dreadnode 2.0.32__py3-none-any.whl → 2.0.34__py3-none-any.whl

dreadnode/agents/agent.py

@@ -50,6 +50,7 @@ from dreadnode.agents.reactions import (
     Retry,
     RetryWithFeedback,
 )
+from dreadnode.agents.sanitize import sanitize_orphan_tool_messages
 from dreadnode.agents.tools import Tool, ToolCall, ToolMode, Toolset, discover_tools_on_obj
 from dreadnode.agents.trajectory import Trajectory
 from dreadnode.core.exceptions import warn_at_user_stacklevel
@@ -329,6 +330,12 @@ class Agent(Executor[AgentEvent, Trajectory]):
             messages, params, post_transform = await transform_callback(messages, params)
             post_transforms.append(post_transform)
 
+        # ENG-7343 / ENG-6214: general tool-call repair at the provider boundary.
+        # Strip orphan tool_results and synthesize placeholders for tool_use
+        # blocks whose results were lost (cancel mid-tool, compaction split).
+        # Anthropic + OpenAI both 400 on the orphan shape.
+        messages = sanitize_orphan_tool_messages(messages)
+
         try:
             if self.cache is not None and self.generator.supports_prompt_caching():
                 messages = caching.apply_cache_mode_to_messages(self.cache, [messages])[0]

dreadnode/agents/sanitize.py

@@ -0,0 +1,150 @@
+"""Trajectory sanitization for tool-call/tool-result integrity (ENG-7343, ENG-6214).
+
+Strict providers (Anthropic, OpenAI, and OpenAI-compatible gateways) reject
+requests whose tool-call structure is malformed. Mid-tool cancellation,
+compaction, session resume, and weak-model output can all produce shapes that
+400 the entire request and leave a session unrecoverable. This module is the
+single pre-provider chokepoint that repairs them.
+
+Two failure families, both surfacing as request-fatal 400s, are handled here:
+
+1. **Orphan pairs.** An assistant ``tool_call`` with no matching ``tool_result``
+   (or the inverse). Anthropic 400s with "unexpected tool_use_id ... must have a
+   corresponding tool_use block". Cause: cancel mid-tool, or compaction splitting
+   a pair across the summarization boundary.
+
+2. **Malformed tool_calls that the adapter silently drops.** A ``tool_call`` with
+   a blank ``function.name`` is dropped by Responses-API adapters while its
+   ``function_call_output`` survives, producing OpenAI's
+   "No tool call found for function call output with call_id ..." 400 — the same
+   symptom as (1) but a different root cause the orphan pass cannot see (the id
+   is present on both sides, so the pair *looks* complete). An empty
+   ``tool_calls`` array is likewise rejected by some gateways (DeepSeek). These
+   are normalized *before* the orphan analysis. Reference: hermes-agent
+   ``agent/agent_runtime_helpers.py`` pre-call sanitizer.
+
+None of these passes mutate the input messages or the persisted trajectory —
+repaired messages are shallow copies, so stored history and prompt caching stay
+byte-stable.
+"""
+
+from collections import Counter
+
+from loguru import logger
+
+from dreadnode.generators.message import Message
+
+_INTERRUPTED_TOOL_RESULT = "[Tool execution was interrupted]"
+# A blank tool-call name is invalid anyway; a non-empty sentinel keeps the call
+# paired with its result through Responses-API adapters that would otherwise drop
+# the nameless call and orphan its output.
+_EMPTY_NAME_SENTINEL = "invalid_tool_call"
+
+
+def _repair_tool_calls(messages: list[Message]) -> tuple[list[Message], int, int]:
+    """Normalize assistant ``tool_calls`` that strict providers reject.
+
+    - Empty ``tool_calls`` list → ``None`` (some gateways 400 on empty arrays).
+    - Blank ``function.name`` → ``_EMPTY_NAME_SENTINEL`` so the call is not
+      silently dropped by the adapter and orphaned from its output (ENG-7343).
+
+    Returns ``(messages, emptied, renamed)``. Never mutates the input.
+    """
+    result: list[Message] = []
+    emptied = 0
+    renamed = 0
+
+    for m in messages:
+        if m.role != "assistant" or not m.tool_calls:
+            # Collapse an empty (but non-None) tool_calls array to None.
+            if m.role == "assistant" and m.tool_calls is not None and not m.tool_calls:
+                result.append(m.model_copy(update={"tool_calls": None}))
+                emptied += 1
+            else:
+                result.append(m)
+            continue
+
+        new_calls = []
+        changed = False
+        for tc in m.tool_calls:
+            if (tc.function.name or "").strip():
+                new_calls.append(tc)
+                continue
+            new_calls.append(
+                tc.model_copy(
+                    update={
+                        "function": tc.function.model_copy(update={"name": _EMPTY_NAME_SENTINEL})
+                    }
+                )
+            )
+            renamed += 1
+            changed = True
+
+        result.append(m.model_copy(update={"tool_calls": new_calls}) if changed else m)
+
+    return result, emptied, renamed
+
+
+def sanitize_orphan_tool_messages(messages: list[Message]) -> list[Message]:
+    """Return ``messages`` with tool-call/result integrity restored.
+
+    Runs the malformed-tool_call repair, then resolves orphan pairs. Does not
+    mutate the input list. Idempotent: ``f(f(x)) == f(x)``.
+    """
+    messages, emptied, renamed = _repair_tool_calls(messages)
+
+    tool_use_ids: set[str] = {
+        tc.id for m in messages if m.role == "assistant" and m.tool_calls for tc in m.tool_calls
+    }
+    # A *count* of available results per id, not a set: duplicate or blank ids
+    # (weak models behind OpenAI-compatible gateways emit both) would collapse
+    # in a set, so a second same-id call whose result is missing would never be
+    # synthesized and reach the provider unmatched. Each call consumes one
+    # available result; a call with none left gets a synthesized result.
+    available_results: Counter[str] = Counter(
+        m.tool_call_id for m in messages if m.role == "tool" and m.tool_call_id is not None
+    )
+
+    result: list[Message] = []
+    synthesized = 0
+    stripped = 0
+
+    for m in messages:
+        if m.role == "tool" and m.tool_call_id is not None and m.tool_call_id not in tool_use_ids:
+            stripped += 1
+            continue
+
+        result.append(m)
+
+        if m.role == "assistant" and m.tool_calls:
+            for tc in m.tool_calls:
+                if available_results[tc.id] > 0:
+                    # Reserve one real result for this call; the rest of the loop
+                    # keeps it in place when it is reached.
+                    available_results[tc.id] -= 1
+                    continue
+                result.append(
+                    Message(
+                        role="tool",
+                        tool_call_id=tc.id,
+                        content=_INTERRUPTED_TOOL_RESULT,
+                    )
+                )
+                synthesized += 1
+
+    if synthesized or stripped or emptied or renamed:
+        # INFO, not DEBUG: any repair here means a malformed/orphan tool shape
+        # reached the provider boundary — a signal the compaction boundary
+        # detector, a cancel path, or a weak model let something through. We
+        # want to see this firing in the wild, not silently paper over it.
+        # See ENG-7343 / ENG-6551 Phase 2.
+        logger.info(
+            "sanitize_orphan_tool_messages: synthesized={}, stripped={}, "
+            "emptied_tool_calls={}, renamed_blank_tool_calls={}",
+            synthesized,
+            stripped,
+            emptied,
+            renamed,
+        )
+
+    return result

dreadnode/agents/subagent.py

@@ -11,6 +11,7 @@ from textwrap import dedent
 
 from loguru import logger
 
+from dreadnode.agents.events import AgentEnd
 from dreadnode.agents.tools import Toolset, tool_method
 from dreadnode.core.meta import Config
 from dreadnode.generators.message import Message
@@ -207,6 +208,21 @@ class SubAgentToolset(Toolset):
             logger.error(f"Sub-agent failed: {e}")
             return f"Sub-agent failed: {e}"
         else:
+            terminal_event = next(
+                (event for event in reversed(trajectory.events) if isinstance(event, AgentEnd)),
+                None,
+            )
+            if terminal_event is not None and terminal_event.error:
+                error_text = str(terminal_event.error)
+                logger.error(
+                    "Sub-agent ended with error | type={} | message={}",
+                    type(terminal_event.error).__name__
+                    if isinstance(terminal_event.error, BaseException)
+                    else "error",
+                    error_text,
+                )
+                return f"Sub-agent failed: {error_text}"
+
             # Get the last assistant message content as the response
             last_message = trajectory.messages[-1] if trajectory.messages else None
             response = str(last_message.content) if last_message else ""

dreadnode/agents/tools.py

@@ -121,8 +121,15 @@ class FunctionDefinition(BaseModel):
         if not isinstance(value, dict):
             return value
 
-        if value.get("type") == "object" and value.get("properties") == {}:
-            return None
+        # A function definition must always carry a parameters object with a
+        # `properties` key so it survives model_dump(exclude_none=True) and satisfies
+        # strict providers (e.g. Together, DeepInfra) that reject tool definitions
+        # missing the `parameters` field. Fill in an empty `properties` when absent
+        # while preserving any sibling schema keys (additionalProperties,
+        # patternProperties, required, $defs, ...) so free-form-map and strict
+        # no-arg schemas are not silently flattened.
+        if value.get("type") == "object" and not value.get("properties"):
+            return {**value, "properties": value.get("properties") or {}}
 
         return value
 

dreadnode/airt/__init__.py

@@ -101,6 +101,12 @@ from dreadnode.airt.salami_slicing import salami_slicing_attack
 from dreadnode.airt.self_persuasion import self_persuasion_attack
 from dreadnode.airt.siren import siren_attack
 from dreadnode.airt.tap import tap_attack
+from dreadnode.airt.targets import (
+    TargetAuth,
+    TargetSpec,
+    build_target,
+    nova_sonic_target,
+)
 from dreadnode.airt.templatefuzz import templatefuzz_attack
 from dreadnode.airt.tmap_trajectory import tmap_trajectory_attack
 from dreadnode.airt.trojail import trojail_attack
@@ -108,6 +114,8 @@ from dreadnode.airt.watermark_removal import watermark_removal_attack
 
 __all__ = [
     "Assessment",
+    "TargetAuth",
+    "TargetSpec",
     "adversarial_reasoning_attack",
     "advpromptier_attack",
     "alignment_faking_attack",
@@ -117,6 +125,7 @@ __all__ = [
     "autodan_turbo_attack",
     "autoredteamer_attack",
     "beast_attack",
+    "build_target",
     "cot_jailbreak_attack",
     "crescendo_attack",
     "deep_inception_attack",
@@ -136,6 +145,7 @@ __all__ = [
     "multimodal_attack",
     "nes_attack",
     "nexus_attack",
+    "nova_sonic_target",
     "pair_attack",
     "persona_hijack_attack",
     "prompt_attack",

dreadnode/airt/assessment.py

@@ -138,6 +138,22 @@ class Assessment:
 
         self.target_config = target_config
         self.attacker_config = attacker_config
+
+        # Infer first-class model ids from the configs when not passed explicitly,
+        # so a user who only provides target_config / attacker_config still gets
+        # model metadata on the assessment header AND findings (mirrors the
+        # platform-side backfill). Keys match the capability/TUI convention.
+        if self.target_model is None and self.target_config:
+            self.target_model = self.target_config.get("model")
+        if self.attacker_model is None and self.attacker_config:
+            self.attacker_model = self.attacker_config.get("model") or self.attacker_config.get(
+                "attacker_model"
+            )
+        if self.judge_model is None and self.attacker_config:
+            self.judge_model = self.attacker_config.get(
+                "evaluator_model"
+            ) or self.attacker_config.get("judge")
+
         self._attack_manifest = attack_manifest
         self._workflow_run_id = workflow_run_id
         self._workflow_script = workflow_script
@@ -350,6 +366,15 @@ class Assessment:
             study.airt_category = self.goal_category
         if self.goal_category and not study.airt_sub_category:
             study.airt_sub_category = self.goal_category
+        # Propagate the assessment's model identifiers so findings carry the
+        # target/judge metadata without the caller passing airt_* kwargs to the
+        # attack factory (e.g. multimodal_attack, which the user builds directly).
+        if self.target_model and not study.airt_target_model:
+            study.airt_target_model = self.target_model
+        if self.judge_model and not study.airt_evaluator_model:
+            study.airt_evaluator_model = self.judge_model
+        if self.attacker_model and not study.airt_attacker_model:
+            study.airt_attacker_model = self.attacker_model
 
         from dreadnode.airt.analytics.types import GoalCategory
 

dreadnode/airt/message_parts.py

@@ -46,6 +46,18 @@ def _mime_for_extension(ext: str | None, default: str) -> str:
     return _MIME_BY_EXT.get(ext.lower().lstrip("."), default)
 
 
+# Legacy/alias MIME types that browsers handle poorly, mapped to the standard.
+_MIME_ALIASES = {
+    "audio/x-wav": "audio/wav",
+    "audio/wave": "audio/wav",
+    "audio/x-pn-wav": "audio/wav",
+}
+
+
+def _normalize_mime(mime: str | None) -> str | None:
+    return _MIME_ALIASES.get(mime, mime) if mime else mime
+
+
 def text_part(
     text: str,
     *,
@@ -106,9 +118,14 @@ def _media_part(
 ) -> dict[str, t.Any]:
     """Build a media message part, storing bytes as a content-addressed artifact."""
     meta = _store_bytes_as_artifact(span, data, filename=filename)
+    # Prefer the caller's canonical media_type over log_artifact's guessed MIME:
+    # Python's mimetypes maps `.wav` to the legacy `audio/x-wav`, which some
+    # browsers refuse to play in an <audio> element. `_normalize_mime` maps such
+    # aliases back to the standard type.
+    resolved_mime = _normalize_mime(media_type or (meta.get("mime_type") if meta else None))
     source: dict[str, t.Any] = {
         "ref": "artifact",
-        "media_type": (meta.get("mime_type") if meta else None) or media_type,
+        "media_type": resolved_mime,
         "byte_size": (meta.get("size") if meta else None) or len(data),
         "filename": (meta.get("name") if meta else None) or filename,
     }
@@ -226,12 +243,75 @@ def response_to_parts(
     content-addressed artifacts; text is inlined.
     """
     from dreadnode.core.types import Audio, Image, Video
+    from dreadnode.generators.message import (
+        ContentAudioInput,
+        ContentImageUrl,
+        ContentText,
+        ContentVideoUrl,
+    )
 
     parts: list[dict[str, t.Any]] = []
 
     def _walk(value: t.Any) -> None:
         if value is None:
             return
+        # SDK message content-part types (media-out responses: image/audio/video
+        # generated by the target land here). Extract the real bytes/text instead
+        # of stringifying the part's repr.
+        if isinstance(value, ContentText):
+            if value.text:
+                parts.append(text_part(value.text))
+            return
+        if isinstance(value, ContentImageUrl):
+            url = value.image_url.url
+            mime = "image/png"
+            if url.startswith("data:") and ";" in url:
+                mime = url[5:].split(";", 1)[0] or mime
+            parts.append(
+                _media_part(
+                    span,
+                    value.to_bytes(),
+                    kind="image",
+                    media_type=mime,
+                    filename="response_image.png",
+                    transform=None,
+                    variant="output",
+                    caption=None,
+                )
+            )
+            return
+        if isinstance(value, ContentAudioInput):
+            fmt = getattr(value.input_audio, "format", "wav") or "wav"
+            parts.append(
+                _media_part(
+                    span,
+                    value.to_bytes(),
+                    kind="audio",
+                    media_type=_mime_for_extension(fmt, "audio/wav"),
+                    filename=f"response_audio.{fmt}",
+                    transform=None,
+                    variant="output",
+                    caption=None,
+                )
+            )
+            return
+        if isinstance(value, ContentVideoUrl):
+            import base64 as _b64
+
+            data = _b64.b64decode(value.file.file_data.split(",", 1)[-1])
+            parts.append(
+                _media_part(
+                    span,
+                    data,
+                    kind="video",
+                    media_type=value.file.mimetype or "video/mp4",
+                    filename=value.file.filename or "response_video.mp4",
+                    transform=None,
+                    variant="output",
+                    caption=None,
+                )
+            )
+            return
         if isinstance(value, str):
             if value:
                 parts.append(text_part(value))