fix(config): honor endpoint: alias in redteam/behavior override blocks

[nikhilpatidar]

PR Type

• Bug fix
• Feature

Fixes #256

What

• Accept endpoint: as an alias in the redteam: override block in nuguard/config.py _flatten_yaml, mirroring the shared target: block's alias handling.
• Accept endpoint: as an alias in the behavior: override block by pre-merging behavior.endpoint: into behavior.target_endpoint before the shared-as-base merge.
• Added 2 regression tests in tests/test_config.py (test_redteam_endpoint_alias_overrides_shared_endpoint, test_behavior_endpoint_alias_overrides_shared_endpoint) pinning the contract for both aliases.

Why

The shared target: block in nuguard.yaml accepts both endpoint: and target_endpoint: as aliases (nuguard/config.py:199-203). nuguard.yaml.example line 47 documents endpoint: as the canonical name. The override blocks (redteam: and behavior:) only accepted target_endpoint:, so users who wrote redteam.endpoint: or behavior.endpoint: saw their override silently dropped and the shared value win instead. This is an asymmetric alias handling bug — the override blocks must mirror what the shared block accepts.

Root Cause

• Redteam override block at nuguard/config.py:233-234 checked only target_endpoint; the endpoint alias was not consulted.
• Behavior override block at nuguard/config.py:397-431 injects shared target_endpoint into _shared_for_behavior and then merges b = {**_shared_for_behavior, **b}. A user-written behavior.endpoint: key was never renamed to target_endpoint: before the merge, so it never overrode the shared value.

How

• Reproduced the bug with a 5-line python -c "..." against the existing _flatten_yaml — confirmed flat['target_endpoint'] resolved to the shared /api/chat value when redteam.endpoint: /api/redteam was set.
• Inspected the existing test_redteam_endpoint_overrides_shared_endpoint test in tests/test_config.py:335 — it exercises only the long-form target_endpoint: path; the alias path was never covered.
• Added the elif "endpoint" in redteam: branch next to the existing target_endpoint check in the redteam block, plus a behavior.endpoint → behavior.target_endpoint rename before the shared-as-base merge.
• Added two regression tests in the existing TestSharedTargetBlock class so they sit alongside the existing test_redteam_endpoint_overrides_shared_endpoint test that pins the long-form contract.

Test Steps

• Reproduce the original issue: a yaml containing redteam.endpoint: /api/redteam against target.endpoint: /api/chat resolves to /api/chat (wrong).
• Confirm the issue no longer occurs on this branch: same yaml resolves to /api/redteam (correct).
• Run uv run pytest tests/test_config.py -v — 36 tests pass (34 existing + 2 new).
• Run uv run pytest tests/test_config.py tests/cli/ tests/sbom/ -q — 296 passed, 1 skipped.
• Run uv run ruff check nuguard/config.py tests/test_config.py — clean.
• Run uv run mypy nuguard/config.py — clean.

Checks

• make test passes for the changed files (uv run pytest tests/test_config.py tests/cli/ tests/sbom/ -q — 296 passed, 1 skipped)
• make lint passes (ruff check + mypy on nuguard/config.py)
• make fmt applied, no diff
• Added regression tests covering both aliases

Other Notes

• Branched from origin/main (f5b131bb), bug/* → main per CONTRIBUTING.md.
• No changes to any existing tests; only two new test methods added in the TestSharedTargetBlock class.
• The fix is purely additive in terms of behaviour — the long-form target_endpoint: path is unchanged; the alias path now works.

[KanishkThamman]

Correct fix for the alias asymmetry, well tested. One nit inline on precedence consistency.

[KanishkThamman]

Nit: precedence is inverted vs. the shared target: block, which prefers endpoint over target_endpoint (if endpoint / elif target_endpoint). Here target_endpoint wins over endpoint. Only matters if both keys are set in the same block, but worth making consistent.

[nikhilpatidar]

Fixed in d0a94d5. Flipped the precedence in both the redteam and behavior override blocks so endpoint (canonical) wins over target_endpoint when both keys are set in the same block, matching the shared target: block on lines 199-203.

Added 4 new tests to tests/test_config.py::TestSharedTargetBlock:

• test_redteam_endpoint_wins_over_target_endpoint_when_both_set
• test_behavior_endpoint_wins_over_target_endpoint_when_both_set
• test_redteam_target_endpoint_used_when_endpoint_absent (alias resolution still works)
• test_behavior_target_endpoint_used_when_endpoint_absent (alias resolution still works)

Negative-tested: with the precedence reverted, the alias value wins instead of the canonical on both blocks.