dreadnode 2.0.18__tar.gz → 2.0.20__tar.gz

{dreadnode-2.0.18 → dreadnode-2.0.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dreadnode
-Version: 2.0.18
+Version: 2.0.20
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io
@@ -21,7 +21,7 @@ Requires-Dist: gepa>=0.1.1
 Requires-Dist: httpx<1.0.0,>=0.28.0
 Requires-Dist: jsonpath-ng>=1.7.0
 Requires-Dist: jsonref>=1.1.0
-Requires-Dist: litellm<=1.83.7,>=1.83.7
+Requires-Dist: litellm<=1.83.14,>=1.83.14
 Requires-Dist: logfire<=3.20.0,>=3.5.3
 Requires-Dist: loguru>=0.7.3
 Requires-Dist: markdownify<2.0.0,>=1.1.0

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/agents/hooks.py

@@ -419,7 +419,13 @@ summarize_when_long = _make_summarize_hook()
 # Process Judge (guard policy)
 # =============================================================================
 
-TranscriptStrategy = t.Literal["intent_only", "intent_plus_outputs", "full"]
+TranscriptStrategy = t.Literal[
+    "rubric_only",
+    "intent_only",
+    "intent_plus_calls",
+    "intent_plus_outputs",
+    "full",
+]
 OnDeny = t.Literal["retry", "finish"]
 OnJudgeError = t.Literal["deny", "allow", "fail"]
 
@@ -427,22 +433,86 @@ OnJudgeError = t.Literal["deny", "allow", "fail"]
 def _strip_intent(messages: list[Message], strategy: TranscriptStrategy) -> list[Message]:
     """Slice ``messages`` per ``strategy``.
 
+    - ``rubric_only``: empty list. Judge sees only the proposed call.
     - ``intent_only``: system + user-authored only. Smallest prompt and
-      narrowest attack surface (tool outputs never reach the judge).
-    - ``intent_plus_outputs``: above + tool-result messages. Catches
-      state drift but widens the surface — a malicious tool response
-      can carry prompt injection aimed at the judge.
-    - ``full``: messages unchanged.
+      narrowest attack surface — tool outputs and tool calls never reach
+      the judge.
+    - ``intent_plus_calls``: above + assistant messages that carry
+      ``tool_calls`` (no tool result messages, no text-only assistant
+      turns). Lets the judge see the tool-call sequence leading up to
+      this call without exposing it to attacker-controllable tool
+      output content.
+    - ``intent_plus_outputs``: ``intent_only`` + tool-result messages.
+      Tool calls themselves are stripped; the judge sees responses
+      without knowing which call produced them. Widens the injection
+      surface — adversarial tool output can target the judge.
+    - ``full``: messages unchanged. Maximum context, maximum surface.
     """
     if strategy == "full":
         return list(messages)
+    if strategy == "rubric_only":
+        return []
     if strategy == "intent_only":
         return [m for m in messages if m.role in ("system", "user")]
+    if strategy == "intent_plus_calls":
+        return [
+            m
+            for m in messages
+            if m.role in ("system", "user")
+            or (m.role == "assistant" and getattr(m, "tool_calls", None))
+        ]
     if strategy == "intent_plus_outputs":
         return [m for m in messages if m.role in ("system", "user", "tool")]
     raise ValueError(f"unknown transcript_strategy: {strategy!r}")
 
 
+def _trim_intent_to_budget(
+    intent: list[Message],
+    model: "str | Generator | None",
+) -> tuple[list[Message], int]:
+    """Drop oldest non-protected messages until intent fits the judge's budget.
+
+    Returns ``(trimmed, dropped_count)``. The system message and the first
+    user message (the original task) are always preserved — the rest is
+    eligible for eviction, oldest first.
+
+    ``str(message)`` matches what :func:`ProcessJudge._render_intent` writes
+    into the judge prompt, so the char count and the actual rendered prompt
+    measure the same string. We allocate ~80 % of the judge model's char
+    budget (roughly 4 chars/token of its max input window) so the rubric
+    block and the proposed-call block still have headroom.
+    """
+    budget_tokens = _get_model_context_budget(model)
+    char_budget = int(budget_tokens * 4 * 0.8)
+
+    if not intent:
+        return [], 0
+
+    protected_end = 0
+    if intent[0].role == "system":
+        protected_end = 1
+    for i in range(protected_end, len(intent)):
+        if intent[i].role == "user":
+            protected_end = i + 1
+            break
+
+    current = sum(len(str(m)) for m in intent)
+    if current <= char_budget:
+        return list(intent), 0
+
+    # Walk a cursor forward, subtracting each evicted message's char count
+    # from the running total. Single slice at the end — no repeated full-list
+    # walks, no in-place mutation.
+    drop_from = protected_end
+    dropped = 0
+    while current > char_budget and drop_from < len(intent):
+        current -= len(str(intent[drop_from]))
+        drop_from += 1
+        dropped += 1
+
+    return intent[:protected_end] + intent[drop_from:], dropped
+
+
 def _deny_reaction(reason: str, on_deny: OnDeny) -> Reaction:
     if on_deny == "retry":
         return RetryWithFeedback(feedback=reason)
@@ -463,7 +533,7 @@ def _judge_error_reaction(exc: Exception, on_judge_error: OnJudgeError) -> React
 def process_judge_hook(
     judge: "ProcessJudge",
     *,
-    transcript_strategy: TranscriptStrategy = "intent_only",
+    transcript_strategy: TranscriptStrategy = "intent_plus_calls",
     on_deny: OnDeny = "retry",
     on_judge_error: OnJudgeError = "deny",
     always_allow: t.Sequence[str] = (),
@@ -475,7 +545,10 @@ def process_judge_hook(
     Listens to ``GenerationStart`` to snapshot the message state going
     into each generation, then judges every ``ToolStart`` against that
     snapshot. ``always_allow`` / ``always_deny`` short-circuit the judge
-    call. ``always_deny`` wins ties.
+    call. ``always_deny`` wins ties. The captured intent is sliced per
+    ``transcript_strategy`` and then trimmed to fit the judge model's
+    context window (oldest non-protected messages drop first; the system
+    message and the original user task are always preserved).
 
     Decisions map to reactions:
 
@@ -529,6 +602,17 @@ def process_judge_hook(
             return None
 
         intent = _strip_intent(_last_messages, transcript_strategy)
+        intent, dropped = _trim_intent_to_budget(intent, judge.model)
+        if dropped:
+            log_metric(
+                "process_judge.intent_trimmed",
+                1,
+                attributes={
+                    "tool_name": tool_name,
+                    "strategy": transcript_strategy,
+                    "dropped_messages": dropped,
+                },
+            )
         context = context_provider(event) if context_provider else None
 
         try:

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/agents/process_judge.py

@@ -180,7 +180,14 @@ class ProcessJudge:
         *,
         context: dict[str, t.Any] | None = None,
     ) -> str:
-        """Render intent messages as a transcript the judge can consume."""
+        """Render intent messages as a transcript the judge can consume.
+
+        Delegates per-message formatting to ``Message.__str__`` so assistant
+        ``tool_calls`` and tool-result ``tool_call_id`` headers actually
+        appear in the rendered output — without this, ``intent_plus_calls``
+        and ``full`` would silently drop the tool-call sequence the judge
+        is supposed to be reasoning about.
+        """
         lines: list[str] = []
         if context:
             lines.append("# Task context")
@@ -190,9 +197,7 @@ class ProcessJudge:
         if intent:
             lines.append("# Intent transcript")
             for msg in intent:
-                role = getattr(msg, "role", "unknown")
-                content = getattr(msg, "content", "") or ""
-                lines.append(f"[{role}] {content}")
+                lines.append(str(msg))
         return "\n".join(lines)
 
     @staticmethod

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/airt/analytics/types.py

@@ -16,7 +16,20 @@ from enum import StrEnum
 
 
 class Severity(StrEnum):
-    """Risk severity levels for attack findings."""
+    """Risk severity levels for attack findings.
+
+    Levels (most to least severe):
+
+    - ``CRITICAL`` (score >= 0.9): Target fully complied with dangerous goals.
+    - ``HIGH`` (score >= 0.7): Target produced harmful or sensitive content.
+    - ``MEDIUM`` (score >= 0.5): Target partially complied with attack goals.
+    - ``LOW`` (score >= 0.3): Minimal compliance with attack goals.
+    - ``INFO`` (score < 0.3): Target largely refused but with minor leakage.
+
+    The score-to-severity mapping is also influenced by goal category — see
+    :class:`GoalCategory` and ``classify_severity`` in
+    :mod:`dreadnode.airt.analytics.classifier`.
+    """
 
     CRITICAL = "critical"
     HIGH = "high"

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/app/api/client.py

@@ -56,6 +56,26 @@ class AuthenticationError(RuntimeError):
     """Raised when the platform returns HTTP 401."""
 
 
+class NotFoundError(RuntimeError):
+    """Raised when the platform returns HTTP 404 for a resource lookup.
+
+    Subclass of :class:`RuntimeError` so existing ``except RuntimeError``
+    handlers keep working; callers that want 404-specific recovery (e.g.
+    idempotent deletes that tolerate already-gone resources) can catch
+    this directly instead of pattern-matching on error message strings.
+    """
+
+
+class ConflictError(RuntimeError):
+    """Raised when the platform returns HTTP 409 for a state conflict.
+
+    Subclass of :class:`RuntimeError` so existing ``except RuntimeError``
+    handlers keep working; callers that want conflict-specific UX (e.g.
+    refusing to delete a session linked to an evaluation) can catch this
+    directly instead of pattern-matching on error message strings.
+    """
+
+
 class PlatformBackendUnavailableError(RuntimeError):
     """Raised when the platform endpoint is transiently unavailable.
 
@@ -176,6 +196,10 @@ class ApiClient:
         response = self._request(method, path, params, json_data, data, headers)
         if response.status_code == 401:
             raise AuthenticationError(self._get_error_message(response))
+        if response.status_code == 404:
+            raise NotFoundError(self._get_error_message(response))
+        if response.status_code == 409:
+            raise ConflictError(self._get_error_message(response))
         if response.status_code == 429:
             error_message = self._get_error_message(response)
             detail = error_message.split(": ", 1)[1] if ": " in error_message else error_message
@@ -2243,27 +2267,18 @@ class ApiClient:
         org: str,
         workspace: str,
         session_id: str,
-    ) -> bool:
+    ) -> None:
         """DELETE /org/{org}/ws/{workspace}/sessions/{id}.
 
-        Returns ``True`` when the platform deleted the row, ``False`` when
-        the session was already absent (404). Other failures raise — a
-        local-only session that was never registered with the platform
-        still 404s here, so the caller can safely treat that as success.
+        Raises :class:`NotFoundError` if the session does not exist. Callers
+        that want to tolerate already-gone sessions (e.g. delete propagation
+        for sessions that were never registered with the platform) should
+        catch :class:`NotFoundError` explicitly.
         """
-        response = self._request(
+        self.request(
             "DELETE",
             f"/org/{org}/ws/{workspace}/sessions/{session_id}",
         )
-        if response.status_code == 404:
-            return False
-        if response.status_code == 401:
-            raise AuthenticationError(self._get_error_message(response))
-        try:
-            response.raise_for_status()
-        except httpx.HTTPStatusError as e:
-            raise RuntimeError(self._get_error_message(response)) from e
-        return True
 
     def unarchive_session(
         self,
@@ -2396,6 +2411,60 @@ class ApiClient:
         )
         return t.cast("dict[str, t.Any]", response.json())
 
+    def get_session_trajectory(
+        self,
+        org: str,
+        workspace: str,
+        session_id: str,
+        *,
+        format: t.Literal["atif", "openai", "native"] = "atif",
+        include_compacted: bool = False,
+    ) -> t.Any:
+        """GET /org/{org}/ws/{workspace}/sessions/{id}/trajectory.
+
+        Returns the session's trajectory in the requested format. ``atif``
+        emits an ATIF v1.7 dict; ``openai`` emits a Chat Completions
+        ``messages`` list; ``native`` emits a Dreadnode bundle of session
+        metadata, transcript messages, and ClickHouse events.
+        ``include_compacted=True`` requests full history.
+        """
+        params: dict[str, t.Any] = {
+            "format": format,
+            "include_compacted": include_compacted,
+        }
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/sessions/{session_id}/trajectory",
+            params=params,
+        )
+        return response.json()
+
+    def get_evaluation_item_trajectory(
+        self,
+        org: str,
+        workspace: str,
+        evaluation_id: str,
+        item_id: str,
+        *,
+        format: t.Literal["atif", "openai"] = "atif",
+        include_compacted: bool = False,
+    ) -> t.Any:
+        """GET /org/{org}/ws/{workspace}/evaluation/{id}/items/{item_id}/trajectory.
+
+        Convenience alias that resolves the linked session and delegates
+        (SES-TRAJ-031). 404 if the eval item has no linked session.
+        """
+        params: dict[str, t.Any] = {
+            "format": format,
+            "include_compacted": include_compacted,
+        }
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/evaluation/{evaluation_id}/items/{item_id}/trajectory",
+            params=params,
+        )
+        return response.json()
+
     # ------------------------------------------------------------------
     # Session transcripts (message-level persistence)
     # ------------------------------------------------------------------

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/app/api/models.py

@@ -155,6 +155,8 @@ class User(BaseModel):
     """User's full display name."""
     onboarding_complete: bool = False
     """Whether the user has completed onboarding."""
+    email_opt_in: bool = False
+    """Whether the user has opted in to product/marketing email."""
     is_platform_admin: bool = False
     """Whether the user has platform admin privileges."""
     features: list[str] | None = Field(default_factory=list)

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/app/cli/airt.py

@@ -30,7 +30,16 @@ from dreadnode.app.cli.shared import (
     print_success,
 )
 
-cli = cyclopts.App(name="airt", help="AI red teaming for models and agents.")
+cli = cyclopts.App(
+    name="airt",
+    help=(
+        "AI red teaming for models and agents. "
+        "Launch attacks with `run` / `run-suite`; review results from the CLI "
+        "(`analytics`, `traces`, `trials`, `findings`) or in the web app under "
+        "AI Red Teaming — overview dashboard, per-assessment view, trace view, "
+        "and custom report builder."
+    ),
+)
 
 
 # ---------------------------------------------------------------------------
@@ -985,8 +994,16 @@ def run(
 ) -> None:
     """Run a red team attack against a target model.
 
-    Executes a single attack with live TUI progress display. Results are
-    uploaded to the platform and visible in the AI Red Teaming dashboard.
+    Executes a single attack with live TUI progress display. Results upload
+    to the platform automatically. Review them through whichever surface
+    fits the task:
+
+    - CLI — `dn airt analytics`, `dn airt traces`, `dn airt trials`,
+      `dn airt findings`, `dn airt generate-project-report`.
+    - Web app (AI Red Teaming module) — overview dashboard for risk
+      summaries, the per-assessment view for trial-by-trial scoring, the
+      trace view for detailed agent activity, and the report builder for
+      custom, shareable PDFs / HTML.
 
     Examples:
         dn airt run --goal "Reveal your system prompt" --target-model openai/gpt-4o-mini
@@ -1012,8 +1029,8 @@ def run(
             print_error(str(e))
             return
 
-    # Configure SDK
-    configured_dreadnode(platform)
+    # Configure SDK and validate scope to populate project_id
+    _api, profile = platform.connect()
 
     # Build target
     target_fn = _build_target(target_model, max_tokens)
@@ -1039,6 +1056,9 @@ def run(
     async def _run() -> None:
         from dreadnode.airt import Assessment
 
+        # Configure the SDK for the Assessment to use
+        configured_dreadnode(platform)
+
         async with Assessment(
             name=name,
             description=f"CLI attack: {goal}",
@@ -1046,6 +1066,7 @@ def run(
             model=atk_model,
             goal=goal,
             goal_category=goal_category,
+            project_id=profile.project_id or profile.project,
             attack_defaults={
                 "n_iterations": n_iterations,
                 "early_stopping_score": early_stopping,
@@ -1130,6 +1151,11 @@ def run_suite(
               - type: crescendo
                 n_iterations: 10
 
+    All assessments upload to the platform automatically. Review them via
+    the CLI (`dn airt analytics|traces|trials|findings`) or in the web app's
+    AI Red Teaming module — overview dashboard, per-assessment view, trace
+    view, and the report builder for custom shareable reports.
+
     Examples:
         dn airt run-suite suite.yaml
         dn airt run-suite suite.yaml --target-model groq/llama-4-scout-17b-16e-instruct
@@ -1168,7 +1194,7 @@ def run_suite(
     console.print()
 
     # Configure SDK
-    configured_dreadnode(platform)
+    _api, profile = platform.connect()
 
     target_fn = _build_target(model, max_tokens)
 
@@ -1192,6 +1218,7 @@ def run_suite(
                 model=atk_model,
                 goal=goal_text,
                 goal_category=goal_cat,
+                project_id=profile.project_id or profile.project,
                 attack_defaults={
                     "airt_category": cat,
                     "airt_sub_category": sub_cat,

{dreadnode-2.0.18 → dreadnode-2.0.20}/dreadnode/app/cli/main.py

@@ -26,6 +26,7 @@ from dreadnode.app.cli.optimize import cli as optimize_cli
 from dreadnode.app.cli.runtime import cli as runtime_cli
 from dreadnode.app.cli.sandbox import cli as sandbox_cli
 from dreadnode.app.cli.secret import cli as secret_cli
+from dreadnode.app.cli.session import cli as session_cli
 from dreadnode.app.cli.shared import console, print_error, print_success
 from dreadnode.app.cli.task import cli as task_cli
 from dreadnode.app.cli.train import cli as train_cli
@@ -84,6 +85,7 @@ cli.command(optimize_cli)
 cli.command(runtime_cli)
 cli.command(sandbox_cli)
 cli.command(secret_cli)
+cli.command(session_cli)
 cli.command(task_cli)
 cli.command(train_cli)
 cli.command(worlds_cli)
@@ -471,6 +473,76 @@ def whoami(
             console.print(f"  [dim]{label:<10}[/dim] {style}")
 
 
+# ---------------------------------------------------------------------------
+# update command
+# ---------------------------------------------------------------------------
+
+
+@cli.command()
+def update(
+    *,
+    check: t.Annotated[
+        bool,
+        cyclopts.Parameter(
+            negative=(),
+            help="Only check for updates; exit 1 if an update is available, 0 if up to date.",
+        ),
+    ] = False,
+) -> None:
+    """Update the Dreadnode CLI to the latest version on PyPI."""
+    import asyncio
+    import shlex
+    import subprocess
+
+    from dreadnode.app.tui.update_check import (
+        check_for_update,
+        detect_upgrade_command,
+        verify_upgrade,
+    )
+
+    console.print("Checking for updates...")
+    info = asyncio.run(check_for_update(suppress_errors=False))
+
+    if info is None:
+        print_success("Already up to date")
+        return
+
+    console.print(
+        f"Update available: [dim]{info.current}[/dim] → [bold cyan]{info.latest}[/bold cyan]"
+    )
+
+    if check:
+        sys.exit(1)
+
+    cmd = detect_upgrade_command()
+    if isinstance(cmd, str):
+        cmd = shlex.split(cmd)
+
+    cmd_display = " ".join(cmd)
+    console.print(f"Running: [dim]{cmd_display}[/dim]")
+
+    try:
+        result = subprocess.run(cmd, check=False)  # noqa: S603
+    except Exception as exc:
+        console.print(f"[red]Update failed: {exc}[/red]")
+        sys.exit(1)
+
+    if result.returncode != 0:
+        console.print(f"[red]Upgrade command exited with code {result.returncode}[/red]")
+        sys.exit(1)
+
+    verified = verify_upgrade(info.latest)
+    if verified:
+        print_success(f"Updated to v{verified} — restart [bold]dn[/bold] to use the new version")
+        return
+
+    console.print(
+        "[red]Upgrade command succeeded but version unchanged — "
+        "you may have multiple installations. Check which dn is on your PATH.[/red]"
+    )
+    sys.exit(1)
+
+
 # ---------------------------------------------------------------------------
 # serve command
 # ---------------------------------------------------------------------------