From c7bbb0d8fcdc61b9a6c8da1e17f94e20beedc1be Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Tue, 29 Sep 2026 23:29:27 +0000
Subject: [PATCH] fix: multi_agent.cwe-770 security vulnerability

Automated security fix generated by OrbisAI Security
---
 src/ai-chat.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/ai-chat.js b/src/ai-chat.js
index d5f9286..5027cf9 100644
--- a/src/ai-chat.js
+++ b/src/ai-chat.js
@@ -281,7 +281,18 @@ const readSse = async (response, { onText, onUsage }) => {
   return { text, toolCalls, sessionId }
 }
 
+const MIN_REQUEST_INTERVAL_MS = 1000
+let lastRequestAt = 0
+
 const requestAi = async (payload, handlers) => {
+  const now = Date.now()
+  if (now - lastRequestAt < MIN_REQUEST_INTERVAL_MS) {
+    const err = new Error('rate_limited')
+    err.code = 'rate_limited'
+    throw err
+  }
+  lastRequestAt = now
+
   const response = await fetch(getAiEndpoint(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },