verifiers 0.3.2.dev153__tar.gz → 0.3.2.dev155__tar.gz

{verifiers-0.3.2.dev153 → verifiers-0.3.2.dev155}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev153
+Version: 0.3.2.dev155
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev153 → verifiers-0.3.2.dev155}/verifiers/v1/configs/runtime.py

@@ -19,7 +19,9 @@ def parse_network_rule(rule: str) -> tuple[SplitResult, str, int | None]:
     return parsed, (parsed.hostname or "").lower().rstrip("."), port
 
 
-def network_rule_matches(rule: str, scheme: str, host: str, port: int) -> bool:
+def network_rule_matches(
+    rule: str, scheme: str, host: str, port: int, *, subdomains: bool = False
+) -> bool:
     """Match a network-policy host pattern or URL origin. Paths are ignored."""
     try:
         parsed, pattern, rule_port = parse_network_rule(rule)
@@ -30,9 +32,7 @@ def network_rule_matches(rule: str, scheme: str, host: str, port: int) -> bool:
     if rule_port is not None and rule_port != port:
         return False
     host = host.lower().rstrip(".")
-    return fnmatchcase(host, pattern) or (
-        pattern.startswith("*.") and host == pattern[2:]
-    )
+    return fnmatchcase(host, pattern) or (subdomains and host.endswith(f".{pattern}"))
 
 
 def intersect_network_hosts(left: str, right: str) -> str:
@@ -45,7 +45,7 @@ def intersect_network_hosts(left: str, right: str) -> str:
             parent.startswith("*.") and not has_magic(parent[2:])
         ):
             continue
-        if fnmatchcase(child, parent) or child == parent.removeprefix("*."):
+        if fnmatchcase(child, parent):
             return child
     if all(has_magic(host) for host in (left, right)) and any(
         has_magic(host.removeprefix("*.")) for host in (left, right)
@@ -61,7 +61,8 @@ class NetworkPolicyConfig(BaseConfig):
     """Destinations allowed during execution; `*` is unrestricted and `[]` is
     framework-only."""
     block: list[str] = Field(default_factory=list)
-    """Destinations denied during execution; any `*` makes the policy framework-only."""
+    """Denied destinations; bare domains include subdomains, `*.` excludes the base
+    domain, and any `*` makes the policy framework-only."""
 
     @model_validator(mode="after")
     def validate_network_policy(self) -> Self:
@@ -82,7 +83,8 @@ class NetworkPolicyConfig(BaseConfig):
     def permits(self, scheme: str, host: str, port: int) -> bool:
         """Whether the destination is allowed by the configured egress rules."""
         return not any(
-            network_rule_matches(rule, scheme, host, port) for rule in self.block
+            network_rule_matches(rule, scheme, host, port, subdomains=True)
+            for rule in self.block
         ) and any(network_rule_matches(rule, scheme, host, port) for rule in self.allow)
 
     def with_task_network_policy(self, allow: list[str], block: list[str]) -> Self:

{verifiers-0.3.2.dev153 → verifiers-0.3.2.dev155}/verifiers/v1/harnesses/rlm/harness.py

@@ -69,7 +69,7 @@ class CompactionConfig(BaseConfig):
 
 class RLMHarnessConfig(HarnessConfig):
     version: str = Field(
-        default="38c44a06fdef484a19d8d6c4e5697100971f9ecd", min_length=1
+        default="7b5c89b2a0055e6c1a993cdd0ba0384053835f14", min_length=1
     )
     """Git ref (branch, tag, or commit) of nano-rlm to install. Must know every
     field this harness puts on the wire, i.e. be at least the default ref."""