fix: Three-part prompt split to prevent guardrail blocking PR diffs containing security strings

Author: sudsali

scripts/issue_bot/bedrock_client.py

@@ -100,22 +100,42 @@ def _split_prompt(self, prompt):
         """Split rendered prompt into trusted system prompt and untrusted user content.
 
         Everything before <knowledge_base> is trusted instructions (system prompt).
-        Everything from <knowledge_base> onward contains user data (guarded).
+        Content between <knowledge_base> and <user_input> is context (not guarded).
+        Content from <user_input> onward is untrusted user data (guarded).
+
+        This prevents guardrail false positives on PR diffs and source code
+        that may contain security-related strings (e.g., "ignore previous instructions"
+        appearing as literal code in a sanitizer module).
         """
-        marker = "<knowledge_base>"
-        idx = prompt.find(marker)
-        if idx == -1:
+        kb_marker = "<knowledge_base>"
+        user_marker = "<user_input>"
+
+        kb_idx = prompt.find(kb_marker)
+        if kb_idx == -1:
             # No marker — guard everything as untrusted
             if self._guardrail_id:
                 return None, [{"guardContent": {"text": {"text": prompt}}}]
             return None, [{"text": prompt}]
 
-        system = prompt[:idx].strip()
-        user_data = prompt[idx:].strip()
+        system = prompt[:kb_idx].strip()
+
+        user_idx = prompt.find(user_marker, kb_idx)
+        if user_idx == -1:
+            # Backward compat: no <user_input> marker means everything after
+            # <knowledge_base> may contain untrusted content — guard it all.
+            after_kb = prompt[kb_idx:].strip()
+            if self._guardrail_id:
+                return system, [{"guardContent": {"text": {"text": after_kb}}}]
+            return system, [{"text": after_kb}]
+
+        # Three-part split: system | context (not guarded) | user input (guarded)
+        context_data = prompt[kb_idx:user_idx].strip()
+        user_data = prompt[user_idx:].strip()
 
+        user_content = [{"text": context_data}]
         if self._guardrail_id:
-            user_content = [{"guardContent": {"text": {"text": user_data}}}]
+            user_content.append({"guardContent": {"text": {"text": user_data}}})
         else:
-            user_content = [{"text": user_data}]
+            user_content.append({"text": user_data})
 
         return system, user_content

tests/test_bot.py

@@ -279,3 +279,78 @@ def test_empty_url_preserved(self):
         url = ""
         result = "" if url and not url.startswith("https://github.com/") else url
         assert result == ""
+
+
+# ---------------------------------------------------------------------------
+# _split_prompt (BedrockClient prompt splitting)
+# ---------------------------------------------------------------------------
+
+class TestSplitPrompt:
+    """Test the three-part prompt split: system | context (unguarded) | user (guarded)."""
+
+    def _make_client(self, guardrail_id=""):
+        class FakeCfg:
+            bedrock_model_id = "test"
+            bedrock_timeout = 10
+            guardrail_id = ""
+            guardrail_version = "DRAFT"
+        cfg = FakeCfg()
+        cfg.guardrail_id = guardrail_id
+        from issue_bot.bedrock_client import BedrockClient
+        # Avoid actual boto3 client creation
+        import unittest.mock as mock
+        with mock.patch("boto3.client"):
+            client = BedrockClient(cfg)
+        return client
+
+    def test_no_markers_no_guardrail(self):
+        client = self._make_client()
+        system, user = client._split_prompt("just text")
+        assert system is None
+        assert user == [{"text": "just text"}]
+
+    def test_no_markers_with_guardrail(self):
+        client = self._make_client(guardrail_id="gr-123")
+        system, user = client._split_prompt("just text")
+        assert system is None
+        assert user == [{"guardContent": {"text": {"text": "just text"}}}]
+
+    def test_kb_only_no_user_marker(self):
+        prompt = "instructions\n<knowledge_base>\ncontext and diff"
+        client = self._make_client(guardrail_id="gr-123")
+        system, user = client._split_prompt(prompt)
+        assert system == "instructions"
+        assert len(user) == 1
+        assert "guardContent" in user[0]  # Backward compat: guarded when no <user_input>
+
+    def test_three_part_split_with_guardrail(self):
+        prompt = "instructions\n<knowledge_base>\nKB + diff here\n<user_input>\nuser title and body"
+        client = self._make_client(guardrail_id="gr-123")
+        system, user = client._split_prompt(prompt)
+        assert system == "instructions"
+        assert len(user) == 2
+        assert "text" in user[0]  # context block — unguarded
+        assert "guardContent" in user[1]  # user input — guarded
+        assert "KB + diff" in user[0]["text"]
+        assert "user title" in user[1]["guardContent"]["text"]["text"]
+
+    def test_three_part_split_no_guardrail(self):
+        prompt = "instructions\n<knowledge_base>\ncontext\n<user_input>\nuser data"
+        client = self._make_client()
+        system, user = client._split_prompt(prompt)
+        assert system == "instructions"
+        assert len(user) == 2
+        assert all("text" in block for block in user)  # both unguarded without guardrail
+
+    def test_diff_with_injection_strings_not_guarded(self):
+        """PR diffs containing 'ignore previous instructions' as source code
+        should NOT be guarded, preventing guardrail false positives."""
+        diff = 'sanitizer has: "ignore previous instructions"'
+        prompt = f"review this PR\n<knowledge_base>\n{diff}\n<user_input>\nPR title: Spark4 support"
+        client = self._make_client(guardrail_id="gr-123")
+        system, user = client._split_prompt(prompt)
+        # The diff is in the unguarded context block
+        assert "ignore previous instructions" in user[0]["text"]
+        assert "text" in user[0]  # NOT guardContent
+        # The user input IS guarded
+        assert "guardContent" in user[1]