feat(evaluators): add ends_with mode to list evaluator

Author: lan17

evaluators/README.md

@@ -21,10 +21,12 @@ Pattern matching for text (PII, keywords, SQL injection)
 ### List
 Match against value lists (blocked users, restricted cities, allowed prefixes).
 Supports `match_mode: "exact"` for full-string membership, `match_mode: "contains"`
-for keyword-style matching, and `match_mode: "starts_with"` for prefix matching.
+for keyword-style matching, `match_mode: "starts_with"` for prefix matching, and
+`match_mode: "ends_with"` for suffix matching.
 ```python
 {"name": "list", "config": {"values": ["admin", "root"], "case_sensitive": False}}
 {"name": "list", "config": {"values": ["/home/lev/agent-control"], "match_mode": "starts_with"}}
+{"name": "list", "config": {"values": [".md"], "match_mode": "ends_with"}}
 ```
 
 ### SQL

evaluators/builtin/src/agent_control_evaluators/list/config.py

@@ -19,11 +19,11 @@ class ListEvaluatorConfig(EvaluatorConfig):
     match_on: Literal["match", "no_match"] = Field(
         "match", description="Trigger rule on match or no match"
     )
-    match_mode: Literal["exact", "contains", "starts_with"] = Field(
+    match_mode: Literal["exact", "contains", "starts_with", "ends_with"] = Field(
         "exact",
         description=(
             "'exact' for full string match, 'contains' for keyword matching, "
-            "'starts_with' for prefix matching"
+            "'starts_with' for prefix matching, and 'ends_with' for suffix matching"
         ),
     )
     case_sensitive: bool = Field(False, description="Whether matching is case sensitive")

evaluators/builtin/src/agent_control_evaluators/list/evaluator.py

@@ -18,7 +18,7 @@ class ListEvaluator(Evaluator[ListEvaluatorConfig]):
     Checks if data matches values in a list. Supports:
     - any/all logic (match any value vs match all values)
     - match/no_match trigger (trigger on match or no match)
-    - exact/contains/starts_with mode (full match vs keyword vs prefix)
+    - exact/contains/starts_with/ends_with mode (full match vs keyword vs prefix/suffix)
     - case sensitivity toggle
 
     Example configs:
@@ -53,6 +53,9 @@ def _build_regex(self) -> Any:
         elif self.config.match_mode == "starts_with":
             # Prefix matching using anchors
             pattern = f"^({'|'.join(escaped)})"
+        elif self.config.match_mode == "ends_with":
+            # Suffix matching using anchors
+            pattern = f"({'|'.join(escaped)})$"
         else:
             # Exact match using anchors
             pattern = f"^({'|'.join(escaped)})$"

evaluators/builtin/tests/list/test_list.py

@@ -260,6 +260,212 @@ async def test_starts_with_supports_list_input_with_all_logic(self) -> None:
         assert matching_result.matched is True
         assert partial_result.matched is False
 
+    @pytest.mark.asyncio
+    async def test_ends_with_matches_suffix(self) -> None:
+        """Test that ends_with mode triggers on suffix matches."""
+        # Given: an ends_with evaluator config
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=["/SOUL.md", ".py"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating a path with an allowed suffix
+        result = await evaluator.evaluate("/home/lev/agent-control/SOUL.md")
+
+        # Then: the suffix match triggers
+        assert result.matched is True
+        assert result.metadata["matches"] == ["/home/lev/agent-control/SOUL.md"]
+
+    @pytest.mark.asyncio
+    async def test_ends_with_matches_exact_path_value(self) -> None:
+        """Test that ends_with mode matches the configured path value exactly."""
+        # Given: an ends_with evaluator config
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=["/home/lev/agent-control/SOUL.md"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating the exact configured path
+        result = await evaluator.evaluate("/home/lev/agent-control/SOUL.md")
+
+        # Then: the exact path matches
+        assert result.matched is True
+        assert result.metadata["matches"] == ["/home/lev/agent-control/SOUL.md"]
+
+    @pytest.mark.asyncio
+    async def test_ends_with_no_match_when_suffix_absent(self) -> None:
+        """Test that ends_with mode does not trigger when no suffix matches."""
+        # Given: an ends_with evaluator config
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=["/SOUL.md", ".py"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating a path with no configured suffix
+        result = await evaluator.evaluate("/var/log/system.log")
+
+        # Then: the evaluator does not trigger
+        assert result.matched is False
+
+    @pytest.mark.asyncio
+    async def test_ends_with_honors_case_sensitivity(self) -> None:
+        """Test that ends_with mode respects case sensitivity settings."""
+        # Given: two ends_with evaluators that differ only by case sensitivity
+        insensitive = ListEvaluator(
+            ListEvaluatorConfig(
+                values=["/SOUL.MD"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=False,
+            )
+        )
+        sensitive = ListEvaluator(
+            ListEvaluatorConfig(
+                values=["/SOUL.MD"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating the same lower-case path against both
+        insensitive_result = await insensitive.evaluate("/home/lev/agent-control/SOUL.md")
+        sensitive_result = await sensitive.evaluate("/home/lev/agent-control/SOUL.md")
+
+        # Then: only the case-insensitive evaluator matches
+        assert insensitive_result.matched is True
+        assert sensitive_result.matched is False
+
+    @pytest.mark.asyncio
+    async def test_ends_with_supports_no_match_allowlists(self) -> None:
+        """Test that ends_with works with no_match for allowlist-style controls."""
+        # Given: an ends_with evaluator configured as an allowlist
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=[".md", ".txt"],
+                logic="any",
+                match_on="no_match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating one allowed and one disallowed path
+        allowed_result = await evaluator.evaluate("/home/lev/agent-control/SOUL.md")
+        denied_result = await evaluator.evaluate("/var/log/system.log")
+
+        # Then: only the disallowed path triggers the control
+        assert allowed_result.matched is False
+        assert denied_result.matched is True
+
+    @pytest.mark.asyncio
+    async def test_ends_with_matches_plain_text_suffix(self) -> None:
+        """Test that ends_with mode works for ordinary non-path strings."""
+        # Given: an ends_with evaluator config for ordinary strings
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=["-control", ":done"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating values with and without the configured suffixes
+        matched_result = await evaluator.evaluate("agent-control")
+        unmatched_result = await evaluator.evaluate("done: please")
+
+        # Then: only the true suffix match triggers
+        assert matched_result.matched is True
+        assert unmatched_result.matched is False
+
+    @pytest.mark.asyncio
+    async def test_ends_with_escapes_regex_metacharacters(self) -> None:
+        """Test that ends_with treats configured values as literals, not regex."""
+        # Given: suffixes containing regex metacharacters
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=[".tar.gz+", "[beta]"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating values that end with those literal suffixes
+        archive_result = await evaluator.evaluate("release-1.tar.gz+")
+        beta_result = await evaluator.evaluate("feature-[beta]")
+
+        # Then: both values match literally
+        assert archive_result.matched is True
+        assert beta_result.matched is True
+
+    @pytest.mark.asyncio
+    async def test_ends_with_supports_list_input_with_any_logic(self) -> None:
+        """Test that ends_with works on list inputs when any item matches."""
+        # Given: an ends_with evaluator with any-item semantics
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=[".md", "-control"],
+                logic="any",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating a list where only one element matches
+        result = await evaluator.evaluate(["/var/log/system.log", "agent-control"])
+
+        # Then: the evaluator triggers and reports the matching entry
+        assert result.matched is True
+        assert result.metadata["matches"] == ["agent-control"]
+
+    @pytest.mark.asyncio
+    async def test_ends_with_supports_list_input_with_all_logic(self) -> None:
+        """Test that ends_with respects all-item semantics for list inputs."""
+        # Given: an ends_with evaluator with all-item semantics
+        evaluator = ListEvaluator(
+            ListEvaluatorConfig(
+                values=[".md", ".txt"],
+                logic="all",
+                match_on="match",
+                match_mode="ends_with",
+                case_sensitive=True,
+            )
+        )
+
+        # When: evaluating one fully matching list and one partially matching list
+        matching_result = await evaluator.evaluate(
+            ["/home/lev/agent-control/SOUL.md", "/tmp/cache/notes.txt"]
+        )
+        partial_result = await evaluator.evaluate(
+            ["/home/lev/agent-control/SOUL.md", "/var/log/system.log"]
+        )
+
+        # Then: only the fully matching list triggers
+        assert matching_result.matched is True
+        assert partial_result.matched is False
+
     @pytest.mark.asyncio
     async def test_legacy_empty_string_value_is_ignored_defensively(self) -> None:
         """Test that legacy invalid configs do not compile into a match-all regex."""

ui/src/core/evaluators/list/form.tsx

@@ -75,14 +75,15 @@ export const ListForm = ({ form }: EvaluatorFormProps<ListFormValues>) => {
         label={
           <LabelWithTooltip
             label="Match mode"
-            tooltip="Exact string match, keyword contains, or string prefix matching"
+            tooltip="Exact string match, keyword contains, string prefix matching, or string suffix matching"
           />
         }
         labelProps={labelPropsInline}
         data={[
           { value: 'exact', label: 'Exact (full string match)' },
           { value: 'contains', label: 'Contains (keyword match)' },
           { value: 'starts_with', label: 'Starts with (prefix match)' },
+          { value: 'ends_with', label: 'Ends with (suffix match)' },
         ]}
         size="sm"
         {...form.getInputProps('match_mode')}

ui/src/core/evaluators/list/types.ts

@@ -9,8 +9,8 @@ export type ListFormValues = {
   logic: 'any' | 'all';
   /** When to trigger: on match or no match */
   match_on: 'match' | 'no_match';
-  /** Match mode: exact, contains, or starts_with */
-  match_mode: 'exact' | 'contains' | 'starts_with';
+  /** Match mode: exact, contains, starts_with, or ends_with */
+  match_mode: 'exact' | 'contains' | 'starts_with' | 'ends_with';
   /** Whether matching is case sensitive */
   case_sensitive: boolean;
 };