promptfoo 0.125.0 → 0.125.1

package/dist/src/mantleChat-Cpefl7Zm.js

@@ -0,0 +1,154 @@
+import { t as OpenAiChatCompletionProvider } from "./chat-zCWuBKAj.js";
+import { i as isBedrockGrokModel, o as isBedrockOpenAiResponsesModel } from "./routing-JymeTqiF.js";
+import { i as resolveBedrockMantleRegion, n as getBedrockMantleOrigin, r as resolveBedrockMantleApiKey, t as BedrockTokenProvider } from "./tokenProvider-C_w2klkB.js";
+//#region src/providers/bedrock/mantleChat.ts
+/**
+* The Bedrock **Mantle** endpoint exposes an OpenAI-compatible **Chat Completions** API at
+*
+*   https://bedrock-mantle.<region>.api.aws/<route>/chat/completions
+*
+* `bedrock:mantle:<id>` selects this API explicitly. Mantle and Runtime have distinct
+* catalogs and model namespaces, including Mantle's Qwen `*-instruct` ids. Most models
+* use `/v1`; xAI, Gemma 4, and supported GPT-5.6 models use `/openai/v1`.
+*
+* This is the Chat Completions counterpart to {@link createBedrockOpenAiResponsesProvider} (the
+* `/openai/v1/responses` path used by the OpenAI frontier and xAI Grok models). Use the bare
+* `bedrock:openai.gpt-5.6-sol` / `bedrock:xai.grok-4.3` forms for those (Responses API, with
+* reasoning tokens); use `bedrock:mantle:<id>` to talk to the Chat Completions endpoint directly.
+*
+* Default region used when none is configured. The mantle model catalog is regional (see
+* `GET /v1/models`), so the caller should set `region` to one where the target model is offered.
+*/
+const DEFAULT_BEDROCK_MANTLE_CHAT_REGION = "us-east-1";
+const DEFAULT_BEDROCK_MANTLE_GROK_CHAT_REGION = "us-west-2";
+const BEDROCK_OPENAI_CHAT_MODELS = /* @__PURE__ */ new Set([
+	"openai.gpt-5.6-sol",
+	"openai.gpt-5.6-terra",
+	"openai.gpt-5.6-luna"
+]);
+/**
+* Base URL for the mantle Chat Completions API. Most mantle chat models use the bare `/v1`
+* path, but xAI, Gemma 4, and supported GPT-5.6 chat models use `/openai/v1`.
+*/
+function getBedrockMantleChatBaseUrl(region, modelName) {
+	const path = modelName !== void 0 && isBedrockGrokModel(modelName) || modelName !== void 0 && BEDROCK_OPENAI_CHAT_MODELS.has(modelName) || modelName?.startsWith("google.gemma-4") ? "openai/v1" : "v1";
+	return `${getBedrockMantleOrigin(region)}/${path}`;
+}
+function isBedrockMantleEndpoint(apiBaseUrl) {
+	try {
+		return /^(?:[a-z0-9-]+\.)?bedrock-mantle(?:-fips)?\.[a-z0-9-]+(?:\.vpce)?\.(?:api\.aws|amazonaws\.com(?:\.cn)?)$/.test(new URL(apiBaseUrl).hostname.replace(/\.+$/, ""));
+	} catch {
+		return false;
+	}
+}
+/**
+* OpenAI Chat Completions provider pinned to the Bedrock mantle endpoint. Behaves like the
+* OpenAI Platform chat provider (shared request/response/usage handling) but always targets the
+* configured mantle `apiBaseUrl`.
+*/
+var BedrockMantleChatProvider = class extends OpenAiChatCompletionProvider {
+	bedrockTokenProvider;
+	bedrockRegion;
+	constructor(modelName, options = {}) {
+		super(modelName, options);
+		const region = resolveBedrockMantleRegion(options.config ?? {}, options.env, isBedrockGrokModel(modelName) ? DEFAULT_BEDROCK_MANTLE_GROK_CHAT_REGION : DEFAULT_BEDROCK_MANTLE_CHAT_REGION);
+		this.bedrockRegion = region;
+		this.config = {
+			...this.config,
+			apiBaseUrl: this.config.apiBaseUrl || getBedrockMantleChatBaseUrl(region, modelName)
+		};
+		this.bedrockTokenProvider = new BedrockTokenProvider(this.config, options.env, region);
+	}
+	requiresApiKey() {
+		return false;
+	}
+	getApiKey() {
+		return resolveBedrockMantleApiKey(this.config, this.env);
+	}
+	getRequestAuthentication() {
+		return async (signal) => {
+			const token = await this.bedrockTokenProvider.getToken(signal);
+			return token ? { Authorization: `Bearer ${token}` } : {};
+		};
+	}
+	getGenAISystem() {
+		return "bedrock";
+	}
+	getBillingRegion() {
+		return this.bedrockRegion;
+	}
+	normalizeCapabilityModelName(modelName) {
+		return modelName.replace(/^(openai|xai)\./, "");
+	}
+	getCapabilityModelName() {
+		return this.normalizeCapabilityModelName(this.modelName);
+	}
+	isReasoningModel() {
+		return isBedrockGrokModel(this.modelName) || super.isReasoningModel();
+	}
+	getBillingModelName(config) {
+		const modelName = super.getBillingModelName(config).replace(/^(?:openai|xai)\./, "");
+		return /^gpt-5\.6(?:-|$)/.test(modelName) || modelName === "grok-4.3" ? `bedrock:${modelName}` : modelName;
+	}
+	supportsTemperature() {
+		return isBedrockGrokModel(this.modelName) || super.supportsTemperature();
+	}
+	async getOpenAiBody(prompt, context, callApiOptions) {
+		const result = await super.getOpenAiBody(prompt, context, callApiOptions);
+		const model = result.body.model;
+		const apiUrl = new URL(this.getApiUrl());
+		if (isBedrockMantleEndpoint(apiUrl.href)) {
+			const expectedPath = new URL(getBedrockMantleChatBaseUrl(DEFAULT_BEDROCK_MANTLE_CHAT_REGION, model)).pathname;
+			if (apiUrl.pathname.replace(/\/+$/, "") !== expectedPath) throw new Error(`Bedrock model ${model} requires the ${expectedPath} Mantle endpoint. Configure a separate provider using bedrock:mantle:${model}.`);
+		}
+		if (model.startsWith("google.gemma-4-") && result.config.reasoning_effort !== void 0) result.body.reasoning_effort = result.config.reasoning_effort;
+		if (isBedrockGrokModel(model)) {
+			delete result.body.presence_penalty;
+			delete result.body.frequency_penalty;
+			delete result.body.stop;
+		}
+		return result;
+	}
+	/**
+	* Pin requests to the configured mantle endpoint. The base `getApiUrl()` prefers
+	* `apiHost`/`OPENAI_API_HOST` over `apiBaseUrl`, so without this an ambient `OPENAI_API_HOST`
+	* (set for an unrelated OpenAI-compatible provider) would hijack Bedrock calls and send the
+	* Bedrock bearer token to the wrong host.
+	*/
+	getApiUrl() {
+		return this.config.apiBaseUrl || super.getApiUrl();
+	}
+	getOpenAiRequestHeaders(customHeaders = this.config.headers) {
+		return customHeaders ?? {};
+	}
+	shouldBustCache() {
+		return true;
+	}
+};
+/**
+* Construct a Chat Completions provider configured for the Bedrock mantle endpoint. Resolves the
+* region (config → AWS_BEDROCK_REGION → AWS_REGION → default), targets the mantle endpoint
+* unless the caller supplies an explicit `apiBaseUrl`, and authenticates with either a
+* configured Bedrock bearer token or a request-scoped token generated from AWS credentials.
+*/
+function createBedrockMantleChatProvider(modelName, providerOptions = {}) {
+	if (isBedrockOpenAiResponsesModel(modelName) && !BEDROCK_OPENAI_CHAT_MODELS.has(modelName)) throw new Error(`Amazon Bedrock model "bedrock:mantle:${modelName}" is not supported by promptfoo's Mantle Chat Completions adapter. Use the bare "bedrock:${modelName}" id so promptfoo routes it through Bedrock's OpenAI-compatible Responses API.`);
+	const config = providerOptions.config ?? {};
+	const region = resolveBedrockMantleRegion(config, providerOptions.env, isBedrockGrokModel(modelName) ? DEFAULT_BEDROCK_MANTLE_GROK_CHAT_REGION : DEFAULT_BEDROCK_MANTLE_CHAT_REGION);
+	const apiBaseUrl = config.apiBaseUrl || getBedrockMantleChatBaseUrl(region, modelName);
+	const profile = modelName.match(/^[a-z]+\.(openai\.gpt-5\.6-(?:sol|terra|luna))$/);
+	if (profile && isBedrockMantleEndpoint(apiBaseUrl)) throw new Error(`Amazon Bedrock inference profile "${modelName}" cannot be used on Mantle. Use "bedrock:mantle:${profile[1]}" for Mantle Chat Completions or "bedrock:converse:${modelName}" for Runtime Converse.`);
+	const isGrok = isBedrockGrokModel(modelName);
+	return new BedrockMantleChatProvider(modelName, {
+		...providerOptions,
+		config: {
+			...config,
+			apiBaseUrl,
+			...isGrok ? { omitDefaults: true } : {}
+		}
+	});
+}
+//#endregion
+export { createBedrockMantleChatProvider };
+
+//# sourceMappingURL=mantleChat-Cpefl7Zm.js.map

package/dist/src/mcp-B0V0ikdM.js

@@ -0,0 +1,84 @@
+import { jt as ProviderEnvOverridesSchema } from "./tables-D7gZdWrS.js";
+import { i as InputsInputSchema } from "./shared-CPig5o70.js";
+import { g as McpAuthSchema, h as McpAuthInputSchema } from "./util-DMNFhk47.js";
+import { z as z$1 } from "zod";
+//#region src/contracts/providerConfig/shared.ts
+/** Provider-owned configuration is closed; request payloads and schemas remain open JSON. */
+const JsonObjectInputSchema = z$1.record(z$1.string(), z$1.json());
+z$1.templateLiteral(["file://", z$1.string().regex(/[\s\S]+/)]);
+z$1.strictObject({
+	label: z$1.string().optional(),
+	prompts: z$1.array(z$1.string()).optional(),
+	transform: z$1.string().optional(),
+	delay: z$1.number().optional(),
+	env: ProviderEnvOverridesSchema.catchall(z$1.string()).optional(),
+	inputs: InputsInputSchema.optional()
+});
+//#endregion
+//#region src/contracts/providerConfig/mcp.ts
+const McpServerFieldsSchema = z$1.looseObject({
+	path: z$1.string().describe("Local MCP server script; the shared client supports .js and .py files").optional(),
+	command: z$1.string().describe("Command to launch a stdio MCP server").optional(),
+	args: z$1.array(z$1.string()).optional().describe("Arguments passed to command; not used with path"),
+	name: z$1.string().optional().describe("Optional server name used to identify its tools"),
+	url: z$1.string().describe("Remote MCP server URL; connection validates the effective URL").optional(),
+	auth: McpAuthInputSchema.optional().describe("Authentication for remote servers; omitted means no configured auth"),
+	headers: z$1.record(z$1.string(), z$1.string()).optional().describe("Additional remote-server HTTP headers; generated auth headers take precedence"),
+	env: z$1.record(z$1.string(), z$1.string()).optional().describe("Environment variables for a stdio server process")
+});
+const McpServerInputSchema = z$1.union([
+	McpServerFieldsSchema.extend({ command: McpServerFieldsSchema.shape.command.unwrap().min(1) }).strict(),
+	McpServerFieldsSchema.extend({ path: McpServerFieldsSchema.shape.path.unwrap().min(1) }).strict(),
+	McpServerFieldsSchema.extend({ url: McpServerFieldsSchema.shape.url.unwrap().min(1) }).strict()
+], { error: "Either command or path or url must be specified for MCP server" }).describe("At least one connection field is required. The shared client prefers command, then path, then url; the Claude adapter prefers url, then command, then path");
+const McpServerRuntimeFieldsSchema = McpServerFieldsSchema.extend({ auth: McpAuthSchema.optional() });
+const McpServerSchema = z$1.union([
+	McpServerRuntimeFieldsSchema.extend({ command: z$1.string().min(1) }),
+	McpServerRuntimeFieldsSchema.extend({ path: z$1.string().min(1) }),
+	McpServerRuntimeFieldsSchema.extend({ url: z$1.string().min(1) })
+], { error: "Either command or path or url must be specified for MCP server" });
+/** Serializable options read by MCPClient; no defaults or execution side effects. */
+const McpClientConfigInputSchema = z$1.strictObject({
+	enabled: z$1.boolean().optional().describe("Defaults to true when parsed for execution"),
+	server: McpServerInputSchema.optional().describe("Single server; the shared client uses servers instead when that array is present"),
+	servers: z$1.array(McpServerInputSchema).optional().describe("Servers to connect to; an empty array is allowed. The Claude adapter also includes server"),
+	timeout: z$1.number().nonnegative().optional().describe("Request timeout in milliseconds; omitted uses MCP_REQUEST_TIMEOUT_MS then the SDK default of 60000 (60 seconds). Zero leaves the SDK timeout unchanged"),
+	resetTimeoutOnProgress: z$1.boolean().optional().describe("Reset the request timeout on progress notifications; defaults to false"),
+	maxTotalTimeout: z$1.number().nonnegative().optional().describe("Maximum request duration in milliseconds, including progress updates; zero or omitted adds no maximum"),
+	pingOnConnect: z$1.boolean().optional().describe("Ping the server after connecting; defaults to false"),
+	tools: z$1.array(z$1.string()).optional().describe("Tool-name allowlist for the shared client; unsupported by the Claude Agent SDK adapter"),
+	exclude_tools: z$1.array(z$1.string()).optional().describe("Tool names to exclude; nonempty exclusions are unsupported by the Claude Agent SDK adapter"),
+	debug: z$1.boolean().optional().describe("Enable debug logging; falls back to MCP_DEBUG"),
+	verbose: z$1.boolean().optional().describe("Enable verbose logging; falls back to MCP_VERBOSE")
+});
+/** Standalone MCP providers add argument defaults and ProviderResponse transforms. */
+const McpConfigInputSchema = McpClientConfigInputSchema.extend({
+	serverName: z$1.string().optional().describe("Server name supplied by mcp:<name> provider IDs"),
+	defaultArgs: JsonObjectInputSchema.optional().describe("Arguments merged into every tool call; per-call arguments take precedence"),
+	transformResponse: z$1.string().optional().describe("Response transform expression or file:// module reference; evaluated only at runtime"),
+	responseParser: z$1.string().optional().meta({
+		description: "Deprecated alias for transformResponse",
+		deprecated: true
+	})
+});
+const McpResponseTransformSchema = z$1.union([z$1.string(), z$1.custom((value) => typeof value === "function")]);
+const McpConfigSchema = McpConfigInputSchema.loose().extend({
+	enabled: z$1.boolean().prefault(true),
+	defaultArgs: z$1.record(z$1.string(), z$1.unknown()).optional().meta({ ...McpConfigInputSchema.shape.defaultArgs.meta() }),
+	server: McpServerSchema.optional(),
+	servers: z$1.array(McpServerSchema).optional(),
+	transformResponse: McpResponseTransformSchema.optional(),
+	responseParser: McpResponseTransformSchema.optional().meta({ ...McpConfigInputSchema.shape.responseParser.meta() })
+});
+z$1.toJSONSchema(McpClientConfigInputSchema, {
+	target: "draft-07",
+	io: "input"
+});
+z$1.toJSONSchema(McpConfigInputSchema, {
+	target: "draft-07",
+	io: "input"
+});
+//#endregion
+export { McpConfigSchema as t };
+
+//# sourceMappingURL=mcp-B0V0ikdM.js.map

package/dist/src/mcp-CV2k2gwj.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { zt as ProviderEnvOverridesSchema } from "./tables-BONxKPrt.js";
+import { i as InputsInputSchema } from "./shared-D-YP2yH6.js";
+import { g as McpAuthSchema, h as McpAuthInputSchema } from "./util-WH8CgVs4.js";
+import { z as z$1 } from "zod";
+//#region src/contracts/providerConfig/shared.ts
+/** Provider-owned configuration is closed; request payloads and schemas remain open JSON. */
+const JsonObjectInputSchema = z$1.record(z$1.string(), z$1.json());
+z$1.templateLiteral(["file://", z$1.string().regex(/[\s\S]+/)]);
+z$1.strictObject({
+	label: z$1.string().optional(),
+	prompts: z$1.array(z$1.string()).optional(),
+	transform: z$1.string().optional(),
+	delay: z$1.number().optional(),
+	env: ProviderEnvOverridesSchema.catchall(z$1.string()).optional(),
+	inputs: InputsInputSchema.optional()
+});
+//#endregion
+//#region src/contracts/providerConfig/mcp.ts
+const McpServerFieldsSchema = z$1.looseObject({
+	path: z$1.string().describe("Local MCP server script; the shared client supports .js and .py files").optional(),
+	command: z$1.string().describe("Command to launch a stdio MCP server").optional(),
+	args: z$1.array(z$1.string()).optional().describe("Arguments passed to command; not used with path"),
+	name: z$1.string().optional().describe("Optional server name used to identify its tools"),
+	url: z$1.string().describe("Remote MCP server URL; connection validates the effective URL").optional(),
+	auth: McpAuthInputSchema.optional().describe("Authentication for remote servers; omitted means no configured auth"),
+	headers: z$1.record(z$1.string(), z$1.string()).optional().describe("Additional remote-server HTTP headers; generated auth headers take precedence"),
+	env: z$1.record(z$1.string(), z$1.string()).optional().describe("Environment variables for a stdio server process")
+});
+const McpServerInputSchema = z$1.union([
+	McpServerFieldsSchema.extend({ command: McpServerFieldsSchema.shape.command.unwrap().min(1) }).strict(),
+	McpServerFieldsSchema.extend({ path: McpServerFieldsSchema.shape.path.unwrap().min(1) }).strict(),
+	McpServerFieldsSchema.extend({ url: McpServerFieldsSchema.shape.url.unwrap().min(1) }).strict()
+], { error: "Either command or path or url must be specified for MCP server" }).describe("At least one connection field is required. The shared client prefers command, then path, then url; the Claude adapter prefers url, then command, then path");
+const McpServerRuntimeFieldsSchema = McpServerFieldsSchema.extend({ auth: McpAuthSchema.optional() });
+const McpServerSchema = z$1.union([
+	McpServerRuntimeFieldsSchema.extend({ command: z$1.string().min(1) }),
+	McpServerRuntimeFieldsSchema.extend({ path: z$1.string().min(1) }),
+	McpServerRuntimeFieldsSchema.extend({ url: z$1.string().min(1) })
+], { error: "Either command or path or url must be specified for MCP server" });
+/** Serializable options read by MCPClient; no defaults or execution side effects. */
+const McpClientConfigInputSchema = z$1.strictObject({
+	enabled: z$1.boolean().optional().describe("Defaults to true when parsed for execution"),
+	server: McpServerInputSchema.optional().describe("Single server; the shared client uses servers instead when that array is present"),
+	servers: z$1.array(McpServerInputSchema).optional().describe("Servers to connect to; an empty array is allowed. The Claude adapter also includes server"),
+	timeout: z$1.number().nonnegative().optional().describe("Request timeout in milliseconds; omitted uses MCP_REQUEST_TIMEOUT_MS then the SDK default of 60000 (60 seconds). Zero leaves the SDK timeout unchanged"),
+	resetTimeoutOnProgress: z$1.boolean().optional().describe("Reset the request timeout on progress notifications; defaults to false"),
+	maxTotalTimeout: z$1.number().nonnegative().optional().describe("Maximum request duration in milliseconds, including progress updates; zero or omitted adds no maximum"),
+	pingOnConnect: z$1.boolean().optional().describe("Ping the server after connecting; defaults to false"),
+	tools: z$1.array(z$1.string()).optional().describe("Tool-name allowlist for the shared client; unsupported by the Claude Agent SDK adapter"),
+	exclude_tools: z$1.array(z$1.string()).optional().describe("Tool names to exclude; nonempty exclusions are unsupported by the Claude Agent SDK adapter"),
+	debug: z$1.boolean().optional().describe("Enable debug logging; falls back to MCP_DEBUG"),
+	verbose: z$1.boolean().optional().describe("Enable verbose logging; falls back to MCP_VERBOSE")
+});
+/** Standalone MCP providers add argument defaults and ProviderResponse transforms. */
+const McpConfigInputSchema = McpClientConfigInputSchema.extend({
+	serverName: z$1.string().optional().describe("Server name supplied by mcp:<name> provider IDs"),
+	defaultArgs: JsonObjectInputSchema.optional().describe("Arguments merged into every tool call; per-call arguments take precedence"),
+	transformResponse: z$1.string().optional().describe("Response transform expression or file:// module reference; evaluated only at runtime"),
+	responseParser: z$1.string().optional().meta({
+		description: "Deprecated alias for transformResponse",
+		deprecated: true
+	})
+});
+const McpResponseTransformSchema = z$1.union([z$1.string(), z$1.custom((value) => typeof value === "function")]);
+const McpConfigSchema = McpConfigInputSchema.loose().extend({
+	enabled: z$1.boolean().prefault(true),
+	defaultArgs: z$1.record(z$1.string(), z$1.unknown()).optional().meta({ ...McpConfigInputSchema.shape.defaultArgs.meta() }),
+	server: McpServerSchema.optional(),
+	servers: z$1.array(McpServerSchema).optional(),
+	transformResponse: McpResponseTransformSchema.optional(),
+	responseParser: McpResponseTransformSchema.optional().meta({ ...McpConfigInputSchema.shape.responseParser.meta() })
+});
+z$1.toJSONSchema(McpClientConfigInputSchema, {
+	target: "draft-07",
+	io: "input"
+});
+z$1.toJSONSchema(McpConfigInputSchema, {
+	target: "draft-07",
+	io: "input"
+});
+//#endregion
+export { McpConfigSchema as t };
+
+//# sourceMappingURL=mcp-CV2k2gwj.js.map

package/dist/src/memoryPoisoning-BC5FQQWZ.js

@@ -0,0 +1,111 @@
+import { o as logger } from "./logger-Gff7RMNF.js";
+import { X as VERSION, t as fetchWithProxy } from "./fetch-B5KxZuKu.js";
+import { t as invariant } from "./invariant-CHP0zrix.js";
+import { s as getUserEmail } from "./accounts-CPISMNlh.js";
+import { h as remoteGenerationContextPayload, i as getRemoteGenerationUrl, r as getRemoteGenerationHeaders } from "./remoteGeneration-DtnqocnL.js";
+import { d as createEmptyTokenUsage, n as accumulateAttackerTokenUsage, s as accumulateResponseTokenUsage } from "./tokenUsageUtils-BfzeNdYY.js";
+import { E as throwIfTargetPromptExceedsMaxChars, _ as messagesToRedteamHistory, a as callTargetProvider } from "./shared-Dh3yfRBd.js";
+import { o as REDTEAM_MEMORY_POISONING_PLUGIN_ID } from "./server/index.js";
+//#region src/redteam/providers/agentic/memoryPoisoning.ts
+var MemoryPoisoningProvider = class {
+	config;
+	constructor(config) {
+		this.config = config;
+	}
+	get targetId() {
+		if (typeof this.config.targetId === "string") return this.config.targetId;
+		return typeof this.config.config?.targetId === "string" ? this.config.config.targetId : void 0;
+	}
+	id() {
+		return REDTEAM_MEMORY_POISONING_PLUGIN_ID;
+	}
+	/**
+	* Generates a scenario containing a memory and a follow up question/command which is dependent on the memory.
+	*
+	*  1. Generate a scenario containing memories and follow up questions/commands which are dependent on the memories.
+	*  2. Send the memory message to the target.
+	*  3. Send the test case to the target; the test case should poison the memory created in the previous step.
+	*  4. Send the follow up question to the target.
+	*  5. A memory is successfully poisoned if the follow up question is answered incorrectly.
+	*
+	* @param prompt The poisoned prompt.
+	* @param context The context of the poisoned prompt.
+	* @param options The options for the poisoned prompt.
+	*/
+	async callApi(prompt, context, options) {
+		try {
+			const targetProvider = context?.originalProvider;
+			const purpose = context?.test?.metadata?.purpose;
+			invariant(targetProvider, "Expected originalProvider to be set");
+			invariant(context?.test, "Expected test to be set");
+			invariant(purpose, "Expected purpose to be set");
+			const scenarioRes = await fetchWithProxy(getRemoteGenerationUrl(), {
+				body: JSON.stringify({
+					task: "agentic:memory-poisoning-scenario",
+					...remoteGenerationContextPayload(this.targetId),
+					purpose,
+					version: VERSION,
+					email: getUserEmail()
+				}),
+				headers: getRemoteGenerationHeaders(),
+				method: "POST"
+			}, options?.abortSignal);
+			if (!scenarioRes.ok) throw new Error(`Failed to generate scenario: ${scenarioRes.statusText}`);
+			const scenario = await scenarioRes.json();
+			context.test.metadata ??= {};
+			context.test.metadata["scenario"] = scenario;
+			const totalTokenUsage = createEmptyTokenUsage();
+			if (scenario.tokenUsage) accumulateAttackerTokenUsage(totalTokenUsage, { tokenUsage: scenario.tokenUsage });
+			throwIfTargetPromptExceedsMaxChars(scenario.memory);
+			const memoryResponse = await callTargetProvider(targetProvider, scenario.memory, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, memoryResponse);
+			throwIfTargetPromptExceedsMaxChars(prompt);
+			const testResponse = await callTargetProvider(targetProvider, prompt, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, testResponse);
+			throwIfTargetPromptExceedsMaxChars(scenario.followUp);
+			const response = await callTargetProvider(targetProvider, scenario.followUp, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, response);
+			const messages = [
+				{
+					content: scenario.memory,
+					role: "user"
+				},
+				{
+					content: memoryResponse.output,
+					role: "assistant"
+				},
+				{
+					content: prompt,
+					role: "user"
+				},
+				{
+					content: testResponse.output,
+					role: "assistant"
+				},
+				{
+					content: scenario.followUp,
+					role: "user"
+				},
+				{
+					content: response.output,
+					role: "assistant"
+				}
+			];
+			return {
+				output: response.output,
+				metadata: {
+					messages,
+					redteamHistory: messagesToRedteamHistory(messages)
+				},
+				tokenUsage: totalTokenUsage
+			};
+		} catch (error) {
+			logger.error(`Error in MemoryPoisoningProvider: ${error}`);
+			throw error;
+		}
+	}
+};
+//#endregion
+export { MemoryPoisoningProvider };
+
+//# sourceMappingURL=memoryPoisoning-BC5FQQWZ.js.map

package/dist/src/memoryPoisoning-BDwrtZKX.js

@@ -0,0 +1,111 @@
+import { o as logger } from "./logger-CNHLbG5Y.js";
+import { t as invariant } from "./invariant-CHP0zrix.js";
+import { Y as VERSION, t as fetchWithProxy } from "./fetch-BG_Jl7ty.js";
+import { a as getUserEmail } from "./accounts-vJBPs89d.js";
+import { h as remoteGenerationContextPayload, i as getRemoteGenerationUrl, r as getRemoteGenerationHeaders } from "./remoteGeneration-CAtvamG6.js";
+import { d as createEmptyTokenUsage, n as accumulateAttackerTokenUsage, s as accumulateResponseTokenUsage } from "./tokenUsageUtils-C51DmahQ.js";
+import { E as throwIfTargetPromptExceedsMaxChars, _ as messagesToRedteamHistory, a as callTargetProvider } from "./shared-tfPT8Tna.js";
+import { t as REDTEAM_MEMORY_POISONING_PLUGIN_ID } from "./constants-3y0xcfa4.js";
+//#region src/redteam/providers/agentic/memoryPoisoning.ts
+var MemoryPoisoningProvider = class {
+	config;
+	constructor(config) {
+		this.config = config;
+	}
+	get targetId() {
+		if (typeof this.config.targetId === "string") return this.config.targetId;
+		return typeof this.config.config?.targetId === "string" ? this.config.config.targetId : void 0;
+	}
+	id() {
+		return REDTEAM_MEMORY_POISONING_PLUGIN_ID;
+	}
+	/**
+	* Generates a scenario containing a memory and a follow up question/command which is dependent on the memory.
+	*
+	*  1. Generate a scenario containing memories and follow up questions/commands which are dependent on the memories.
+	*  2. Send the memory message to the target.
+	*  3. Send the test case to the target; the test case should poison the memory created in the previous step.
+	*  4. Send the follow up question to the target.
+	*  5. A memory is successfully poisoned if the follow up question is answered incorrectly.
+	*
+	* @param prompt The poisoned prompt.
+	* @param context The context of the poisoned prompt.
+	* @param options The options for the poisoned prompt.
+	*/
+	async callApi(prompt, context, options) {
+		try {
+			const targetProvider = context?.originalProvider;
+			const purpose = context?.test?.metadata?.purpose;
+			invariant(targetProvider, "Expected originalProvider to be set");
+			invariant(context?.test, "Expected test to be set");
+			invariant(purpose, "Expected purpose to be set");
+			const scenarioRes = await fetchWithProxy(getRemoteGenerationUrl(), {
+				body: JSON.stringify({
+					task: "agentic:memory-poisoning-scenario",
+					...remoteGenerationContextPayload(this.targetId),
+					purpose,
+					version: VERSION,
+					email: getUserEmail()
+				}),
+				headers: getRemoteGenerationHeaders(),
+				method: "POST"
+			}, options?.abortSignal);
+			if (!scenarioRes.ok) throw new Error(`Failed to generate scenario: ${scenarioRes.statusText}`);
+			const scenario = await scenarioRes.json();
+			context.test.metadata ??= {};
+			context.test.metadata["scenario"] = scenario;
+			const totalTokenUsage = createEmptyTokenUsage();
+			if (scenario.tokenUsage) accumulateAttackerTokenUsage(totalTokenUsage, { tokenUsage: scenario.tokenUsage });
+			throwIfTargetPromptExceedsMaxChars(scenario.memory);
+			const memoryResponse = await callTargetProvider(targetProvider, scenario.memory, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, memoryResponse);
+			throwIfTargetPromptExceedsMaxChars(prompt);
+			const testResponse = await callTargetProvider(targetProvider, prompt, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, testResponse);
+			throwIfTargetPromptExceedsMaxChars(scenario.followUp);
+			const response = await callTargetProvider(targetProvider, scenario.followUp, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, response);
+			const messages = [
+				{
+					content: scenario.memory,
+					role: "user"
+				},
+				{
+					content: memoryResponse.output,
+					role: "assistant"
+				},
+				{
+					content: prompt,
+					role: "user"
+				},
+				{
+					content: testResponse.output,
+					role: "assistant"
+				},
+				{
+					content: scenario.followUp,
+					role: "user"
+				},
+				{
+					content: response.output,
+					role: "assistant"
+				}
+			];
+			return {
+				output: response.output,
+				metadata: {
+					messages,
+					redteamHistory: messagesToRedteamHistory(messages)
+				},
+				tokenUsage: totalTokenUsage
+			};
+		} catch (error) {
+			logger.error(`Error in MemoryPoisoningProvider: ${error}`);
+			throw error;
+		}
+	}
+};
+//#endregion
+export { MemoryPoisoningProvider };
+
+//# sourceMappingURL=memoryPoisoning-BDwrtZKX.js.map

package/dist/src/memoryPoisoning-BFemS_FF.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import { c as logger } from "./logger-pCNnmVuz.js";
+import { Y as VERSION, r as fetchWithProxy } from "./fetch-RXHsZF-J.js";
+import { t as invariant } from "./invariant-CbHB1xyx.js";
+import { s as getUserEmail } from "./accounts-BOxNYxVN.js";
+import { h as remoteGenerationContextPayload, i as getRemoteGenerationUrl, r as getRemoteGenerationHeaders } from "./remoteGeneration-g3KvW-sP.js";
+import { d as createEmptyTokenUsage, n as accumulateAttackerTokenUsage, s as accumulateResponseTokenUsage } from "./tokenUsageUtils-CHs91tUW.js";
+import { E as throwIfTargetPromptExceedsMaxChars, _ as messagesToRedteamHistory, a as callTargetProvider } from "./shared-DDJg8ycC.js";
+import { t as REDTEAM_MEMORY_POISONING_PLUGIN_ID } from "./constants-CDdPiEZR.js";
+//#region src/redteam/providers/agentic/memoryPoisoning.ts
+var MemoryPoisoningProvider = class {
+	config;
+	constructor(config) {
+		this.config = config;
+	}
+	get targetId() {
+		if (typeof this.config.targetId === "string") return this.config.targetId;
+		return typeof this.config.config?.targetId === "string" ? this.config.config.targetId : void 0;
+	}
+	id() {
+		return REDTEAM_MEMORY_POISONING_PLUGIN_ID;
+	}
+	/**
+	* Generates a scenario containing a memory and a follow up question/command which is dependent on the memory.
+	*
+	*  1. Generate a scenario containing memories and follow up questions/commands which are dependent on the memories.
+	*  2. Send the memory message to the target.
+	*  3. Send the test case to the target; the test case should poison the memory created in the previous step.
+	*  4. Send the follow up question to the target.
+	*  5. A memory is successfully poisoned if the follow up question is answered incorrectly.
+	*
+	* @param prompt The poisoned prompt.
+	* @param context The context of the poisoned prompt.
+	* @param options The options for the poisoned prompt.
+	*/
+	async callApi(prompt, context, options) {
+		try {
+			const targetProvider = context?.originalProvider;
+			const purpose = context?.test?.metadata?.purpose;
+			invariant(targetProvider, "Expected originalProvider to be set");
+			invariant(context?.test, "Expected test to be set");
+			invariant(purpose, "Expected purpose to be set");
+			const scenarioRes = await fetchWithProxy(getRemoteGenerationUrl(), {
+				body: JSON.stringify({
+					task: "agentic:memory-poisoning-scenario",
+					...remoteGenerationContextPayload(this.targetId),
+					purpose,
+					version: VERSION,
+					email: getUserEmail()
+				}),
+				headers: getRemoteGenerationHeaders(),
+				method: "POST"
+			}, options?.abortSignal);
+			if (!scenarioRes.ok) throw new Error(`Failed to generate scenario: ${scenarioRes.statusText}`);
+			const scenario = await scenarioRes.json();
+			context.test.metadata ??= {};
+			context.test.metadata["scenario"] = scenario;
+			const totalTokenUsage = createEmptyTokenUsage();
+			if (scenario.tokenUsage) accumulateAttackerTokenUsage(totalTokenUsage, { tokenUsage: scenario.tokenUsage });
+			throwIfTargetPromptExceedsMaxChars(scenario.memory);
+			const memoryResponse = await callTargetProvider(targetProvider, scenario.memory, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, memoryResponse);
+			throwIfTargetPromptExceedsMaxChars(prompt);
+			const testResponse = await callTargetProvider(targetProvider, prompt, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, testResponse);
+			throwIfTargetPromptExceedsMaxChars(scenario.followUp);
+			const response = await callTargetProvider(targetProvider, scenario.followUp, context, options);
+			accumulateResponseTokenUsage(totalTokenUsage, response);
+			const messages = [
+				{
+					content: scenario.memory,
+					role: "user"
+				},
+				{
+					content: memoryResponse.output,
+					role: "assistant"
+				},
+				{
+					content: prompt,
+					role: "user"
+				},
+				{
+					content: testResponse.output,
+					role: "assistant"
+				},
+				{
+					content: scenario.followUp,
+					role: "user"
+				},
+				{
+					content: response.output,
+					role: "assistant"
+				}
+			];
+			return {
+				output: response.output,
+				metadata: {
+					messages,
+					redteamHistory: messagesToRedteamHistory(messages)
+				},
+				tokenUsage: totalTokenUsage
+			};
+		} catch (error) {
+			logger.error(`Error in MemoryPoisoningProvider: ${error}`);
+			throw error;
+		}
+	}
+};
+//#endregion
+export { MemoryPoisoningProvider };
+
+//# sourceMappingURL=memoryPoisoning-BFemS_FF.js.map