Merge remote-tracking branch 'origin/main' into docker-blackwell-build

# Conflicts:
#	unsloth/models/vision.py

.github/workflows/local-agent-guides-ci.yml

@@ -6,29 +6,27 @@
 # Detects when our local-agent setup recipes drift out of sync with
 # `unsloth run`. Boots a real `unsloth run --disable-tools` server and
 # drives the coding agents end to end through the *exact* recipes defined
-# in unsloth_cli/commands/connect.py (the in-repo source of truth -- there
-# is no docs/ tree). Wherever connect.py has a recipe we drive the agent
-# via `unsloth connect <agent> --no-launch` and execute what it prints, so
-# the test self-updates against connect.py and catches silent recipe drift.
+# in unsloth_cli/commands/start.py (the in-repo source of truth -- there
+# is no docs/ tree). Wherever start.py has a recipe we drive the agent
+# via `unsloth start <agent> --no-launch` and execute what it prints, so
+# the test self-updates against start.py and catches silent recipe drift.
 #
 # Source-of-truth files this workflow guards:
-#   unsloth_cli/commands/connect.py   the `unsloth connect <agent>` recipes
+#   unsloth_cli/commands/start.py   the `unsloth start <agent>` recipes
 #   unsloth_cli/commands/studio.py    the `unsloth run` banner (API Key line)
 #
 # Failure taxonomy (each surfaced with a distinct ::error:: + the agent name
-# + the connect.py location, so a red X is immediately triageable):
+# + the start.py location, so a red X is immediately triageable):
 #   (a) Unsloth server/API regression -- the dialect HTTP preflight fails
 #       BEFORE the agent runs (or the server never becomes healthy).
 #   (b) Agent package install failed   -- npm/curl install of the CLI failed.
 #   (c) Guide drift                    -- preflight passed + install ok, but
-#       the documented `unsloth connect` flow produced no/garbled output.
+#       the documented `unsloth start` flow produced no/garbled output.
 #
 # Agents covered (6): claude, codex, hermes, openclaw, opencode, pi.
-#   - claude/codex/hermes/openclaw/opencode have a connect.py recipe.
-#   - pi has NO `unsloth connect pi` command in connect.py at HEAD; it is
-#     driven by a hand-written recipe and the matrix cell asserts that the
-#     missing connect recipe is the (known) reason, so the day connect.py
-#     grows a `pi` command this cell flips to the self-updating path.
+#   - All six have a `unsloth start <agent>` recipe, so each cell obtains its
+#     env + command from `unsloth start <agent> --no-launch` and runs THAT
+#     (self-updating: a recipe change is exercised automatically).
 
 name: Local Agent Guides CI
 
@@ -83,7 +81,7 @@ jobs:
   # ═════════════════════════════════════════════════════════════════════
   # Job 1: connection
   #   Per-agent: serve gemma-3-270m, HTTP-preflight the agent's dialect,
-  #   install the agent, run `unsloth connect <agent> --no-launch`, execute
+  #   install the agent, run `unsloth start <agent> --no-launch`, execute
   #   the emitted recipe with a trivial prompt, assert a non-empty reply.
   #   Runs on PR + weekly + dispatch. Each matrix cell is its own runner so
   #   it serves exactly one model on its own port.
@@ -103,7 +101,9 @@ jobs:
     env:
       # gemma-4-E4B (128K context, capable enough to drive every agent for a
       # trivial reply; the 270m model produced empty/failed responses for
-      # codex/openclaw and is below hermes' 64K context floor). Served as a flat
+      # codex/openclaw). Hermes' 64K context floor no longer constrains the model
+      # choice: write_hermes_config claims the floor for smaller windows and
+      # scales compaction back to the real window. Served as a flat
       # GGUF file (the -MTP- repo ships no separate draft, so this is plain 4B).
       GGUF_REPO: unsloth/gemma-4-E4B-it-GGUF
       GGUF_FILE: gemma-4-E4B-it-UD-Q4_K_XL.gguf
@@ -209,7 +209,7 @@ jobs:
               ;;
             *)
               # OpenAI Chat Completions dialect (hermes/opencode/pi/openclaw).
-              # OpenClaw's connect.py recipe writes an "openai-completions"
+              # OpenClaw's start.py recipe writes an "openai-completions"
               # provider (write_openclaw_config), so it uses this path, not
               # /v1/messages.
               code=$(curl -s -o /tmp/pf.json -w '%{http_code}' "$B/v1/chat/completions" \
@@ -227,13 +227,13 @@ jobs:
           AGENT: ${{ matrix.agent }}
         run: bash .github/scripts/agent-guides-install.sh "$AGENT"
 
-      # ── (c) drive the agent via connect.py and assert a reply ──────────
-      # For the 5 agents with a connect.py recipe we run
-      # `unsloth connect <agent> --no-launch`, eval its env/unset exports,
+      # ── (c) drive the agent via start.py and assert a reply ──────────
+      # For the 5 agents with a start.py recipe we run
+      # `unsloth start <agent> --no-launch`, eval its env/unset exports,
       # then run the printed command with a hard timeout (no headless-TTY
       # hang). Pi has no connect recipe, so it is driven by hand and the
       # cell asserts that absence is the (known) reason.
-      - name: Drive ${{ matrix.agent }} via unsloth connect (class-c isolation)
+      - name: Drive ${{ matrix.agent }} via unsloth start (class-c isolation)
         env:
           AGENT: ${{ matrix.agent }}
         run: bash .github/scripts/agent-guides-drive.sh connection "$AGENT"
@@ -248,8 +248,10 @@ jobs:
           # `API Key: <key>`) into logs/unsloth-run-<port>.log, and the upload
           # step publishes all of logs/, so scrubbing only studio-logs would leak
           # the bearer token in the retained artifact.
+          # Sweep EVERY uploaded path, not just logs/ -- redacted-configs/ and
+          # agent-workdir/ are published by the same upload step.
           if [ -n "${UNSLOTH_API_KEY:-}" ]; then
-            grep -rlF "$UNSLOTH_API_KEY" logs 2>/dev/null | while IFS= read -r f; do
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
               sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
             done
           fi
@@ -438,8 +440,10 @@ jobs:
           # `API Key: <key>`) into logs/unsloth-run-<port>.log, and the upload
           # step publishes all of logs/, so scrubbing only studio-logs would leak
           # the bearer token in the retained artifact.
+          # Sweep EVERY uploaded path, not just logs/ -- redacted-configs/ and
+          # agent-workdir/ are published by the same upload step.
           if [ -n "${UNSLOTH_API_KEY:-}" ]; then
-            grep -rlF "$UNSLOTH_API_KEY" logs 2>/dev/null | while IFS= read -r f; do
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
               sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
             done
           fi
@@ -582,8 +586,10 @@ jobs:
           # `API Key: <key>`) into logs/unsloth-run-<port>.log, and the upload
           # step publishes all of logs/, so scrubbing only studio-logs would leak
           # the bearer token in the retained artifact.
+          # Sweep EVERY uploaded path, not just logs/ -- redacted-configs/ and
+          # agent-workdir/ are published by the same upload step.
           if [ -n "${UNSLOTH_API_KEY:-}" ]; then
-            grep -rlF "$UNSLOTH_API_KEY" logs 2>/dev/null | while IFS= read -r f; do
+            grep -rlF "$UNSLOTH_API_KEY" logs redacted-configs agent-workdir 2>/dev/null | while IFS= read -r f; do
               sed -i "s#${UNSLOTH_API_KEY}#<REDACTED>#g" "$f" 2>/dev/null || true
             done
           fi

.github/workflows/studio-backend-ci.yml

@@ -68,9 +68,10 @@ jobs:
           pip install -r studio/backend/requirements/studio.txt
           # Extras that studio.txt does not list but the import chain needs
           # (python-multipart for FastAPI form/file uploads, sqlalchemy/cryptography
-          #  for the auth DB, yaml/jinja2 for utils.models.model_config, etc.):
+          #  for the auth DB, yaml/jinja2 for utils.models.model_config, psutil for
+          #  the orphan-cleanup process scan, etc.):
           pip install \
-            python-multipart aiofiles sqlalchemy cryptography \
+            python-multipart aiofiles sqlalchemy cryptography psutil \
             pyyaml jinja2 mammoth unpdf requests \
             'numpy<3' pytest pytest-asyncio httpx
           # Torch CPU + transformers are required by a chunk of the backend test
@@ -133,7 +134,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r studio/backend/requirements/studio.txt
           pip install \
-            python-multipart aiofiles sqlalchemy cryptography \
+            python-multipart aiofiles sqlalchemy cryptography psutil \
             pyyaml jinja2 mammoth unpdf requests typer \
             'numpy<3' pytest pytest-asyncio httpx
           # torchvision: unsloth_zoo.vision_utils imports it at module scope.
@@ -229,7 +230,9 @@ jobs:
               tests/sh/test_resolve_cuda_archs.sh \
               tests/sh/test_tauri_install_exit_order.sh \
               tests/sh/test_torch_constraint.sh \
-              tests/sh/test_torch_flavor.sh; do
+              tests/sh/test_torch_flavor.sh \
+              tests/sh/test_with_llama_cpp_dir_flag.sh \
+              tests/sh/test_with_llama_cpp_dir_link_behavior.sh; do
               echo "::group::$s"
               bash "$s"
               echo "::endgroup::"

.github/workflows/studio-export-capability-ci.yml

@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+# Runs studio/backend/tests/test_export_capability.py on Linux, Windows and macOS.
+#
+# export_capability() is per-OS (is_apple_silicon() and the PyTorch-import probe differ per
+# platform) and the export backend must import without PyTorch, so this confirms the gating and
+# import-safety on hosted Windows/macOS. Hosted runners have no GPU/MLX, so a real accelerator
+# export is validated separately. No GPU / model / llama.cpp: the tests mock the probes and block
+# torch/unsloth, so the job installs only a CPU PyTorch plus import deps.
+
+name: Studio export capability
+
+on:
+  pull_request:
+    paths:
+      - 'studio/backend/utils/hardware/hardware.py'
+      - 'studio/backend/core/export/export.py'
+      - 'studio/backend/routes/export.py'
+      - 'studio/backend/main.py'
+      - 'studio/backend/tests/test_export_capability.py'
+      - '.github/workflows/studio-export-capability-ci.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'studio/backend/utils/hardware/hardware.py'
+      - 'studio/backend/core/export/export.py'
+      - 'studio/backend/routes/export.py'
+      - 'studio/backend/main.py'
+      - 'studio/backend/tests/test_export_capability.py'
+      - '.github/workflows/studio-export-capability-ci.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  capability:
+    name: capability (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      # No accelerator on hosted runners; keep detection on the CPU path.
+      CUDA_VISIBLE_DEVICES: ""
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+      - name: Install CPU PyTorch
+        # CPU wheel index so every OS gets a CPU build; keep PyPI as an extra index so torch's
+        # transitive deps still resolve (matching the other workflows in this repo).
+        run: python -m pip install --index-url https://download.pytorch.org/whl/cpu --extra-index-url https://pypi.org/simple "torch>=2.4,<2.13"
+      - name: Install backend import deps
+        # Enough to import utils.hardware and core.export.export; NOT unsloth (needs a GPU, and
+        # the import-safety test blocks it) or triton/llama.cpp (Linux-only / native builds).
+        run: python -m pip install
+          transformers peft accelerate safetensors huggingface_hub datasets
+          sentencepiece protobuf fastapi starlette structlog psutil
+          python-multipart pydantic httpx "numpy<3" pytest
+      - name: Export capability + import-safety tests
+        working-directory: studio/backend
+        run: python -m pytest tests/test_export_capability.py -q