feat(evaluators): add starts_with/ends_with mode to list evaluator (#154)

## Summary
- add `starts_with` and `ends_with` match modes to the built-in `list`
evaluator so policies can be expressed as plain prefix and suffix lists
instead of synthesized regexes
- expose the new modes in the UI evaluator form and update the shared UI
types
- expand evaluator coverage for prefix and suffix matching,
allowlist-style `no_match` usage, path-like inputs, ordinary strings,
escaping, and list-input semantics
- document the new list evaluator modes in the evaluator overview README

## Scope
- User-facing/API changes: `list` evaluator configs now accept
`match_mode: "starts_with"` and `match_mode: "ends_with"`; the UI
exposes both as selectable options
- Internal changes: compile the new match modes into anchored
prefix/suffix regexes in the evaluator implementation and add targeted
evaluator tests
- Out of scope: changing prefix or suffix semantics to be
path-boundary-aware; this PR preserves generic string-prefix and
string-suffix behavior

## Risk and Rollout
- Risk level: low
- Rollback plan: revert commits `5d29b8a`, `4ddef38`, `567f25f`, and
`ef694b2`, which removes the new match modes, coverage, and docs updates

## Testing
- [x] Added or updated automated tests
- [x] Ran `make check` (or explained why not)
- [ ] Manually verified behavior

## Checklist
- [ ] Linked issue/spec (if applicable)
- [x] Updated docs/examples for user-facing changes
- [ ] Included any required follow-up tasks

Author: lan17

evaluators/README.md

@@ -19,9 +19,14 @@ Pattern matching for text (PII, keywords, SQL injection)
 ```
 
 ### List
-Match against value lists (blocked users, restricted cities)
+Match against value lists (blocked users, restricted cities, allowed prefixes).
+Supports `match_mode: "exact"` for full-string membership, `match_mode: "contains"`
+for keyword-style matching, `match_mode: "starts_with"` for prefix matching, and
+`match_mode: "ends_with"` for suffix matching.
 ```python
 {"name": "list", "config": {"values": ["admin", "root"], "case_sensitive": False}}
+{"name": "list", "config": {"values": ["/home/lev/agent-control"], "match_mode": "starts_with"}}
+{"name": "list", "config": {"values": [".md"], "match_mode": "ends_with"}}
 ```
 
 ### SQL

evaluators/builtin/src/agent_control_evaluators/list/config.py

@@ -19,9 +19,12 @@ class ListEvaluatorConfig(EvaluatorConfig):
     match_on: Literal["match", "no_match"] = Field(
         "match", description="Trigger rule on match or no match"
     )
-    match_mode: Literal["exact", "contains"] = Field(
+    match_mode: Literal["exact", "contains", "starts_with", "ends_with"] = Field(
         "exact",
-        description="'exact' for full string match, 'contains' for keyword/substring match",
+        description=(
+            "'exact' for full string match, 'contains' for keyword matching, "
+            "'starts_with' for prefix matching, and 'ends_with' for suffix matching"
+        ),
     )
     case_sensitive: bool = Field(False, description="Whether matching is case sensitive")
 

evaluators/builtin/src/agent_control_evaluators/list/evaluator.py

@@ -18,7 +18,7 @@ class ListEvaluator(Evaluator[ListEvaluatorConfig]):
     Checks if data matches values in a list. Supports:
     - any/all logic (match any value vs match all values)
     - match/no_match trigger (trigger on match or no match)
-    - exact/contains mode (full match vs substring/keyword)
+    - exact/contains/starts_with/ends_with mode (full match vs keyword vs prefix/suffix)
     - case sensitivity toggle
 
     Example configs:
@@ -50,6 +50,12 @@ def _build_regex(self) -> Any:
         if self.config.match_mode == "contains":
             # Word boundary matching for substring/keyword detection
             pattern = f"\\b({'|'.join(escaped)})\\b"
+        elif self.config.match_mode == "starts_with":
+            # Prefix matching using anchors
+            pattern = f"^({'|'.join(escaped)})"
+        elif self.config.match_mode == "ends_with":
+            # Suffix matching using anchors
+            pattern = f"({'|'.join(escaped)})$"
         else:
             # Exact match using anchors
             pattern = f"^({'|'.join(escaped)})$"