {
 				t.Errorf("%s: missing %q in:\n%s", c.name, want, got)

agent/proxyenv_test.go

@@ -49,3 +49,26 @@ func TestProxyEnvInjectsCAWhenRecording(t *testing.T) {
 		}
 	}
 }
+
+// Only the recording proxy (a CA is present) gets the pace marker; the global
+// proxy of the capture-off path is passed as configured.
+func TestProxyEnvMarksOnlyTheRecordingProxy(t *testing.T) {
+	proxyVars := map[string]bool{"HTTP_PROXY": true, "HTTPS_PROXY": true, "ALL_PROXY": true}
+	check := func(env []string, want, what string) {
+		t.Helper()
+		n := 0
+		for _, e := range env {
+			if k, v, _ := strings.Cut(e, "="); proxyVars[strings.ToUpper(k)] {
+				n++
+				if v != want {
+					t.Errorf("%s: %s, want %s", what, e, want)
+				}
+			}
+		}
+		if n != 6 {
+			t.Errorf("%s: %d proxy variables, want 6", what, n)
+		}
+	}
+	check(proxyEnv("http://127.0.0.1:8788", "/data/ca.pem"), "http://artex-pace:artex-pace@127.0.0.1:8788", "capture on")
+	check(proxyEnv("http://u:p@10.0.0.1:3128", ""), "http://u:p@10.0.0.1:3128", "capture off")
+}

agent/worker.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/egress"
 	"github.com/Autumn-27/artex/intercept"
 	"github.com/Autumn-27/norma/agentcore"
 	"github.com/Autumn-27/norma/harness"
@@ -212,10 +213,19 @@ func (w *Worker) SetWebSearch(o WebSearchOpts) { w.webSearch = o }
 // honor the proxy vars. ALL_PROXY is set too so a socks5 egress proxy (which curl
 // only reads from ALL_PROXY, not HTTP(S)_PROXY) works in the capture-off path.
 // Empty proxyAddr → nil (direct, unchanged env).
+//
+// With a MITM CA (capture on) the proxy URL carries the pace marker userinfo
+// (egress.MarkProxyURL): the recording proxy then paces this connection's
+// requests by the noise profile. Only Bash gets the marker; WebFetch, the http
+// custom tools and enrich keep the plain URL, since egress paces them already.
+// The global proxy (capture off) is left as configured.
 func proxyEnv(proxyAddr, caCert string) []string {
 	if proxyAddr == "" {
 		return nil
 	}
+	if caCert != "" {
+		proxyAddr = egress.MarkProxyURL(proxyAddr)
+	}
 	env := []string{
 		"HTTP_PROXY=" + proxyAddr, "HTTPS_PROXY=" + proxyAddr,
 		"http_proxy=" + proxyAddr, "https_proxy=" + proxyAddr,

egress/pace.go

@@ -0,0 +1,67 @@
+package egress
+
+import (
+	"context"
+	"encoding/base64"
+	"net/url"
+	"strings"
+)
+
+// Bash commands reach targets through the recording proxy, outside the clients
+// this package governs. With traffic capture on, the proxy URL in their
+// environment carries a marker userinfo (MarkProxyURL). The proxy paces each
+// request of a marked client connection with Wait, and leaves unmarked
+// connections alone: WebFetch, the http custom tools and the enrich probe use
+// the plain proxy URL and are already paced by their governor, so no request
+// is paced twice. Best effort, not a security boundary: a command that ignores
+// the proxy, or drops the marker, is not paced.
+
+// PaceUser is the user and password of the marker userinfo.
+const PaceUser = "artex-pace"
+
+// MarkProxyURL returns raw with the marker userinfo. raw is returned unchanged
+// when it does not parse or already carries a userinfo.
+func MarkProxyURL(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" || u.User != nil {
+		return raw
+	}
+	u.User = url.UserPassword(PaceUser, PaceUser)
+	return u.String()
+}
+
+// IsPaceMarker reports whether a Proxy-Authorization value is Basic
+// credentials for PaceUser.
+func IsPaceMarker(proxyAuthorization string) bool {
+	scheme, enc, ok := strings.Cut(strings.TrimSpace(proxyAuthorization), " ")
+	if !ok || !strings.EqualFold(scheme, "Basic") {
+		return false
+	}
+	dec, err := base64.StdEncoding.DecodeString(strings.TrimSpace(enc))
+	if err != nil {
+		return false
+	}
+	user, _, _ := strings.Cut(string(dec), ":")
+	return user == PaceUser
+}
+
+// Wait paces one request to hostKey under the current profile. See
+// Governor.Wait.
+func Wait(ctx context.Context, hostKey string) error { return Current().Wait(ctx, hostKey) }
+
+// Wait takes a token of the host's bucket plus the jitter, as a governed request
+// does, and counts the request in the host's noise counter. It takes no
+// in-flight slot, and nothing is cached, coalesced or retried. Off, it returns
+// at once and counts nothing. An error means ctx ended first; the request is
+// counted either way, since the caller sends it regardless.
+func (g *Governor) Wait(ctx context.Context, hostKey string) error {
+	if g.off() {
+		return nil
+	}
+	h := g.host(hostKey)
+	err := sleep(ctx, g.reserve(h)+g.jitter())
+	g.mu.Lock()
+	h.sent++
+	g.mu.Unlock()
+	return err
+}

egress/pace_test.go

@@ -0,0 +1,85 @@
+package egress
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestMarkProxyURL(t *testing.T) {
+	for in, want := range map[string]string{
+		"http://127.0.0.1:8788":            "http://artex-pace:artex-pace@127.0.0.1:8788",
+		"http://u:p@127.0.0.1:8788":        "http://u:p@127.0.0.1:8788",
+		"":                                 "",
+		"127.0.0.1:8788":                   "127.0.0.1:8788",
+		"socks5://proxy.example.test:1080": "socks5://artex-pace:artex-pace@proxy.example.test:1080",
+	} {
+		if got := MarkProxyURL(in); got != want {
+			t.Errorf("MarkProxyURL(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestIsPaceMarker(t *testing.T) {
+	enc := func(s string) string { return base64.StdEncoding.EncodeToString([]byte(s)) }
+	for v, want := range map[string]bool{
+		"Basic " + enc("artex-pace:artex-pace"):  true,
+		"basic " + enc("artex-pace:x"):           true,
+		"Basic " + enc("user:pass"):              false,
+		"Bearer " + enc("artex-pace:artex-pace"): false,
+		"Basic !!!":                              false,
+		"Basic":                                  false,
+		"":                                       false,
+	} {
+		if got := IsPaceMarker(v); got != want {
+			t.Errorf("IsPaceMarker(%q) = %v, want %v", v, got, want)
+		}
+	}
+}
+
+func TestWait(t *testing.T) {
+	if err := New(Profile{Name: "off"}).Wait(t.Context(), "a.example"); err != nil {
+		t.Fatalf("off Wait: %v", err)
+	}
+	off := New(Profile{Name: "off"})
+	_ = off.Wait(t.Context(), "a.example")
+	if s := off.Snapshot(); len(s) != 0 {
+		t.Fatalf("off counted: %v", s)
+	}
+
+	// 10 req/s, burst 1, no jitter: the second Wait takes ~100 ms.
+	g := New(Profile{Name: "test", RPS: 10, Burst: 1, MaxPerHost: 1, MaxGlobal: 1})
+	start := time.Now()
+	for range 2 {
+		if err := g.Wait(t.Context(), "a.example"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if d := time.Since(start); d < 80*time.Millisecond {
+		t.Fatalf("two Waits at 10 req/s took %v", d)
+	}
+	if s := g.Snapshot(); len(s) != 1 || s[0].RPM != 2 || s[0].Inflight != 0 || s[0].PeakInflight != 0 {
+		t.Fatalf("snapshot after Wait = %+v, want rpm 2 and no in-flight slot", s)
+	}
+
+	// A wait past the context's end returns its error and still counts.
+	slow := New(Profile{Name: "test", RPS: 0.5, Burst: 1, MaxPerHost: 1, MaxGlobal: 1})
+	_ = slow.Wait(t.Context(), "b.example")
+	ctx, cancel := context.WithTimeout(t.Context(), 20*time.Millisecond)
+	defer cancel()
+	if err := slow.Wait(ctx, "b.example"); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("bounded Wait: %v, want DeadlineExceeded", err)
+	}
+	if s := slow.Snapshot(); len(s) != 1 || s[0].RPM != 2 {
+		t.Fatalf("snapshot after a timed-out Wait = %+v, want rpm 2", s)
+	}
+
+	// The package Wait uses the current profile.
+	keepProfile(t)
+	SetProfile(Profile{Name: "off"})
+	if err := Wait(t.Context(), "c.example"); err != nil || len(Current().Snapshot()) != 0 {
+		t.Fatalf("package Wait under off: err=%v snapshot=%v", err, Current().Snapshot())
+	}
+}

traffic/pace.go

@@ -0,0 +1,63 @@
+package traffic
+
+import (
+	"context"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/Autumn-27/artex/egress"
+	mproxy "github.com/lqqyt2423/go-mitmproxy/proxy"
+)
+
+// paceWaitMax bounds the pacing wait of one request. Past it the request is
+// sent unpaced: pacing never blocks a command indefinitely.
+const paceWaitMax = 30 * time.Second
+
+// Requestheaders runs for every request the proxy sees: the CONNECT that opens
+// a tunnel, each request inside an intercepted tunnel, and each plain-HTTP
+// request. The recording proxy takes no credentials, so a Proxy-Authorization
+// header is only ever meant for it (clients send the proxy URL's userinfo
+// there): it is dropped here, before anything is forwarded, and never reaches
+// the target or the recording. When it carries the pace marker
+// (egress.PaceUser), the client connection is marked; every request on it,
+// including those inside its tunnel, is then paced by the current noise
+// profile before it goes upstream. Unmarked connections are not paced here.
+func (s *sink) Requestheaders(f *mproxy.Flow) {
+	if f.Request == nil || f.ConnContext == nil || f.ConnContext.ClientConn == nil {
+		return
+	}
+	id := f.ConnContext.ClientConn.Id
+	if egress.IsPaceMarker(f.Request.Header.Get("Proxy-Authorization")) {
+		s.paced.Store(id, struct{}{})
+	}
+	f.Request.Header.Del("Proxy-Authorization")
+	if f.Request.Method == http.MethodConnect || f.Request.URL == nil {
+		return
+	}
+	if _, marked := s.paced.Load(id); marked {
+		pace(f)
+	}
+}
+
+// ClientDisconnected forgets a closed connection's mark.
+func (s *sink) ClientDisconnected(c *mproxy.ClientConn) {
+	if c != nil {
+		s.paced.Delete(c.Id)
+	}
+}
+
+// pace waits for the request's host under the current noise profile, bounded
+// by paceWaitMax and by the request's own context. Off returns at once.
+func pace(f *mproxy.Flow) {
+	ctx := context.Background()
+	if raw := f.Request.Raw(); raw != nil {
+		ctx = raw.Context()
+	}
+	ctx, cancel := context.WithTimeout(ctx, paceWaitMax)
+	defer cancel()
+	host := egress.HostKey(f.Request.URL)
+	if err := egress.Wait(ctx, host); err != nil {
+		log.Printf("[traffic] pacing a Bash request to %s stopped waiting (%v); sending it unpaced", host, err)
+	}
+}

traffic/pace_test.go

@@ -0,0 +1,262 @@
+package traffic
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/egress"
+	mproxy "github.com/lqqyt2423/go-mitmproxy/proxy"
+)
+
+// startProxy runs a real recording proxy on a free loopback port and returns it
+// with its sink and URL. extra addons run after the recording sink.
+func startProxy(t *testing.T, extra ...mproxy.Addon) (*Traffic, *sink, string) {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	addr := ln.Addr().String()
+	ln.Close()
+	tr, err := Open(t.TempDir(), addr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := tr.proxy.Addons[0].(*sink)
+	for _, a := range extra {
+		tr.proxy.AddAddon(a)
+	}
+	go func() { _ = tr.Start() }()
+	t.Cleanup(func() {
+		_ = tr.proxy.Close()
+		_ = tr.Close()
+	})
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		c, err := net.Dial("tcp", addr)
+		if err == nil {
+			c.Close()
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("proxy did not listen on %s: %v", addr, err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return tr, s, "http://" + addr
+}
+
+// proxyClient is a curl-like client: it sends the proxy URL's userinfo as
+// Proxy-Authorization on CONNECT and on plain-HTTP requests, and trusts the CA.
+func proxyClient(t *testing.T, tr *Traffic, proxyURL string) *http.Client {
+	t.Helper()
+	pem, err := os.ReadFile(tr.CACertPath())
+	if err != nil {
+		t.Fatal(err)
+	}
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(pem) {
+		t.Fatal("no CA in", tr.CACertPath())
+	}
+	u, _ := url.Parse(proxyURL)
+	return &http.Client{Transport: &http.Transport{Proxy: http.ProxyURL(u), TLSClientConfig: &tls.Config{RootCAs: pool}}}
+}
+
+// probe records the ClientConn of each request the proxy sees, after the sink.
+type probe struct {
+	mproxy.BaseAddon
+	mu   sync.Mutex
+	conn map[string]string // "METHOD url" -> ClientConn.Id
+}
+
+func (p *probe) Requestheaders(f *mproxy.Flow) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.conn == nil {
+		p.conn = map[string]string{}
+	}
+	p.conn[f.Request.Method+" "+f.Request.URL.String()] = f.ConnContext.ClientConn.Id.String()
+}
+
+func get(t *testing.T, c *http.Client, u string) {
+	t.Helper()
+	resp, err := c.Get(u)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = io.Copy(io.Discard, resp.Body)
+	resp.Body.Close()
+	if resp.StatusCode != 200 {
+		t.Fatalf("GET %s: %d", u, resp.StatusCode)
+	}
+}
+
+func markedCount(s *sink) int {
+	n := 0
+	s.paced.Range(func(any, any) bool { n++; return true })
+	return n
+}
+
+func hostRPM(host string) int {
+	for _, h := range egress.Current().Snapshot() {
+		if h.Host == host {
+			return h.RPM
+		}
+	}
+	return 0
+}
+
+// A marked client (the Bash proxy URL) is paced and counted, through a CONNECT
+// tunnel and on plain HTTP; an unmarked one (WebFetch, custom tools, enrich)
+// is not paced here. No Proxy-Authorization reaches a target or the recording,
+// every exchange is recorded, and a closed connection loses its mark.
+func TestBashPacingThroughProxy(t *testing.T) {
+	prev := egress.CurrentProfile()
+	t.Cleanup(func() { egress.SetProfile(prev) })
+	// 2 req/s, burst 1, no jitter: from the second request on, each waits 500 ms.
+	egress.SetProfile(egress.Profile{Name: "test", RPS: 2, Burst: 1, MaxPerHost: 1, MaxGlobal: 8})
+
+	var mu sync.Mutex
+	leaked := map[string]string{}
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if v := r.Header.Get("Proxy-Authorization"); v != "" {
+			mu.Lock()
+			leaked[r.URL.Path] = v
+			mu.Unlock()
+		}
+		_, _ = io.WriteString(w, "ok")
+	})
+	marked := httptest.NewServer(handler)
+	defer marked.Close()
+	unmarked := httptest.NewServer(handler)
+	defer unmarked.Close()
+	tlsSrv := httptest.NewTLSServer(handler)
+	defer tlsSrv.Close()
+	// The MITM leaf for a bare IP has no IP SAN: address the TLS target by name.
+	tlsURL := strings.Replace(tlsSrv.URL, "127.0.0.1", "localhost", 1)
+
+	p := &probe{}
+	tr, s, proxyURL := startProxy(t, p)
+	bash := proxyClient(t, tr, egress.MarkProxyURL(proxyURL))
+	plain := proxyClient(t, tr, proxyURL)
+
+	start := time.Now()
+	for range 3 {
+		get(t, bash, marked.URL+"/bash")
+	}
+	if d := time.Since(start); d < 900*time.Millisecond {
+		t.Fatalf("3 marked requests to one host took %v, want >= 1s of pacing", d)
+	}
+	if n := hostRPM(strings.TrimPrefix(marked.URL, "http://")); n != 3 {
+		t.Fatalf("egress counter for the marked host = %d, want 3", n)
+	}
+	for range 3 {
+		get(t, plain, unmarked.URL+"/plain")
+	}
+	if n := hostRPM(strings.TrimPrefix(unmarked.URL, "http://")); n != 0 {
+		t.Fatalf("unmarked requests were paced by the proxy: counter %d, want 0", n)
+	}
+	get(t, bash, tlsURL+"/tls1")
+	get(t, bash, tlsURL+"/tls2")
+	tlsHost := strings.TrimPrefix(tlsURL, "https://")
+	if n := hostRPM(tlsHost); n != 2 {
+		t.Fatalf("egress counter for the tunnelled host = %d, want 2", n)
+	}
+
+	p.mu.Lock()
+	connectID := p.conn["CONNECT //"+tlsHost]
+	inner1, inner2 := p.conn["GET "+tlsURL+"/tls1"], p.conn["GET "+tlsURL+"/tls2"]
+	p.mu.Unlock()
+	if connectID == "" || inner1 != connectID || inner2 != connectID {
+		t.Fatalf("tunnel flows do not share the CONNECT's connection: connect=%q inner=%q,%q", connectID, inner1, inner2)
+	}
+	mu.Lock()
+	if len(leaked) != 0 {
+		t.Fatalf("Proxy-Authorization reached the target: %v", leaked)
+	}
+	mu.Unlock()
+
+	rows, err := tr.Search("", 0, 100)
+	if err != nil || len(rows) != 8 {
+		t.Fatalf("recorded %d exchanges (err %v), want 8", len(rows), err)
+	}
+	for _, r := range rows {
+		req, _, err := tr.Get(r.ID)
+		if err != nil || strings.Contains(strings.ToLower(req), "proxy-authorization") {
+			t.Fatalf("recorded request %s keeps Proxy-Authorization (err %v):\n%s", r.ID, err, req)
+		}
+	}
+
+	if markedCount(s) == 0 {
+		t.Fatal("no connection marked")
+	}
+	bash.CloseIdleConnections()
+	plain.CloseIdleConnections()
+	deadline := time.Now().Add(5 * time.Second)
+	for markedCount(s) != 0 {
+		if time.Now().After(deadline) {
+			t.Fatalf("%d marks left after the clients closed", markedCount(s))
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+// Off: a marked request is neither paced nor counted.
+func TestBashPacingOff(t *testing.T) {
+	prev := egress.CurrentProfile()
+	t.Cleanup(func() { egress.SetProfile(prev) })
+	egress.SetProfile(egress.Profile{Name: "off"})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer srv.Close()
+	tr, _, proxyURL := startProxy(t)
+	bash := proxyClient(t, tr, egress.MarkProxyURL(proxyURL))
+	for range 3 {
+		get(t, bash, srv.URL+"/")
+	}
+	if snap := egress.Current().Snapshot(); len(snap) != 0 {
+		t.Fatalf("off counted marked requests: %v", snap)
+	}
+}
+
+// The sink drops Proxy-Authorization from every request and marks only on the
+// pace marker; a disconnect clears the mark.
+func TestSinkStripsAndMarks(t *testing.T) {
+	prev := egress.CurrentProfile()
+	t.Cleanup(func() { egress.SetProfile(prev) })
+	egress.SetProfile(egress.Profile{Name: "off"})
+	s := &sink{}
+	flow := func(method, auth string, conn *mproxy.ClientConn) *mproxy.Flow {
+		u, _ := url.Parse("http://a.example/")
+		h := http.Header{}
+		if auth != "" {
+			h.Set("Proxy-Authorization", auth)
+		}
+		return &mproxy.Flow{Request: &mproxy.Request{Method: method, URL: u, Header: h}, ConnContext: &mproxy.ConnContext{ClientConn: conn}}
+	}
+	f := flow(http.MethodGet, "Basic dXNlcjpwYXNz", &mproxy.ClientConn{}) // user:pass, not the marker
+	s.Requestheaders(f)
+	if f.Request.Header.Get("Proxy-Authorization") != "" || markedCount(s) != 0 {
+		t.Fatalf("foreign credentials: header %q, marks %d", f.Request.Header.Get("Proxy-Authorization"), markedCount(s))
+	}
+	conn := &mproxy.ClientConn{}
+	conn.Id[0] = 1
+	f = flow(http.MethodConnect, "Basic YXJ0ZXgtcGFjZTphcnRleC1wYWNl", conn) // artex-pace:artex-pace
+	s.Requestheaders(f)
+	if f.Request.Header.Get("Proxy-Authorization") != "" || markedCount(s) != 1 {
+		t.Fatalf("marker on CONNECT: header %q, marks %d", f.Request.Header.Get("Proxy-Authorization"), markedCount(s))
+	}
+	s.ClientDisconnected(conn)
+	if markedCount(s) != 0 {
+		t.Fatal("mark kept after disconnect")
+	}
+}

traffic/traffic.go

@@ -383,10 +383,12 @@ func (t *Traffic) stopping() bool {
 }
 func (t *Traffic) DB() *sql.DB { return t.db }
 
-// sink is the go-mitmproxy addon that records completed exchanges.
+// sink is the go-mitmproxy addon that records completed exchanges, and paces
+// the requests of client connections marked for pacing (see pace.go).
 type sink struct {
 	mproxy.BaseAddon
-	t *Traffic
+	t     *Traffic
+	paced sync.Map // ClientConn.Id of a marked connection -> struct{}
 }
 
 func (s *sink) Response(f *mproxy.Flow) {

web/src/app/(main)/system/settings/noise-profile-card.tsx

@@ -78,8 +78,11 @@ export function NoiseProfileCard() {
         </CardTitle>
         <CardDescription>
           Paces the requests ARTEX itself sends to targets (WebFetch, http custom tools, the enrich probe) and sets the
-          low-and-slow guidance in agent prompts. Commands run through Bash are not paced. This setting takes
-          precedence over ARTEX_NOISE_PROFILE and applies to the next request.
+          low-and-slow guidance in agent prompts. With traffic capture on, Bash commands that use the proxy (curl,
+          wget, python-requests…) are paced too, by rate and jitter only: the in-flight, cache and retry limits apply
+          to ARTEX's own requests. Raw scanners such as nmap, and commands that bypass the proxy, are not paced; this
+          is best effort, not a security boundary. This setting takes precedence over ARTEX_NOISE_PROFILE and applies
+          to the next request.
         </CardDescription>
       </CardHeader>
       <CardContent className="flex flex-col gap-4">