injection_detection: opaque KeyError when inline `yara_rules` miss a requested injection name

Did you check the docs and existing issues?

Yes — no existing issue covers this.

Bug

_load_rules in nemoguardrails/library/injection_detection/actions.py raises an opaque KeyError when injection detection is configured with inline yara_rules and the injections list names a rule that is not present in those inline rules (e.g. mixing a built-in name like sqli with an inline custom rule, or a typo).

When inline yara_rules are provided, built-in rules are not loaded, so only the inline rules are available. But _load_rules filters the inline dict by intersection and then indexes it with every requested name:

rules_source = {name: rule for name, rule in yara_rules.items() if name in rule_names}   # intersection
rules = yara.compile(sources={rule_name: rules_source[rule_name] for rule_name in rule_names})  # indexes ALL names -> KeyError

Neither _validate_injection_config nor _extract_injection_config catches this (rule-name validation is skipped when inline rules are used), so the guardrail dies with a bare KeyError: 'sqli' instead of a clear configuration error.

Steps to reproduce

from pathlib import Path
from nemoguardrails.library.injection_detection.actions import _load_rules

_load_rules(
    Path("."),
    ("sqli", "custom_rule"),
    {"custom_rule": 'rule custom_rule { strings: $a = "foo" condition: $a }'},
)
# KeyError: 'sqli'

Expected behavior

A clear, actionable ValueError naming the missing rule(s) and the available inline rules — mirroring the ValueError the yara_path branch already raises for unknown rule names — rather than an opaque KeyError.

Fix

I have a fix + regression test ready (validate the requested names against the inline yara_rules up front and raise a descriptive ValueError, fail-closed). It was in PR #2147, which the contribution-workflow bot closed because it wasn't linked to a triaged issue. Happy to re-open / re-file against this issue once it's triaged and assigned.

Environment

• nemoguardrails: develop

Start in nemoguardrails/library/injection_detection/actions.py at _load_rules and run the inline-yara_rules reproduction from the issue. Check the existing yara_path error handling for its expected behavior. Done means missing requested names produce an actionable ValueError listing the missing and available inline rules instead of a KeyError, with the regression test described in the issue passing.