verifiers 0.3.2.dev154__tar.gz → 0.3.2.dev156__tar.gz

{verifiers-0.3.2.dev154 → verifiers-0.3.2.dev156}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev154
+Version: 0.3.2.dev156
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev154 → verifiers-0.3.2.dev156}/verifiers/v1/configs/runtime.py

@@ -19,7 +19,9 @@ def parse_network_rule(rule: str) -> tuple[SplitResult, str, int | None]:
     return parsed, (parsed.hostname or "").lower().rstrip("."), port
 
 
-def network_rule_matches(rule: str, scheme: str, host: str, port: int) -> bool:
+def network_rule_matches(
+    rule: str, scheme: str, host: str, port: int, *, subdomains: bool = False
+) -> bool:
     """Match a network-policy host pattern or URL origin. Paths are ignored."""
     try:
         parsed, pattern, rule_port = parse_network_rule(rule)
@@ -30,9 +32,7 @@ def network_rule_matches(rule: str, scheme: str, host: str, port: int) -> bool:
     if rule_port is not None and rule_port != port:
         return False
     host = host.lower().rstrip(".")
-    return fnmatchcase(host, pattern) or (
-        pattern.startswith("*.") and host == pattern[2:]
-    )
+    return fnmatchcase(host, pattern) or (subdomains and host.endswith(f".{pattern}"))
 
 
 def intersect_network_hosts(left: str, right: str) -> str:
@@ -45,7 +45,7 @@ def intersect_network_hosts(left: str, right: str) -> str:
             parent.startswith("*.") and not has_magic(parent[2:])
         ):
             continue
-        if fnmatchcase(child, parent) or child == parent.removeprefix("*."):
+        if fnmatchcase(child, parent):
             return child
     if all(has_magic(host) for host in (left, right)) and any(
         has_magic(host.removeprefix("*.")) for host in (left, right)
@@ -61,7 +61,8 @@ class NetworkPolicyConfig(BaseConfig):
     """Destinations allowed during execution; `*` is unrestricted and `[]` is
     framework-only."""
     block: list[str] = Field(default_factory=list)
-    """Destinations denied during execution; any `*` makes the policy framework-only."""
+    """Denied destinations; bare domains include subdomains, `*.` excludes the base
+    domain, and any `*` makes the policy framework-only."""
 
     @model_validator(mode="after")
     def validate_network_policy(self) -> Self:
@@ -82,7 +83,8 @@ class NetworkPolicyConfig(BaseConfig):
     def permits(self, scheme: str, host: str, port: int) -> bool:
         """Whether the destination is allowed by the configured egress rules."""
         return not any(
-            network_rule_matches(rule, scheme, host, port) for rule in self.block
+            network_rule_matches(rule, scheme, host, port, subdomains=True)
+            for rule in self.block
         ) and any(network_rule_matches(rule, scheme, host, port) for rule in self.allow)
 
     def with_task_network_policy(self, allow: list[str], block: list[str]) -> Self:

{verifiers-0.3.2.dev154 → verifiers-0.3.2.dev156}/verifiers/v1/dialects/base.py

@@ -16,6 +16,7 @@ import logging
 from abc import ABC, abstractmethod
 from collections.abc import Callable, Mapping
 from glob import has_magic
+from ipaddress import ip_address
 from typing import Any, ClassVar, Generic, TypeVar
 
 from pydantic import AnyHttpUrl, BaseModel, ValidationError
@@ -129,10 +130,10 @@ class RequestFilter:
 def provider_domains(
     policy: NetworkPolicyConfig, requested: object = None
 ) -> list[str]:
-    """Translate allow/block rules to provider filters without changing their scope.
+    """Translate host rules to the provider's native domain filters.
 
-    Provider filters include subdomains, so exact hosts need a covering wildcard rule.
-    Empty results mean the policy cannot be represented; never send an empty filter.
+    Strip leading wildcards and let the provider define domain/subdomain scope.
+    Empty results mean unsupported rules; never send an empty filter.
     """
     rules = policy.block or policy.allow
     if requested is not None and not isinstance(requested, list):
@@ -149,9 +150,7 @@ def provider_domains(
                 url, host, port = parse_network_rule(rule)
             except ValueError:
                 return []
-            if is_filter and (
-                url.username is not None or url.path or url.query or url.fragment
-            ):
+            if url.username is not None or url.path or url.query or url.fragment:
                 return []
             domain = host if is_filter else host.removeprefix("*.")
             if (
@@ -162,17 +161,12 @@ def provider_domains(
                 or not domain.isascii()
             ):
                 return []
-            output.append(host)
-    for host in hosts:
-        if not host.startswith("*.") and not (
-            policy.block
-            and any(
-                wildcard.startswith("*.")
-                and intersect_network_hosts(wildcard, host) == host
-                for wildcard in hosts
-            )
-        ):
-            return []
+            try:
+                ip_address(domain)
+            except ValueError:
+                output.append(host)
+            else:
+                return []
     domains = list(dict.fromkeys(host.removeprefix("*.") for host in hosts))
     if requested is None:
         return domains