feat: FormData support, custom field names, direct API targeting for Gandalf + persistent API key config

[devin-ai-integration]

Summary

Adds three capabilities needed for ARGUS to scan non-standard AI targets like Gandalf:

1. FormData body format — _fire_via_agent_endpoint() can now send multipart/form-data requests (data=) instead of JSON (json=) when body_format="formdata" is set on the target config. build_body_for_format() gains support for formdata and custom formats with configurable prompt field names and extra static fields.

2. CLI options for body negotiation — --body-format, --prompt-field, and --extra-field flags added to scan, live, and alec-export. Example Gandalf usage:

   argus scan gandalf \
     --target https://gandalf-api.lakera.ai/api/send-message \
     --body-format formdata \
     --prompt-field prompt \
     --extra-field defender=baseline
   

3. Persistent config (src/argus/config.py) — new argus config set/get/delete/list/path commands backed by ~/.argus/argusrc (TOML, 0600 perms). API keys resolve with priority: CLI flag → env var → config file. This replaces the need to export ANTHROPIC_API_KEY=... every session.

Additional changes in prompt_injection.py:

• Response JSON parsing now checks answer key first (Gandalf returns {"answer": "..."})
• Non-JSON responses are handled gracefully instead of crashing

Review & Testing Checklist for Human

• Verify build_body_for_format("formdata") actually produces correct FormData — the function returns a dict which is then passed as data= to httpx. Confirm httpx sends this as multipart/form-data and not application/x-www-form-urlencoded (httpx uses data= for form-encoded; files= is needed for true multipart). This is the most critical correctness question — Gandalf may require one or the other.
• Test argus config set anthropic_api_key sk-ant-... end-to-end — verify the file is created at ~/.argus/argusrc with 0600 permissions, and that a subsequent argus scan picks up the key without --agent-api-key or env var.
• Test against Gandalf baseline — run the example command above and confirm ARGUS actually gets a response from gandalf-api.lakera.ai (not a 405 or format error).
• Check that data.get("answer", ...) in prompt_injection.py doesn't break existing targets — this changes the JSON field extraction priority for ALL targets, not just Gandalf. Targets that have an answer field with different semantics could be affected.
• Note: extra-field parsing is duplicated 3x across scan/live/alec-export with inconsistent error handling (only scan warns on malformed values). Acceptable for now but should be extracted to a helper.

Notes

• Only the prompt_injection agent is wired to use body_format/prompt_field/extra_fields. Other agents still use their default HTTP dispatch. This is intentional — prompt injection is the primary agent that fires at chat endpoints.
• The new config.py module (228 lines) has no dedicated unit tests. The 352 existing tests pass but don't exercise config file read/write/permissions.
• argus_config._config_path() (private function) is referenced in CLI display code — minor code smell.

Link to Devin session: https://app.devin.ai/sessions/8b0c5ca873934d77aa254157cc41924c
Requested by: @andrebyrd-odingard

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring