verifiers 0.3.2.dev154__py3-none-any.whl → 0.3.2.dev156__py3-none-any.whl

verifiers/v1/configs/runtime.py

@@ -19,7 +19,9 @@ def parse_network_rule(rule: str) -> tuple[SplitResult, str, int | None]:
     return parsed, (parsed.hostname or "").lower().rstrip("."), port
 
 
-def network_rule_matches(rule: str, scheme: str, host: str, port: int) -> bool:
+def network_rule_matches(
+    rule: str, scheme: str, host: str, port: int, *, subdomains: bool = False
+) -> bool:
     """Match a network-policy host pattern or URL origin. Paths are ignored."""
     try:
         parsed, pattern, rule_port = parse_network_rule(rule)
@@ -30,9 +32,7 @@ def network_rule_matches(rule: str, scheme: str, host: str, port: int) -> bool:
     if rule_port is not None and rule_port != port:
         return False
     host = host.lower().rstrip(".")
-    return fnmatchcase(host, pattern) or (
-        pattern.startswith("*.") and host == pattern[2:]
-    )
+    return fnmatchcase(host, pattern) or (subdomains and host.endswith(f".{pattern}"))
 
 
 def intersect_network_hosts(left: str, right: str) -> str:
@@ -45,7 +45,7 @@ def intersect_network_hosts(left: str, right: str) -> str:
             parent.startswith("*.") and not has_magic(parent[2:])
         ):
             continue
-        if fnmatchcase(child, parent) or child == parent.removeprefix("*."):
+        if fnmatchcase(child, parent):
             return child
     if all(has_magic(host) for host in (left, right)) and any(
         has_magic(host.removeprefix("*.")) for host in (left, right)
@@ -61,7 +61,8 @@ class NetworkPolicyConfig(BaseConfig):
     """Destinations allowed during execution; `*` is unrestricted and `[]` is
     framework-only."""
     block: list[str] = Field(default_factory=list)
-    """Destinations denied during execution; any `*` makes the policy framework-only."""
+    """Denied destinations; bare domains include subdomains, `*.` excludes the base
+    domain, and any `*` makes the policy framework-only."""
 
     @model_validator(mode="after")
     def validate_network_policy(self) -> Self:
@@ -82,7 +83,8 @@ class NetworkPolicyConfig(BaseConfig):
     def permits(self, scheme: str, host: str, port: int) -> bool:
         """Whether the destination is allowed by the configured egress rules."""
         return not any(
-            network_rule_matches(rule, scheme, host, port) for rule in self.block
+            network_rule_matches(rule, scheme, host, port, subdomains=True)
+            for rule in self.block
         ) and any(network_rule_matches(rule, scheme, host, port) for rule in self.allow)
 
     def with_task_network_policy(self, allow: list[str], block: list[str]) -> Self:

verifiers/v1/dialects/base.py

@@ -16,6 +16,7 @@ import logging
 from abc import ABC, abstractmethod
 from collections.abc import Callable, Mapping
 from glob import has_magic
+from ipaddress import ip_address
 from typing import Any, ClassVar, Generic, TypeVar
 
 from pydantic import AnyHttpUrl, BaseModel, ValidationError
@@ -129,10 +130,10 @@ class RequestFilter:
 def provider_domains(
     policy: NetworkPolicyConfig, requested: object = None
 ) -> list[str]:
-    """Translate allow/block rules to provider filters without changing their scope.
+    """Translate host rules to the provider's native domain filters.
 
-    Provider filters include subdomains, so exact hosts need a covering wildcard rule.
-    Empty results mean the policy cannot be represented; never send an empty filter.
+    Strip leading wildcards and let the provider define domain/subdomain scope.
+    Empty results mean unsupported rules; never send an empty filter.
     """
     rules = policy.block or policy.allow
     if requested is not None and not isinstance(requested, list):
@@ -149,9 +150,7 @@ def provider_domains(
                 url, host, port = parse_network_rule(rule)
             except ValueError:
                 return []
-            if is_filter and (
-                url.username is not None or url.path or url.query or url.fragment
-            ):
+            if url.username is not None or url.path or url.query or url.fragment:
                 return []
             domain = host if is_filter else host.removeprefix("*.")
             if (
@@ -162,17 +161,12 @@ def provider_domains(
                 or not domain.isascii()
             ):
                 return []
-            output.append(host)
-    for host in hosts:
-        if not host.startswith("*.") and not (
-            policy.block
-            and any(
-                wildcard.startswith("*.")
-                and intersect_network_hosts(wildcard, host) == host
-                for wildcard in hosts
-            )
-        ):
-            return []
+            try:
+                ip_address(domain)
+            except ValueError:
+                output.append(host)
+            else:
+                return []
     domains = list(dict.fromkeys(host.removeprefix("*.") for host in hosts))
     if requested is None:
         return domains

{verifiers-0.3.2.dev154.dist-info → verifiers-0.3.2.dev156.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev154
+Version: 0.3.2.dev156
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev154.dist-info → verifiers-0.3.2.dev156.dist-info}/RECORD

@@ -48,7 +48,7 @@ verifiers/v1/configs/env.py,sha256=k47XBYYWLOf-8P1dbek3x_s0ucNb726xxoryG69DIr4,7
 verifiers/v1/configs/harness.py,sha256=ZrR-Egzfft95oMoqQ78bAq9TqP882Q68M_47Ajw9lE8,2918
 verifiers/v1/configs/judge.py,sha256=WEwA8D4X5JSaIP3c-E2wPnvgByWeT6JRAn1d8gfiQ40,2142
 verifiers/v1/configs/retries.py,sha256=-nPlgmz7J_NZ4GOYG6oCc3thXo4La2SufBmvQGvvPGo,821
-verifiers/v1/configs/runtime.py,sha256=ZEGx5JEgkMOLBQhiKAg6nzqKMhUu4W9tCE3AR--X8HY,5412
+verifiers/v1/configs/runtime.py,sha256=3LDAnKy-BotE6MqyT1l07Y_bAq9Wye1OU8JZ7lyUVvY,5474
 verifiers/v1/configs/select.py,sha256=_HdcepQaJ1sDCYcs7Vqx72npDwHGOgUjsLDZmcgnonU,4743
 verifiers/v1/configs/serve.py,sha256=oa_0BrAVEKboU344w0hYkSaXj8lf26t0H87gvncAo0Q,2716
 verifiers/v1/configs/task.py,sha256=57OnEGAa6jTiG12Lx_elREU02koYh8UkM0t0Vvxahys,2614
@@ -62,7 +62,7 @@ verifiers/v1/configs/cli/replay.py,sha256=vUCNs-9j1CXcAZhGozN1EaztcXK_dYVK3iN_fR
 verifiers/v1/configs/cli/validate.py,sha256=oc-SSot6-5a0vXC-yFEQxYbb1O4r8k0Or8d_ijmizkU,3581
 verifiers/v1/dialects/__init__.py,sha256=MNOYM2NdTlSxGK4VtoEjMtD5zya2MpjPDX5jMvZUWEo,736
 verifiers/v1/dialects/anthropic.py,sha256=rkxS8K4xvSTZwS86Mz_a4MfHzrkYf9Vvu8wCerzVNIw,26111
-verifiers/v1/dialects/base.py,sha256=7peaHJGdVT93G3erTnlAcRJi7tGvJ9BUkd_W5O4HGms,16140
+verifiers/v1/dialects/base.py,sha256=BOqQFQU5ya80fp3Ny_miLHArtYTWlPpvxVC7z8UKaQ0,15909
 verifiers/v1/dialects/chat.py,sha256=KOrDW2f4WMLl37Pv2EilKddCXUUgRNjl4tQseMiPC-o,23775
 verifiers/v1/dialects/responses.py,sha256=GXI4xzvZWL5Dugi9uHPhrSdgV6RQ5zQuuPfzVztu2Go,30457
 verifiers/v1/envs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -193,8 +193,8 @@ verifiers/v1/utils/scope.py,sha256=bzUEiWDOVdbj7dXOwGOlzsQ_-Xu0j9NR5TalQB-8TS8,8
 verifiers/v1/utils/score.py,sha256=493yJVMw8teCu9JxapxMFPFzI0hNUqdo0Y2nGW4kckk,6200
 verifiers/v1/utils/trace_store.py,sha256=RsCDonGR-bs-tvEstcppiJm3jFmAdIiG83fA5KtCbAw,2801
 verifiers/v1/utils/version.py,sha256=-obEo_-l9-D8FLef4hYxncOe-uJpxrM1g2Hig_37Sgs,1607
-verifiers-0.3.2.dev154.dist-info/METADATA,sha256=PCpfeUDas7lHnPiFDRXfbqrDs-QW5R2FHsxwOdEnAaM,4161
-verifiers-0.3.2.dev154.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-verifiers-0.3.2.dev154.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
-verifiers-0.3.2.dev154.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
-verifiers-0.3.2.dev154.dist-info/RECORD,,
+verifiers-0.3.2.dev156.dist-info/METADATA,sha256=siLTRPsZNEdrKeTcWP3JzhmhLsMG3Qmb7PgN4Cv-J34,4161
+verifiers-0.3.2.dev156.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+verifiers-0.3.2.dev156.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
+verifiers-0.3.2.dev156.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
+verifiers-0.3.2.dev156.dist-info/RECORD,,