[FIX Breaking]: PrependedConversationConfig and Attack Param Consistency

[rlundeen2]

PrependedConversationConfig

Added new PrependedConversationConfig dataclass to configure how prepended conversations are handled. Supports configurable behavior for non-chat targets (normalize_first_turn vs raise), and allows specifying which roles should have converters applied. Includes factory methods for common configurations

Consistent next_message Handling

• Fixed RedTeamingAttack._generate_next_prompt_async to return Message instead of str, preserving multimodal content (images, audio)
• Ensures next_message is sent as the first message to targets across all attacks
• Multimodal content is now properly preserved end-to-end
• Consistent prepended_conversation Handling (e.g some attacks used to extract next_message if the last prepended message was user, but others did not. Now it is never auto-extracted)

ConversationManager Refactoring

• Refactored initialize_context_async to accept context object with cleaner parameter passing
• Moved prepended conversation processing logic into the manager
• Added add_prepended_conversation_to_memory_async for explicit memory operations
• Started handling non PromptChatTargets
• The logic for this used to be quite difficult to follow. prepended_conversation was updated multiple places. Now it should all be handled centrally.

Test Coverage

• Added test_attack_parameter_consistency.py with cross-attack behavioral tests
• Rewrote test_conversation_manager.py to match refactored API
• Added comprehensive tests for PrependedConversationConfig settings
• Fixed numerous tests affected by API changes

Breaking Changes

Nothing major IMO; I think both of these are really internal.

• ConversationManager.initialize_context_async signature changed to accept context parameter
• generate_next_prompt_async in RedTeamingAttack now returns Message instead of str