feat(rule_agent): safety findings carry hit call_indices for span anchoring - #504
Merged
Merged
Conversation
…horing
A safety finding names its position in prose ("call 3"), but a platform that
anchors the finding onto a specific trace span needs that position as data, not
scraped from a sentence that could be reworded. All five safety rules now emit
0-based `call_indices` in the reason[1] JSON, aligned with the tool-call
sequence the rule read (`call N` in prose == index N-1):
- Destructive / SensitiveAccess / SecretExposure / GatewayBypass collect the
offending index in their finding loop and pass it to `_safety_flag`.
- GatewayBypass marks the direct-network call (where the bypass happened), not
the earlier policy refusal.
- SandboxExplicitlyDisabled builds its own reason, so it appends the same
reason[1] shape with `call_indices` derived from its offenders.
`call_indices` is present only when there is at least one hit; a clean pass
carries none. Adds TestFindingsCarryHitCallIndices covering all five rules,
multiple hits, and the clean-pass case.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
安全层规则命中时，finding 只在英文句子里写位置（"...call 10 (exec_command)..."），没有结构化的位置字段。下游平台（如 dingo-saas 的评估报告）要把 finding 标记到轨迹里对应的那次调用，只能靠正则从句子里抠 "call N"——句子格式一改就崩，很脆弱。
改动
5 条安全规则命中时，除现有英文 finding 外，在
reason[1]的 JSON 里新增call_indices（0-based，与规则读取的 tool-call 序列对齐，call N== indexN-1）：_safety_flag。reason[1]JSON 形态，call_indices由 offenders 换算。call_indices仅在有命中时出现；干净通过不带此字段，reason[1] 形态与现有{findings, total}完全兼容，下游旧读者无需改。测试
新增
TestFindingsCarryHitCallIndices，覆盖全部 5 条规则、多命中按序、以及干净通过不带字段。test_rule_agent_safety.py全绿（65 passed）。🤖 Generated with Claude Code