misconfig/CVE/PoC/rate-limit agents, data-safety guardrail, Burp proxy, PoC dir

Agents (+10 → library 375): absurd-misconfig hunters (exposed .git/.env/backups,
debug/actuator, default creds, dir listing, ops dashboards, permissive CORS,
verbose errors), a CVE Hunter (fingerprint → correlate → safe PoC), a PoC
Developer (writes runnable scripts to the run's pocs/), and a Rate-Limit tester.

Doctrine (pipeline):
- SAFETY_DOCTRINE injected into every exploit/chain/host prompt: no modify/delete/
  exfiltrate/state-change without permission; on PII prove with a masked sample +
  count, never dump.
- tool_doctrine adds: smart targeted nuclei (fingerprint-first, -tags/-id, rate/
  timeouts), misconfig hunting, rate-limit control checks, authorized tool
  download (git clone PoC repos / fetch scanners), Burp/ZAP proxy routing, and a
  per-run PoC workspace.

Harness/CLI/REPL:
- RunConfig.proxy; spawn_engagement creates <workdir>/pocs and exports
  NEUROSPLOIT_POCS + NEUROSPLOIT_PROXY (proxy from cfg or the env var).
- REPL /proxy <url> and /burp (Session.proxy); /show shows proxy.

Docs: README highlights + Cloud/counts (375), RELEASE v3.5.5 sections.

neurosploit-rs/app/src/main.rs

@@ -550,6 +550,19 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
     std::fs::create_dir_all(&workdir).ok();
     cfg.workdir = Some(workdir.display().to_string());
     cfg.rl_path = Some(base.join("data").join("rl_state_rs.json").display().to_string());
+    // PoC scratch dir: agents write custom exploit scripts here (see doctrine).
+    let pocs = workdir.join("pocs");
+    std::fs::create_dir_all(&pocs).ok();
+    std::env::set_var("NEUROSPLOIT_POCS", pocs.display().to_string());
+    // Local intercepting proxy (Burp/ZAP): agents route HTTP through it. Comes
+    // from cfg.proxy (REPL /proxy) or the NEUROSPLOIT_PROXY env var (CLI).
+    let proxy = cfg.proxy.clone()
+        .or_else(|| std::env::var("NEUROSPLOIT_PROXY").ok())
+        .filter(|p| !p.trim().is_empty());
+    if let Some(p) = proxy {
+        std::env::set_var("NEUROSPLOIT_PROXY", &p);
+        println!("  │  proxy  : {p} (traffic routed to Burp/ZAP for inspection)");
+    }
     write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
 
     println!("  ┌─ NeuroSploit v3.5.5  ·  by Joas A Santos & Red Team Leaders");