verifiers 0.3.2.dev156__py3-none-any.whl → 0.3.2.dev158__py3-none-any.whl

verifiers/v1/__init__.py

@@ -15,7 +15,6 @@ from verifiers.v1.clients import (
 )
 from verifiers.v1.configs.agent import AgentConfig
 from verifiers.v1.configs.cli.env import (
-    merge_env_defaults,
     narrowed_env_annotation,
     resolve_env_field,
 )
@@ -153,6 +152,7 @@ from verifiers.v1.utils.decorators import (
     stop,
     tool,
 )
+from verifiers.v1.utils.generic import merge_defaults
 from verifiers.v1.utils.git import (
     PATCH_CAP_BYTES as PATCH_CAP_BYTES,
 )
@@ -321,7 +321,7 @@ __all__ = [  # noqa: RUF022 - grouped by public API area
     "SharedEnvConfig",
     "ServeConfig",
     "resolve_env_field",
-    "merge_env_defaults",
+    "merge_defaults",
     "narrowed_env_annotation",
     "SingleAgentEnvConfig",
     "AgentConfig",

verifiers/v1/configs/cli/env.py

@@ -1,5 +1,6 @@
 """Run-config plumbing around the `[env]` block: narrowing the `env` field of
-every config that owns one, and layering shared env defaults under it.
+every config that owns one. `merge_defaults` (`utils/generic.py`) layers shared env
+defaults under it.
 
 A run composes the blocks it needs — `[env]` (what runs, `configs/env.py`),
 `[serve]` (how it's hosted, `configs/serve.py`) — plus its own fields. Nothing here is a base class: the eval
@@ -10,11 +11,11 @@ single_agent_env_config)`. The `SerializeAsAny` is load-bearing: pydantic serial
 by declared type, so a plain `EnvConfig` silently drops a narrowed subclass's agents
 and knobs from `model_dump()` — the env-server wire's payload."""
 
-from pydantic import BaseModel, ValidationError
+from pydantic import ValidationError
 from pydantic_config import BaseConfig
 
-from verifiers.v1.configs.env import EnvConfig, SharedEnvConfig
-from verifiers.v1.utils.generic import deep_merge, prefix_validation_error
+from verifiers.v1.configs.env import EnvConfig
+from verifiers.v1.utils.generic import prefix_validation_error
 
 
 def resolve_env_field(data: dict, narrowed: "type[EnvConfig] | None" = None) -> dict:
@@ -45,32 +46,6 @@ def resolve_env_field(data: dict, narrowed: "type[EnvConfig] | None" = None) ->
     return data
 
 
-def merge_env_defaults(defaults: SharedEnvConfig, env: dict | None) -> dict:
-    """A raw `env` block over `defaults`, the knobs that several envs of one run share
-    (e.g. the retries of every eval source). Only the fields set in `defaults` apply,
-    and the env's own values win. A subtree whose `id`/`type` differs from the
-    default's is the env's alone, so one plugin's knobs never leak into another's."""
-    return deep_merge(_dump_set(defaults), env or {})
-
-
-def _dump_set(config: BaseModel) -> dict:
-    """`config`'s set fields, including those set on a sub-config after construction
-    (which leaves the parent's field unmarked). Each dumped sub-config keeps its
-    `id`/`type` even at the default: `deep_merge` detects a plugin switch only when
-    both sides name it."""
-    dump = {}
-    for name in type(config).model_fields:
-        value = getattr(config, name)
-        if isinstance(value, BaseModel):
-            nested = _dump_set(value)
-            if nested or name in config.model_fields_set:
-                keys = [k for k in ("id", "type") if k in type(value).model_fields]
-                dump[name] = {**{k: getattr(value, k) for k in keys}, **nested}
-        elif name in config.model_fields_set:
-            dump[name] = config.model_dump(include={name})[name]
-    return dump
-
-
 def narrowed_env_annotation(cls) -> "type[EnvConfig] | None":
     """The env field's annotation when the CLI pre-narrowed it (`narrow_config`
     swaps in a concrete subclass). The base declaration reads as `EnvConfig` itself

verifiers/v1/utils/artifacts.py

@@ -141,7 +141,8 @@ async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
 
     Archive bytes are untrusted: the agent controls both their source files and the
     runtime tooling that creates them. Every archive is therefore validated on the host
-    before the grading runtime is changed. Only regular files and directories travel.
+    before the grading runtime is changed. Regular files, directories, and confined links
+    can travel; link chains and extraction through symlinks cannot.
     """
     if not collected:
         return
@@ -214,6 +215,9 @@ def _validate_restore(root: str, archive: bytes | None) -> None:
 
     try:
         with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as tar:
+            regular_files: set[PurePosixPath] = set()
+            members: set[PurePosixPath] = set()
+            symlinks: dict[PurePosixPath, str] = {}
             for member in tar:
                 member_path = PurePosixPath(member.name)
                 destination = PurePosixPath("/") / member_path
@@ -227,10 +231,65 @@ def _validate_restore(root: str, archive: bytes | None) -> None:
                         f"artifact member {member.name!r} is outside declared root "
                         f"{root!r}"
                     )
-                if not (member.isfile() or member.isdir()):
+                if member_path in members:
+                    raise RuntimeError(f"duplicate artifact member {member.name!r}")
+                members.add(member_path)
+                if member.issym():
+                    symlinks[member_path] = member.linkname
+                elif member.islnk():
+                    # Tar deduplicates hard-linked build outputs (e.g. Cargo's build
+                    # scripts). A target must already be a regular member of this
+                    # archive, never a path supplied by the verifier image.
+                    target = PurePosixPath(member.linkname)
+                    if (
+                        not member.linkname
+                        or target.is_absolute()
+                        or ".." in target.parts
+                        or target not in regular_files
+                        or target == member_path
+                    ):
+                        raise RuntimeError(
+                            f"artifact hard link {member.name!r} has unsafe target "
+                            f"{member.linkname!r}"
+                        )
+                elif not (member.isfile() or member.isdir()):
                     raise RuntimeError(
                         f"artifact member {member.name!r} is a link or special file"
                     )
+                if member.isfile():
+                    regular_files.add(member_path)
+            # Check after reading the whole archive, so a later symlink cannot
+            # turn an earlier member's parent or a link target into a redirection.
+            for member_path in members:
+                if any(parent in symlinks for parent in member_path.parents):
+                    raise RuntimeError(
+                        f"artifact member {str(member_path)!r} traverses a symlink"
+                    )
+            relative_root = root_path.relative_to("/")
+            for member_path, linkname in symlinks.items():
+                target = PurePosixPath(linkname)
+                if not linkname or target.is_absolute():
+                    raise RuntimeError(
+                        f"artifact symlink {str(member_path)!r} has unsafe target "
+                        f"{linkname!r}"
+                    )
+                resolved = member_path.parent
+                if not resolved.is_relative_to(relative_root):
+                    raise RuntimeError(
+                        f"artifact symlink {str(member_path)!r} has unsafe target "
+                        f"{linkname!r}"
+                    )
+                # Walk before normalizing '..': a/../b is unsafe if a is itself
+                # a symlink. Missing internal targets are safe (e.g. build outputs).
+                for part in target.parts:
+                    resolved = resolved.parent if part == ".." else resolved / part
+                    if not resolved.is_relative_to(relative_root) or any(
+                        path in symlinks for path in (resolved, *resolved.parents)
+                    ):
+                        raise RuntimeError(
+                            f"artifact symlink {str(member_path)!r} has unsafe target "
+                            f"{linkname!r}"
+                        )
     except tarfile.TarError as exc:
         raise RuntimeError(f"unreadable artifact archive for {root!r}: {exc}") from exc
 

verifiers/v1/utils/generic.py

@@ -2,7 +2,7 @@
 
 from typing import TypeVar, get_args, get_origin
 
-from pydantic import ValidationError
+from pydantic import BaseModel, ValidationError
 
 T = TypeVar("T")
 
@@ -39,6 +39,58 @@ def deep_merge(base: dict, override: dict) -> dict:
     return merged
 
 
+def merge_defaults(defaults: BaseModel, raw: dict | None) -> dict:
+    """Fill in a raw config block with the values that `defaults` sets, e.g. a
+    group's shared knobs under each member's own block.
+
+    - Only fields that were set on `defaults` are filled in; its plain defaults are not.
+    - Nested blocks are filled in key by key; a value already in `raw` is kept.
+    - If `raw` names a different `id`/`type` for a block (at any depth), that block is
+      taken from `raw` alone, so one plugin's fields never leak into another's.
+
+    For example, with `defaults` set to `algo = {type = "grpo", kl = 0.1}`:
+    `{}` becomes `{type = "grpo", kl = 0.1}`, `{kl = 0.5}` becomes
+    `{type = "grpo", kl = 0.5}`, and `{type = "max_rl"}` stays `{type = "max_rl"}`.
+    """
+    # `deep_merge` detects an `id`/`type` switch only on nested blocks, so wrap the
+    # block once to detect a switch of the block itself too.
+    identity = {
+        k: getattr(defaults, k)
+        for k in ("id", "type")
+        if k in type(defaults).model_fields
+    }
+    block = {**identity, **_dump_set(defaults)}
+    return deep_merge({"block": block}, {"block": raw or {}})["block"]
+
+
+def _dump_set(config: BaseModel) -> dict:
+    """The fields set on `config`, including extra fields, as a nested dict. A
+    sub-config the parent did not set still counts when its own fields changed after
+    construction (pydantic then leaves the parent's field unmarked), but not when it
+    only matches the field's default, which may itself be built with arguments. A
+    dumped sub-config always includes its `id`/`type`, because `deep_merge` detects a
+    switch only when both sides name it."""
+    dump = {}
+    for name, field in type(config).model_fields.items():
+        value = getattr(config, name)
+        if isinstance(value, BaseModel):
+            nested = _dump_set(value)
+            if name not in config.model_fields_set:
+                default = field.get_default(
+                    call_default_factory=True, validated_data=config.__dict__
+                )
+                if isinstance(default, BaseModel) and nested == _dump_set(default):
+                    continue
+            if nested or name in config.model_fields_set:
+                keys = [k for k in ("id", "type") if k in type(value).model_fields]
+                dump[name] = {**{k: getattr(value, k) for k in keys}, **nested}
+        elif name in config.model_fields_set:
+            dump[name] = config.model_dump(include={name})[name]
+    # Extra fields of an `extra="allow"` model exist only because they were set.
+    dump.update(config.model_dump(include=set(config.model_extra or {})))
+    return dump
+
+
 def concrete_type(
     cls: type, bound: type[T], *, origin: type | None = None
 ) -> type[T] | None:

{verifiers-0.3.2.dev156.dist-info → verifiers-0.3.2.dev158.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev156
+Version: 0.3.2.dev158
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev156.dist-info → verifiers-0.3.2.dev158.dist-info}/RECORD

@@ -1,5 +1,5 @@
 verifiers/__init__.py,sha256=F5IVMw6mhGaPBMCw7QKk0la_r5mMwydP2hdTTdQucik,352
-verifiers/v1/__init__.py,sha256=6t2FsosAjmyfJz6qS8tDQ2gWCvQfyRzqk1mYwv5_-EQ,8738
+verifiers/v1/__init__.py,sha256=_8pSA4XU7zR4V-8sRpnZjh-YkfAYx1a0pikJtoFKzIk,8764
 verifiers/v1/agent.py,sha256=yBCCBe5tVTeQ8OZDlVSZLw_IDvCmEQSnF3wQ1BZcT14,32342
 verifiers/v1/env.py,sha256=GqrVxxrvv-9WitXhD8Rre0tKQgnQWeD8mTM2gDHMVBs,18040
 verifiers/v1/episode.py,sha256=UPtA02aGWA-fY8cJKEuYCMtQVnPN1C0BSN13LggNT8U,5986
@@ -55,7 +55,7 @@ verifiers/v1/configs/task.py,sha256=57OnEGAa6jTiG12Lx_elREU02koYh8UkM0t0Vvxahys,
 verifiers/v1/configs/taskset.py,sha256=LLbKdV2LW0ZjB9-fsKErIVKjchOAPcDLWGLVjgXKG_0,935
 verifiers/v1/configs/cli/__init__.py,sha256=YMDUPdbRlDJ77dhj3QqzmyRhqNgUvuQdpj_bdBqzZPM,78
 verifiers/v1/configs/cli/debug.py,sha256=CcUZ9MEcv0iAL9w2BkTfnZg20yWJ-Vn8P30-e5tuCic,2741
-verifiers/v1/configs/cli/env.py,sha256=FcapEAtgeHzRuVaqk8BU36ZxmMOfdJ1XlioPbdwwspo,3990
+verifiers/v1/configs/cli/env.py,sha256=qg2LNOasAU0yg3b0xqXpx3cIj4nHbHSlK3Ldc3NhiT4,2667
 verifiers/v1/configs/cli/eval.py,sha256=9Zw7mAUipMhoIcwRa_lgo5gII4rMmMEBAgzcPxPWPjw,6895
 verifiers/v1/configs/cli/init.py,sha256=JvIUOdhfZfNOXg2wm2i06jLLHpb97tNMzZqmcK_9wVw,916
 verifiers/v1/configs/cli/replay.py,sha256=vUCNs-9j1CXcAZhGozN1EaztcXK_dYVK3iN_fRmbSXw,2929
@@ -174,11 +174,11 @@ verifiers/v1/tasksets/textarena/__init__.py,sha256=Os2OlBY_pSH0B1DP32RitumgSLpq2
 verifiers/v1/tasksets/textarena/taskset.py,sha256=zGslerxmH2ZT7FJdP-72R6a9p71kr2pNS3r5_xnq1lQ,4406
 verifiers/v1/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 verifiers/v1/utils/aio.py,sha256=0yNFOqB2oO6Qktc6NI_ZSAGuo1aHsIK_wuT1BtmoZ3I,1532
-verifiers/v1/utils/artifacts.py,sha256=i9DRhxViMAf-aBPjs3_9Q8RWVRC5pD-_v97VbNPPNcY,9638
+verifiers/v1/utils/artifacts.py,sha256=3QL2ELwqXuek9OLwF4hJdzZb_hwfVjjenw8VjepdLlo,12855
 verifiers/v1/utils/compile.py,sha256=5pxy31wx2Q-3pQjOO5B9SH6OT-wwb8r4F1LAl6HMeQA,5835
 verifiers/v1/utils/decorators.py,sha256=vhoN6YoKb15-Fkqmc9RaNlUIbt9WRvNK4zAn2bAxfS4,5367
 verifiers/v1/utils/format.py,sha256=yX160sGewMMZn9iJqTHRbYYt4Z9pHasjMlFT1dXrKD8,2446
-verifiers/v1/utils/generic.py,sha256=2VIN9RapMO9pVkFHB1UKUHck1vlTJ1pjfad2NzxuuXA,2055
+verifiers/v1/utils/generic.py,sha256=Iy_mgApIEBqm0DPpjBDLLkDFN0_NJ-UQmY9bZpdv5cM,4742
 verifiers/v1/utils/git.py,sha256=MTRinOvG4EddfjdahHkFZUihHmhJ37n5ROtgjzjE1NA,8366
 verifiers/v1/utils/image.py,sha256=OFw_wdwVtbdwa8uJ3X3vYfhpUAi0CTH5HMBupjVsRRQ,282
 verifiers/v1/utils/interrupt.py,sha256=F-KKhc5ndPJJfhd3SuMqyqhXhA32FhCRy5KWFJpEoM4,1179
@@ -193,8 +193,8 @@ verifiers/v1/utils/scope.py,sha256=bzUEiWDOVdbj7dXOwGOlzsQ_-Xu0j9NR5TalQB-8TS8,8
 verifiers/v1/utils/score.py,sha256=493yJVMw8teCu9JxapxMFPFzI0hNUqdo0Y2nGW4kckk,6200
 verifiers/v1/utils/trace_store.py,sha256=RsCDonGR-bs-tvEstcppiJm3jFmAdIiG83fA5KtCbAw,2801
 verifiers/v1/utils/version.py,sha256=-obEo_-l9-D8FLef4hYxncOe-uJpxrM1g2Hig_37Sgs,1607
-verifiers-0.3.2.dev156.dist-info/METADATA,sha256=siLTRPsZNEdrKeTcWP3JzhmhLsMG3Qmb7PgN4Cv-J34,4161
-verifiers-0.3.2.dev156.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-verifiers-0.3.2.dev156.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
-verifiers-0.3.2.dev156.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
-verifiers-0.3.2.dev156.dist-info/RECORD,,
+verifiers-0.3.2.dev158.dist-info/METADATA,sha256=v6hCapMsuYV66Fvoz8QpYw8ZjlIG-AAXPIEoef8oSDM,4161
+verifiers-0.3.2.dev158.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+verifiers-0.3.2.dev158.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
+verifiers-0.3.2.dev158.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
+verifiers-0.3.2.dev158.dist-info/RECORD,,