fix: synthesize messages for BEFORE_MODEL when messages is empty

evanbijoy251 · claude · evanbijoy251 · commit 4ae60e8e3028 · 2026-07-14T12:37:50.000+05:30
Production WASM rules (e.g. block_ssn_in_prompts) check
input.messages[].content (plain string) rather than the flat
model_input field. The callback-handler path never passes messages,
so context.messages is always [] and rules silently miss violations.

Fix: context_to_input now builds a synthetic [{"role": "user",
"content": model_input}] entry when messages is empty for
BEFORE_MODEL. Verified against the production bundle — the SSN rule
now fires: fired_deny=["Message contains a value matching the SSN
pattern (###-##-####)"], deny=true.

Generated with Claude Code

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
diff --git a/src/uipath/runtime/governance/rego/evaluator.py b/src/uipath/runtime/governance/rego/evaluator.py
@@ -51,6 +51,14 @@ def context_to_input(
     agent_input = context.agent_input
     if context.hook == LifecycleHook.BEFORE_MODEL and not agent_input:
         agent_input = context.model_input
+    # WASM rules check input.messages[].content (plain string) rather than
+    # the flat model_input field. When messages is empty for a BEFORE_MODEL
+    # hook, synthesize a single user message from model_input so that rules
+    # like block_ssn_in_prompts can match. The callback-handler path never
+    # passes messages, so this is the only way to populate the field.
+    messages = context.messages
+    if context.hook == LifecycleHook.BEFORE_MODEL and not messages and context.model_input:
+        messages = [{"role": "user", "content": context.model_input}]
     return {
         "hook": context.hook.value,
         "agent_input": agent_input,
@@ -67,7 +75,7 @@ def context_to_input(
             "llm_calls": session.get("llm_calls", 0),
         },
         "ring": context.ring,
-        "messages": context.messages,
+        "messages": messages,
         "features": features,
     }
 
diff --git a/tests/test_rego_evaluator.py b/tests/test_rego_evaluator.py
@@ -154,6 +154,47 @@ def test_context_to_input_other_hooks_no_normalization() -> None:
     assert result["agent_input"] == ""
 
 
+def test_context_to_input_before_model_synthesizes_messages() -> None:
+    # When messages is empty for BEFORE_MODEL, a synthetic user message is
+    # built from model_input so WASM rules checking input.messages fire.
+    ctx = CheckContext(
+        hook=LifecycleHook.BEFORE_MODEL,
+        agent_name="a",
+        runtime_id="r",
+        model_input="identify 999-99-9999",
+        messages=[],
+    )
+    result = context_to_input(ctx)
+    assert result["messages"] == [{"role": "user", "content": "identify 999-99-9999"}]
+
+
+def test_context_to_input_before_model_keeps_explicit_messages() -> None:
+    # When messages is already populated, it is NOT overwritten.
+    existing = [{"role": "user", "content": "original"}]
+    ctx = CheckContext(
+        hook=LifecycleHook.BEFORE_MODEL,
+        agent_name="a",
+        runtime_id="r",
+        model_input="other text",
+        messages=existing,
+    )
+    result = context_to_input(ctx)
+    assert result["messages"] == existing
+
+
+def test_context_to_input_other_hooks_no_messages_synthesis() -> None:
+    # Messages synthesis must not apply to other hooks.
+    ctx = CheckContext(
+        hook=LifecycleHook.BEFORE_AGENT,
+        agent_name="a",
+        runtime_id="r",
+        model_input="should not synthesize",
+        messages=[],
+    )
+    result = context_to_input(ctx)
+    assert result["messages"] == []
+
+
 # ---------------------------------------------------------------------------
 # _extract_wasm_from_bundle / _extract_data_json_from_bundle
 # ---------------------------------------------------------------------------
