fix(llamaindex): address remaining review minors (pages 4-5)

Follow-up to the #360 review pass — the earlier commit covered the blockers
(rebind + uninstall) + trace_id; these are the payload-extraction minors:

- event_handler.py:236 — _coerce_args no longer drops non-dict args: a
  list-shaped arg (common with MCP tools) is preserved under `_`, and
  malformed JSON is kept raw under `_raw` instead of {} — a payload
  governance can't parse must not slip past arg-based policies.
- event_handler.py:224 — _message_text now walks a multimodal ChatMessage's
  text blocks when `.content` is empty, instead of str(message) (which
  serialized a pydantic repr into the scanned blob).

Acknowledged, intentionally unchanged (noted for consistency / follow-up):
- event_handler.py:170 (sync handle): deliberate synchronous gate — a
  BEFORE_MODEL/TOOL_CALL decision must complete before the call proceeds.
  Async governance is a protocol-wide change (evaluator is sync) → follow-up.
- event_handler.py:186 (warning vs exception): kept logger.warning for the
  swallow path to match LangChain #899 and the other 4 adapters.
- latest-message-only scan: same documented tradeoff as #899 (avoids
  re-firing on prior turns); kept for parity.

Tests: list-shaped/malformed _coerce_args + block-extraction fallback. 130 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aditik0303

packages/uipath-llamaindex/src/uipath_llamaindex/governance/event_handler.py

@@ -281,15 +281,25 @@ def _latest_message_text(messages: Any) -> str:
 
 
 def _message_text(message: Any) -> str:
-    """Pull text from a ``ChatMessage`` (``.content``) or a bare string."""
+    """Pull text from a ``ChatMessage`` (``.content`` / ``.blocks``) or a str."""
     if message is None:
         return ""
     if isinstance(message, str):
         return message[:_BEFORE_MODEL_TEXT_CAP]
     content = getattr(message, "content", None)
     if isinstance(content, str) and content:
         return content[:_BEFORE_MODEL_TEXT_CAP]
-    # Newer ChatMessage carries typed blocks; fall back to str().
+    # Multimodal ChatMessage carries typed blocks. Walk them for text (a
+    # TextBlock exposes ``.text``) rather than ``str(message)``, which would
+    # serialize the pydantic repr — dict-syntax noise that pollutes the
+    # regex-scanned blob. Non-text blocks (image/binary) have no scannable text.
+    blocks = getattr(message, "blocks", None)
+    if isinstance(blocks, (list, tuple)):
+        texts = [
+            t for b in blocks if isinstance((t := getattr(b, "text", None)), str) and t
+        ]
+        if texts:
+            return "\n".join(texts)[:_BEFORE_MODEL_TEXT_CAP]
     return str(message)[:_BEFORE_MODEL_TEXT_CAP]
 
 
@@ -307,10 +317,14 @@ def _response_text(response: Any) -> str:
 
 
 def _coerce_args(arguments: Any) -> Dict[str, Any]:
-    """Normalise tool arguments (JSON string / Mapping / None) to a dict.
-
-    ``AgentToolCallEvent.arguments`` is a JSON-encoded string; other call
-    sites may hand a dict directly.
+    """Normalise tool arguments (JSON string / Mapping / list / None) to a dict.
+
+    ``AgentToolCallEvent.arguments`` is usually a JSON-encoded string; other
+    call sites may hand a dict directly. Non-dict payloads are preserved (not
+    dropped) so an arg-based policy can still scan them: a list-shaped arg
+    (common with MCP tools) is wrapped under ``_``, and malformed JSON is kept
+    raw under ``_raw`` — a payload governance can't parse must not be a way to
+    slip past it.
     """
     if arguments is None:
         return {}
@@ -321,8 +335,9 @@ def _coerce_args(arguments: Any) -> Dict[str, Any]:
             parsed = json.loads(arguments)
             return parsed if isinstance(parsed, dict) else {"_": parsed}
         except (TypeError, ValueError):
-            return {}
-    return {}
+            return {"_raw": arguments}
+    # list / tuple / other structured args — preserve rather than drop to {}.
+    return {"_": arguments}
 
 
 __all__: List[str] = [

packages/uipath-llamaindex/tests/governance/test_event_handler.py

@@ -295,7 +295,26 @@ def test_coerce_args_dict_passthrough():
 
 def test_coerce_args_none_and_bad():
     assert _coerce_args(None) == {}
-    assert _coerce_args("not json") == {}
+    # malformed JSON is preserved raw (not dropped) so policies can still scan it
+    assert _coerce_args("not json") == {"_raw": "not json"}
+
+
+def test_coerce_args_preserves_list_shaped_args():
+    # list-shaped tool args (common with MCP tools) must not be dropped to {}
+    assert _coerce_args(["a", "b"]) == {"_": ["a", "b"]}
+    assert _coerce_args('["a", "b"]') == {"_": ["a", "b"]}
+
+
+def test_message_text_walks_blocks_when_content_empty():
+    # a multimodal message whose .content is empty falls back to its text
+    # blocks, not str(message) (which would serialize a pydantic repr)
+    from uipath_llamaindex.governance.event_handler import _message_text
+
+    msg = SimpleNamespace(
+        content=None,
+        blocks=[SimpleNamespace(text="block one"), SimpleNamespace(text="block two")],
+    )
+    assert _message_text(msg) == "block one\nblock two"
 
 
 # --------------------------------------------------------------------------