dreadnode 2.0.47__tar.gz → 2.0.50__tar.gz

{dreadnode-2.0.47 → dreadnode-2.0.50}/LICENSE

@@ -175,18 +175,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 Dreadnode, Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -199,5 +188,3 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-
-# TODO change me

{dreadnode-2.0.47 → dreadnode-2.0.50}/PKG-INFO

@@ -1,17 +1,18 @@
 Metadata-Version: 2.5
 Name: dreadnode
-Version: 2.0.47
+Version: 2.0.50
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io
 Author-email: Dreadnode Team <support@dreadnode.io>
+License-Expression: Apache-2.0
 License-File: LICENSE
 Requires-Python: <3.14,>=3.11
 Requires-Dist: aiofiles<25.0.0,>=24.1.0
 Requires-Dist: art<7.0.0,>=6.5
 Requires-Dist: aws-sdk-bedrock-runtime>=0.7.0; python_version >= '3.12'
 Requires-Dist: awscrt>=0.27.0; python_version >= '3.12'
-Requires-Dist: boto3<=1.41.5,>=1.40.0
+Requires-Dist: boto3<2.0.0,>=1.40.0
 Requires-Dist: coolname<3.0.0,>=2.2.0
 Requires-Dist: croniter<7.0.0,>=6.0.0
 Requires-Dist: cyclopts>=4.2.0
@@ -19,31 +20,31 @@ Requires-Dist: datasets>=4.5.0
 Requires-Dist: ddgs>=9.0.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: fastmcp>=2.14.0
-Requires-Dist: fsspec[s3]<=2025.10.0,>=2025.10.0
+Requires-Dist: fsspec[s3]<2027.0.0,>=2025.10.0
 Requires-Dist: gepa>=0.1.1
 Requires-Dist: httpx<1.0.0,>=0.28.0
 Requires-Dist: jsonpath-ng>=1.7.0
 Requires-Dist: jsonref>=1.1.0
 Requires-Dist: jsonschema>=4.26.0
-Requires-Dist: litellm<=1.84.0,>=1.84.0
-Requires-Dist: logfire<=3.20.0,>=3.5.3
+Requires-Dist: litellm==1.101.3
+Requires-Dist: logfire<5.0.0,>=3.5.3
 Requires-Dist: loguru>=0.7.3
 Requires-Dist: markdown-it-py[linkify]>=2.1.0
 Requires-Dist: markdownify<2.0.0,>=1.1.0
 Requires-Dist: mcp<2.0.0,>=1.25.0
 Requires-Dist: networkx>=3.6.1
-Requires-Dist: numpy<=2.3.5,>=2.3.0
+Requires-Dist: numpy<2.5.0,>=2.3.0
 Requires-Dist: optuna<5.0.0,>=4.5.0
 Requires-Dist: orjson>=3.11.5
 Requires-Dist: packaging>=24.0
-Requires-Dist: pandas<3.0.0,>=2.2.3
+Requires-Dist: pandas<4.0.0,>=2.2.3
 Requires-Dist: pillow<13.0.0,>=11.0.0
 Requires-Dist: prompt-toolkit<4.0.0,>=3.0.52
 Requires-Dist: pyarrow>=4.0.0
 Requires-Dist: pydantic-xml>=2.14.0
 Requires-Dist: pydantic<3.0.0,>=2.9.2
 Requires-Dist: pyyaml>=6.0.2
-Requires-Dist: s3fs<=2025.10.0,>=2025.10.0
+Requires-Dist: s3fs<2027.0.0,>=2025.10.0
 Requires-Dist: scipy<2.0.0,>=1.11.0
 Requires-Dist: smithy-aws-core>=0.7.0; python_version >= '3.12'
 Requires-Dist: soundfile<1.0.0,>=0.13.1
@@ -83,6 +84,10 @@ Requires-Dist: scikit-learn<2.0.0,>=1.7.1; extra == 'scoring'
 Requires-Dist: sentence-transformers<6.0.0,>=5.1.0; extra == 'scoring'
 Requires-Dist: textblob<1.0.0,>=0.19.0; extra == 'scoring'
 Requires-Dist: textstat<1.0.0,>=0.7.10; extra == 'scoring'
+Provides-Extra: slip
+Requires-Dist: sentence-transformers<6.0.0,>=5.1.0; extra == 'slip'
+Requires-Dist: spacy<4,>=3.7; extra == 'slip'
+Requires-Dist: wordfreq<4,>=3; extra == 'slip'
 Provides-Extra: training
 Requires-Dist: ray[default,serve]<3.0.0,>=2.10.0; extra == 'training'
 Requires-Dist: torch>=2.9.0; extra == 'training'

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/agents/agent.py

@@ -141,8 +141,9 @@ def _replayable(messages: list[Message]) -> list[Message]:
     turn sends an empty text block, which some providers reject outright
     (see ``CacheControlOnEmptyTextFixup``) and none can use (ENG-7585).
 
-    Reasoning lives in ``metadata``, not ``content``, so a thinking-only
-    message is still replayable and must survive this filter.
+    Reasoning lives in ``metadata``, which ``Message.to_openai`` does not
+    serialise, so a thinking-only message survives this filter to stay in the
+    trajectory record — not because the reasoning itself is sent back.
     """
 
     def carries_nothing(message: Message) -> bool:
@@ -409,7 +410,7 @@ class Agent(Executor[AgentEvent, Trajectory]):
         messages = sanitize_orphan_tool_messages(messages)
 
         try:
-            if self.cache is not None and self.generator.supports_prompt_caching():
+            if self.cache is not None and await self.generator.supports_prompt_caching():
                 messages = caching.apply_cache_mode_to_messages(self.cache, [messages])[0]
             logger.trace(f"Generating with model '{self.generator.model}'. Messages: {messages!r}")
 

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/agents/engines/base.py

@@ -96,7 +96,12 @@ class PermissionBridge(t.Protocol):
     """
 
     async def request_tool_approval(
-        self, *, tool_name: str, tool_input: dict[str, t.Any]
+        self,
+        *,
+        tool_name: str,
+        tool_input: dict[str, t.Any],
+        tool_call_id: str | None = None,
+        reason: str | None = None,
     ) -> bool: ...
 
 

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/agents/events.py

@@ -161,18 +161,19 @@ class AgentStep(AgentEvent):
         if self.usage.cost_usd is not None:
             return self.usage.cost_usd
 
-        import litellm
+        from dreadnode.app.model_catalog import resolve_model_info
 
         if self.generator is None:
             return None
 
-        model = self.generator.model
-        while model not in litellm.model_cost:
-            if "/" not in model:
-                return None
-            model = "/".join(model.split("/")[1:])
-
-        model_info: AnyDict = litellm.model_cost[model]
+        # The gateway owns the alias -> deployment mapping, so it is the only
+        # thing that can price a ``dn/`` model. Guessing by stripping segments
+        # priced dn/deepseek-v4-flash 132% high (ENG-8431). The resolver picks
+        # the gateway up from the environment; passing this generator's own
+        # api_base would point it at a BYOK endpoint that owes us no catalog.
+        model_info: AnyDict = resolve_model_info(self.generator.model)
+        if not model_info:
+            return None
         input_token_cost = float(model_info.get("input_cost_per_token", 0))
         output_token_cost = float(model_info.get("output_cost_per_token", 0))
 

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/agents/hooks.py

@@ -389,18 +389,12 @@ def _get_model_context_budget(model_or_generator: "str | Generator | None") -> i
     if not isinstance(model_str, str):
         return 100_000
     try:
-        import litellm
-
-        lookup = model_str
-        while lookup not in litellm.model_cost:
-            if "/" not in lookup:
-                break
-            lookup = "/".join(lookup.split("/")[1:])
-        if lookup in litellm.model_cost:
-            info = litellm.model_cost[lookup]
-            max_input = info.get("max_input_tokens") or info.get("max_tokens", 0)
-            if max_input and max_input > 0:
-                return int(max_input * 0.75)
+        from dreadnode.app.model_catalog import resolve_model_info
+
+        info = resolve_model_info(model_str)
+        max_input = info.get("max_input_tokens") or info.get("max_tokens", 0)
+        if max_input and max_input > 0:
+            return int(max_input * 0.75)
     except Exception:  # noqa: S110 - best-effort model metadata fallback should stay quiet
         pass
     return 100_000
@@ -934,6 +928,8 @@ def process_judge_hook(
                 approved = await bridge.request_tool_approval(
                     tool_name=tool_name,
                     tool_input=tool_input,
+                    tool_call_id=event.tool_call.id,
+                    reason=decision.reason,
                 )
                 event.policy_decision = _decision_metadata(
                     source="judge",

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/agents/mcp/client.py

@@ -33,6 +33,7 @@ from dreadnode.agents.mcp.config import (
 )
 from dreadnode.agents.tools import Tool
 from dreadnode.app.paths import rotate_log
+from dreadnode.core.tls import cached_platform_ssl_context
 from dreadnode.generators.models import ErrorModel
 
 if t.TYPE_CHECKING:
@@ -42,6 +43,21 @@ if t.TYPE_CHECKING:
     from dreadnode.generators.message import Content
 
 
+def _create_mcp_http_client(
+    headers: dict[str, str] | None = None,
+    timeout: httpx.Timeout | None = None,
+    auth: httpx.Auth | None = None,
+) -> httpx.AsyncClient:
+    """Preserve MCP transport defaults while verifying against native trust."""
+    return httpx.AsyncClient(
+        headers=headers,
+        timeout=timeout if timeout is not None else httpx.Timeout(30.0, read=300.0),
+        auth=auth,
+        follow_redirects=True,
+        verify=cached_platform_ssl_context(),
+    )
+
+
 # An interactive (user-initiated) OAuth connect blocks on a human browser
 # round-trip, so the per-step init timeout must comfortably exceed the
 # localhost callback server's wait (_DEFAULT_CALLBACK_TIMEOUT = 300s).
@@ -611,7 +627,9 @@ class MCPClient:
                     "Accept": "application/json, text/event-stream",
                 }
             )
-            async with httpx.AsyncClient(timeout=min(http_timeout, 5), auth=auth) as probe:
+            async with httpx.AsyncClient(
+                timeout=min(http_timeout, 5), auth=auth, verify=cached_platform_ssl_context()
+            ) as probe:
                 r = await probe.post(url, content=b"{}", headers=probe_headers)
                 # Auth errors affect both transports equally. With a provider
                 # attached the authenticated connect will handle the challenge,
@@ -702,6 +720,7 @@ class MCPClient:
 
         try:
             ctx = streamablehttp_client(
+                httpx_client_factory=_create_mcp_http_client,
                 url=url,
                 headers=headers,
                 timeout=timeout,
@@ -731,6 +750,7 @@ class MCPClient:
         auth = self._build_auth_provider(url)
 
         ctx = sse_client(
+            httpx_client_factory=_create_mcp_http_client,
             url=url,
             headers=headers,
             timeout=timeout,

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/agents/tools.py

@@ -1,5 +1,6 @@
 import asyncio
 import contextlib
+import contextvars
 import functools
 import inspect
 import json
@@ -36,6 +37,11 @@ if t.TYPE_CHECKING:
 P = te.ParamSpec("P", default=...)
 R = te.TypeVar("R", default=t.Any)
 
+current_tool_call: contextvars.ContextVar["ToolCall | None"] = contextvars.ContextVar(
+    "current_tool_call", default=None
+)
+"""The tool call whose function is running, so code inside a tool can name its call."""
+
 
 @contextlib.asynccontextmanager
 async def _tool_span(tool_name: str, tool_call: "ToolCall") -> t.AsyncIterator[t.Any]:
@@ -476,18 +482,22 @@ class Tool(BaseModel, t.Generic[P, R]):
             if self._type_adapter is not None:
                 kwargs = self._type_adapter.validate_python(kwargs)
             kwargs = kwargs or {}
+            call_token = current_tool_call.set(tool_call)
 
             # Call the function. Sync tools are offloaded to a worker thread
             # so blocking work (subprocess.run, network, large file I/O) does
             # not stall the event loop — the TUI shares that loop with input
             # parsing, and a multi-second block desyncs Textual's escape-
             # sequence parser, leaking raw mouse/key bytes into the composer.
-            if inspect.iscoroutinefunction(self.fn):
-                result = self.fn(**kwargs)  # ty: ignore[missing-argument]  # ParamSpec limitation
-            else:
-                result = await asyncio.to_thread(self.fn, **kwargs)  # ParamSpec limitation
-            if inspect.isawaitable(result):
-                result = await result
+            try:
+                if inspect.iscoroutinefunction(self.fn):
+                    result = self.fn(**kwargs)  # ty: ignore[missing-argument]  # ParamSpec limitation
+                else:
+                    result = await asyncio.to_thread(self.fn, **kwargs)  # ParamSpec limitation
+                if inspect.isawaitable(result):
+                    result = await result
+            finally:
+                current_tool_call.reset(call_token)
 
             if isinstance(result, Stop):
                 raise result  # noqa: TRY301 - intentional control-flow routing into Stop handler

{dreadnode-2.0.47 → dreadnode-2.0.50}/dreadnode/airt/__init__.py

@@ -26,6 +26,7 @@ LLM jailbreak attacks:
 - genetic_persona_attack: GA-based persona prompt evolution
 - nexus_attack: NEXUS multi-module attack with ThoughtNet reasoning
 - siren_attack: Siren multi-turn attack with turn-level LLM feedback
+- slip_attack: SLIP self-jailbreaking via lexical insertion prompting (target as its own guide)
 - j2_meta_attack: J2 meta-jailbreak (jailbreak a model to jailbreak others)
 - attention_shifting_attack: ASJA dialogue history mutation attack
 - cot_jailbreak_attack: Chain-of-thought reasoning exploitation attack
@@ -91,6 +92,7 @@ from dreadnode.airt.agentic_suite import (
     scorers_for_category,
     transforms_for_category,
 )
+from dreadnode.airt.agentvigil import agentvigil_attack
 from dreadnode.airt.alignment_faking import alignment_faking_attack
 from dreadnode.airt.analogy_escalation import analogy_escalation_attack
 from dreadnode.airt.aprt_progressive import aprt_progressive_attack
@@ -105,6 +107,7 @@ from dreadnode.airt.crescendo import crescendo_attack
 from dreadnode.airt.deep_inception import deep_inception_attack
 from dreadnode.airt.drattack import drattack
 from dreadnode.airt.echo_chamber import echo_chamber_attack
+from dreadnode.airt.eva import eva_attack
 from dreadnode.airt.evasion import (
     bae_evasion,
     boundary_evasion,
@@ -141,6 +144,7 @@ from dreadnode.airt.inversion import (
     confidence_inversion,
     nes_inversion,
 )
+from dreadnode.airt.iterinject import iterinject_attack
 from dreadnode.airt.j2_meta import j2_meta_attack
 from dreadnode.airt.jbdistill import jbdistill_attack
 from dreadnode.airt.jbfuzz import jbfuzz_attack
@@ -167,6 +171,7 @@ from dreadnode.airt.reward_hacking import reward_hacking_attack
 from dreadnode.airt.salami_slicing import salami_slicing_attack
 from dreadnode.airt.self_persuasion import self_persuasion_attack
 from dreadnode.airt.siren import siren_attack
+from dreadnode.airt.slip import litellm_embedder, slip_attack
 from dreadnode.airt.tap import tap_attack
 from dreadnode.airt.target import extract_response_text, extract_tool_calls
 from dreadnode.airt.targets import (
@@ -198,6 +203,7 @@ __all__ = [
     "adversarial_reasoning_attack",
     "advpromptier_attack",
     "agent_suite",
+    "agentvigil_attack",
     "alignment_faking_attack",
     "analogy_escalation_attack",
     "approval_bypass",
@@ -227,6 +233,7 @@ __all__ = [
     "echo_chamber_attack",
     "entropy_membership",
     "equation_solving_extraction",
+    "eva_attack",
     "evolutionary_proposer",
     "extract_response_text",
     "extract_tool_calls",
@@ -239,6 +246,7 @@ __all__ = [
     "hopskipjump_evasion",
     "humor_bypass_attack",
     "injection_channels",
+    "iterinject_attack",
     "j2_meta_attack",
     "jacobian_extraction",
     "jbdistill_attack",
@@ -246,6 +254,7 @@ __all__ = [
     "knockoff_extraction",
     "label_only_membership",
     "lira_membership",
+    "litellm_embedder",
     "loss_membership",
     "lrm_autonomous_attack",
     "mapf_attack",
@@ -280,6 +289,7 @@ __all__ = [
     "simba_attack",
     "simba_evasion",
     "siren_attack",
+    "slip_attack",
     "square_evasion",
     "tap_attack",
     "templatefuzz_attack",