verifiers 0.3.2.dev156__tar.gz → 0.3.2.dev158__tar.gz

{verifiers-0.3.2.dev156 → verifiers-0.3.2.dev158}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev156
+Version: 0.3.2.dev158
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev156 → verifiers-0.3.2.dev158}/verifiers/v1/__init__.py

@@ -15,7 +15,6 @@ from verifiers.v1.clients import (
 )
 from verifiers.v1.configs.agent import AgentConfig
 from verifiers.v1.configs.cli.env import (
-    merge_env_defaults,
     narrowed_env_annotation,
     resolve_env_field,
 )
@@ -153,6 +152,7 @@ from verifiers.v1.utils.decorators import (
     stop,
     tool,
 )
+from verifiers.v1.utils.generic import merge_defaults
 from verifiers.v1.utils.git import (
     PATCH_CAP_BYTES as PATCH_CAP_BYTES,
 )
@@ -321,7 +321,7 @@ __all__ = [  # noqa: RUF022 - grouped by public API area
     "SharedEnvConfig",
     "ServeConfig",
     "resolve_env_field",
-    "merge_env_defaults",
+    "merge_defaults",
     "narrowed_env_annotation",
     "SingleAgentEnvConfig",
     "AgentConfig",

{verifiers-0.3.2.dev156 → verifiers-0.3.2.dev158}/verifiers/v1/configs/cli/env.py

@@ -1,5 +1,6 @@
 """Run-config plumbing around the `[env]` block: narrowing the `env` field of
-every config that owns one, and layering shared env defaults under it.
+every config that owns one. `merge_defaults` (`utils/generic.py`) layers shared env
+defaults under it.
 
 A run composes the blocks it needs — `[env]` (what runs, `configs/env.py`),
 `[serve]` (how it's hosted, `configs/serve.py`) — plus its own fields. Nothing here is a base class: the eval
@@ -10,11 +11,11 @@ single_agent_env_config)`. The `SerializeAsAny` is load-bearing: pydantic serial
 by declared type, so a plain `EnvConfig` silently drops a narrowed subclass's agents
 and knobs from `model_dump()` — the env-server wire's payload."""
 
-from pydantic import BaseModel, ValidationError
+from pydantic import ValidationError
 from pydantic_config import BaseConfig
 
-from verifiers.v1.configs.env import EnvConfig, SharedEnvConfig
-from verifiers.v1.utils.generic import deep_merge, prefix_validation_error
+from verifiers.v1.configs.env import EnvConfig
+from verifiers.v1.utils.generic import prefix_validation_error
 
 
 def resolve_env_field(data: dict, narrowed: "type[EnvConfig] | None" = None) -> dict:
@@ -45,32 +46,6 @@ def resolve_env_field(data: dict, narrowed: "type[EnvConfig] | None" = None) ->
     return data
 
 
-def merge_env_defaults(defaults: SharedEnvConfig, env: dict | None) -> dict:
-    """A raw `env` block over `defaults`, the knobs that several envs of one run share
-    (e.g. the retries of every eval source). Only the fields set in `defaults` apply,
-    and the env's own values win. A subtree whose `id`/`type` differs from the
-    default's is the env's alone, so one plugin's knobs never leak into another's."""
-    return deep_merge(_dump_set(defaults), env or {})
-
-
-def _dump_set(config: BaseModel) -> dict:
-    """`config`'s set fields, including those set on a sub-config after construction
-    (which leaves the parent's field unmarked). Each dumped sub-config keeps its
-    `id`/`type` even at the default: `deep_merge` detects a plugin switch only when
-    both sides name it."""
-    dump = {}
-    for name in type(config).model_fields:
-        value = getattr(config, name)
-        if isinstance(value, BaseModel):
-            nested = _dump_set(value)
-            if nested or name in config.model_fields_set:
-                keys = [k for k in ("id", "type") if k in type(value).model_fields]
-                dump[name] = {**{k: getattr(value, k) for k in keys}, **nested}
-        elif name in config.model_fields_set:
-            dump[name] = config.model_dump(include={name})[name]
-    return dump
-
-
 def narrowed_env_annotation(cls) -> "type[EnvConfig] | None":
     """The env field's annotation when the CLI pre-narrowed it (`narrow_config`
     swaps in a concrete subclass). The base declaration reads as `EnvConfig` itself

{verifiers-0.3.2.dev156 → verifiers-0.3.2.dev158}/verifiers/v1/utils/artifacts.py

@@ -141,7 +141,8 @@ async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
 
     Archive bytes are untrusted: the agent controls both their source files and the
     runtime tooling that creates them. Every archive is therefore validated on the host
-    before the grading runtime is changed. Only regular files and directories travel.
+    before the grading runtime is changed. Regular files, directories, and confined links
+    can travel; link chains and extraction through symlinks cannot.
     """
     if not collected:
         return
@@ -214,6 +215,9 @@ def _validate_restore(root: str, archive: bytes | None) -> None:
 
     try:
         with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as tar:
+            regular_files: set[PurePosixPath] = set()
+            members: set[PurePosixPath] = set()
+            symlinks: dict[PurePosixPath, str] = {}
             for member in tar:
                 member_path = PurePosixPath(member.name)
                 destination = PurePosixPath("/") / member_path
@@ -227,10 +231,65 @@ def _validate_restore(root: str, archive: bytes | None) -> None:
                         f"artifact member {member.name!r} is outside declared root "
                         f"{root!r}"
                     )
-                if not (member.isfile() or member.isdir()):
+                if member_path in members:
+                    raise RuntimeError(f"duplicate artifact member {member.name!r}")
+                members.add(member_path)
+                if member.issym():
+                    symlinks[member_path] = member.linkname
+                elif member.islnk():
+                    # Tar deduplicates hard-linked build outputs (e.g. Cargo's build
+                    # scripts). A target must already be a regular member of this
+                    # archive, never a path supplied by the verifier image.
+                    target = PurePosixPath(member.linkname)
+                    if (
+                        not member.linkname
+                        or target.is_absolute()
+                        or ".." in target.parts
+                        or target not in regular_files
+                        or target == member_path
+                    ):
+                        raise RuntimeError(
+                            f"artifact hard link {member.name!r} has unsafe target "
+                            f"{member.linkname!r}"
+                        )
+                elif not (member.isfile() or member.isdir()):
                     raise RuntimeError(
                         f"artifact member {member.name!r} is a link or special file"
                     )
+                if member.isfile():
+                    regular_files.add(member_path)
+            # Check after reading the whole archive, so a later symlink cannot
+            # turn an earlier member's parent or a link target into a redirection.
+            for member_path in members:
+                if any(parent in symlinks for parent in member_path.parents):
+                    raise RuntimeError(
+                        f"artifact member {str(member_path)!r} traverses a symlink"
+                    )
+            relative_root = root_path.relative_to("/")
+            for member_path, linkname in symlinks.items():
+                target = PurePosixPath(linkname)
+                if not linkname or target.is_absolute():
+                    raise RuntimeError(
+                        f"artifact symlink {str(member_path)!r} has unsafe target "
+                        f"{linkname!r}"
+                    )
+                resolved = member_path.parent
+                if not resolved.is_relative_to(relative_root):
+                    raise RuntimeError(
+                        f"artifact symlink {str(member_path)!r} has unsafe target "
+                        f"{linkname!r}"
+                    )
+                # Walk before normalizing '..': a/../b is unsafe if a is itself
+                # a symlink. Missing internal targets are safe (e.g. build outputs).
+                for part in target.parts:
+                    resolved = resolved.parent if part == ".." else resolved / part
+                    if not resolved.is_relative_to(relative_root) or any(
+                        path in symlinks for path in (resolved, *resolved.parents)
+                    ):
+                        raise RuntimeError(
+                            f"artifact symlink {str(member_path)!r} has unsafe target "
+                            f"{linkname!r}"
+                        )
     except tarfile.TarError as exc:
         raise RuntimeError(f"unreadable artifact archive for {root!r}: {exc}") from exc
 

verifiers-0.3.2.dev158/verifiers/v1/utils/generic.py

@@ -0,0 +1,105 @@
+"""Generic helpers shared across v1 modules."""
+
+from typing import TypeVar, get_args, get_origin
+
+from pydantic import BaseModel, ValidationError
+
+T = TypeVar("T")
+
+
+def prefix_validation_error(e: ValidationError, prefix: tuple) -> ValidationError:
+    """`e` with `prefix` prepended to every error's loc. A sub-model validated
+    inside a `mode="before"` validator surfaces its errors at the validator's own
+    loc, so without re-raising prefixed the CLI renders a flag path missing the
+    segments the user actually typed."""
+    return ValidationError.from_exception_data(
+        e.title,
+        [
+            {**err, "loc": prefix + tuple(err["loc"])}
+            for err in e.errors(include_url=False)
+        ],
+    )
+
+
+def deep_merge(base: dict, override: dict) -> dict:
+    """`override` onto `base`, recursing into dicts, so a partial nested override
+    keeps the untouched keys of the declared default. An override that switches a
+    subtree's discriminator (`id`/`type`) replaces the subtree wholesale — the old
+    plugin's fields must not leak into the new type's validation."""
+    merged = dict(base)
+    for key, value in override.items():
+        if isinstance(value, dict) and isinstance(merged.get(key), dict):
+            switched = any(
+                k in value and k in merged[key] and value[k] != merged[key][k]
+                for k in ("id", "type")
+            )
+            merged[key] = value if switched else deep_merge(merged[key], value)
+        else:
+            merged[key] = value
+    return merged
+
+
+def merge_defaults(defaults: BaseModel, raw: dict | None) -> dict:
+    """Fill in a raw config block with the values that `defaults` sets, e.g. a
+    group's shared knobs under each member's own block.
+
+    - Only fields that were set on `defaults` are filled in; its plain defaults are not.
+    - Nested blocks are filled in key by key; a value already in `raw` is kept.
+    - If `raw` names a different `id`/`type` for a block (at any depth), that block is
+      taken from `raw` alone, so one plugin's fields never leak into another's.
+
+    For example, with `defaults` set to `algo = {type = "grpo", kl = 0.1}`:
+    `{}` becomes `{type = "grpo", kl = 0.1}`, `{kl = 0.5}` becomes
+    `{type = "grpo", kl = 0.5}`, and `{type = "max_rl"}` stays `{type = "max_rl"}`.
+    """
+    # `deep_merge` detects an `id`/`type` switch only on nested blocks, so wrap the
+    # block once to detect a switch of the block itself too.
+    identity = {
+        k: getattr(defaults, k)
+        for k in ("id", "type")
+        if k in type(defaults).model_fields
+    }
+    block = {**identity, **_dump_set(defaults)}
+    return deep_merge({"block": block}, {"block": raw or {}})["block"]
+
+
+def _dump_set(config: BaseModel) -> dict:
+    """The fields set on `config`, including extra fields, as a nested dict. A
+    sub-config the parent did not set still counts when its own fields changed after
+    construction (pydantic then leaves the parent's field unmarked), but not when it
+    only matches the field's default, which may itself be built with arguments. A
+    dumped sub-config always includes its `id`/`type`, because `deep_merge` detects a
+    switch only when both sides name it."""
+    dump = {}
+    for name, field in type(config).model_fields.items():
+        value = getattr(config, name)
+        if isinstance(value, BaseModel):
+            nested = _dump_set(value)
+            if name not in config.model_fields_set:
+                default = field.get_default(
+                    call_default_factory=True, validated_data=config.__dict__
+                )
+                if isinstance(default, BaseModel) and nested == _dump_set(default):
+                    continue
+            if nested or name in config.model_fields_set:
+                keys = [k for k in ("id", "type") if k in type(value).model_fields]
+                dump[name] = {**{k: getattr(value, k) for k in keys}, **nested}
+        elif name in config.model_fields_set:
+            dump[name] = config.model_dump(include={name})[name]
+    # Extra fields of an `extra="allow"` model exist only because they were set.
+    dump.update(config.model_dump(include=set(config.model_extra or {})))
+    return dump
+
+
+def concrete_type(
+    cls: type, bound: type[T], *, origin: type | None = None
+) -> type[T] | None:
+    """Find a concrete bounded type through `cls`'s MRO, most-derived first."""
+    for klass in cls.__mro__:
+        for base in getattr(klass, "__orig_bases__", ()):
+            if origin is not None and get_origin(base) is not origin:
+                continue
+            for arg in get_args(base):
+                if isinstance(arg, type) and issubclass(arg, bound):
+                    return arg
+    return None

verifiers-0.3.2.dev156/verifiers/v1/utils/generic.py

@@ -1,53 +0,0 @@
-"""Generic helpers shared across v1 modules."""
-
-from typing import TypeVar, get_args, get_origin
-
-from pydantic import ValidationError
-
-T = TypeVar("T")
-
-
-def prefix_validation_error(e: ValidationError, prefix: tuple) -> ValidationError:
-    """`e` with `prefix` prepended to every error's loc. A sub-model validated
-    inside a `mode="before"` validator surfaces its errors at the validator's own
-    loc, so without re-raising prefixed the CLI renders a flag path missing the
-    segments the user actually typed."""
-    return ValidationError.from_exception_data(
-        e.title,
-        [
-            {**err, "loc": prefix + tuple(err["loc"])}
-            for err in e.errors(include_url=False)
-        ],
-    )
-
-
-def deep_merge(base: dict, override: dict) -> dict:
-    """`override` onto `base`, recursing into dicts, so a partial nested override
-    keeps the untouched keys of the declared default. An override that switches a
-    subtree's discriminator (`id`/`type`) replaces the subtree wholesale — the old
-    plugin's fields must not leak into the new type's validation."""
-    merged = dict(base)
-    for key, value in override.items():
-        if isinstance(value, dict) and isinstance(merged.get(key), dict):
-            switched = any(
-                k in value and k in merged[key] and value[k] != merged[key][k]
-                for k in ("id", "type")
-            )
-            merged[key] = value if switched else deep_merge(merged[key], value)
-        else:
-            merged[key] = value
-    return merged
-
-
-def concrete_type(
-    cls: type, bound: type[T], *, origin: type | None = None
-) -> type[T] | None:
-    """Find a concrete bounded type through `cls`'s MRO, most-derived first."""
-    for klass in cls.__mro__:
-        for base in getattr(klass, "__orig_bases__", ()):
-            if origin is not None and get_origin(base) is not origin:
-                continue
-            for arg in get_args(base):
-                if isinstance(arg, type) and issubclass(arg, bound):
-                    return arg
-    return None