completion-kit 0.28.44 → 0.28.45

data/app/models/completion_kit/run.rb

@@ -2,6 +2,7 @@ module CompletionKit
   class Run < ApplicationRecord
     include Turbo::Broadcastable
     include CompletionKit::Taggable
+    include CompletionKit::MetricSelection
 
     STATUSES = %w[pending running completed failed].freeze
     INSERT_BATCH_SIZE = 1000
@@ -21,14 +22,17 @@ module CompletionKit
     has_many :dashboard_dismissals, as: :dismissable, dependent: :destroy
 
     attr_writer :avg_score, :check_pass_rate, :metric_averages, :response_count
+    attr_accessor :cloned_from_judge_model
 
     validates :name, presence: true
     validates :status, inclusion: { in: STATUSES }
     validates :max_tokens, numericality: { only_integer: true, greater_than: 0 }, allow_nil: true
     validates :judge_temperature, numericality: { greater_than_or_equal_to: 0, less_than_or_equal_to: 1 }, allow_nil: true
-    validate :dataset_supplies_prompt_variables
-    validate :judge_only_run_supplies_output_column
+    validate :references_in_scope
+    validate :dataset_supplies_prompt_variables, unless: :reference_out_of_scope?
+    validate :judge_only_run_supplies_output_column, unless: :reference_out_of_scope?
     validate :dataset_supplies_expected_column
+    validate :judge_model_servable, if: :judge_model_newly_selected?
 
     before_validation :set_default_status, on: :create
     before_validation :set_auto_name, on: :create
@@ -221,9 +225,10 @@ module CompletionKit
     end
 
     def replace_metrics!(metric_ids)
-      return unless metric_ids
+      return if metric_ids.nil?
+
       run_metrics.delete_all
-      Array(metric_ids).reject(&:blank?).each_with_index do |metric_id, index|
+      normalize_metric_ids(metric_ids).each_with_index do |metric_id, index|
         run_metrics.create!(metric_id: metric_id, position: index + 1)
       end
     end
@@ -329,12 +334,13 @@ module CompletionKit
           return fail_with_summary!("Dataset has no \"#{column}\" column")
         end
       else
-        client = LlmClient.for_model(prompt.llm_model, ApiConfig.for_model(prompt.llm_model))
-        unless client.configured?
-          return fail_with_summary!("LLM API not configured: #{client.configuration_errors.join(', ')}")
-        end
+        generation_error = generation_client_error
+        return fail_with_summary!(generation_error) if generation_error
       end
 
+      judge_error = judge_model_error
+      return fail_with_summary!(judge_error) if judge_error
+
       begin
         transaction do
           responses.destroy_all
@@ -395,7 +401,7 @@ module CompletionKit
 
           response_ids = responses.order(:row_index).pluck(:id)
           if judge
-            judge_metrics = llm_judge_configured? ? llm_metrics.to_a : []
+            judge_metrics = judge_model.present? ? llm_metrics.to_a : []
             chk_metrics = check_metrics.to_a
             review_jobs = response_ids.flat_map do |rid|
               judge_metrics.map { |m| JudgeReviewJob.new(rid, m.id, id) } +
@@ -424,6 +430,11 @@ module CompletionKit
     end
 
     def regrade!
+      judge_error = judge_model_error
+      if judge_error
+        errors.add(:base, judge_error)
+        return false
+      end
       return false if metrics.empty? || !gradable?
 
       eligible_responses = responses.where(status: "succeeded")
@@ -447,7 +458,7 @@ module CompletionKit
         update!(status: "running", failure_summary: nil, error_message: nil, judge_temperature_ignored: false)
 
         response_ids.each do |rid|
-          llm_metrics.each { |m| JudgeReviewJob.perform_later(rid, m.id, id) } if llm_judge_configured?
+          llm_metrics.each { |m| JudgeReviewJob.perform_later(rid, m.id, id) } if judge_model.present?
           check_metrics.each { |m| CheckReviewJob.perform_later(rid, m.id, id) }
         end
         RunCompletionCheckJob.perform_later(id)
@@ -479,7 +490,8 @@ module CompletionKit
     end
 
     def rerun!
-      new_run = Run.create!(
+      ensure_models_resolve!
+      Run.create!(
         prompt_id: prompt_id,
         dataset_id: dataset_id,
         judge_model: judge_model,
@@ -489,10 +501,10 @@ module CompletionKit
         output_column: output_column,
         expected_column: expected_column,
         tag_names: tag_names,
-        status: "pending"
+        status: "pending",
+        cloned_from_judge_model: judge_model,
+        selected_metric_ids: run_metrics.pluck(:metric_id)
       )
-      new_run.replace_metrics!(metric_ids)
-      new_run
     end
 
     def retry_failures!(only: nil)
@@ -686,6 +698,40 @@ module CompletionKit
       Rails.error.report(e, handled: true, context: { hook: "on_run_started", run_id: id })
     end
 
+    def generation_client_error
+      client = LlmClient.for_model(prompt.llm_model, ApiConfig.for_model(prompt.llm_model))
+      "LLM API not configured: #{client.configuration_errors.join(', ')}" unless client.configured?
+    rescue UnknownModelError => e
+      e.message
+    end
+
+    def judge_model_error
+      return unless judge_model.present? && llm_metrics.exists?
+      return if ApiConfig.provider_for_model(judge_model)
+
+      %(No configured provider serves judge model "#{judge_model}")
+    end
+
+    def ensure_models_resolve!
+      raise UnknownModelError, prompt.llm_model unless judge_only? || ApiConfig.provider_for_model(prompt.llm_model)
+
+      judge_error = judge_model_error
+      raise ConfigurationError, judge_error if judge_error
+    end
+
+    def judge_model_newly_selected?
+      return false if judge_model.blank?
+      return judge_model != cloned_from_judge_model if new_record? && cloned_from_judge_model.present?
+
+      judge_model_changed?
+    end
+
+    def judge_model_servable
+      return if ApiConfig.servable_model?(judge_model)
+
+      errors.add(:judge_model, %("#{judge_model}" is not served by any configured provider))
+    end
+
     def fail_with_summary!(message)
       errors.add(:base, message)
       if persisted?
@@ -736,6 +782,23 @@ module CompletionKit
       end
     end
 
+    def prompt_out_of_scope?
+      will_save_change_to_prompt_id? && prompt_id.present? && prompt.nil?
+    end
+
+    def dataset_out_of_scope?
+      will_save_change_to_dataset_id? && dataset_id.present? && dataset.nil?
+    end
+
+    def reference_out_of_scope?
+      prompt_out_of_scope? || dataset_out_of_scope?
+    end
+
+    def references_in_scope
+      errors.add(:prompt_id, "not found") if prompt_out_of_scope?
+      errors.add(:dataset_id, "not found") if dataset_out_of_scope?
+    end
+
     def dataset_supplies_prompt_variables
       missing = missing_dataset_variables
       return if missing.empty?

data/app/models/completion_kit/run_metric.rb

@@ -1,6 +1,6 @@
 module CompletionKit
   class RunMetric < ApplicationRecord
     belongs_to :run
-    belongs_to :metric
+    belongs_to :metric, optional: false
   end
 end

data/app/models/concerns/completion_kit/metric_selection.rb

@@ -0,0 +1,35 @@
+module CompletionKit
+  module MetricSelection
+    extend ActiveSupport::Concern
+
+    included do
+      validate :selected_metrics_in_scope, if: -> { @metric_selection_assigned }
+      after_save :attach_selected_metrics, if: -> { @metric_selection_assigned }
+    end
+
+    def selected_metric_ids=(ids)
+      @metric_selection_assigned = !ids.nil?
+      @selected_metric_ids = ids
+    end
+
+    def selected_metric_ids
+      @metric_selection_assigned ? normalize_metric_ids(@selected_metric_ids) : metric_ids
+    end
+
+    private
+
+    def normalize_metric_ids(ids)
+      Array(ids).reject(&:blank?).map(&:to_i).uniq
+    end
+
+    def selected_metrics_in_scope
+      wanted = selected_metric_ids
+      errors.add(:metric_ids, "include one that isn't available") if CompletionKit::Metric.where(id: wanted).count < wanted.size
+    end
+
+    def attach_selected_metrics
+      replace_metrics!(@selected_metric_ids)
+      @metric_selection_assigned = false
+    end
+  end
+end

data/app/services/completion_kit/api_config.rb

@@ -39,14 +39,14 @@ module CompletionKit
       available_match = available_models.find { |model| model[:id] == model_name.to_s }
       return available_match[:provider] if available_match
 
-      guess = case model_name.to_s
-              when /\Agpt-/ then "openai"
-              when /\Aclaude-/ then "anthropic"
-              end
-      configured = ProviderCredential.distinct.pluck(:provider)
-      return guess if configured.empty?
+      guessed_provider(model_name)
+    end
 
-      guess if guess && configured.include?(guess)
+    def self.servable_model?(model_name)
+      return true unless Model.for_generation.exists?
+      return true if Model.active.exists?(model_id: model_name.to_s)
+
+      guessed_provider(model_name).present?
     end
 
     def self.default_judge_model
@@ -58,11 +58,15 @@ module CompletionKit
     def self.valid_for_model?(model_name)
       client = LlmClient.for_model(model_name, for_model(model_name))
       client.configured?
+    rescue UnknownModelError
+      false
     end
 
     def self.errors_for_model(model_name)
       client = LlmClient.for_model(model_name, for_model(model_name))
       client.configuration_errors
+    rescue UnknownModelError => e
+      [e.message]
     end
 
     def self.available_models(provider: nil, scope: :generation)
@@ -90,5 +94,17 @@ module CompletionKit
         []
       end.uniq { |model| model[:id] }
     end
+
+    def self.guessed_provider(model_name)
+      guess = case model_name.to_s
+              when /\Agpt-/ then "openai"
+              when /\Aclaude-/ then "anthropic"
+              end
+      configured = ProviderCredential.distinct.pluck(:provider)
+      return guess if configured.empty?
+
+      guess if guess && configured.include?(guess)
+    end
+    private_class_method :guessed_provider
   end
 end

data/app/services/completion_kit/azure_foundry_client.rb

@@ -35,7 +35,7 @@ module CompletionKit
       end
 
       if response.success?
-        data = JSON.parse(response.body)
+        data = JsonObject.parse(response.body)
         content = data.dig("choices", 0, "message", "content").to_s.strip
         return "Error: model returned empty content" if content.empty?
         content
@@ -48,6 +48,8 @@ module CompletionKit
       raise
     rescue ProviderEndpoint::UnsafeEndpoint => e
       "Error: API endpoint #{e.message}"
+    rescue JSON::ParserError => e
+      "Error: #{EndpointError.from(e).message}"
     rescue => e
       "Error: #{e.message}"
     end
@@ -61,7 +63,7 @@ module CompletionKit
       end
       return [] unless response.success?
 
-      body = JSON.parse(response.body)
+      body = JsonObject.parse(response.body)
       if foundry_project?
         body.fetch("value", []).map { |d| { id: d["name"], name: d["name"] } }
       else

data/app/services/completion_kit/csv_processor.rb

@@ -53,13 +53,11 @@ module CompletionKit
     end
 
     def self.apply_variables(prompt, variables)
-      result = prompt.template.dup
+      values = variables.to_h.transform_keys(&:to_s)
+      return prompt.template.dup if values.empty?
 
-      variables.each do |name, value|
-        result.gsub!(/\{\{\s*#{Regexp.escape(name.to_s)}\s*\}\}/, value.to_s)
-      end
-
-      result
+      names = values.keys.map { |name| Regexp.escape(name) }.join("|")
+      prompt.template.gsub(/\{\{\s*(#{names})\s*\}\}/) { values[Regexp.last_match(1)].to_s }
     end
   end
 end

data/app/services/completion_kit/json_object.rb

@@ -0,0 +1,14 @@
+require "json"
+
+module CompletionKit
+  module JsonObject
+    module_function
+
+    def parse(text)
+      data = JSON.parse(text)
+      raise JSON::ParserError, "expected a JSON object, got #{data.class}" unless data.is_a?(Hash)
+
+      data
+    end
+  end
+end

data/app/services/completion_kit/llm_client.rb

@@ -79,7 +79,7 @@ module CompletionKit
 
     def self.for_model(model_name, config = {})
       provider = ApiConfig.provider_for_model(model_name)
-      raise ArgumentError, "Unsupported model: #{model_name}" unless provider
+      raise UnknownModelError, model_name unless provider
 
       for_provider(provider, config)
     end

data/app/services/completion_kit/mcp_dispatcher.rb

@@ -7,7 +7,7 @@ module CompletionKit
 
     def self.initialize_session
       {
-        session_id: McpSession.start!,
+        session_id: SecureRandom.uuid,
         protocolVersion: PROTOCOL_VERSION,
         serverInfo: {name: "CompletionKit", version: CompletionKit::VERSION},
         capabilities: {tools: {listChanged: false}}

data/app/services/completion_kit/mcp_tools/base.rb

@@ -20,6 +20,8 @@ module CompletionKit
       def call(name, arguments)
         tool = self::TOOLS.fetch(name)
         send(tool[:handler], arguments)
+      rescue ConfigurationError => e
+        error_result(e.message)
       end
 
       def text_result(data)

data/app/services/completion_kit/mcp_tools/datasets.rb

@@ -106,7 +106,7 @@ module CompletionKit
       rescue ProviderEndpoint::UnsafeEndpoint => e
         error_result("URL is not allowed: it #{e.message}.")
       rescue Faraday::Error => e
-        error_result("Could not download CSV: #{e.message}")
+        error_result("Could not download CSV. #{EndpointError.from(e).message}")
       end
 
       def self.csv_connection(url)

data/app/services/completion_kit/mcp_tools/judges.rb

@@ -41,10 +41,10 @@ module CompletionKit
           name: args["name"],
           dataset: dataset,
           judge_model: args["judge_model"],
-          output_column: args["output_column"].presence || "actual_output"
+          output_column: args["output_column"].presence || "actual_output",
+          selected_metric_ids: [metric.id]
         )
         if run.save
-          run.replace_metrics!([metric.id])
           text_result(run.reload.as_json)
         else
           error_result(run.errors.full_messages.join(", "))

data/app/services/completion_kit/mcp_tools/metric_groups.rb

@@ -56,10 +56,9 @@ module CompletionKit
       end
 
       def self.create(args)
-        metric_group = CompletionKit::MetricGroup.new(args.slice("name", "description"))
+        metric_group = CompletionKit::MetricGroup.new(args.slice("name", "description").merge("selected_metric_ids" => args["metric_ids"]))
         metric_group.tag_names = args["tag_names"] if args.key?("tag_names")
         if metric_group.save
-          metric_group.replace_metrics!(args["metric_ids"])
           text_result(metric_group.reload.as_json)
         else
           error_result(metric_group.errors.full_messages.join(", "))
@@ -68,8 +67,7 @@ module CompletionKit
 
       def self.update(args)
         metric_group = CompletionKit::MetricGroup.find(args["id"])
-        if metric_group.update(args.except("id", "metric_ids").slice("name", "description"))
-          metric_group.replace_metrics!(args["metric_ids"]) if args.key?("metric_ids")
+        if metric_group.update(args.slice("name", "description").merge("selected_metric_ids" => args["metric_ids"]))
           metric_group.update!(tag_names: args["tag_names"]) if args.key?("tag_names")
           text_result(metric_group.reload.as_json)
         else

data/app/services/completion_kit/mcp_tools/provider_credentials.rb

@@ -29,12 +29,13 @@ module CompletionKit
           handler: :create
         },
         "provider_credentials_update" => {
-          description: "Update a provider credential",
+          description: "Update a provider credential. Changing provider or api_endpoint on a credential with a stored key requires api_key in the same call, so a stored key never moves to a new provider or endpoint.",
           inputSchema: {
             type: "object",
             properties: {
               id: {type: "integer"}, provider: {type: "string"},
-              api_key: {type: "string"}, api_endpoint: {type: "string"}, api_version: {type: "string"}
+              api_key: {type: "string", description: "Required when provider or api_endpoint changes and a key is stored"},
+              api_endpoint: {type: "string"}, api_version: {type: "string"}
             },
             required: ["id"]
           },

data/app/services/completion_kit/mcp_tools/runs.rb

@@ -109,9 +109,8 @@ module CompletionKit
       end
 
       def self.create(args)
-        run = Run.new(args.slice("name", "prompt_id", "dataset_id", "judge_model", "output_column", "expected_column", *GENERATION_FIELDS))
+        run = Run.new(args.slice("name", "prompt_id", "dataset_id", "judge_model", "output_column", "expected_column", *GENERATION_FIELDS).merge("selected_metric_ids" => resolve_metric_ids(args)))
         if run.save
-          run.replace_metrics!(resolve_metric_ids(args))
           run.update!(tag_names: args["tag_names"]) if args.key?("tag_names")
           text_result(run_payload(run.reload))
         else
@@ -121,8 +120,7 @@ module CompletionKit
 
       def self.update(args)
         run = Run.find(args["id"])
-        if run.update(args.except("id", "metric_ids", "metric_group_id", "tag_names").slice("name", "dataset_id", "judge_model", "output_column", "expected_column", *GENERATION_FIELDS))
-          run.replace_metrics!(resolve_metric_ids(args)) if args.key?("metric_ids") || args["metric_group_id"].present?
+        if run.update(args.slice("name", "dataset_id", "judge_model", "output_column", "expected_column", *GENERATION_FIELDS).merge("selected_metric_ids" => resolve_metric_ids(args)))
           run.update!(tag_names: args["tag_names"]) if args.key?("tag_names")
           text_result(run_payload(run.reload))
         else
@@ -140,7 +138,7 @@ module CompletionKit
         if run.start!
           text_result(run_payload(run.reload))
         else
-          text_result(run.failure_summary || run.errors.full_messages.to_sentence)
+          error_result(run.failure_summary || run.errors.full_messages.to_sentence)
         end
       end
 
@@ -149,7 +147,7 @@ module CompletionKit
         if run.regrade!
           text_result(run_payload(run.reload))
         else
-          error_result("Nothing to re-grade. The run has no succeeded responses or no metrics attached.")
+          error_result(run.errors.full_messages.to_sentence.presence || "Nothing to re-grade. The run has no succeeded responses or no metrics attached.")
         end
       end
 
@@ -160,6 +158,8 @@ module CompletionKit
         else
           error_result(new_run.failure_summary || "Could not start the new run.")
         end
+      rescue ActiveRecord::RecordInvalid => e
+        error_result(e.record.errors.full_messages.join(", "))
       end
 
       def self.retry_failures(args)

data/app/services/completion_kit/model_discovery_service.rb

@@ -67,7 +67,7 @@ module CompletionKit
 
     def extract_provider_error_message(body)
       return nil if body.blank?
-      data = JSON.parse(body)
+      data = JsonObject.parse(body)
       err = data["error"]
       message = (err.is_a?(Hash) && err["message"]) || data["message"] || (err.is_a?(String) && err) || nil
       redact_secrets(message)
@@ -89,7 +89,7 @@ module CompletionKit
         req.headers["Authorization"] = "Bearer #{@api_key}"
       end
       raise_fetch_error!(response) unless response.success?
-      JSON.parse(response.body).fetch("data", []).map { |e| { id: e["id"], display_name: nil } }
+      JsonObject.parse(response.body).fetch("data", []).map { |e| { id: e["id"], display_name: nil } }
     end
 
     def fetch_anthropic_models
@@ -98,7 +98,7 @@ module CompletionKit
         req.headers["anthropic-version"] = "2023-06-01"
       end
       raise_fetch_error!(response) unless response.success?
-      JSON.parse(response.body).fetch("data", []).map { |e| { id: e["id"], display_name: e["display_name"] } }
+      JsonObject.parse(response.body).fetch("data", []).map { |e| { id: e["id"], display_name: e["display_name"] } }
     end
 
     def fetch_openrouter_models
@@ -108,7 +108,7 @@ module CompletionKit
         req.headers["X-Title"] = "CompletionKit"
       end
       raise_fetch_error!(response) unless response.success?
-      JSON.parse(response.body).fetch("data", []).filter_map do |entry|
+      JsonObject.parse(response.body).fetch("data", []).filter_map do |entry|
         next nil if entry["deprecated"] == true
         context_length = entry["context_length"].to_i
         next nil if context_length < 8192
@@ -132,7 +132,7 @@ module CompletionKit
         req.headers["Authorization"] = "Bearer #{@api_key}" if @api_key.present?
       end
       raise DiscoveryError, custom_endpoint_error_message(response) unless response.success?
-      JSON.parse(response.body).fetch("data", []).map { |e| { id: e["id"], display_name: e["id"] } }
+      JsonObject.parse(response.body).fetch("data", []).map { |e| { id: e["id"], display_name: e["id"] } }
     end
 
     def custom_endpoint_error_message(response)
@@ -181,7 +181,7 @@ module CompletionKit
       end
       raise DiscoveryError, azure_error_message(response) unless response.success?
 
-      body = JSON.parse(response.body)
+      body = JsonObject.parse(response.body)
       if azure_foundry_project?
         @catalog_model_count = fetch_azure_catalog_count
         body.fetch("value", []).map { |d| { id: d["name"], display_name: d["name"] } }
@@ -196,7 +196,7 @@ module CompletionKit
       end
       return nil unless response.success?
 
-      JSON.parse(response.body).fetch("data", []).length
+      JsonObject.parse(response.body).fetch("data", []).length
     rescue StandardError
       nil
     end
@@ -356,7 +356,7 @@ module CompletionKit
       end
     rescue StandardError => e
       model.supports_generation = false
-      model.generation_error = redact_secrets(e.message)
+      model.generation_error = redact_secrets(EndpointError.from(e).message)
     end
 
     def probe_judging(model)
@@ -384,7 +384,7 @@ module CompletionKit
       end
     rescue StandardError => e
       model.supports_judging = false
-      model.judging_error = redact_secrets(e.message)
+      model.judging_error = redact_secrets(EndpointError.from(e).message)
     end
 
     OPENAI_REASONING_PROBE_BUDGET = 65_536
@@ -405,7 +405,7 @@ module CompletionKit
     end
 
     def extract_text(response)
-      data = JSON.parse(response.body)
+      data = JsonObject.parse(response.body)
       case @provider
       when "openai"
         message = Array(data["output"]).find { |o| o["type"] == "message" }

data/app/services/completion_kit/ollama_client.rb

@@ -26,7 +26,7 @@ module CompletionKit
       end
 
       if response.success?
-        data = JSON.parse(response.body)
+        data = JsonObject.parse(response.body)
         data["choices"][0]["text"].strip
       else
         "Error: #{response.status} - #{response.body}"
@@ -37,6 +37,8 @@ module CompletionKit
       raise
     rescue ProviderEndpoint::UnsafeEndpoint => e
       "Error: API endpoint #{e.message}"
+    rescue JSON::ParserError => e
+      "Error: #{EndpointError.from(e).message}"
     rescue => e
       "Error: #{e.message}"
     end
@@ -50,7 +52,7 @@ module CompletionKit
 
       return [] unless response.success?
 
-      models = JSON.parse(response.body).fetch("data", []).map { |entry| entry["id"] }.sort
+      models = JsonObject.parse(response.body).fetch("data", []).map { |entry| entry["id"] }.sort
       models.map { |id| { id: id, name: id } }
     rescue StandardError
       []

data/app/services/completion_kit/promptfoo_importer.rb

@@ -86,7 +86,7 @@ module CompletionKit
           next
         end
 
-        prompt = Prompt.create!(name: "Imported prompt #{index + 1}", template: template, llm_model: model)
+        prompt = Prompt.create!(name: "Imported prompt #{index + 1}", template: template, llm_model: model, allow_unconfigured_provider: true)
         created << prompt.name
       end
       { created: created, skipped: skipped }

data/app/services/completion_kit/provider_endpoint.rb

@@ -5,11 +5,17 @@ module CompletionKit
   module ProviderEndpoint
     class UnsafeEndpoint < StandardError; end
 
-    BLOCKED_NETS = [IPAddr.new("0.0.0.0/8"), IPAddr.new("100.64.0.0/10")].freeze
+    BLOCKED_NETS = %w[
+      0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24
+      192.88.99.0/24 192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
+      2001::/23 2001:db8::/32 2002::/16 3fff::/20
+    ].map { |net| IPAddr.new(net) }.freeze
+    GLOBAL_UNICAST = IPAddr.new("2000::/3")
+    NAT64 = IPAddr.new("64:ff9b::/96")
     ISSUE_MESSAGES = {
       invalid_url: "is not a valid http or https URL",
-      unresolvable: "could not be resolved",
-      unsafe_host: "resolves to a private address"
+      unresolvable: "does not resolve to a public address",
+      unsafe_host: "does not resolve to a public address"
     }.freeze
 
     module_function
@@ -66,12 +72,15 @@ module CompletionKit
 
     def unsafe?(ip)
       ip = ip.native
-      return true if ip.private?
-      return true if ip.link_local?
-      return true if ip.to_i.zero?
-      return true if ip.ipv4? && BLOCKED_NETS.any? { |net| net.include?(ip) }
-      return true if ip.loopback? && !CompletionKit.config.allow_loopback_endpoints
-      false
+      return !CompletionKit.config.allow_loopback_endpoints if ip.loopback?
+      return nat64_unsafe?(ip) if NAT64.include?(ip)
+      return true if ip.ipv6? && !GLOBAL_UNICAST.include?(ip)
+      BLOCKED_NETS.any? { |net| net.include?(ip) }
+    end
+
+    def nat64_unsafe?(ip)
+      target = IPAddr.new(ip.to_i & 0xffff_ffff, Socket::AF_INET)
+      target.loopback? || unsafe?(target)
     end
   end
 end

data/app/views/completion_kit/agreements/_buttons.html.erb

@@ -3,7 +3,7 @@
   <% pending_verdict = local_assigns[:pending_verdict] %>
   <% active_verdict = pending_verdict || current_verdict %>
   <% error = local_assigns[:error] %>
-  <% me = CompletionKit.config.username.presence || "operator" %>
+  <% me = ck_current_reviewer %>
   <% other_agreements = CompletionKit::Agreement
         .where(response_id: response_row.id, metric_id: metric.id)
         .where.not(created_by: me)