Initial commit: Add agent.ts

[danenania]

No description provided.

[promptfoo-scanner]

The new multi-turn conversation support only runs guardrails on the last user message, but passes the full conversation history (including unchecked earlier messages) to all agents. An attacker can inject malicious prompts in earlier messages that will bypass jailbreak detection and prompt injection guardrails.

Suggested Fix

Run guardrails on ALL user messages in the conversation history, not just the last one:

// Extract ALL user messages for guardrails check
const userMessages = conversationHistory
  .filter((m) => "role" in m && m.role === "user")
  .map((m) => {
    if ("content" in m && Array.isArray(m.content) && m.content[0] && "text" in m.content[0]) {
      return m.content[0].text;
    }
    return "";
  })
  .filter((text) => text.length > 0);

// Check each user message through guardrails
for (const messageText of userMessages) {
  const guardrailsResult = await runGuardrails(
    messageText,
    jailbreakGuardrailConfig,
    context
  );

  if (guardrailsHasTripwire(guardrailsResult)) {
    const guardrailsOutput = buildGuardrailFailOutput(guardrailsResult ?? []);
    return { ...guardrailsOutput, tracking };
  }
}

[promptfoo-scanner]

The new message array input has no validation on array length or individual message sizes. Attackers can submit extremely large message arrays or very long messages, causing excessive OpenAI API costs and potential service degradation through token-based denial of service.

Suggested Fix

Add input size limits before processing:

// Define limits
const MAX_MESSAGES = 50;
const MAX_MESSAGE_LENGTH = 10000;
const MAX_TOTAL_LENGTH = 50000;

if (workflow.messages && workflow.messages.length > 0) {
  // Validate message count
  if (workflow.messages.length > MAX_MESSAGES) {
    throw new Error(`Message history exceeds maximum of ${MAX_MESSAGES} messages`);
  }

  // Validate lengths
  let totalLength = 0;
  for (const msg of workflow.messages) {
    const msgLength = msg.content?.length || 0;
    if (msgLength > MAX_MESSAGE_LENGTH) {
      throw new Error(`Message exceeds maximum length of ${MAX_MESSAGE_LENGTH} characters`);
    }
    totalLength += msgLength;
  }

  if (totalLength > MAX_TOTAL_LENGTH) {
    throw new Error(`Total content exceeds maximum of ${MAX_TOTAL_LENGTH} characters`);
  }

  conversationHistory = convertToAgentInputItems(workflow.messages);
} else if (workflow.input_as_text) {
  if (workflow.input_as_text.length > MAX_MESSAGE_LENGTH) {
    throw new Error(`Input exceeds maximum length of ${MAX_MESSAGE_LENGTH} characters`);
  }
  conversationHistory = [
    { role: "user", content: [{ type: "input_text", text: workflow.input_as_text }] },
  ];
}