dreadnode 2.0.33__tar.gz → 2.0.35__tar.gz

{dreadnode-2.0.33 → dreadnode-2.0.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dreadnode
-Version: 2.0.33
+Version: 2.0.35
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io
@@ -9,6 +9,9 @@ License-File: LICENSE
 Requires-Python: <3.14,>=3.11
 Requires-Dist: aiofiles<25.0.0,>=24.1.0
 Requires-Dist: art<7.0.0,>=6.5
+Requires-Dist: aws-sdk-bedrock-runtime>=0.7.0; python_version >= '3.12'
+Requires-Dist: awscrt>=0.27.0; python_version >= '3.12'
+Requires-Dist: boto3>=1.40.0
 Requires-Dist: coolname<3.0.0,>=2.2.0
 Requires-Dist: croniter<7.0.0,>=6.0.0
 Requires-Dist: cyclopts>=4.2.0
@@ -40,6 +43,7 @@ Requires-Dist: pydantic-xml>=2.14.0
 Requires-Dist: pydantic<3.0.0,>=2.9.2
 Requires-Dist: pyyaml>=6.0.2
 Requires-Dist: scipy<2.0.0,>=1.11.0
+Requires-Dist: smithy-aws-core>=0.7.0; python_version >= '3.12'
 Requires-Dist: soundfile<1.0.0,>=0.13.1
 Requires-Dist: starlette<1.4.0,>=1.3.1
 Requires-Dist: textual>=8.0.2
@@ -62,6 +66,7 @@ Requires-Dist: textstat<1.0.0,>=0.7.10; extra == 'all'
 Requires-Dist: torch>=2.9.0; extra == 'all'
 Provides-Extra: claude-code
 Requires-Dist: claude-agent-sdk>=0.1.0; extra == 'claude-code'
+Provides-Extra: nova-sonic
 Provides-Extra: scoring
 Requires-Dist: confusables<2.0.0,>=1.2.0; extra == 'scoring'
 Requires-Dist: nltk<4.0.0,>=3.9.1; extra == 'scoring'
@@ -379,6 +384,9 @@ pip install -U "dreadnode[scoring]"
 # Optional training and serving stack
 pip install -U "dreadnode[training]"
 
+# Amazon Nova Sonic speech-to-speech target (requires Python >=3.12)
+pip install -U "dreadnode[nova-sonic]"
+
 # All optional features
 pip install -U "dreadnode[all]"
 ```

{dreadnode-2.0.33 → dreadnode-2.0.35}/README.md

@@ -298,6 +298,9 @@ pip install -U "dreadnode[scoring]"
 # Optional training and serving stack
 pip install -U "dreadnode[training]"
 
+# Amazon Nova Sonic speech-to-speech target (requires Python >=3.12)
+pip install -U "dreadnode[nova-sonic]"
+
 # All optional features
 pip install -U "dreadnode[all]"
 ```

{dreadnode-2.0.33 → dreadnode-2.0.35}/dreadnode/agents/agent.py

@@ -50,6 +50,7 @@ from dreadnode.agents.reactions import (
     Retry,
     RetryWithFeedback,
 )
+from dreadnode.agents.sanitize import sanitize_orphan_tool_messages
 from dreadnode.agents.tools import Tool, ToolCall, ToolMode, Toolset, discover_tools_on_obj
 from dreadnode.agents.trajectory import Trajectory
 from dreadnode.core.exceptions import warn_at_user_stacklevel
@@ -329,6 +330,12 @@ class Agent(Executor[AgentEvent, Trajectory]):
             messages, params, post_transform = await transform_callback(messages, params)
             post_transforms.append(post_transform)
 
+        # ENG-7343 / ENG-6214: general tool-call repair at the provider boundary.
+        # Strip orphan tool_results and synthesize placeholders for tool_use
+        # blocks whose results were lost (cancel mid-tool, compaction split).
+        # Anthropic + OpenAI both 400 on the orphan shape.
+        messages = sanitize_orphan_tool_messages(messages)
+
         try:
             if self.cache is not None and self.generator.supports_prompt_caching():
                 messages = caching.apply_cache_mode_to_messages(self.cache, [messages])[0]

dreadnode-2.0.35/dreadnode/agents/sanitize.py

@@ -0,0 +1,150 @@
+"""Trajectory sanitization for tool-call/tool-result integrity (ENG-7343, ENG-6214).
+
+Strict providers (Anthropic, OpenAI, and OpenAI-compatible gateways) reject
+requests whose tool-call structure is malformed. Mid-tool cancellation,
+compaction, session resume, and weak-model output can all produce shapes that
+400 the entire request and leave a session unrecoverable. This module is the
+single pre-provider chokepoint that repairs them.
+
+Two failure families, both surfacing as request-fatal 400s, are handled here:
+
+1. **Orphan pairs.** An assistant ``tool_call`` with no matching ``tool_result``
+   (or the inverse). Anthropic 400s with "unexpected tool_use_id ... must have a
+   corresponding tool_use block". Cause: cancel mid-tool, or compaction splitting
+   a pair across the summarization boundary.
+
+2. **Malformed tool_calls that the adapter silently drops.** A ``tool_call`` with
+   a blank ``function.name`` is dropped by Responses-API adapters while its
+   ``function_call_output`` survives, producing OpenAI's
+   "No tool call found for function call output with call_id ..." 400 — the same
+   symptom as (1) but a different root cause the orphan pass cannot see (the id
+   is present on both sides, so the pair *looks* complete). An empty
+   ``tool_calls`` array is likewise rejected by some gateways (DeepSeek). These
+   are normalized *before* the orphan analysis. Reference: hermes-agent
+   ``agent/agent_runtime_helpers.py`` pre-call sanitizer.
+
+None of these passes mutate the input messages or the persisted trajectory —
+repaired messages are shallow copies, so stored history and prompt caching stay
+byte-stable.
+"""
+
+from collections import Counter
+
+from loguru import logger
+
+from dreadnode.generators.message import Message
+
+_INTERRUPTED_TOOL_RESULT = "[Tool execution was interrupted]"
+# A blank tool-call name is invalid anyway; a non-empty sentinel keeps the call
+# paired with its result through Responses-API adapters that would otherwise drop
+# the nameless call and orphan its output.
+_EMPTY_NAME_SENTINEL = "invalid_tool_call"
+
+
+def _repair_tool_calls(messages: list[Message]) -> tuple[list[Message], int, int]:
+    """Normalize assistant ``tool_calls`` that strict providers reject.
+
+    - Empty ``tool_calls`` list → ``None`` (some gateways 400 on empty arrays).
+    - Blank ``function.name`` → ``_EMPTY_NAME_SENTINEL`` so the call is not
+      silently dropped by the adapter and orphaned from its output (ENG-7343).
+
+    Returns ``(messages, emptied, renamed)``. Never mutates the input.
+    """
+    result: list[Message] = []
+    emptied = 0
+    renamed = 0
+
+    for m in messages:
+        if m.role != "assistant" or not m.tool_calls:
+            # Collapse an empty (but non-None) tool_calls array to None.
+            if m.role == "assistant" and m.tool_calls is not None and not m.tool_calls:
+                result.append(m.model_copy(update={"tool_calls": None}))
+                emptied += 1
+            else:
+                result.append(m)
+            continue
+
+        new_calls = []
+        changed = False
+        for tc in m.tool_calls:
+            if (tc.function.name or "").strip():
+                new_calls.append(tc)
+                continue
+            new_calls.append(
+                tc.model_copy(
+                    update={
+                        "function": tc.function.model_copy(update={"name": _EMPTY_NAME_SENTINEL})
+                    }
+                )
+            )
+            renamed += 1
+            changed = True
+
+        result.append(m.model_copy(update={"tool_calls": new_calls}) if changed else m)
+
+    return result, emptied, renamed
+
+
+def sanitize_orphan_tool_messages(messages: list[Message]) -> list[Message]:
+    """Return ``messages`` with tool-call/result integrity restored.
+
+    Runs the malformed-tool_call repair, then resolves orphan pairs. Does not
+    mutate the input list. Idempotent: ``f(f(x)) == f(x)``.
+    """
+    messages, emptied, renamed = _repair_tool_calls(messages)
+
+    tool_use_ids: set[str] = {
+        tc.id for m in messages if m.role == "assistant" and m.tool_calls for tc in m.tool_calls
+    }
+    # A *count* of available results per id, not a set: duplicate or blank ids
+    # (weak models behind OpenAI-compatible gateways emit both) would collapse
+    # in a set, so a second same-id call whose result is missing would never be
+    # synthesized and reach the provider unmatched. Each call consumes one
+    # available result; a call with none left gets a synthesized result.
+    available_results: Counter[str] = Counter(
+        m.tool_call_id for m in messages if m.role == "tool" and m.tool_call_id is not None
+    )
+
+    result: list[Message] = []
+    synthesized = 0
+    stripped = 0
+
+    for m in messages:
+        if m.role == "tool" and m.tool_call_id is not None and m.tool_call_id not in tool_use_ids:
+            stripped += 1
+            continue
+
+        result.append(m)
+
+        if m.role == "assistant" and m.tool_calls:
+            for tc in m.tool_calls:
+                if available_results[tc.id] > 0:
+                    # Reserve one real result for this call; the rest of the loop
+                    # keeps it in place when it is reached.
+                    available_results[tc.id] -= 1
+                    continue
+                result.append(
+                    Message(
+                        role="tool",
+                        tool_call_id=tc.id,
+                        content=_INTERRUPTED_TOOL_RESULT,
+                    )
+                )
+                synthesized += 1
+
+    if synthesized or stripped or emptied or renamed:
+        # INFO, not DEBUG: any repair here means a malformed/orphan tool shape
+        # reached the provider boundary — a signal the compaction boundary
+        # detector, a cancel path, or a weak model let something through. We
+        # want to see this firing in the wild, not silently paper over it.
+        # See ENG-7343 / ENG-6551 Phase 2.
+        logger.info(
+            "sanitize_orphan_tool_messages: synthesized={}, stripped={}, "
+            "emptied_tool_calls={}, renamed_blank_tool_calls={}",
+            synthesized,
+            stripped,
+            emptied,
+            renamed,
+        )
+
+    return result

{dreadnode-2.0.33 → dreadnode-2.0.35}/dreadnode/agents/subagent.py

@@ -11,6 +11,7 @@ from textwrap import dedent
 
 from loguru import logger
 
+from dreadnode.agents.events import AgentEnd
 from dreadnode.agents.tools import Toolset, tool_method
 from dreadnode.core.meta import Config
 from dreadnode.generators.message import Message
@@ -207,6 +208,21 @@ class SubAgentToolset(Toolset):
             logger.error(f"Sub-agent failed: {e}")
             return f"Sub-agent failed: {e}"
         else:
+            terminal_event = next(
+                (event for event in reversed(trajectory.events) if isinstance(event, AgentEnd)),
+                None,
+            )
+            if terminal_event is not None and terminal_event.error:
+                error_text = str(terminal_event.error)
+                logger.error(
+                    "Sub-agent ended with error | type={} | message={}",
+                    type(terminal_event.error).__name__
+                    if isinstance(terminal_event.error, BaseException)
+                    else "error",
+                    error_text,
+                )
+                return f"Sub-agent failed: {error_text}"
+
             # Get the last assistant message content as the response
             last_message = trajectory.messages[-1] if trajectory.messages else None
             response = str(last_message.content) if last_message else ""

{dreadnode-2.0.33 → dreadnode-2.0.35}/dreadnode/agents/tools.py

@@ -121,8 +121,15 @@ class FunctionDefinition(BaseModel):
         if not isinstance(value, dict):
             return value
 
-        if value.get("type") == "object" and value.get("properties") == {}:
-            return None
+        # A function definition must always carry a parameters object with a
+        # `properties` key so it survives model_dump(exclude_none=True) and satisfies
+        # strict providers (e.g. Together, DeepInfra) that reject tool definitions
+        # missing the `parameters` field. Fill in an empty `properties` when absent
+        # while preserving any sibling schema keys (additionalProperties,
+        # patternProperties, required, $defs, ...) so free-form-map and strict
+        # no-arg schemas are not silently flattened.
+        if value.get("type") == "object" and not value.get("properties"):
+            return {**value, "properties": value.get("properties") or {}}
 
         return value
 

{dreadnode-2.0.33 → dreadnode-2.0.35}/dreadnode/airt/__init__.py

@@ -62,6 +62,7 @@ from dreadnode.airt.alignment_faking import alignment_faking_attack
 from dreadnode.airt.analogy_escalation import analogy_escalation_attack
 from dreadnode.airt.aprt_progressive import aprt_progressive_attack
 from dreadnode.airt.assessment import Assessment
+from dreadnode.airt.atlas import atlas_attack
 from dreadnode.airt.attention_shifting import attention_shifting_attack
 from dreadnode.airt.autodan_turbo import autodan_turbo_attack
 from dreadnode.airt.autoredteamer import autoredteamer_attack
@@ -101,6 +102,7 @@ from dreadnode.airt.salami_slicing import salami_slicing_attack
 from dreadnode.airt.self_persuasion import self_persuasion_attack
 from dreadnode.airt.siren import siren_attack
 from dreadnode.airt.tap import tap_attack
+from dreadnode.airt.target import extract_response_text, extract_tool_calls
 from dreadnode.airt.targets import (
     TargetAuth,
     TargetSpec,
@@ -121,6 +123,7 @@ __all__ = [
     "alignment_faking_attack",
     "analogy_escalation_attack",
     "aprt_progressive_attack",
+    "atlas_attack",
     "attention_shifting_attack",
     "autodan_turbo_attack",
     "autoredteamer_attack",
@@ -131,6 +134,8 @@ __all__ = [
     "deep_inception_attack",
     "drattack",
     "echo_chamber_attack",
+    "extract_response_text",
+    "extract_tool_calls",
     "genetic_persona_attack",
     "goat_attack",
     "goat_v2_attack",

{dreadnode-2.0.33 → dreadnode-2.0.35}/dreadnode/airt/assessment.py

@@ -138,6 +138,22 @@ class Assessment:
 
         self.target_config = target_config
         self.attacker_config = attacker_config
+
+        # Infer first-class model ids from the configs when not passed explicitly,
+        # so a user who only provides target_config / attacker_config still gets
+        # model metadata on the assessment header AND findings (mirrors the
+        # platform-side backfill). Keys match the capability/TUI convention.
+        if self.target_model is None and self.target_config:
+            self.target_model = self.target_config.get("model")
+        if self.attacker_model is None and self.attacker_config:
+            self.attacker_model = self.attacker_config.get("model") or self.attacker_config.get(
+                "attacker_model"
+            )
+        if self.judge_model is None and self.attacker_config:
+            self.judge_model = self.attacker_config.get(
+                "evaluator_model"
+            ) or self.attacker_config.get("judge")
+
         self._attack_manifest = attack_manifest
         self._workflow_run_id = workflow_run_id
         self._workflow_script = workflow_script
@@ -350,6 +366,15 @@ class Assessment:
             study.airt_category = self.goal_category
         if self.goal_category and not study.airt_sub_category:
             study.airt_sub_category = self.goal_category
+        # Propagate the assessment's model identifiers so findings carry the
+        # target/judge metadata without the caller passing airt_* kwargs to the
+        # attack factory (e.g. multimodal_attack, which the user builds directly).
+        if self.target_model and not study.airt_target_model:
+            study.airt_target_model = self.target_model
+        if self.judge_model and not study.airt_evaluator_model:
+            study.airt_evaluator_model = self.judge_model
+        if self.attacker_model and not study.airt_attacker_model:
+            study.airt_attacker_model = self.attacker_model
 
         from dreadnode.airt.analytics.types import GoalCategory