43 commits

Author	SHA1	Message	Date
Daniel Han	11d5f64eeb	Studio: reword the Cloudflare line when the public probe fails (#6217) ... On a 0.0.0.0 bind whose public ip:port is not reachable (cloud firewall), the banner still printed "Secure link access via Cloudflare: <url>" right after "is NOT reachable from the public internet", which reads as if the tunnel might also be blocked. The Cloudflare quick-tunnel works regardless. Thread the reachability probe result through a module-level _public_reachable tri-state and, when the public probe definitively failed but the tunnel is up, print "Also, the secure link access via Cloudflare works: <url>". Reachable or undecided cases keep the existing wording.	2026-06-11 20:07:51 -07:00
Daniel Han	1a99980b46	Studio: auto Cloudflare tunnel for 0.0.0.0 launches (#6204) ... * Studio: auto Cloudflare tunnel for 0.0.0.0 launches Binding Studio to 0.0.0.0 for remote access often leaves the raw http://<ip>:<port> URL unreachable (https-vs-http, blocked high ports, closed cloud security groups). On a wildcard bind, auto-start a free cloudflared quick tunnel and show its https://*.trycloudflare.com URL in the startup banner: Secure link access via Cloudflare: https://<random>.trycloudflare.com - new studio/backend/cloudflare_tunnel.py: find or download+cache the cloudflared binary (per-OS/arch GitHub release, safe .tgz extract), start the tunnel, parse the URL, tear it down. Stdlib only; best-effort and non-fatal throughout (a missing binary or offline box never blocks or slows startup). - run_server starts the tunnel for 0.0.0.0 only (skips loopback, api-only and Colab), prints the line in the banner, and _graceful_shutdown stops the child so it never orphans. - --cloudflare/--no-cloudflare flag (default on) on `unsloth studio` and `unsloth studio run`, forwarded through the re-exec into run_server. - tests for the helper, the CLI flag forwarding, and the run.py defaults. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio cloudflare: send a User-Agent on the cloudflared download GitHub's CDN can 403 the default Python-urllib User-Agent on release asset downloads. Set an explicit UA and pin it with a test. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio cloudflare: address review (opt-out for subcommands, tunnel teardown) - reject --no-cloudflare placed before a subcommand (it would not reach the subcommand), mirroring the --parallel guard - register the tunnel before waiting for its URL so a shutdown during the wait stops cloudflared instead of orphaning it - tear the server + children down if `unsloth studio run` startup aborts (health timeout, model-load error, Ctrl+C) before the wait loop * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-06-11 07:10:08 -07:00
Daniel Han	62191c4765	Windows/WSL installer: fix winget msstore cert failure, amd-smi DiskPart prompt, and enable AMD GPU (Strix Halo gfx1151) (#5940) ... * Fix Windows installer winget msstore certificate failure `winget install` was invoked without `--source winget`, so winget also queried the msstore source. When msstore fails certificate pinning (error 0x8a15005e, "The server certificate did not match any of the expected values") winget aborts and demands `--source`, so the Python (and uv) install fails even though the package exists in the winget source. - Pass `--source winget` to all winget install calls (Python x2, uv). Both packages live in the winget source, so this is strictly correct and skips the failing msstore round-trip entirely. - Add a python.org fallback (Install-PythonFromPythonOrg) that downloads the official installer and runs it silently per-user (no admin/UAC) when winget is unavailable or fails for any reason. Mirrors the existing uv -> astral.sh fallback so Python installs without manual steps. Resolves the latest 3.13.x from python.org with a pinned fallback, and selects the amd64/arm64/x86 installer per architecture. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Pin remaining setup.ps1 winget calls to --source winget Two winget invocations in studio/setup.ps1 still queried all sources and could hit the same msstore certificate-pinning failure (0x8a15005e) that broke the Python install in install.ps1: - `winget show Nvidia.CUDA --versions` (CUDA Toolkit version probe) - `winget install ... ShiningLight.OpenSSL.Dev` (OpenSSL dev for llama-server) Every other winget call in this file already passes `--source winget` (Git, CMake, VS Build Tools, CUDA install, Node.js, and setup.ps1's own Python 3.12 install), so these two were stragglers. Both packages live in the winget source; pinning it makes setup robust to an unhealthy msstore source, matching the rest of the file. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Stop amd-smi GPU probe from popping a DiskPart UAC prompt On Windows, AMD GPU detection in install.ps1 and studio/setup.ps1 runs `amd-smi list` / `static --asic` / `version`. amd-smi (shipped in System32 by the Adrenalin driver) auto-elevates to read GPU/APU memory details, surfacing a confusing DiskPart UAC prompt mid-install. The Studio backend already documents and circuit-breaks on this in studio/backend/utils/hardware/amd.py, but the installers did not. Add an Invoke-AmdSmiNoElevate helper (both scripts) that runs amd-smi via Start-Process under __COMPAT_LAYER=RunAsInvoker so it cannot auto-elevate (no prompt), with a 30s timeout (matching amd.py) so a flaky amd-smi cannot stall the install for minutes. On failure/timeout the existing WMI name -> gfx fallback still resolves the arch, so detection is unchanged on working hosts. Verified on a Strix Halo (Radeon 8060S / gfx1151) box: the prompt is gone and the probe is bounded. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Add experimental ROCm-on-WSL setup helper for Strix Halo (gfx1151) install.sh already routes gfx1151 (Radeon 8060S / Strix Halo) to the repo.amd.com/rocm/whl/gfx1151 wheels once a ROCm runtime is present, but it does not install AMD's driver/ROCm stack -- a large, admin-gated prerequisite. scripts/install_rocm_wsl_strixhalo.sh automates the Linux side on a dedicated Ubuntu 24.04 WSL2 distro: ROCm 7.2 (wsl usecase), the rocr4wsl HSA runtime, a librocdxg build, env setup, and a PyTorch gfx1151 GPU smoke test. A hard preflight refuses to run until the Adrenalin >=26.3.1 driver is actually present, so it cannot half-install. Procedure adapted from AMD's ROCm-on-WSL docs and community gfx1151 notes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Detect AMD GPUs by name so native Windows gets a GPU llama.cpp The gfx-arch inference from the WMI GPU name was gated behind $HasROCm, which the hipinfo/amd-smi probe leaves false on the common Windows case (Adrenalin driver only, no HIP SDK -- and amd-smi often cannot read the arch without elevation). So an AMD GPU was detected by name but never mapped to a gfx target, --rocm-gfx was not forwarded, and studio setup fell back to a CPU llama.cpp build. Un-gate the inference (install.ps1 + studio/setup.ps1) so it runs whenever an AMD GPU name is available. The inferred gfx is forwarded as --rocm-gfx, which makes install_llama_prebuilt.py download the matching lemonade-sdk ROCm prebuilt (e.g. llama-bNNNN-windows-rocm-gfx1151-x64.zip) -- a GPU-accelerated llama.cpp that bundles its own ROCm runtime, so it runs with just the Adrenalin driver. PyTorch's ROCm wheels still require a confirmed HIP SDK ($HasROCm), so this only affects llama.cpp / inference and never pulls broken ROCm torch. Also broaden the name->arch table to every family lemonade ships Windows assets for: gfx120X (RDNA 4), gfx110X (RDNA 3), gfx1151/gfx1150 (RDNA 3.5), and gfx103X (RDNA 2). Unknown names still fall back to CPU. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Suppress amd-smi DiskPart UAC prompt in the Python install/runtime paths The earlier PowerShell guard covered install.ps1 / setup.ps1, but the Python installer (install_llama_prebuilt.py detect_host, install_python_stack.py ROCm probes) and the Studio backend monitor (amd.py) also shell out to amd-smi on Windows, where it auto-elevates and pops the same DiskPart UAC prompt mid-install / at runtime. Inject __COMPAT_LAYER=RunAsInvoker into the amd-smi subprocess env on Windows so it runs un-elevated (no prompt). Callers already tolerate an empty/failed result and fall back to WMI / name detection (installer) or the existing circuit breaker (amd.py). Gated to Windows so Linux/macOS amd-smi behaviour is unchanged. - install_llama_prebuilt.py: handled centrally in run_capture (covers detect_host's `amd-smi list` and the version probe). - install_python_stack.py: new _amd_smi_env() helper on its 3 raw subprocess.run amd-smi calls. - amd.py: merge RunAsInvoker into the existing child env. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Tighten AMD GPU name->arch patterns to avoid mismatches The W9[0-9]{3} and RX 90[0-9]{2} patterns added for RDNA 4 were speculative and over-broad: W9xxx would also match old GCN FirePro W9100/W9000 cards (wrong gfx1201 -> a lemonade gfx120X download that fails validation), and RX 90[0-9]{2} was redundant with the explicit 9070/9060 entries. Drop both; keep only confirmed RDNA 4 SKUs. Unmatched AMD names still fall back cleanly to CPU. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fetch the llama.cpp validation model via huggingface_hub The prebuilt validation downloads a tiny GGUF test model from huggingface via bare urllib. On Windows / proxy setups where the server sends an incomplete TLS chain, urllib cannot complete the Amazon CA chain (it does no AIA intermediate fetching) and fails with CERTIFICATE_VERIFY_FAILED, so a perfectly good GPU prebuilt is rejected and the installer falls back to a CPU source build. Route the validation-model download through huggingface_hub (hf_hub_download) -- the same mechanism Studio uses for model downloads, which completes the chain where urllib cannot -- keeping the direct URL as a fallback. This lets the lemonade ROCm prebuilt validate and install on cert-restricted machines (verified: hf_hub_download succeeds where urllib returns CERTIFICATE_VERIFY_FAILED). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Guard the remaining raw amd-smi version probe via run_capture A ROCm-version detector in install_llama_prebuilt.py called amd-smi version through a raw subprocess.run that bypassed run_capture's Windows RunAsInvoker guard, so it still triggered the DiskPart UAC prompt during setup. Route it through run_capture like the other amd-smi calls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Forward --rocm-gfx even when the ROCm runtime is unconfirmed setup.ps1 forwarded --rocm-gfx (and picked the windows-hip llama.cpp prebuilt) only inside `if ($HasROCm)`. On Adrenalin-only hosts (amd-smi present but no HIP SDK, so $HasROCm stays false) the gfx arch was name-inferred but never forwarded, so install_llama_prebuilt.py saw has_rocm=False and installed the CPU build -- even though the lemonade gfx1151 GPU prebuilt runs fine there (it bundles its own ROCm runtime; verified: llama-cli --list-devices -> ROCm0: AMD Radeon 8060S, 69 GB). Forward --rocm-gfx whenever a gfx arch is known (it is authoritative and implies ROCm in install_llama_prebuilt.py), and treat a known gfx arch as windows-hip in the existing-install mismatch check. --has-rocm stays gated on the confirmed-runtime signal. Verified on Radeon 8060S / gfx1151: the installer now selects, validates, and installs llama-b1286-windows-rocm-gfx1151-x64.zip (ROCm DLLs present) instead of the CPU build. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Install AMD ROCm PyTorch on name-inferred gfx hosts (enables Train/Export) setup.ps1 picked the AMD ROCm PyTorch wheels only inside `if ($HasROCm ...)`. On Adrenalin-only hosts (amd-smi present but no HIP SDK, so $HasROCm is false) the gfx arch was name-inferred but the ROCm-wheel branch never ran, so the host got torch+cpu. With CPU torch, torch.cuda.is_available() is False, so the Studio backend sets CHAT_ONLY=True and hides Train/Export. Un-gate the ROCm PyTorch index resolution on a known gfx arch (mirrors the llama.cpp --rocm-gfx fix). AMD's per-arch Windows wheels (repo.amd.com/rocm/whl/<gfx>) bundle the ROCm runtime, so they work without a HIP SDK; a failed install still falls back to CPU. Verified on Radeon 8060S / gfx1151: torch 2.11.0+rocm7.13.0 installs and torch.cuda.is_available() -> True, device "AMD Radeon(TM) 8060S Graphics", GPU matmul OK -> CHAT_ONLY=False -> Train/Export enabled. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Force amd-smi un-elevated process-wide in the Python installers Guarding individual amd-smi call sites kept missing some (install_python_stack.py's probe loop and its Windows GPU re-check), so the DiskPart UAC prompt kept reappearing. Set __COMPAT_LAYER=RunAsInvoker process-wide at the top of install_python_stack.py and install_llama_prebuilt.py on Windows so every amd-smi subprocess (current and future) runs un-elevated with no per-call guard. Safe: these scripts only spawn amd-smi/rocminfo/hipinfo probes and pip/uv. setup.ps1 keeps per-call guards because it also spawns winget installers that need elevation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fix Invoke-AmdSmiNoElevate exit code on PS 5.1 + RX 7700S arch match Start-Process -PassThru leaves the returned process object's .ExitCode $null after WaitForExit on Windows PowerShell 5.1, so the helper set $LASTEXITCODE to $null and every caller's `if ($LASTEXITCODE -eq 0 ...)` was always false -- the amd-smi GPU / gfx-token / ROCm-version detection branch was effectively dead (masked only because the un-gated WMI name->gfx inference still ran). Reproduced on PS 5.1.26100. Rewrite the helper to use [System.Diagnostics.Process]::Start with a ProcessStartInfo (UseShellExecute=false), whose .ExitCode is reliable, with async stream reads (ReadToEndAsync) to avoid a pipe-buffer deadlock and WaitForExit(timeout) to bound a flaky amd-smi. __COMPAT_LAYER= RunAsInvoker (inherited via the process env) still suppresses the auto-elevation / DiskPart prompt. Also drops the temp files and the empty-ArgumentList edge case. Verified: exit code propagates (7 -> $LASTEXITCODE=7), output captured, env restored. Also fix the gfx1100 name pattern `RX 7700(?! S)` -> `RX 7700(?!S)` so the spaceless retail name "RX 7700S" is correctly excluded (it belongs to the gfx1102 row). Both found by PR review. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address PR review follow-ups (install.sh table, update path, tests, WSL) From the multi-agent PR review: - install.sh: sync the AMD name->arch table with install.ps1 / setup.ps1 (the bash table had drifted to the old narrow patterns). Adds RDNA 2 (gfx103X), workstation PRO W SKUs, and more Strix Halo/Point names, and orders gfx1102 before gfx1100 so the spaceless retail name "RX 7700S" resolves correctly (bash case has no negative lookahead). AMD-ROCm-only: the name inference stays gated behind _has_amd_rocm_gpu(), so NVIDIA / CPU / macOS are unaffected. - setup.ps1: the "dependencies up to date" fast path skipped the torch reinstall, so an existing user who had CPU torch (installed before ROCm-wheel support) stayed stuck in CHAT_ONLY. Now, when an AMD gfx arch is known AND the installed torch is CPU-only, don't skip -- force the dependency pass so the ROCm wheels install. - scripts/install_rocm_wsl_strixhalo.sh: resolve the real /opt/rocm dir instead of hardcoding ROCM_VER for LD_LIBRARY_PATH / the librocdxg symlink (breaks if amdgpu-install lays ROCm under a patch-version dir); add a LIBROCDXG_REF pin knob and a "verified against" freshness header. - tests/studio/install/test_pr5940_followups.py: cover _hf_resolve_url_parts, _fetch_validation_model_bytes (hf path + urllib fallback), run_capture's Windows-only amd-smi RunAsInvoker injection, and install.ps1 vs setup.ps1 name-table parity (catches future drift). 14 tests, all passing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fix DiskPart UAC prompt: skip amd-smi on Windows without a HIP SDK On Windows, amd-smi re-initialises the ROCm runtime on every invocation (even `amd-smi version`) and, on hosts without a working HIP runtime (consumer APUs/dGPUs with only the Adrenalin driver), elevates a child process at runtime -- popping a UAC/DiskPart prompt. amd-smi's own manifest is asInvoker, so __COMPAT_LAYER=RunAsInvoker cannot suppress that runtime elevation (verified: even `amd-smi version` hangs and times out with RunAsInvoker set). Replace the ineffective RunAsInvoker-only approach with a real gate: only spawn amd-smi on Windows when a HIP SDK is detectable (hipinfo present, so amd-smi runs un-elevated) or the user opts in with UNSLOTH_ENABLE_AMD_SMI=1. The gfx arch is already resolved from WMI name inference (forwarded via --rocm-gfx), so ROCm wheel + lemonade llama.cpp selection is unaffected. Linux/macOS amd-smi never elevates and is untouched (no regression). RunAsInvoker is kept as harmless belt-and-suspenders for tools that DO use manifest elevation. Applied consistently across: - studio/backend/utils/hardware/amd.py (runtime GPU polling) - install.ps1, studio/setup.ps1 (install-time detection) - studio/install_llama_prebuilt.py (prebuilt arch probe + version) - studio/install_python_stack.py (ROCm version + arch probe) Verified live on AMD Radeon 8060S (gfx1151), native Windows: fresh install detects the GPU, installs ROCm torch (torch.cuda.is_available() True), launches Studio with no DiskPart prompt, and inference, tool calling, web search, LoRA finetuning, and GGUF export all run on the GPU. Tests: add 6 _amd_smi_allowed() gating tests + PowerShell-installer gate assertions; update the three amd-smi monitoring tests to opt in (they mock amd-smi as available). Full suite: 267 passed, 2 skipped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * install.sh: helpful WSL message when the GPU isn't exposed to ROCm In WSL, an AMD GPU's ROCm-on-WSL runtime is only available with a recent Adrenalin driver AND a distro AMD supports (currently Ubuntu 24.04). When neither is in place, GPU detection (rocminfo/_has_amd_rocm_gpu) finds nothing and we silently fall back to CPU. Add an actionable hint in the CPU-fallback path, shown only on WSL and only AFTER detection has already failed -- so it is forward-compatible: the moment a driver/distro DOES expose the GPU (e.g. if AMD later adds Ubuntu 26.04 support), detection succeeds and the hint never fires. The message: - notes a GPU is plumbed in (/dev/dxg) but no ROCm runtime is exposed, - lists the two prerequisites (Adrenalin driver + Ubuntu 24.04), - if the distro is not 24.04, says AMD may not support it yet, - tells the user to `wsl --install Ubuntu-24.04` and re-run, - links AMD's ROCm-on-WSL guide + the experimental Strix Halo helper. Verified live: on Ubuntu-24.04 the hint shows (version-warning omitted) and the CPU install completes; on Ubuntu-26.04 the extra "this distro may not be supported" line appears and points to 24.04. Also fix the experimental scripts/install_rocm_wsl_strixhalo.sh: AMD's repo.radeon.com/amdgpu-install/ is indexed by unified installer version (30.30, 31.30, ...), NOT ROCm version, so the hard-coded amdgpu-install/7.2.0/ path 404'd. Scan the installer dirs newest-first for a noble .deb matching the target ROCm major.minor (ROCm 7.2 -> 30.30.x/amdgpu-install_7.2.x), falling back to the newest available. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * WSL: fix shortcut collision + pin ROCm-on-WSL driver reqs from AMD docs Two WSL-related fixes informed by AMD's official ROCm-on-WSL docs and field reports for Strix Halo / Ryzen AI Max+ (Radeon 8060S, gfx1151): 1. Shortcut collision (real bug). install.sh's WSL branch wrote "Unsloth Studio.lnk" to the SAME Desktop / Start Menu folder as the native-Windows installer (install.ps1 New-StudioShortcuts). Running install.sh in WSL therefore silently retargeted the native shortcut at the WSL launcher (wt.exe -> wsl.exe), so the desktop/start-menu icon stopped launching native GPU Studio. Now the WSL shortcut uses a DISTINCT name -- "Unsloth Studio (WSL - <distro>).lnk" -- and fetches the Unsloth .ico to %LOCALAPPDATA%\Unsloth Studio so it shows the proper icon. Native and WSL shortcuts now coexist. 2. Precise ROCm-on-WSL prerequisites. Research (AMD radeon-ryzen WSL compatibility matrix, gianni.rosagallina.com Feb-2026 guide, ROCm/ROCm#4952/#5509/#6022) confirms WSL GPU on Strix Halo requires AMD Adrenalin Edition >= 26.1.1 (26.2.2+ is the first production ROCDXG/WSL release) + ROCm 7.2.1 + Ubuntu 24.04; an older driver does not inject the ROCm/DXG runtime into /usr/lib/wsl/lib, so rocminfo sees only the CPU. install.sh's WSL hint and the experimental install_rocm_wsl_strixhalo.sh header/preflight now state the exact driver version (was a guessed ">=26.3.1"), bump ROCM_VER to 7.2.1, link AMD's radeon-ryzen docs, and document the known librocdxg caveat that usable VRAM is currently capped at the .wslconfig memory setting. bash -n clean; install test suite 267 passed, 2 skipped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer: hint when the AMD driver is too old for ROCm-on-WSL Adds a detect-and-guide hook for the optional WSL-GPU path. An AMD GPU on native Windows can also be used inside WSL2, but only with AMD Adrenalin Edition >= 26.2.2 (the first production ROCDXG/WSL release). Native Windows GPU works with any recent driver, so this is purely about enabling the WSL path. We intentionally do NOT auto-install the driver: AMD referrer-gates driver downloads (scripted curl/Invoke-WebRequest are blocked) and does not publish Adrenalin via winget, so no installer can reliably fetch it -- and silently swapping a live display driver is risky. Instead we point the user at AMD's official download page (one click), after which the existing WSL detection lights up automatically. - install.ps1: new Show-AmdWslDriverHint -- when an AMD GPU is present and the installed driver predates the 26.2.2 release (DriverDate < 2026-02-01), print a concise tip with the AMD download URL. Handles DriverDate as either a CIM DateTime or a WMI string. Suppress with UNSLOTH_SKIP_AMD_DRIVER_HINT=1. - install.sh (WSL hint): add the direct Adrenalin 26.2.2 download URL and note that AMD downloads are referrer-gated (open in a browser). Verified: hint fires on a Sept-2025 driver, auto-suppresses on >= 2026-02-01; install.ps1 parses; install.sh bash -n clean; suite 267 passed, 2 skipped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * install.ps1: refresh shell icon cache after creating the shortcut After writing the Desktop / Start Menu .lnk, nudge Explorer to refresh its icon (ie4uinit.exe -show). Without this, a stale icon cache can show a blank shortcut icon until the next explorer restart -- most visible when a shortcut of the same name was rewritten (e.g. a native install followed by a WSL install, which previously shared the name; now they use distinct names, but the cache nudge makes the icon appear immediately regardless). Best-effort and wrapped in try/catch so it never fails the install. The bundled unsloth.ico itself is valid (verified it renders). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * setup.ps1: don't silently CPU-build llama.cpp on an AMD GPU For AMD, GPU acceleration comes from the lemonade ROCm prebuilt (it bundles the ROCm runtime, no HIP SDK needed) and is the preferred/default path. The source-build fallback is CPU-only -- a HIP/ROCm *source* build would need the full HIP SDK + ROCm clang toolchain, which the prebuilt exists to avoid. Previously, if an AMD-GPU host ever fell through to the source build (e.g. the prebuilt could not be downloaded), it printed "building llama.cpp (CPU-only, no NVIDIA GPU detected)" and quietly produced a CPU binary -- masking the lost GPU acceleration. Now that case emits a loud [WARN] explaining the GPU prebuilt is the AMD path and how to restore it (re-run / check network / set UNSLOTH_LLAMA_RELEASE_TAG), so AMD never silently degrades to CPU. No behavior change on the happy path: AMD still gets the GPU prebuilt (verified on gfx1151: ggml-hip.dll bundled, ~80% GPU compute during inference). NVIDIA (CUDA source build) and CPU-only hosts are unchanged. setup.ps1 parses; install suite 267 passed, 2 skipped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * uninstall: remove shared llama.cpp build, kill lock-holders, match WSL shortcut Three gaps found by running a real uninstall on a native-Windows + WSL host; all fixes are scoped to Unsloth-owned paths and no-op on the other pathways (env/custom-root, NVIDIA/AMD/CPU, Mac) so nothing else regresses. uninstall.ps1: - Remove the default-mode SHARED llama.cpp build + cache. setup.ps1 installs them at ~/.unsloth/llama.cpp and ~/.unsloth/.cache -- SIBLINGS of studio, not under it -- so deleting <studio> left hundreds of MB behind. Now removed explicitly, then ~/.unsloth is dropped ONLY if empty (never nukes unrelated content). No-op in env/custom mode (llama.cpp nests under the custom root, removed already) and when absent. UNSLOTH_LLAMA_CPP_PATH (user-owned) is kept. - New _StopProcessesLockingRoots: _StopStudioProcesses only matched the venv unsloth/python/studio exe, so it missed (a) llama-server.exe under llama.cpp and (b) an orphaned multiprocessing python fork that ran from the SYSTEM python but loaded a venv DLL (bitsandbytes) -- on Windows an open DLL handle blocks the directory delete, leaving a half-removed install. The new helper kills any process whose image path OR loaded module is under a target root (module scan scoped to python/unsloth/llama-server names; vendor-agnostic). - _RemovePath now retries (transient post-kill handle release). uninstall.sh: - Remove the default-mode ~/.unsloth/llama.cpp + ~/.unsloth/.cache; rmdir ~/.unsloth only if empty. - WSL Windows-side shortcut cleanup now matches by TARGET (any "Unsloth Studio*.lnk" whose target launches wsl.exe), covering both the legacy "Unsloth Studio.lnk" and the new "Unsloth Studio (WSL - <distro>).lnk" -- and never removes a native-Windows shortcut (which launches wscript.exe). uninstall.ps1 parses; uninstall.sh passes sh -n and bash -n. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * install.ps1: invalidate Win11 Start Menu tile cache after creating shortcut The Start Menu shortcut kept showing a blank/generic icon even after the Explorer icon-cache rebuild, because Windows 11's StartMenuExperienceHost keeps its OWN pre-rendered tile-icon cache (%LOCALAPPDATA%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\ TempState\TileCache_*.bin + StartUnifiedTileModelCache.dat), separate from Explorer's iconcache_*.db. ie4uinit and an explorer.exe restart do not touch it, and they don't recycle the host -- so a rewritten same-name shortcut keeps showing the first-rendered (often the generic wscript ">") tile until the host restarts on its own. Fix: after creating the shortcut, drop only the Start Menu RENDER caches (TileCache_* + StartUnifiedTileModelCache.dat) and stop StartMenuExperienceHost (Windows auto-relaunches it), so the tile re-resolves the real icon via the shell image factory. start2.bin (the user's pinned layout) is deliberately preserved. Guarded by Test-Path (Windows 10 has no such host -> skipped) and wrapped in try/catch so it can never fail the install. Windows-only (install.ps1); no effect on Linux/macOS/Studio. Verified live: rendering the shortcut via IShellItemImageFactory::GetImage (the API StartMenuExperienceHost uses) returns the Unsloth sloth icon, color-matched, after this invalidation -- previously it returned the generic script tile. install.ps1 parses; install suite 267 passed, 2 skipped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ROCm-on-WSL for AMD Strix Halo (gfx1151): auto-setup + runtime enablement Make Unsloth Studio set up ROCm-on-WSL automatically for AMD Strix Halo (Radeon 8060S / gfx1151) and use the GPU at runtime, validated end-to-end on a Ryzen AI Max+ PRO 395 (ROCm 7.2.1 + librocdxg + Adrenalin Apr-2026): rocminfo enumerates gfx1151, torch.cuda True, ~85.8 GB UMA pool. Every change is a strict no-op for all other configs (NVIDIA/CUDA, discrete + native-Linux AMD ROCm, macOS/MLX, Windows, CPU-only, non-Strix WSL) and can never abort the installer. - scripts/install_rocm_wsl_strixhalo.sh: rewrite to the validated recipe. Fixes that would have broken a working box: drop the /usr/lib/wsl/lib preflight (a working ROCDXG host has only d3d12/dxcore there); remove the obsolete rocr4wsl step (gone from the 7.2.1 repo; would hard-fail and also rips out the standard hsa-rocr ROCDXG needs); dynamic librocdxg soname (was hardcoded 1.1.0; build is 1.2.0); direct apt-repo install; Windows SDK auto-discovery; persist env to /etc/profile.d + ~/.bashrc; idempotent. - install.sh: _maybe_bootstrap_rocm_wsl auto-offers/runs the helper when it detects a Strix Halo APU in WSL (/dev/dxg) with no ROCm runtime, then loads the env so detection routes to the gfx1151 wheels. Fast-path when already configured. Fix an inaccurate WSL hint line. - studio/backend/main.py + worker.py: set HSA_ENABLE_DXG_DETECTION=1 in-process before torch (gated on /dev/dxg AND librocdxg.so), so the worker uses the GPU even when launched outside a login shell. Mirrors the existing BNB_ROCM_VERSION injection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * uninstall: clean up ROCm-on-WSL artifacts + Start Menu tile cache - uninstall.sh: remove the ROCm-on-WSL helper artifacts -- the librocdxg build clone (~/.unsloth/librocdxg, which otherwise blocks the empty-dir rmdir of ~/.unsloth), the throwaway smoke-test venv, the persisted env (/etc/profile.d/unsloth-rocm-wsl.sh) and the ~/.bashrc block. The system ROCm userspace is a shared prereq like CUDA and is kept by default; UNSLOTH_UNINSTALL_ROCM=1 removes it too. No-ops on macOS / non-Strix Linux. - uninstall.ps1: invalidate the Win11 Start Menu tile cache after removing the shortcut so its tile disappears promptly (mirrors install.ps1), preserving start2.bin. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer: accurate AMD ROCm messaging (HIP SDK optional, not required) The Windows installer printed "HIP SDK not found - GPU-accelerated training unavailable" / "ROCm wheels require the HIP SDK" whenever the HIP SDK was absent. That is misleading: for a detected AMD GPU arch (gfx1151 etc.), setup.ps1 installs AMD's bundled-runtime ROCm PyTorch wheels (repo.amd.com) which ship their own ROCm runtime and do NOT need the HIP SDK -- verified end-to-end (torch 2.11.0+rocm7.13.0, cuda True, QLoRA training on GPU) on a Radeon 8060S with no HIP SDK installed. Gate the GPU-detection + rocm-step messages on a detected gfx arch: when one is known, state that GPU PyTorch uses bundled-runtime wheels and the HIP SDK is optional; only when the arch is unknown fall back to the HIP-SDK hint. Behavior (torch routing) is unchanged; this is messaging only. No-op for NVIDIA/CUDA, HIP-SDK-present, and CPU paths (they hit earlier branches). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer: fix /opt/rocm data-loss + make WSL shortcut create/remove interop-robust Two fixes from the 3-reviewer regression audit + live testing on a systemd-enabled WSL distro (interop disabled): F1 (data-loss, install_rocm_wsl_strixhalo.sh): the /opt/rocm symlink-repair could force-delete a pre-existing REAL ROCm install. The guard only checked that /opt/rocm is a real directory, not that it is the stray librocdxg stub. Now it only touches /opt/rocm when it is NOT a real install (no bin/rocminfo, bin/hipcc, or .info/version present), and MOVES it aside (rocm.unsloth-stub-bak) instead of deleting it, so a wrong guess can never lose data. WSL interop robustness (install.sh + uninstall.sh): both relied on `command -v powershell.exe`, which is true even when WSL interop cannot EXECUTE it (on systemd distros powershell.exe fails with "Exec format error"). Result: the WSL shortcut silently failed to create (install) and to remove (uninstall). - uninstall.sh: test that powershell.exe actually runs; if not, remove the "Unsloth Studio (WSL...).lnk" files directly via drvfs (/mnt/<drive>), which works without interop. The name is WSL-install-specific, so a native install's "Unsloth Studio.lnk" is never touched. - install.sh: when the shortcut cannot be created, warn with the manual launch command + how to re-enable interop, instead of failing silently. No behavior change on the interop-on path. The regression audit otherwise found no regressions on Linux/Mac/Windows/CPU/NVIDIA install paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * install.sh: fast-path fully restores ROCm-on-WSL env when the drop-in is gone Reinstall regression found by uninstall->reinstall testing: after a Studio uninstall that removed /etc/profile.d/unsloth-rocm-wsl.sh but KEPT the shared ROCm (the default), a non-login reinstall hit the bootstrap fast-path (librocdxg present) and its else-branch only set HSA_ENABLE_DXG_DETECTION -- NOT PATH/LD_LIBRARY_PATH. So rocminfo was not on PATH, GPU detection failed, and the installer fell back to CPU-only PyTorch. Fix: when librocdxg is present but the env drop-in is missing, restore the FULL env inline (HSA + TORCH_ROCM_AOTRITON_ENABLE_EXPERIMENTAL + PATH + LD_LIBRARY_PATH) so rocminfo is found and detection routes to the GPU, and recreate /etc/profile.d/unsloth-rocm-wsl.sh so future shells and the Studio worker get it too. No change to the env-present fast-path or any other host. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer: clear Explorer icon cache so shortcut icons aren't blank Root cause of the persistent blank Desktop + Start Menu icons: Explorer caches each shortcut's icon in iconcache_*.db and does NOT re-read the .ico when a same-name .lnk is recreated across reinstalls. The .ico and .lnk are correct (the shell renders them non-blank via IShellItemImageFactory; the .ico has real image data at 16/32/48/128 px), but the stale cache entry wins. The previous fix only ran a weak `ie4uinit -show` + the Start Menu tile-cache clear -- it never invalidated Explorer's icon cache, so the desktop icon stayed blank. Fix (native install.ps1 New-StudioShortcuts AND the WSL shortcut path in install.sh): - ie4uinit -ClearIconCache (thorough; replaces -show as the primary refresh) - SHChangeNotify(SHCNE_ASSOCCHANGED) to force a live desktop/taskbar refresh WITHOUT restarting explorer - keep the Win11 Start Menu tile-cache invalidation (and add it to the WSL shortcut path too, preserving start2.bin) Non-disruptive (no explorer restart). install.ps1 parses clean; install.sh passes bash -n + dash -n; the heredoc-generated WSL PowerShell parses clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer: per-item SHChangeNotify(UPDATEITEM) reliably fixes blank icons The blank Desktop/Start Menu shortcut icons are a stale Explorer PER-ITEM icon cache: when a same-name .lnk is recreated across reinstalls, Explorer caches the previously-resolved (often generic "white page") icon for that item and won't re-extract the .ico on its own. The .ico and the .lnk's IconLocation are correct (every icon API renders the sloth) -- only Explorer's cached display is stale. The previous refresh (ie4uinit -ClearIconCache + a GLOBAL SHCNE_ASSOCCHANGED broadcast) does NOT recover a stale item -- confirmed by reproduction. The reliable, NON-disruptive fix (no explorer restart) is a PER-ITEM SHChangeNotify(SHCNE_UPDATEITEM, SHCNF_PATHW, <lnk path>) for each created shortcut, which forces Explorer to re-read that exact item's icon. Verified end-to-end: deliberately staled a shortcut to the generic icon, ran the installer's exact new refresh code, and the sloth icon recovered with NO explorer restart (confirmed by capturing the live desktop via PrintWindow). Applied to both native install.ps1 (New-StudioShortcuts) and the WSL shortcut path in install.sh. Still clears the on-disk icon cache (ie4uinit) and the Win11 Start Menu tile cache (preserving start2.bin). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * uninstall: remove leftover llama.cpp .staging root so ~/.unsloth is cleaned The llama.cpp atomic-install staging root (install_llama_prebuilt.py INSTALL_STAGING_ROOT_NAME=.staging) is a sibling of the llama.cpp install dir (~/.unsloth/.staging in default mode). It is normally pruned after a successful activate, but an interrupted or retained build can leave a <name>.staging-XXXX tree behind. The uninstallers removed llama.cpp and .cache but not .staging, so the final empty-dir cleanup of ~/.unsloth failed and the directory lingered. Reproduced on WSL (Ubuntu-24.04) where an empty llama.cpp.staging-XXXX dir kept ~/.unsloth alive after uninstall. Remove ~/.unsloth/.staging in both uninstall.sh and uninstall.ps1. No-op in env/custom mode (staging nests under the custom root removed already) and when absent. Cross-platform fix (the staging logic is platform-agnostic). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer: WSL-absent hint + fix here-string lint false positive install.ps1: in the AMD WSL-ROCm driver hint, detect when wsl.exe is absent and add a one-line "wsl --install -d Ubuntu-24.04" pointer so a Strix Halo user with no WSL yet gets an actionable next step (the hint previously assumed an Ubuntu-24.04 distro already existed). Best-effort, informational only. test_rocm_support.py: test_no_here_strings did a crude substring check that false-positived on the conda-style block marker printf '# <<< Unsloth ROCm-on-WSL (gfx1151) <<<' -- a string literal written into the /etc/profile.d drop-in, also used as a sed delimiter pair by uninstall.sh, not a here-string. Strip quoted spans before the check so the lint still catches a real here-string operator but ignores quoted literals. install.sh remains POSIX-clean (sh -n / dash -n / bash -n all pass). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * installer: address PR review comments (gfx1150 mapping, amd-smi opt-out, WSL bootstrap, SDK path, make) Apply the valid bot review findings on #5940; reject the ones that don't hold. Fixed: - AMD name->gfx table (setup.ps1 + install.ps1): Radeon 890M and Ryzen AI 9 HX 370/375 are Strix POINT (gfx1150), not Strix Halo (gfx1151). Move 890M / HX 37x / AI 9 HX to the gfx1150 row and drop the bogus HX 38x pattern (no such Strix Halo SKU). Matches the runtime classifier in worker.py (890M/880M -> gfx1150; 8060S/8050S -> gfx1151). Prevents Strix Point hosts from getting the wrong ROCm prebuilt/wheels. - amd-smi opt-out (setup.ps1 + install.ps1): an explicit UNSLOTH_ENABLE_AMD_SMI= 0/false/no/off now wins over the HIP-SDK heuristic, so a host with a HIP SDK binary but a broken runtime no longer gets the DiskPart/UAC prompt the opt-out exists to avoid. - amd-smi warning probes (install_python_stack.py): _has_rocm_gpu and _detect_amd_gfx_codes now gate amd-smi behind _amd_smi_allowed() (and pass _amd_smi_env()), closing the last unguarded amd-smi spawn on Windows. - WSL ROCm bootstrap (install.sh): the "already-usable ROCm?" early return now requires rocminfo to enumerate the real gfx1151 agent instead of the generic _has_amd_rocm_gpu (whose broad gfx[1-9][0-9] match accepts a fallback "gfx11-generic" ISA), so a Strix Halo box missing the ROCDXG bridge is no longer skipped. The shared helper is untouched (no gfx90a regression). - install_rocm_wsl_strixhalo.sh: * Quote-safe Windows SDK discovery: the old for-in-$(ls -d "...Program Files (x86)/...") word-split on the space and never matched; use find + read loop. * Add `make` to apt prereqs (cmake only recommends it; minimal images lacked it and the librocdxg `make -j` build failed). * Verification requires gfx1151 exactly (not gfx1[0-9]) so a generic ISA or an unrelated RDNA GPU can't pass while the real GPU is absent. Reviewed but NOT changed: - "Forward inferred ROCm arch without HasROCm" (setup.ps1): already correct -- --rocm-gfx is forwarded under `if ($script:ROCmGfxArch)`, not `if ($HasROCm)`. - "Route inferred arch into install.ps1 torch path": not a bug -- install.ps1 installs CPU torch as a base by design and setup.ps1 swaps in the ROCm wheel for the inferred arch (gate `($HasROCm -or $ROCmGfxArch) -and cpu`); verified live the native install ends on torch 2.11.0+rocm7.13.0. - "$p null guard after Start-Process" (install.ps1/setup.ps1): redundant -- the amd-smi runner uses [Process]::Start wrapped in try/catch, so a null process already returns "" with LASTEXITCODE=1 (no uncaught exception). - "ls -> find for /usr/lib/wsl/lib" (gemini): stale -- that heuristic was removed; only a comment about it remains. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer(rocm-wsl): auto-install the Windows 11 SDK via winget (fewer manual steps) librocdxg's build needs the Windows SDK 'shared' headers on the Windows host. Previously the helper just die()d with "install the Windows 11 SDK and re-run" if they were missing -- a manual prerequisite that broke the otherwise-seamless `curl ... install.sh | sh` one-liner on Strix Halo. Now, when the headers aren't found, the helper installs the Windows 11 SDK on the Windows host from inside WSL via winget (powershell.exe interop), then re-discovers them. The SDK installer elevates -> ONE UAC prompt on the Windows desktop; the headers appear under /mnt/c immediately (drvfs is live, no reboot). The user already consented to the ROCm-on-WSL setup, so no extra prompt is added beyond the OS UAC gate. - New _find_win_sdk (space-safe find of the newest installed SDK 'shared' dir) and _install_windows_sdk_via_winget helpers. - winget IDs tried newest-stable first: Microsoft.WindowsSDK.10.0.26100, then .22621. The presence of the headers (re-check) is the source of truth, not winget's exit code. </dev/null so winget never consumes a piped `curl|sh` stdin. - Best-effort + non-fatal: interop-off / no-winget / declined-UAC all fall through to the existing clear manual-install die(). Opt out with UNSLOTH_SKIP_WIN_SDK_INSTALL=1. Removes the last avoidable manual step from the WSL Strix Halo path; only the AMD Adrenalin driver (AMD referrer-gates the download) remains manual. Verified _find_win_sdk resolves the spaced "Program Files (x86)" path; bash -n clean; all winget flags validated against `winget install --help`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * installer(amd): gate install-time amd-smi probe to fix DiskPart UAC prompt install_python_stack.py's Windows "AMD GPU detected but ROCm torch missing" warning probe ran `amd-smi list` whenever amd-smi was on PATH -- and amd-smi ships in C:\Windows\System32 with the AMD Adrenalin driver -- without the _amd_smi_allowed() gate that every other amd-smi call site in the file uses. On Adrenalin-only hosts (no HIP SDK) amd-smi elevates a child at runtime and pops a UAC/DiskPart prompt that __COMPAT_LAYER=RunAsInvoker cannot suppress (amd-smi's manifest is asInvoker). The probe also ran before the ROCm-torch-installed check, so it fired on every Windows AMD install. Gate it behind _amd_smi_allowed() and pass _amd_smi_env(), matching _has_rocm_gpu()/_detect_amd_gfx_codes(). When skipped, the only loss is the best-effort "AMD GPU detected" note on HIP-SDK-less hosts. Adds a per-function AST regression test asserting every function in install_python_stack.py that names the amd-smi command and spawns a subprocess also references _amd_smi_allowed() (flags the pre-fix code; passes after). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * studio(cli): fix `unsloth studio stop` crashing on Windows `stop` used the POSIX `os.kill(pid, 0)` liveness probe, but on Windows CPython raises OSError (WinError 87, "The parameter is incorrect") for *every* pid -- alive or dead. `stop` only catches ProcessLookupError / PermissionError, so the OSError propagated and the command crashed with a traceback before ever reaching its (correct) `taskkill /F` path. Add a cross-platform `_pid_alive(pid)` helper (tasklist on Windows, signal-0 elsewhere) and use it for both the pre-check and the post-kill wait loop. The actual kill path is unchanged. Verified on Windows (Python 3.13): os.kill(pid,0) raises WinError 87 for both a live and a dead pid; `_pid_alive` returns True/False correctly and the full stop() flow (alive -> taskkill -> dead -> "stopped") passes end-to-end against a throwaway process. Adds tests/studio/test_cli_studio_stop_windows.py (AST guard against a bare os.kill(pid,0) liveness probe + mock-only _pid_alive behaviour for the win32 tasklist branch and the POSIX signal-0 branch). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * installer(amd): fix install.sh name->arch table misrouting Strix Point to gfx1151 The bash name->arch inference table in install.sh placed Strix Point identifiers (Radeon 890M, "Ryzen AI 9 HX 370/375", "AI 9 HX") in the gfx1151 (Strix Halo) row, diverging from the install.ps1 / setup.ps1 PowerShell tables which correctly map them to gfx1150. It also carried a stray "HX 38" token absent from the PowerShell source-of-truth. Align install.sh with the PowerShell tables: gfx1151 row: 8060S|8050S|8040S|Strix Halo|Ryzen AI Max|AI Max gfx1150 row: 890M|880M|860M|840M|Strix Point|Krackan|HX 37|AI 9 HX|... Impact is low (the bash table only feeds the display label _gpu_disp_gfx and the "set UNSLOTH_ROCM_GFX_ARCH=..." hint; wheel selection is driven by the detected ROCm version, not this name string) but a Strix Point user would otherwise see/copy the wrong gfx arch. Add a parity test (test_install_sh_name_arch_agrees_with_ps_for_strix_and_non_amd) that parses install.sh's case table and asserts Strix Halo->gfx1151, Strix Point->gfx1150, RX 7700S->gfx1102, and NVIDIA/Intel->no match, cross-checking against install.ps1 (the previous parity test only compared install.ps1 <-> setup.ps1, missing install.sh). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * setup.ps1: keep prebuilt-llama ownership guard within the test's block window The AMD additions to the prebuilt-llama.cpp block (the windows-hip vs windows-cpu existing-install kind validation) pushed the install_llama_prebuilt.py invocation to ~1999 chars after the "installing prebuilt llama.cpp bundle (preferred path)" anchor, right at the edge of the 2000-char window that test_setup_ps1_prebuilt_llama_cpp_has_ownership_guard slices -- so the helper string was truncated and the test failed with "substring not found" (CI: Repo tests (CPU)). The ownership-guard invariant (Assert-StudioOwnedOrAbsent precedes the install_llama_prebuilt.py call) was already satisfied; only the proximity to the anchor regressed. Move the "installing prebuilt..." substep to immediately before the install (after the existing-install pre-cleanup), which also reads better (validate/clean existing -> then "installing"), shrinking anchor->helper from 1999 to 413 chars. Behaviour is unchanged (console message ordering only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * install.sh: auto-run Strix Halo ROCm-on-WSL setup by default `curl -fsSL https://unsloth.ai/install.sh | sh` should make a Strix Halo (gfx1151) GPU usable inside WSL with no extra commands. Previously the ROCm-on-WSL bootstrap was opt-in: it required UNSLOTH_ROCM_WSL_AUTO=1 or an interactive [Y/n] at a TTY, and silently skipped under a pipe (no /dev/tty), so the piped one-liner never set the GPU up automatically. Flip it to auto-by-default for the single narrow case the existing guards allow (WSL + Strix Halo + /dev/dxg + no usable ROCm yet) -- exactly the GPU setup the user ran the installer for. Opt out with UNSLOTH_SKIP_ROCM_WSL_SETUP=1. The Tauri desktop app keeps its own consent UI (only auto-runs when it passes UNSLOTH_ROCM_WSL_AUTO=1). All hardware/OS guards are unchanged, so non-Strix / non-WSL / NVIDIA / native-Linux / macOS / CPU paths are unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * PR comments: condense to be succinct (comments/docstrings only) Shorten the verbose explanatory comments and docstrings this PR added across the installer, scripts, backend shims, CLI, and tests -- tighter, fewer lines, while preserving every non-obvious "why" (os.kill WinError 87, amd-smi RunAsInvoker/UAC, /dev/dxg + librocdxg gating, the ROCm-on-WSL bootstrap guard chain, ownership guards, etc.). No executable code, string literals, messages, or behavior changed. Verified comments-only: docstring-normalized AST equality (Python, 9 files), non-comment token equality (PowerShell, 3 files), comment-stripped diff + sh -n / bash -n (shell, 3 files). Behavior re-confirmed: get_torch_index_url + gfx name->arch table 44/44 under dash & bash; rocm_support / pr5940_followups / cli_studio_stop tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Installer: address PR review (amd-smi opt-out, pipefail, multi-distro, non-root) Fixes valid findings from the Codex/Gemini PR review: - install.ps1 / setup.ps1: gate the `amd-smi version` ROCm-version fallback with $amdSmiAllowed so UNSLOTH_ENABLE_AMD_SMI=0 opt-out is honored (the device probe was gated but this fallback wasn't), avoiding the DiskPart/UAC prompt. - install_rocm_wsl_strixhalo.sh: make the post-verification rocminfo summary best-effort (|| true) so head's early pipe-close under `set -o pipefail` can't fail the bootstrap after gfx1151 was already enumerated; pin the Windows SDK `winget install` to --source winget (matches the msstore-cert fix rationale). - install.ps1: python.org fallback installs the py launcher per-user (InstallLauncherAllUsers=0, avoids admin), and derives the fallback full version from the requested minor so a non-default UNSLOTH_PYTHON (e.g. 3.12) isn't silently replaced with 3.13 when the listing is unreachable. - install.sh: recreate /etc/profile.d/unsloth-rocm-wsl.sh via `sudo tee` for a non-root reinstall (a plain redirect failed silently, dropping the ROCm env). - uninstall.sh: scope WSL Windows-side shortcut removal to the current WSL_DISTRO_NAME (per-distro name or -d "<distro>" arg) so uninstalling one distro no longer deletes other distros' launchers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Studio ROCm Windows: fix field-reported issues from Strix Halo testers Four fixes from PR #5940 field reports (Win11 native, gfx1151): 1. bitsandbytes arch-probe spam: bnb's get_rocm_gpu_arch() runs hipinfo.exe via subprocess PATH at import; the AMD torch wheel ships hipInfo.exe in the venv Scripts dir, which is only on PATH for activated venvs. Every bnb import logged "Could not detect ROCm GPU architecture: [WinError 2]" ERROR + WARNING (even with the HIP SDK installed, whose bin dir is not on PATH either). Prepend the Scripts dir to PATH before bnb imports in main.py, worker.py, and install_python_stack.py, gated on the file existing (only AMD wheels ship it). Verified on gfx1151: ROCM_GPU_ARCH now resolves to gfx1151 with zero errors. 2. OOM-guard double-tax on native Windows unified APUs: mem_get_info's total is the WDDM budget the driver grants HIP (BIOS carve + ~half of remaining RAM) -- the OS share is already outside it. The 0.80 unified cap on top denied loads that fit (field report: 48.49 GiB budget -> "38.79 GiB allowed" OOM for a 47.29 GiB load with 48.08 free). Use 1.0 on win32 unified; Linux keeps 0.80, discrete 0.90. 3. "Missing VRAM" confusion: log the WDDM budget vs physical RAM with the fix (BIOS UMA frame buffer / AMD Software Variable Graphics Memory) when the grant is under 75% of RAM, so a 48 GiB cap on a 96 GiB box reads as policy, not a Studio bug. 4. llama-server fit-step crash (Qwen3.6-27B-MTP + mmproj, lemonade gfx1151): --fit defaults to 'on' upstream, so the fit step runs even when Studio already placed the model via -ngl -1, and aborts in ggml-cuda.cu on some ROCm hosts. Retry the spawn once with --fit off when the server crashes during startup and Studio's own VRAM math had placed the model (never when use_fit or an explicit fit flag was passed). Also keep the TAIL of crash output in the error log (the diagnostic line prints last; head-truncation cut exactly that) and reference the full on-disk log. Verified live on Radeon 8060S: bnb import clean, Qwen3.5-4B-MTP loads and generates through the new spawn loop, stub-crash retry appends --fit off and recovers, fraction probes confirm WDDM overcommit and sub-1.0-only enforcement on current AMD wheels. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio ROCm Windows: GPU-name fallbacks so nothing depends on amd-smi amd-smi does not reliably exist on Windows: the HIP SDK never ships a CLI, inbox Windows Update drivers do not, and only some full Adrenalin packages drop amd-smi.exe into System32 (field report: fresh Win11 + Adrenalin + HIP SDK, still no amd-smi anywhere). Make every consumer work without it: - install_python_stack._detect_windows_gfx_arch: two new probes after hipinfo/amd-smi -- (2b) the venv Scripts hipInfo.exe shipped by AMD torch wheels (drives `studio update` on driver-only hosts), and (4) a last-resort GPU marketing-name -> gfx table via WMI (Win32_VideoController), mirroring setup.ps1's $nameArchTable so a standalone repair resolves the arch with zero AMD tooling installed. - install_llama_prebuilt._resolve_exe: also probe the venv Scripts dir so a standalone rerun finds hipInfo.exe without HIP_PATH. - hardware/amd.py _run_amd_smi: which() guard before spawning -- absence now disables the poller in one step instead of burning the 3-strike circuit breaker on FileNotFoundError; corrected the stale comment claiming Adrenalin ships amd-smi. Simulated against the real detection functions on gfx1151: amd-smi absent, present-but-crashing (exit 1), present-but-hanging (60s sleep vs 5-10s probe timeouts), and hard opt-out -- all resolve gfx1151, no exceptions, bounded time. Full adversarial install (broken amd-smi stub first on PATH + UNSLOTH_ENABLE_AMD_SMI=1, fresh uninstall first): exit 0, name-table arch inference, lemonade gfx1151 b1292 prebuilt, torch 2.11.0+rocm7.13.0 cuda_avail=True on the 8060S, Studio boots healthy and stops cleanly. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: per-attempt llama-server log names + amd-smi test portability Found by cross-platform simulation of the --fit off retry (Windows + Linux sandboxes, real load_model with stub servers): - llama-server log filename now carries the spawn-attempt index. The retry can respawn within the same epoch second; reusing the name opened the same file with "w" and truncated the crash log the retry warning had just pointed the user at (proven with a frozen time.time: one file, crash evidence gone; with the suffix both attempts keep their logs). Regression-pinned in test_llama_cpp_wait_for_health.py. - test_amd_primary_gpu_with_mock now mocks shutil.which alongside subprocess.run: the amd-smi absence guard which()-checks before spawning, so on hosts without a real amd-smi (Linux CI, driver-only Windows) the subprocess mock was never reached and the test failed. Surfaced by running the suite in a clean Linux sandbox. Simulation coverage on both OSes: 67-case platform/edge matrix (real shipped code blocks under win32/linux/darwin spoofs: OOM-guard fractions + VGM-hint boundary, bnb PATH-prepend gates, retry eligibility incl. equals-forms and decoy tokens, GPU-name table adversarial set, WMI fallback without powershell, monitor absence semantics), 6-scenario live retry matrix (crash-once/crash-always/ exit-zero/explicit-fit/hang/log-collision) against real llama-server spawns on Windows and WSL (GPU success legs on the 8060S), and a 3-engine browser matrix (chromium/firefox/webkit) driving the live backend's health + authed /v1 chat completion. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: classify unified-memory via props.is_integrated first Align the ROCm OOM-guard classifier with PR #5988's UMA gate: consult hipDeviceProp_t.integrated (props.is_integrated) before the hardcoded arch set. Strictly additive -- truthy upgrades to unified; 0/absent falls through to the existing gfx1150/gfx1151 + device-name logic, so wheels that omit or zero the field cannot downgrade the known APU set. Extends correct unified-cap treatment to APUs outside that set (e.g. gfx1103 Phoenix iGPUs) and keeps Studio's two unified-memory consumers on one driver signal. Verified live on gfx1151 (is_integrated == 1 on the AMD Windows wheel -> ('gfx1151', True) via the new path). * AMD detection: probe rocminfo with HSA_ENABLE_DXG_DETECTION and sync setup.sh gfx table Fleet validation on a Strix Halo WSL2 box showed the system rocminfo (HSA 1.18, ROCm 7.2.1) only enumerates the GPU over /dev/dxg when HSA_ENABLE_DXG_DETECTION=1, and that rocminfo can sit at /opt/rocm/bin off PATH outside login shells. Detection probes that miss either of these report no GPU on a working ROCDXG host and select the CPU build even though the lemonade bundle offloads fine (95.7 tok/s measured vs 64.5 CPU on the same laptop). Seed the env (a no-op on bare metal) and the PATH fallback in install.sh, studio/setup.sh, and the installer's Linux rocm probe, mirroring what main.py/worker.py already do for the runtime. Also sync studio/setup.sh's name->gfx table with install.sh: 890M and the HX 37/AI 9 HX SKUs are Strix Point (gfx1150, not gfx1151), RX 7700S must match gfx1102 before the gfx1100 row, and the RDNA2/workstation rows were missing. New parity test pins the two bash tables together so they cannot drift again. * Studio: persist server session logs + native-crash stacks to disk Field report (Strix Halo, 96 GB UMA carve, WSL and native Windows): "the studio just terminates without a warning". A native crash in the GPU runtime kills the process with no Python traceback, and a desktop- shortcut console closes before anything can be read. The server only ever logged to the console, so there was nothing to send back. run_server now tees stdout/stderr to ~/.unsloth/studio/logs/server/server-<ts>-pid<n>.log (console behavior unchanged; file copy is best-effort), arms faulthandler at the same file so access violations / SIGSEGV leave a stack trace on disk, and exports PYTHONFAULTHANDLER=1 so training workers inherit crash dumps on their captured stderr. Armed before `from main import app` so even import-time failures leave evidence. Keeps the newest 20 session logs; opt out with UNSLOTH_STUDIO_NO_FILE_LOG=1. Prints "Session log: <path>" at startup so users know what to attach. Verified on this box: a forced real segfault (faulthandler._sigsegv) leaves the full session output plus "Fatal Python error: Segmentation fault" and the thread stack in the file while the console shows nothing; a normal server boot captures the startup banner and serves health as before. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * AMD probe: honor a pre-set HSA_ENABLE_DXG_DETECTION value Match the shell helpers, which use the parameter-default form: a user who exports HSA_ENABLE_DXG_DETECTION=0 to deliberately hide the GPU from DXG detection should not have the probe override it. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: danielhanchen <michaelhan2050@gmail.com>	2026-06-10 04:24:49 -07:00
Daniel Han	187144d4e7	Reduce and tighten code comments and docstrings repo-wide (#6095) ... Trim and tighten code comments and docstrings across the repository. Comment-only: every changed file verified code-identical to main via AST/token comparison.	2026-06-08 23:09:51 -07:00
Daniel Han	8292e699e4	Studio: make code comments and docstrings more succinct (#6029) ... Trim and tighten code comments and docstrings across studio/ Python. Comment-only: every changed file verified code-identical to main via AST/token comparison.	2026-06-08 23:07:28 -07:00
Daniel Han	3ce187da02	Formatting: ruff line-length 100, kwarg-spacing passes, drop blank after short local imports (#6079) ... Raise ruff line-length to 100 and extend the local pre-commit format pipeline (def-signature magic-comma normalization, short multi-line assert collapse, kwarg '=' spacing, blank-line-after-short-import removal, adjacent string-literal / f-string+plain merge, redundant-pass pruning). Every transform re-checks the file AST and is dropped if it would differ; the whole-repo reformat is verified AST-identical per file and idempotent.	2026-06-08 04:24:13 -07:00
Matt Van Horn	5cdbfef390	fix: warn when localhost resolves to ::1 but Studio is bound only to 127.0.0.1 (#5994) ... * fix: warn when localhost resolves to ::1 but Studio is bound only to 127.0.0.1 * studio: fix localhost/::1 warning suppression and cover _run wiring Addresses the Codex review on #5994 plus review-team findings: - Remove the `_local_port_open("::1", port)` early-return. Studio binds 127.0.0.1 only, so a successful connect to ::1:<port> means a *different* process is there -- exactly when http://localhost opens the wrong service and the user most needs the warning. Dropping the probe also removes the ~0.25s startup latency and the probe/warn race. - Extract the banner/warning block from `_run` into `_emit_startup_output` so the wiring is unit-testable, and make the mismatch vs wildcard paths an explicit if/elif (they are mutually exclusive by construction). - Hoist the `_working_local_url` confirmation out of the try block and reorder `_stdout_color_ok` before its only caller. - Tests: add `_emit_startup_output` integration coverage (banner include_stop_hint, warning emission, single stop hint), a regression test that ::1 being occupied does NOT suppress the warning, dual-stack and non-positive-port cases; drop the unreachable `None` getaddrinfo arm. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Etherll <mrmrmidessam@gmail.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-06-05 02:40:56 -07:00
Leo Borcherding	ee6695118c	Fix/studio colab proxy and iframe - Unsloth Studio not loading in Colab (iframe "refused to connect" and wrong URL) (#5844) ... * fix(studio/colab): merge iframe+keepalive into start(), add proxy_headers to uvicorn - Move serve_kernel_port_as_iframe and keepalive loop into colab.start() so both run in the same cell execution context, eliminating the race where the proxy URL was shown before the iframe cell had a chance to run - Add a 2s sleep after run_server() before show_link() to give Colab's proxy infrastructure time to register the bound port - Add proxy_headers=True and forwarded_allow_ips="*" to uvicorn Config so X-Forwarded-Proto/Host from Colab's reverse proxy are trusted - Simplify notebook start cell (no more separate iframe cell needed) * fix(studio/colab): fix iframe blocking and server thread crash in Colab Two root causes for the long-standing proxy/iframe breakage: 1. SecurityHeadersMiddleware set X-Frame-Options: DENY and frame-ancestors 'none' unconditionally, blocking serve_kernel_port_as_iframe regardless of server health. Fix: detect Colab via COLAB_BACKEND_URL/COLAB_GPU env vars, relax frame-ancestors to *.prod.colab.dev and omit X-Frame-Options. 2. asyncio.run() in the daemon thread conflicted with nest_asyncio's global patches applied on the main thread, causing the server to crash silently after ready_event fired. Fix: use explicit new_event_loop() + run_until_complete() in the daemon thread to bypass nest_asyncio's asyncio.run patch. Also replace blind time.sleep(2) with a health endpoint poll so the link and iframe are only shown once the server is truly reachable. * fix(studio/colab): use reliable /content + google.colab path for Colab detection COLAB_BACKEND_URL and COLAB_GPU env vars aren't consistently set across all Colab runtime versions. Use /content dir + google.colab package path as a more reliable signal, computed once at module load. * fix(studio/colab): fix port mismatch, health-check silence, and CSP framing Four bugs causing the iframe and URL button to always fail: 1. Port not propagated back: run_server auto-increments when 8888 is taken, but start() kept using the original port for show_link() and serve_kernel_port_as_iframe() — now reads app.state.server_port. 2. Silent health-check failure: the poll loop never checked whether any attempt succeeded; on all-fail it continued and showed a dead link — now exits early with a clear error message. 3. CSP frame-ancestors too narrow: '*.prod.colab.dev' only matches one subdomain level; actual Colab proxy URLs are two levels deep (e.g. foo.region.prod.colab.dev), and the parent frame may also be colab.research.google.com or a sandboxed null-origin output iframe — changed to '*' in Colab mode (single-user sandbox, no security loss). 4. _IS_COLAB detection hardcoded python3.10/3.11 paths: Python 3.12+ Colab runtimes wouldn't match when env vars aren't set — replaced with a glob over python3.*/dist-packages/google/colab. * fix(studio/colab): harden Colab startup against every known failure mode colab.py: - get_colab_url: retry eval_js up to 3x (10s timeout each), validate that result is a real https:// URL containing the port before accepting it; log a clear warning when falling back to localhost - show_link: safe short_url truncation (try/except around str.index so an unexpected URL shape never blocks the link card from rendering); also emit the URL via logger so it's visible in cell text output even if HTML display is suppressed - start: detect "already running" at entry — on cell re-run Studio is still healthy on port 8888; skip re-launch and go straight to show+iframe so the user never ends up with mismatched port state - start: wrap run_server in try/except (SystemExit + Exception) so startup errors surface as readable messages rather than cell crashes - start: check frontend_path/index.html exists, not just the directory - start: remove unused `import sys` - start / keepalive: catch KeyboardInterrupt so interrupting the cell prints a clean "stopped" message instead of a raw traceback - extract _is_studio_healthy() and _show_and_embed() helpers to deduplicate the fast-path and normal-path logic main.py: - _build_csp: in Colab mode, extend script-src to include *.prod.colab.dev and *.googleusercontent.com (Colab injects scripts from these origins into the output iframe scaffolding) - _build_csp: in Colab mode, extend connect-src with blob:, data:, wss://*.prod.colab.dev, and wss://*.googleusercontent.com so WebSocket streams and Colab kernel traffic are not blocked by CSP * fix(studio/colab): fix iframe width responsiveness and height sizing Replace serve_kernel_port_as_iframe with a raw CSS iframe for two reasons: 1. Width responsiveness: serve_kernel_port_as_iframe sets the width as an HTML attribute (width="100%") which Colab's output machinery can bake into a fixed pixel value on first render, causing the Studio to stop following the notebook panel width when it opens/closes or the window resizes. A CSS style property (style="width:100%") participates in normal reflow and always tracks the parent container width. 2. Height sizing: the hardcoded height=1200 was too tall on short monitors (forced outer-page scroll) and wasted space on tall ones. A small JS snippet reads screen.availHeight and sets height to ~82% of the screen, clamped to [600, 1100]px, with a resize listener that re-fits on zoom changes and panel open/close events. Also eliminate the double eval_js call: _show_and_embed now fetches the Colab proxy URL once and passes it to show_link via the new _url kwarg, so google.colab.kernel.proxyPort is only called once per invocation. Falls back to serve_kernel_port_as_iframe if IPython.display.HTML is unavailable for any reason. * fix(studio/colab): fix link button + add fullscreen hover button to iframe Link button: target="_blank" is blocked by Colab's output sandbox. Switch to onclick="window.open(url,'_blank')" which the sandbox allows. Fullscreen: add a small button that appears on hover in the top-right corner of the iframe. Clicking it calls requestFullscreen() on the wrapper div and stretches the iframe to 100vh/100vw. Exits back to normal on fullscreen change. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * revert(studio/colab): remove fullscreen button * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix(studio/colab): address review feedback - Wrap both urlopen calls in with statements to prevent socket/fd leaks - Replace JS resize listener with CSS height:82vh — simpler, responsive, and no risk of leaked window listeners on cell re-runs - Use importlib.util.find_spec("google.colab") instead of a glob path to detect Colab; more robust across Python versions and venv layouts * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix(studio/colab): fall back to href navigation when window.open is blocked window.open from a cross-origin sandboxed Colab output iframe can be silently blocked by the browser (returns null, no exception). The old code returned false unconditionally, so a blocked popup left the button doing nothing. Now: if window.open succeeds the new tab opens and the href is suppressed; if it returns null the browser follows the href, navigating the output cell to Studio — always does something useful. * fix(studio/colab): remove button, give iframe a branded header bar The "Open Unsloth Studio" button was unreliable in Colab's sandboxed output context regardless of how window.open was called. Since the iframe already loads Studio inline, the button added no value and confused users with a URL that 404s outside the output cell. Replace the separate link card + bare iframe with a single block: a slim black header bar (Unsloth logo + truncated URL) flush on top of the full-height responsive iframe. Cleaner and removes the broken button entirely. * studio: gate uvicorn proxy_headers/forwarded_allow_ips behind _IS_COLAB forwarded_allow_ips="*" was applied unconditionally, so every Studio deployment trusted X-Forwarded-* headers from any client. Only Colab needs that, because its reverse proxy fronts the kernel. For a normal local/standalone Studio this is an unwanted relaxation, especially when bound to 0.0.0.0. Now proxy_headers/forwarded_allow_ips are only set when _IS_COLAB. Standalone runs fall back to uvicorn's defaults (proxy_headers honored from loopback only), restoring the prior security posture, while Colab keeps the wide trust its proxy requires. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han <danielhanchen@gmail.com>	2026-05-28 23:54:48 -07:00
alkinun	9222ffd9b4	Studio: add configurable CPU thread pool limit (#5760) ... * Studio: add configurable CPU thread pool limit * Studio: report invalid CPU thread setting cleanly * Studio: also cover uvicorn main:app, harden tests, move docs to advanced --------- Co-authored-by: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> Co-authored-by: danielhanchen <danielhanchen@gmail.com>	2026-05-27 05:09:34 -07:00
Daniel Han	649b9f7808	Studio: expose --parallel / -np flag on unsloth studio run (#5737) ... * Studio: expose --parallel / -np on `unsloth studio run` The CLI was hardcoding `llama_parallel_slots=4` in `run_kwargs` at `unsloth_cli/commands/studio.py`, leaving users unable to tune the concurrent decode slot count even though the engine, KV-cache math, and `studio.backend.run.run_server(llama_parallel_slots=...)` plumbing all already accepted any N. This change adds a `--parallel` / `--n-parallel` / `-np` typer option (default 4 -- matches the previous hardcoded value), forwards it into `run_kwargs`, and pins the new surface with 4 unit tests. Per-request state in `routes/inference.py` is already isolated (`cancel_event` and `prev_text` are per-request locals in every streaming handler; the `_lock` / `_serial_load_lock` only wrap load/unload, not chat completions), so no concurrency refactor is needed alongside this -- the engine layer already handles N concurrent requests on one loaded model when llama-server is told to. Range guards: 1 <= N <= 64. With higher N each slot gets ctx/N KV cache; users tuning this should be aware that per-call context shrinks proportionally. `unsloth studio` (the bare default command, no subcommand) still defaults to llama_parallel_slots=1 via `run_server`'s own default; this PR does not change that path -- it only exposes the knob on the one-liner `studio run` command that already silently used 4. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Forward --parallel through venv re-exec and drop colliding short aliases `unsloth studio run` re-execs into the Studio venv when invoked from outside it (the common path). The arg-builder forwards every typer option but the new --parallel, so the child re-execs at the default 4 and any user value is silently dropped. Worse: pre-PR users who already pass `-np N` as a pass-through extra (where llama.cpp's last-wins parsing made it stick) silently lose N after this PR lands. Forward --parallel explicitly in the re-exec arg list. While auditing the re-exec path, also drop the colliding 1-char short aliases -m (--model) and -f (--frontend) plus the redundant -hfr. Click's short-option clustering had been silently mis-parsing ~11 llama-server short flags via the pass-through path: -fa as `-f a`, -mg 0 as `-m g` + stray 0, -fitt 1024 as `-f itt` + stray 1024, -hff path as `-f f` + stray `-h path`, -cmoe / -cram / -sm / -ncmoe etc. The docstring promise ("any flag this command does not recognize is forwarded verbatim") was silently violated. -hf (2-char) is kept because Click treats multi-char shorts atomically (no clustering of -hff / -hfv / -hffv / -hft) and -hf is documented in basics/api/README.md. --model / --hf-repo / --frontend long forms all unchanged. studio_default keeps -f because it has no pass-through. Tests: - test_studio_run_parallel_flag.py: 8 new re-exec coverage cases (all 3 aliases, 3 platforms via sys.platform mock, pre-PR `-np` regression, mixed with pass-through extras). - test_studio_run_short_alias_clashes.py (new): surface checks that the removed shorts cannot reappear, plus 11 parametrized cases proving each previously-broken llama-server short flag now passes through verbatim, plus a happy-path test that documented -hf still works for `org/repo:variant` syntax. All 27 tests pass. Negative test (revert either fix) shows the new tests catch the regression. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fix stale studio run docstring describing rejected llama-server flags The pre-PR docstring listed --port, -c / --ctx-size, --api-key, -ngl, --jinja, --flash-attn, --no-context-shift as "rejected with HTTP 400", but only --port and --api-key (plus other networking / auth / model identity / single-model UI flags) are actually in studio/backend/core/inference/llama_server_args.py's denylist. -c / -ngl / --jinja / --flash-attn / --no-context-shift are pass-through and last-wins-override Studio's auto-set value. Rewrite the docstring to match the real denylist groups and point at the canonical source. Also add --parallel to one of the examples now that it is a first-class flag. * ci: broaden Linux + narrow Windows llama.cpp runtime patterns + trim #5741 comments (#5746) * ci: broaden Linux llama.cpp runtime pattern to lib*.so* #5741 patched the explicit Linux pattern list to add ``libllama-*-impl.so*`` after ggml-org/llama.cpp#23462 (between b9279 and b9283) split each binary's entry code into a paired ``lib<binary>-impl.so`` shared library. Same class of upstream repackaging will hit us again whenever a new shared lib is added. Mirror what macOS already does and replace the per-lib list with a single ``lib*.so*`` glob. ``copy_globs`` (line 3614) unions patterns, so the per-variant ``libggml-cuda.so*`` / ``libggml-hip.so*`` entries were never filtering anything; the spec lives in ``runtime_payload_health_groups`` (line 5209) which keeps the explicit minimum-required list per variant. Dry-run against b9296-bin-ubuntu-x64.tar.gz: 40 files copied (all ggml, llama, mtmd, impl variants + the two binaries we ship), 22 skipped (other CLIs, rpc-server, LICENSE). Functionally equal to the post-#5741 set. * cleanup: trim #5741 comments on the pydantic split Comments added in #5741 explained the original bug in full each time. They are mostly redundant with the commit message and the PR. Trim them to one short paragraph per site. No behavior change. * ci: narrow Windows runtime pattern to llama-server.exe + llama-quantize.exe Studio only invokes llama-server and llama-quantize. Mac and Linux already filter to those two binaries; Windows was the odd one out with ``*.exe`` copying every CLI upstream ships (llama-cli, llama-bench, llama-mtmd-cli, ...). Dry-run on b9296 (win cpu-x64, cpu-arm64, cuda-13.1, hip-radeon): 20 unused EXEs skipped per variant, all DLLs (incl. the new llama-*-impl.dll family) still copied via ``*.dll``. ``existing_install_matches_choice`` already checks llama-server.exe exists explicitly (line 5297), so the health gate is unchanged. * Lower default weight_decay in RL config from 0.01 to 0.001 (#5747) In full FT, AdamW weight decay shrinks the parameter directly so the implicit prior is W -> 0. In LoRA the trained parameters are A and B while the effective weight is W = W_init + (alpha/r) * B @ A; decaying A and B separately drives BA -> 0, hence W -> W_init rather than 0. The previous default of 0.01 inherited from full-FT recipes adds a measurable pull on the merged adapter back toward the base model over a few thousand steps. 0.001 keeps a small Frobenius-norm prior on ||A||^2 + ||B||^2 for numerical stability without meaningfully biasing the merged weight toward init, and aligns with the value used across the unsloth notebook templates. * Studio: strip orphan tool_call XML leaking into visible content (#5735) * Studio: strip orphan tool_call XML from streamed visible content The speculative-buffer state machine in `studio/backend/core/inference/llama_cpp.py` can slice a tool_call XML block between the silent DRAINING path and the user-visible content_accum, depending on when in the model's emission the BUFFERING -> STREAMING -> DRAINING transitions fire. Three leak shapes were observed in a 2026-05-22 sweep of 900 Qwen3.5 / Qwen3.6 GGUF runs: Pre-fix XML leak rate: 20/900 (2.22%), concentrated 6.7% on the larger Q8 / MTP configs: Qwen3.6-35B-A3B Q8_0 4/60 (6.7%) Qwen3.6-35B-A3B-MTP Q4 4/60 (6.7%) Qwen3.5-35B-A3B Q8_0 3/60 (5.0%) Qwen3.6-27B Q8_0 3/60 (5.0%) The existing `_TOOL_XML_RE` only matched well-formed `<tool_call>...</tool_call>` and `<function=...></function>` pairs, so unterminated openings (close was DRAINED) and orphan closes (opening was DRAINED) survived the strip and reached the user. Fix relaxes the regex to also strip: 1. Orphan opening up to end-of-string: `(?:</tool_call>|\Z)` 2. Orphan closing tag: bare `</tool_call>` / `</function>` Verified on the full sweep: 20/900 -> 0/900 (100% of detected leaks eliminated). 16 unit tests in `test_tool_xml_strip.py` pin all three leak shapes plus the well-formed cases, plus parametrised checks on the 5 actual real-world leak samples from the sweep data. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: strip tail-only </parameter> orphan + tighten regex The 2026-05-22 gdpval sweep surfaced a 4th XML-leak shape not caught by the earlier regex: a bare `</parameter>\n\n` at end-of-buffer (7 of 192 trials, all Qwen3.5-27B + a few Qwen3.6-27B). The model emits the full `<tool_call><function=...><parameter=...>...content... </parameter></function></tool_call>` envelope, the speculative buffer DRAINS the opening tags as intended, but EOS (max_tokens cutoff) truncates the outer `</function></tool_call>` close, leaving just `</parameter>` as the visible tail. We strip this ONLY when end-anchored (`\s*\Z`) so legitimate mid-text uses (user code samples, documentation discussing the Qwen tool-call XML shape) survive. Verified on the 192-trial gdpval corpus: before=7, after=0. While at it, fold the five top-level alternations into three by sharing tag-name and prefix subgroups: <tool_call>... + <function=\w+>... + --> <(?:tool_call|function=\w+)>... </tool_call> | </function> --> </(?:tool_call|function)> Semantically identical (verified by replay over the 192-trial corpus + adversarial inputs, 0 diffs) and 1.34x faster on real workloads. Backtracking-safety pinned by two new perf guards (256KB '<' spam, 1000x orphan opens). Tests: 16 -> 28 (6 new functional + 4 well-formed-vs-orphan + 2 perf guards). * Tighten comments in XML-strip regex and tests Code says what it does; comments were repeating it. Strip the verbose explanations down to the WHY-only bits (engine quirk, tail-anchor rationale, real-world source of each test sample). No code changes. inference.py: 21 -> 12 lines around _TOOL_XML_RE test_tool_xml_strip.py: 343 -> 259 lines (-84) Tests: 28/28 still pass. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> * Address review: deny pass-through --parallel, preserve legacy short aliases, fix test harness Round 1 review fixes for #5737: 1. Deny --parallel / --n-parallel / -np in the pass-through validator. Without this, `unsloth studio run --model X --parallel 8 -- --parallel 999` would last-win-override the running llama-server slot count while Studio's app.state.llama_parallel_slots and KV-cache fitting stay at the typer value (8), so the resource plan and the running process disagree. Also bypasses the typer 1..64 range guard. Reject so the only path is the first-class typer flag. 2. Backwards-compat shim for -m / -hfr / -f. Dropping the short aliases from typer broke any script using `unsloth studio run -m X` or `-hfr Y` or `-f dist`. Add _consume_legacy_short_aliases which pops EXACT whole-token matches (or `-x=value` inline form) from ctx.args into the corresponding typer parameter. Clustered tokens (`-fa`, `-mg`, `-fitt`, ...) are left in the pass-through tail unchanged. --model becomes Optional with an explicit missing-required check after the preprocessor so legacy `-m X` still satisfies the "must specify a model" requirement. 3. Drop mix_stderr from CliRunner. Typer 0.25.1 / Click 8.4.1 removed the kwarg; the test harness raised TypeError before exercising the PR behaviour. Tests run cleanly on current and older Typer/Click. 4. Correct the -np regression test docstring. Pre-PR `-np 8` was clustered by Click as `-p 8` (port=8) + stray `-n`, silently breaking the port binding -- not "passed through as 8 slots". The post-PR assertion (child gets --parallel 8) is unchanged. 5. Update studio run docstring listing rejected flags so it now correctly includes --parallel / -np / --n-parallel. New tests: - test_llama_server_args.py: parametrized denylist coverage for --parallel / --n-parallel / -np including equals-form, including out-of-range bypass attempts (999, 0). is_managed_flag flips True. - test_studio_run_short_alias_clashes.py: legacy -m / -hfr / -f promote to typer params; --model X + -m Y conflict errors; clustered -mg / -fa / -fitt still pass through (the original bug fix holds). 132 tests pass (98 backend + 34 cli). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Extend legacy-alias shim tests for repo:variant, inline value form, and missing model Three additional edge cases for the -m / -hfr / -f preprocessor: - `-m unsloth/foo:UD-Q4_K_XL` round-trips through both the preprocessor and _split_repo_variant so the child sees --model + --gguf-variant. - `-m=foo` inline value form is promoted just like `-m foo`. - Missing --model after the preprocessor raises typer.Exit(2) cleanly (replacing typer's pre-PR required-flag enforcement now that --model is Optional to allow the legacy promotion path). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Scrub .github/workflows for staging push (matches staging base) * Fix studio CLI argv handling and pass-through docstring drift - studio/backend/core/inference/llama_server_args.py: drop the stale ``-np``/``--parallel`` entry from the docstring's pass-through tunable list. These flags moved into _DENYLIST_GROUPS so the docstring now contradicts the validator and would mislead future maintainers debugging the ValueError from validate_extra_args(["--parallel","8"]). The deleted wording was introduced by dbea77e34 ("Studio: forward llama-server args from `unsloth studio run`, activate `unsloth run`, and allow passing model:quant to load models") when --parallel was still a documented pass-through; the same commit's "quant" reference is about the model:quant syntax, unrelated to the parallel slot wording being deleted here. - unsloth_cli/commands/studio.py: add _expand_attached_np_short next to _consume_legacy_short_aliases. Both work around Click's short-option clustering for this command -- the legacy preprocessor for `-m` / `-f` / `-hfr` and this one for the attached `-np<N>` form. Click clusters `-np8` as `-n -p 8` because `-p` is the typer short for `--port`, silently setting port=8 and dropping the parallel value; rewriting the attached form into separated `-np <N>` in sys.argv before Click parses preserves the user's value. Space/equals forms (`-np 8`, `-np=8`) already work and are left alone. - unsloth_cli/__init__.py: import _expand_attached_np_short from the studio command and run it only when argv[0] looks like the unsloth console-script or workspace cli.py, so importing this module from a notebook or pytest run does not mutate the caller's argv. * Tighten the -np canonicaliser comments Drop the helper's co-location sentence (location is self-evident from grep) and shorten the entry-gate rationale to one short sentence covering the why. * Sync .github/workflows with upstream author branch * Sync .github/workflows with upstream author branch * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Bump install.sh / install.ps1 pin to unsloth>=2026.5.7 (#5753) PyPI release unsloth 2026.5.7 is now live. Bumps the pinned floor in install.sh and install.ps1 from unsloth>=2026.5.6 to unsloth>=2026.5.7 so fresh installs resolve to the new wheel. Tagged on main as v0.1.416-beta. * Catch attached `-np<N>` form in backend pass-through validator The CLI-side `_expand_attached_np_short` rewrites `-np8` to `-np 8` before Click parses, but HTTP /load `llama_extra_args=["-np8"]` goes straight to `validate_extra_args` which only matched the exact token. Reproducer: `validate_extra_args(["-np8"])` previously returned `["-np8"]` instead of raising; once forwarded to llama-server it last-win-overrode Studio's slot count while `app.state.llama_parallel_slots` stayed at the typer value. Normalise `-np<digits>` to `-np` in `_flag_name` so the denylist catches the attached form alongside `-np`, `-np=8`, `--parallel`, `--parallel=8`, and `--n-parallel`. Tests parametrize the new form including out-of-range values. * Restore _consume_legacy_short_aliases unit tests + _expand_attached_np_short tests * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Restore .github/workflows from origin/main Earlier merge from claude_review's staging-scrub commits accidentally deleted production CI workflows. Restore them to main's state. * Scrub .github/workflows for staging push (matches staging base) * Sync .github/workflows with upstream author branch * Round 5+6: broaden -np gate to exact basenames + runtime parallel test Reviewer-flagged improvements squashed into one commit so the auto-push review bot doesn't keep stomping the branch: - unsloth_cli/__init__.py: exact-basename match instead of endswith('cli.py'). Covers unsloth, unsloth.exe, unsloth-cli, unsloth-cli.exe, cli.py, unsloth-cli.py. A third-party mycli.py that happens to import unsloth_cli no longer has its argv mutated. - unsloth_cli/tests/test_studio_run_parallel_flag.py: parametrised runtime test (N in {1, 4, 8, 64}) that fakes the in-venv path and asserts run_server is invoked with llama_parallel_slots=N. Complements the existing source-text check so refactors that preserve runtime semantics don't trip a false failure. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Round 7: respect '--' end-of-options and reject flag-as-value Round 7 reviewer flagged three legitimate edge cases: - _expand_attached_np_short rewrote post-'--' tokens. Convention: '--' ends option processing; payload after it is raw. Stop the loop there. - _consume_legacy_short_aliases promoted post-'--' legacy aliases for the same reason. Treat post-'--' tail as raw. - Legacy '-m -fa' silently consumed '-fa' as the model name, hiding the real CLI shape error. Reject any next-token that starts with '-' (except the lone '-' stdin/path sentinel) with a clear BadParameter. Also expanded the missing-model error string to mention the still- supported legacy '-m' / '-hfr' aliases so users hitting that diagnostic on legacy scripts get the right migration hint. Added four regression tests covering each new behaviour. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Round 8: soften flag-as-value to long-form only + normalise is_managed_flag Round 8 reviewer flagged two cleanups: - _consume_legacy_short_aliases rejected any next token starting with '-' as a flag, which would break legitimate values like '-foo' (path or model name with leading dash). Narrow the rejection to '--long' tokens only; '-x' short forms still pass through. - is_managed_flag did raw _DENYLIST membership while validate_extra_args goes through _flag_name first, so '-np8' / '--parallel=8' / '--port=9000' classified as not-managed by the helper but rejected by the validator. Route is_managed_flag through _flag_name so the two helpers agree on every form callers might use. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Round 9: also catch -np-1 / -np+1 signed attached forms in denylist Round 9 reviewer noticed _flag_name normalised -np<digits> but missed signed variants -np-1 and -np+1, so validate_extra_args waved them through while rejecting --parallel -1. llama.cpp would error out on negative slot counts anyway, but the validator should classify every form of the managed flag identically so the boundary is consistent. * Round 10: signed -np in CLI canonicaliser + reject empty inline aliases Round 10 reviewer flagged two real issues: - _expand_attached_np_short rewrote only -np<digits>; signed forms -np-1 / -np+1 fell through. Backend _flag_name already classifies them as managed, so the CLI rewriter must too -- otherwise Click clusters -np-1 into -n -p -1 (port=-1) and never reaches the backend validator at all. - -m= / -hfr= / -f= empty inline forms were accepted and produced --model '' / --frontend '' (then Path('') silently became '.') on re-exec. Reject empty inline values at the preprocessor with a clear BadParameter so the malformed input fails fast. Both behaviours pinned with parametrised regression tests. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Expose --parallel on plain `unsloth studio` for API-path parity The PR added --parallel to `unsloth studio run` but the plain `unsloth studio` callback (used for API-only / bare-server launches) still hardcoded llama_parallel_slots to its run_server default. With --parallel now denied as a llama_extra_args pass-through, that flow had no first-class way to raise concurrency. - unsloth_cli/commands/studio.py: add --parallel / --n-parallel typer Option (default 4, range 1..64) to studio_default, forward through the venv re-exec, and pass llama_parallel_slots= to run_server in the in-venv path. - studio/backend/run.py: argparse --parallel / --n-parallel with the same range guard so the spawned child accepts the forwarded flag. - unsloth_cli/tests/test_studio_run_parallel_flag.py: test pins the new option presence, aliases, default and range guards. * Round 12: narrow entry-point gate, preserve pre-PR plain-studio default, drop brittle source-text test Three Opus subagent reviewers (security / backcompat / code-quality) flagged the same handful of real issues. Consensus fixes: - unsloth_cli/__init__.py: narrow the -np canonicaliser gate to just {unsloth, unsloth.exe} (the only pyproject-declared console_script). The previous cli.py / unsloth-cli.py entries would silently rewrite sys.argv for any third-party myproj/cli.py that happens to import unsloth_cli. Dev users running python cli.py ... -np N still work via the space form, which parses without the rewrite. - unsloth_cli/commands/studio.py + studio/backend/run.py: restore the pre-PR llama_parallel_slots default of 1 on plain unsloth studio and python studio/backend/run.py. unsloth studio run keeps its hardcoded-pre-PR default of 4. Without this, my earlier API-path parity commit silently dropped per-call context to ctx/4 for the plain-studio flow. - unsloth_cli/tests/test_studio_run_parallel_flag.py: drop the brittle source-text grep test (test_run_kwargs_use_parallel_value). The parametrised runtime test test_in_venv_path_passes_parallel_to_run_server already pins the same intent against actual behaviour. - unsloth_cli/tests/test_studio_run_short_alias_clashes.py: pin the narrow entry-point gate with a parametrised negative test covering seven third-party argv[0] basenames (cli.py, /path/myproj/cli.py, pytest, unsloth-cli, etc.). Re-broadening the gate now trips a test instead of silently mutating an unrelated CLI's argv. * Round 13: shared parallel constants, denylist invariant test, defence-in-depth Three Opus subagent reviewers (adversarial-user / maintenance / cross-file consistency) flagged a consistent set of cleanups; folded into one commit to avoid the pre-commit.ci force-push race. unsloth_cli/commands/studio.py: - Extract _PARALLEL_MIN / _PARALLEL_MAX / _PARALLEL_DEFAULT_RUN / _PARALLEL_DEFAULT_PLAIN module-level constants and use them in both typer Options (plain studio_default = 1, studio run = 4). - _expand_attached_np_short now rewrites -np<junk> when the suffix starts with a digit (or signed digit) so '-np8x' surfaces as a clean '-np takes an int' typer error instead of a baffling '--port invalid' complaint after Click clusters '-n -p 8x'. - Re-exec forwarding emits --load-in-4bit / --no-load-in-4bit explicitly in both directions; previously the True default relied on both layers sharing the same default forever. - run() docstring now explicitly says --parallel / -np pass-through via llama_extra_args is denied (use the typer flag above). studio/backend/run.py: - Mirror the parallel constants and route the argparse default, range check, and error message through them. Help text mentions the asymmetry with 'unsloth studio run' so direct-launch dev users aren't confused by Default 1 in isolation. studio/backend/core/inference/llama_server_args.py: - _flag_name strips surrounding whitespace before denylist lookup so a caller can't slip a managed flag past the boundary with a trailing space (the trimmed form is what downstream parsers see). Tests: - New typer-aliases-subset-of-denylist invariant: every alias the typer Option claims as --parallel on run() MUST be in the backend parallel denylist group. Catches the failure mode where someone adds a new alias and forgets the boundary. - Extended denylist parametrize to cover ~14 previously untested aliases (-mu, -dr, -hfv/-hfrv/-hffv family, -mmu, full --ui group, --models-preset / --models-autoload / --no-models-autoload). - Whitespace-padded denylist rejection (' --parallel', '-np ', etc). - --load-in-4bit re-exec test pinning both polarities + default. - -np<junk> argv rewriter regression tests. - Cross-reference headers between the two test files. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: repair mlx studio base export save_method (#5727) * Round 14: align backend -np recogniser with CLI rewriter + reject parent --parallel Round 14 (reviewer.py --parallel 20 with gpt-5.3-codex-spark) flagged two real P1s and a stale-rebase warning. All three addressed. - studio/backend/core/inference/llama_server_args.py: widen _flag_name so -np<digit-prefix> with trailing junk (-np8x, -np-1foo, -np+1bar, -np9zzz) classifies as managed flag -np, matching the CLI _expand_attached_np_short rewriter. Without this, POST /api/inference/load with llama_extra_args=['-np8x'] slipped past the boundary while the CLI canonicalised the same form. The two sides now agree on every digit-prefix form. - unsloth_cli/commands/studio.py: reject --parallel on the studio group when a subcommand is invoked. Pre-PR the studio callback had no --parallel; my Round 12 addition made 'unsloth studio --parallel 8 run ...' silently drop the 8 because typer doesn't propagate parent options into subcommand kwargs. Now errors with exit 2 and a message pointing the operator at the correct invocation ('unsloth studio run --parallel 8 ...'). - Picked up origin/main via merge (parent commit 0caf0526): the pre-flight stale-rebase detector found 2 lines on main in studio/backend/core/export/export.py missing from PR HEAD. Merged cleanly with no conflicts. Tests: - Parametrised denylist coverage for -np<digit-prefix>+junk forms. - New runtime test confirms exit 2 + helpful error when the group --parallel is supplied alongside an invoked subcommand. - Test that the default group --parallel value still lets a subcommand resolve (no false-positive rejection). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: tighten code comments across --parallel PR Comment-only pass over the seven PR-touched files; trim verbose docstrings, collapse multi-line section dividers, and drop redundant prose that the code already conveys. No behaviour change. * Studio: trim remaining verbose docstrings missed in last pass Shorten the test_studio_run_parallel_flag.py module docstring and the `Re-exec arg-builder coverage` block. No behaviour change. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: second comment-tightening pass across PR-touched code Trim docstrings and inline comments in studio.py, run.py, llama_server_args.py, and unsloth_cli/__init__.py. No behaviour change; all 215 tests still pass. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: deny --embedding / --rerank / --tools pass-through `--embedding` and `--rerank` flip llama-server into single-endpoint mode, which breaks Studio's /v1/chat/completions hop. llama-server's own `--tools` flag silently stacks on top of Studio's tool policy resolved by `--enable-tools` / `--disable-tools`. Add all three (plus the `--embeddings` / `--reranking` plural aliases) to the boundary denylist so HTTP /load and pass-through extras both reject them cleanly instead of silently desyncing the server surface. Test added to the existing `test_denylist_rejects_all_aliases` parametrize. 220 tests pass. * Studio: make PR-touched tests robust to minimal envs + Windows Two cross-OS CI findings: 1. `test_typer_parallel_aliases_are_subset_of_backend_denylist` was doing `from core.inference.llama_server_args import _DENYLIST_GROUPS` which triggers `core/inference/__init__.py` and pulls in the full backend chain (fastapi / structlog / loggers / utils.hardware). The invariant only needs the constants tuple, so load the module directly via `importlib.util.spec_from_file_location` -- the test now runs with just typer + pytest installed. 2. `test_legacy_frontend_alias_still_promotes_to_frontend` asserted the literal string `"/tmp/dist"` after the value round-trips through `Path()`. On Windows `str(Path("/tmp/dist"))` is `"\tmp\dist"`, so the assertion tripped on the same logical path. Compare via `Path(x) == Path("/tmp/dist")` so the test passes on every OS. Both surfaced by the staging-4 cross-OS CI; no production-code change. 220 tests still pass locally. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: load llama_server_args.py directly in its unit tests Same fix as the previous CLI-test commit: import the module via `importlib.util.spec_from_file_location` instead of `from core.inference.llama_server_args import ...`, so the test no longer needs the full backend chain (fastapi / structlog / loggers / utils.hardware) installed via `core/inference/__init__.py`. The boundary validator is intentionally dependency-free; its unit tests should reflect that. * Fix test_main_composer_has_dir_auto anchor after PR #5784 PR #5784 ("Improve image generation UI") rewrote the message-input textarea's static `aria-label="Message input"` into a JSX conditional `aria-label={overlay ? "Image edit instructions" : "Message input"}` but did not update the RTL bidi-attribute regression test, leaving the literal-string `find('aria-label="Message input"')` anchor with no match. The `Repo tests (CPU)` job has been red on main since. Anchor on the inner `"Message input"` string literal instead -- it survives both spellings and still pins the same textarea element so the `dir="auto"` assertion has the right block to inspect. Verified by re-running the exact CI command: 954 passed, 3 skipped, 23 deselected (was 948 passed, 1 failed). --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Long Yixing <longyixing331@gmail.com>	2026-05-26 23:13:45 -07:00
Daniel Han	c49cc6daf5	Studio: auto-recover when shadowed 'unsloth' on PATH hides the frontend dist (#5782) ... * Studio: auto-recover when shadowed 'unsloth' on PATH hides the frontend dist The CLI launcher derives `_PACKAGE_ROOT` from where `unsloth_cli` imports from, and `studio/backend/run.py` derives its default `frontend_path` from `Path(__file__).resolve().parent.parent / "frontend" / "dist"`. When another `unsloth` (a separate venv with `pip install unsloth`, a system install, an older venv earlier on PATH) wins `which unsloth`, both resolve into a site-packages tree that ships frontend source files but no vite-built `dist/`. The backend warned `[WARNING] Frontend not found at ...` and then happily served 200 on every `/api/*` route while returning `{"detail":"Not Found"}` on `/`. The 404 was silent to users -- the process was healthy, the log line scrolled by, and the only symptom was a blank browser tab. This is a real situation: many devboxes carry a workspace venv with `unsloth` installed years before the user runs `curl|sh` to install Studio. The installer-managed binary at `~/.local/bin/unsloth` exists but loses to the older venv on PATH order. Three layers of fix, additive: Layer C -- runtime auto-discovery (unsloth_cli + run.py) The CLI now resolves `--frontend` explicitly before spawning `run.py`, probing in order: package-local default, installer venv site-packages (`$STUDIO_HOME/unsloth_studio/lib/python*/site-packages/...` and the Windows `Lib/site-packages/...` equivalent), and editable-install source roots read from `__editable___*_finder.py` MAPPING dicts in the installer venv. `run.py` does the same probe as a backstop for direct `python run.py` invocations. Layer E -- loud structured error The silent `[WARNING]` is replaced with a `SystemExit` that names every candidate path tried and lists the four one-line fixes (run the absolute path, pass `--frontend`, pass `--api-only`, reinstall). Suppressed only in `--api-only` mode where no UI is served by design. Layer F -- installer self-check (install.sh + install.ps1) At the tail of install, both installers compare `command -v unsloth` (POSIX) / `Get-Command unsloth` (PowerShell) against the just-installed binary. If a different path wins, a yellow `warning` block names the shadowing binary and prints the alias / absolute-path / PATH-reorder fixes. install.sh uses the venv Python for path canonicalization so it also works on macOS (BSD `readlink` has no `-f`). Cross-platform notes: - Glob patterns probe both `lib/python*/site-packages` (POSIX) and `Lib/site-packages` (Windows). - Canonical-binary path branches on `sys.platform == "win32"` to pick `unsloth.exe` over `unsloth`. - install.sh fixed for macOS; install.ps1 is the Windows analog. Tests: `studio/backend/tests/test_frontend_resolution.py` covers five cases via AST-load of the helpers (no uvicorn / FastAPI import needed, matching `test_host_defaults.py`'s style): 1. Resolver returns None when nothing exists anywhere. 2. Resolver picks the first existing candidate when the default works. 3. Fallback to `$UNSLOTH_STUDIO_HOME` site-packages dist when the default is missing. 4. Fallback to an editable-install source root via MAPPING parsing. 5. Resolver tolerates a non-existent `$UNSLOTH_STUDIO_HOME`. All 5 new + 2 existing host-default tests pass. * Studio: address review feedback on PR 5782 (Windows hardlink, Win path hint, broader tests) Four parallel platform reviews (Windows, Linux, macOS, general) on the initial commit surfaced a small batch of correctness items, all addressed here: Windows install.ps1 (medium severity, false positive on every install): The user-facing shim at $StudioHome\bin\unsloth.exe is a hardlink to $VenvDir\Scripts\unsloth.exe (created at line 1582). Resolve-Path does not de-duplicate hardlinks, so the previous string compare always saw the two paths as different and the new "another 'unsloth' wins on PATH" warning would fire on every fresh Windows install. Switched to content-hash equality via Get-FileHash, which collapses hardlinks, symlinks, and identical copies to a single identity. Also restricted the probe to Get-Command -CommandType Application so PowerShell aliases / functions / scripts named "unsloth" don't false-trigger. Windows run.py SystemExit hint (medium severity, defeats the recovery UX): The structured error printed Path(STUDIO_HOME)/"unsloth_studio"/"bin"/ "unsloth.exe" on every platform, but on Windows the installer places the shim at $STUDIO_HOME/bin/unsloth.exe (no unsloth_studio segment) and the venv binary at $STUDIO_HOME/unsloth_studio/Scripts/unsloth.exe. The hint pointed at a non-existent path on Windows. Branch on sys.platform == "win32" to emit the real shim location; Linux / macOS keep the unsloth_ studio/bin/unsloth layout. MAPPING regex robustness (low): [^\n]* silently failed if a future setuptools / black reformat wrapped the MAPPING dict across multiple lines. Tightened to [^}]* + re.DOTALL, which still rejects nested dicts (setuptools never emits those for editable installs) but tolerates either single- or multi-line literals. install.sh broken-venv edge case (low, macOS reviewer): Previously _canon fell back to echoing the raw input when the venv python failed, which would make two symlinked-but-identical paths look different and false-trigger the warning. Now _canon returns empty on failure and the caller skips the whole comparison if either side is unresolvable. argparse default + log readability (nits): run.py's argparse --frontend default now reuses the module-level _DEFAULT_FRONTEND_PATH constant so it stays in lockstep with run_server's default. The [OK] log message resolves the chosen path so support output is always absolute. Tests grow from 5 to 8 in studio/backend/tests/test_frontend_resolution. py (10/10 with the existing host-default tests): - Windows-layout fallback: Lib/site-packages with capital L. - Multi-line MAPPING dict: locks in the [^}]* + re.DOTALL behaviour. - SystemExit message contract: every actionable fix string and the attempted-paths list must appear; pins the user-facing recovery message so a future refactor doesn't drop a bullet. End-to-end re-verified on this box: shadowing workspace_22/bin/unsloth still serves 200 on / through the editable-finder fallback, with the follow-up resolve-then-log change yielding [OK] Frontend loaded from /mnt/disks/unslothai/ubuntu/unsloth/studio/frontend/dist. Out of scope (called out by reviewers but deferred): - _resolve_frontend_path candidate ordering still tries _PACKAGE_ROOT first. For the rare case where a shadowing install carries an older built dist, this serves the stale UI instead of the fresh one. Fix is non-trivial (the --local workflow intentionally wants _PACKAGE_ROOT to win when the cloned repo is the source of truth), so leaving it for a follow-up. - studio/backend/colab.py still bails out on missing frontend instead of routing through the new resolver. Pre-existing behaviour, separate PR. - _resolve_frontend_path is duplicated across run.py and unsloth_cli/ commands/studio.py. Minor maintenance concern; consolidation is natural in a later refactor. * Studio: guard ast.literal_eval result with isinstance(dict) Addresses gemini-code-assist[bot] high-priority inline review on PR 5782 flagging that `mapping.get('studio')` could raise AttributeError if the MAPPING regex matched a brace-delimited literal that ast.literal_eval parsed as a non-dict (set, list, None). The regex `\{[^}]*\}` happily matches `{1, 2, 3}` and literal_eval returns a set; the previous code then crashed on .get(). Setuptools's editable-install template only emits dict literals so this is defensive rather than a live bug, but the guard is one line per call site and prevents a future template change from taking out backend startup or CLI invocation. Both call sites (studio/backend/run.py:558 and unsloth_cli/commands/studio.py:234) now bail out on the finder file when isinstance(mapping, dict) is False; the resolver keeps probing the remaining finders, so a malformed entry in one finder cannot poison the discovery of a good one elsewhere. Adds test_resolver_does_not_crash_on_non_dict_mapping_literal to test_frontend_resolution.py, which writes one bad finder (MAPPING is a set literal) alongside one good finder (MAPPING is a real dict) and asserts the resolver returns the good finder's dist path. Without the guard this test crashes with AttributeError; with the guard it passes. 11/11 tests green.	2026-05-26 05:29:42 -07:00
Daniel Han	b59e02e977	Studio: stop hint, Uvicorn log rename, reachability check + Mac UI CI retry hardening (#5503) ... * Studio: clearer stop hint, Uvicorn log rename, external reachability check Three startup-banner UX improvements to make it obvious how to stop Studio, what the externally reachable URL really is, and whether that URL actually works from outside. 1. Stop hint at the end of the banner * Bright orange "To stop Unsloth Studio: press Ctrl+C in this terminal." line, with a dim "(On macOS this is Control+C, not Command+C.)" follow-up so the macOS Cmd-vs-Ctrl confusion is headed off. * When bound to 127.0.0.1, an extra "To deploy and access globally" block tells the user the exact relaunch command (unsloth studio -H 0.0.0.0 -p PORT) with a trusted-networks caveat. 2. Uvicorn startup log rewrite * Installs a stdlib logging.Filter on the uvicorn / uvicorn.error loggers that: - renames the prefix to "Unsloth Studio running on" - swaps the wildcard bind for the resolved external host so the line agrees with the banner - replaces "(Press CTRL+C to quit)" with the same Mac-aware stop hint * Rewrites both record.msg and record.color_message so it works under plain and colorized log formatters. 3. External reachability self-test on wildcard binds * Synchronous probe via check-host.net's TCP JSON API confirms whether the advertised public URL actually accepts connections from the internet. * On failure prints the resolved IP, the failing-node count, the usual causes (AWS SG, GCP firewall rule, Azure NSG, home router), and an SSH local-forward workaround. * Verifies 127.0.0.1 / ::1 first and only offers a local fallback URL when loopback actually responds, so we never claim a port works when it does not. * Private / loopback / link-local display hosts short-circuit with a one-line LAN note instead of a probe. * Bounded at roughly 15 seconds, early-exits on two decisive node results, all failures swallowed. Banner is split into print_studio_access_banner(include_stop_hint=...) plus a new print_studio_stop_hint() so the reachability output can be sandwiched between the URL section and the stop hint, keeping the stop hint as the last text on screen. Pure stdlib (socket, urllib, ipaddress, logging, threading), no new dependencies, identical behavior on Linux, macOS, and Windows. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * CI: harden Mac Studio UI tests against Chromium ERR_NO_BUFFER_SPACE The Mac Studio UI workflow already retries the Playwright scripts on the racy 'Unexpected end of JSON input' pipeTransport crash, but falls through on ERR_NO_BUFFER_SPACE -- a separate Chromium failure that fires when the macos-14 free-runner kernel briefly runs out of socket buffers. Same fix shape, two layers: * In-script: when a change-password page.goto() attempt fails with ERR_NO_BUFFER_SPACE, sleep 5s then 15s before the next attempt so the OS has time to recover socket buffers. Other failures retry immediately as before. * Workflow: extend both Playwright retry blocks (chat-ui and extra-ui) to also trigger the full Studio kill + reset + reboot retry on ERR_NO_BUFFER_SPACE, not just on the pipeTransport JSON crash. Real assertion / timeout failures still bypass retry and surface immediately. Linux and Windows workflows are unchanged; the flake is macOS-runner-specific. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-05-17 07:44:06 -07:00
Daniel Han	0881a7a5d7	studio: security and hardening pass (auth rate-limit, sandbox, path containment, schema validation, headers) (#5375) ... * studio: contain export and dataset paths under their configured roots resolve_under_root and resolve_dataset_path previously returned absolute paths unchanged, so an authenticated client could supply save_directory="/tmp/escape" (or any other absolute path) and have the exporter drop adapter files anywhere the server user could write. This turned up during a recent audit pass where an authenticated POST to /api/export/export/lora with save_directory="/tmp/lora_escape_test" returned 200 and wrote adapter_model.safetensors, adapter_config.json, and tokenizer files under /tmp. The fix is two-layered: storage_roots.py adds an _assert_contained(resolved, root) helper that runs after path resolution and rejects any result whose realpath does not sit under realpath(root). resolve_under_root now rejects '..' segments and null bytes outright, and only accepts absolute inputs when they are already inside the configured root (internal call sites that re-resolve a stored absolute path stay idempotent; worker.py:resolve_output_dir(output_dir) etc. continue to work). resolve_dataset_path picks up the same containment rule, scoped to the three dataset roots. models/export.py adds field_validator("save_directory", mode="before") to ExportCommonOptions and ExportGGUFRequest so bad input fails fast at 422 with a clear message rather than a 500 deep inside the resolver. The validator rejects empty/whitespace, null bytes, control chars, strings longer than 255 chars, absolute paths, and '..' segments. routes/export.py:_export_details now returns os.path.relpath(output_path, exports_root()) so the Export Complete dialog and /api/models/loras no longer leak the absolute install prefix to the UI; the basename is used as a last-resort fallback. Verified end to end: - POST /api/export/export/lora {"save_directory":"/tmp/foo"} -> 422 "save_directory must be a name or relative path under the export root; absolute paths are rejected". /tmp/foo is not created. - "../../etc/escape" -> 422 "may not contain '..' segments". - save_directory="my_subdir" -> still accepted (400 only because the test had no checkpoint loaded yet, not because of validation). - Internal idempotent re-resolve via resolve_export_dir(absolute path that is already under exports_root) returns the same path unchanged. * studio/sandbox: harden bash + python tool execution The sandboxed Bash and Python tool channels in Chat ran with a thin preexec hook (PR_SET_NO_NEW_PRIVS + RLIMIT_FSIZE only). Bash had a small word blocklist; Python had an AST safety pass aimed at signal-tampering and shell-escape primitives. An audit pass showed several gaps that a tool-calling model could trigger inadvertently: - bash curl/wget/nc reached AWS IMDSv2 and returned live STS credentials for the instance role. - python "import socket; s.connect((169.254.169.254, 80))" reached the same endpoint regardless of the bash blocklist. - "cat /etc/passwd" was blocked at the bash side (because "passwd" is in the blocklist), but "open('/etc/passwd').read()" in Python happily returned its contents. - "chr(115)+chr(117)+chr(100)+chr(111)" style dynamic-arg construction slipped through the AST shell-escape check. - The supervisor used proc.kill() on timeout, which only signals the immediate pid; bash-backgrounded children survived. A fork bomb could spawn for the full 300s timeout window. - Session work directories under ~/studio_sandbox/<id>/ were created with default umask (0o755), so any other UID on the host could enumerate them. - session_id sanitisation used a one-shot str.replace("..",""), which is non-iterative and a small footgun. This commit takes a conservative middle path: the sandbox still runs as the Studio UID with no namespace tricks where the kernel disallows them, but every chokepoint is tightened. _sandbox_preexec now: - calls os.setsid() so children share a process group; the supervisor uses os.killpg(SIGKILL) on timeout/cancel so backgrounded children die with the parent (new _kill_process_tree helper, wired into _cancel_watcher and both _bash_exec / _python_exec timeout branches). - calls os.umask(0o077) so files the child writes default to 0o600. - applies PR_SET_PDEATHSIG=SIGKILL so an orphaned child dies if Studio exits. - best-effort unshare(CLONE_NEWNET) for a private network namespace (failure is logged and swallowed; defense-in-depth is still in place via the bash blocklist and the AST checker below). - sets RLIMIT_NPROC=10000 (tunable via UNSLOTH_STUDIO_SANDBOX_NPROC), RLIMIT_AS=8GB, RLIMIT_CPU=300, RLIMIT_NOFILE=1024. The 10k NPROC figure is chosen to sit well above the ~500 LWPs a healthy Studio + llama-server combination already uses while still capping a runaway fork bomb. NPROC counts LWPs per real UID, so a lower figure (e.g. 256) starves legitimate bash forks ("bash: fork: retry: Resource temporarily unavailable"). _get_workdir: - rejects session_id that doesn't match [A-Za-z0-9_-]{1,64}; non-matching values bucket into a shared "_invalid" dir. - chmod 0o700 on both the workdir and on ~/studio_sandbox/ so other UIDs cannot read another session's contents. _BLOCKED_COMMANDS_COMMON gains: doas, pkexec, halt, poweroff, curl, wget, nc, ncat, netcat, socat, ssh, scp, sftp, rsync, eval, source. The intent is to keep general bash usage working (echo, ls, pipes, loops, for, head, etc.) while denying the obvious egress and escalation paths. The AST checker (_check_signal_escape_patterns) is split into the existing shell/signal/loop checks plus a new narrow IO denylist: - Always flag non-literal args to anything in _SHELL_EXEC_FUNCS, not just _STRING_SHELL_FUNCS. Closes the dynamic-arg bypass. - Reject calls to socket.create_connection, socket.socket().connect, urllib.request.urlopen, http.client.HTTP*Connection, requests.*, httpx.* whose literal host argument is in a cloud-metadata denylist (169.254.169.254 + 169.254.* + 100.64.*, plus the GCP/Alibaba/ECS metadata hostnames and IPv6 link-local). Public hosts (example.com, huggingface.co, ...) still work. Dynamic hosts cannot be statically blocked; mitigated by the bash blocklist + the netns where the kernel allows it. - Reject literal open("/etc/passwd"), /etc/shadow, /etc/sudoers, /etc/ssh/*, and /proc/<pid>/environ. Other files (/etc/os-release, /etc/hostname, /tmp/*, user dirs) still work. The _check_code_safety summariser is updated to include the new network_calls and sensitive_file_reads buckets in its error string. Regression-checked: echo, sleep, ls /tmp, for loops, piped helpers (echo a | tr a A), urllib.request.urlopen("http://example.com"), socket.getaddrinfo("example.com",80), open("/etc/os-release"), open("/tmp/...","w") all still succeed. curl, wget, nc, ssh, rm, socket.create_connection(("169.254.169.254",80)), open("/etc/passwd"), open("/proc/self/environ") all correctly blocked. * studio: rate-limit login, rotate refresh tokens, add logout, security headers, gate bootstrap injection A pass over the auth surface found a cluster of related issues that this commit closes together. Login (routes/auth.py): - Add an in-memory per-IP login rate limiter. Five failed POSTs to /api/auth/login inside a 60s window produce 429 with Retry-After. A successful login clears the bucket. Previously 30 wrong passwords in under one second was accepted as 30x 401, which combined with the (now fixed) admin-username leak from /api/auth/status made brute-force trivial against a small password. Logout (routes/auth.py): - New POST /api/auth/logout returns 204 and calls storage.revoke_user_refresh_tokens(subject) so the refresh token is no longer valid. Previously POST /api/auth/logout returned 405 and there was no way to invalidate refresh tokens short of changing the password. Frontend session.ts already calls clearAuthTokens() to drop localStorage; the new endpoint lets the client also tell the server to revoke server-side state. Refresh-token rotation (routes/auth.py + auth/storage.py): - New storage.consume_refresh_token(token) atomically validates + deletes a refresh token, returning (username, is_desktop). The /api/auth/refresh handler now mints both a new access AND a new refresh token; the supplied token becomes invalid. Replaying a consumed refresh returns 401 "Invalid or expired refresh token". The previous refresh_access_token helper is left in place for callers that intentionally want the non-rotating shape; nothing in the route layer uses it now. /api/auth/status no longer leaks default_username (models/auth.py + routes/auth.py): - AuthStatusResponse.default_username becomes Optional[str] with a None default; the handler always returns None. The frontend already hardcodes HIDDEN_LOGIN_USERNAME = "unsloth" (auth-form.tsx:82), so no UI change is required. window.__UNSLOTH_BOOTSTRAP__ no longer auto-injects (main.py): - _inject_bootstrap is now opt-in via the UNSLOTH_STUDIO_INJECT_BOOTSTRAP env var. The previous default (inject whenever requires_password_change is true) embedded the plaintext bootstrap password into the first-boot HTML for any caller that hit /, /change-password, or any unknown SPA path. Browser extensions and any XSS payload on the page could read it trivially. With the new gate the bootstrap password lives only in the auth/.bootstrap_password file (mode 0o600) where it has always been; users typing it into a current-password field is the right UX. routes/auth.py:change_password also clears app.state.bootstrap_password defensively. Security headers + server fingerprint (main.py + run.py): - New SecurityHeadersMiddleware adds Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=(), and stamps server: unsloth-studio so the generic uvicorn banner no longer fingerprints the stack. The uvicorn.Config gains server_header=False so it stops emitting its own Server header. /api/health minimisation (main.py): - Unauthenticated GET /api/health returns just {"status":"healthy","timestamp":...} so load-balancer liveness probes keep working without leaking version, device_type, chat_only, desktop_protocol_version, or studio_root_id to arbitrary callers. A request that presents a valid Bearer token still gets the full diagnostic payload so internal launchers and sibling-Studio detection (which compares studio_root_id) keep working. Verification: - 30 wrong-password POSTs to /api/auth/login -> first 5 = 401, 6th through 30th = 429. - POST /api/auth/logout with a fresh token -> 204. The matching refresh token then fails 401. - Login -> R1; /api/auth/refresh with R1 -> new access + R2 (R2 != R1); /api/auth/refresh with R1 again -> 401; /api/auth/refresh with R2 -> still succeeds once and rotates again. - curl /api/auth/status -> default_username: null. - curl http://127.0.0.1/ does not contain __UNSLOTH_BOOTSTRAP__. - curl -I / shows CSP, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, Permissions-Policy, and server: unsloth-studio. - curl /api/health unauthenticated -> {status, timestamp} only. curl with Authorization: Bearer <valid> -> full payload. - Existing /api/system, /api/models/list, /api/train/status, /api/inference/status, /api/auth/api-keys, login flow, SPA root all still return 200 after the changes (regression smoke). * studio: add SecurityHeadersMiddleware, MaxBodyMiddleware, /recipes redirect, gate _inject_bootstrap, minimise /api/health This commit lands the main.py-side changes that share a single middleware-registration spot. They are kept together because every change here is either (a) a top-level middleware definition that has to be added next to LoggingMiddleware, or (b) a route handler at the same file-level. SecurityHeadersMiddleware (Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, Permissions-Policy, server: unsloth-studio). The previous responses emitted no CSP, no XFO, no Referrer-Policy and were stamped server: uvicorn. MaxBodyMiddleware rejects POST/PUT/PATCH on the inference / dataset / data-recipe / train / export prefixes when Content-Length exceeds UNSLOTH_STUDIO_MAX_BODY_MB (default 100). The audit hit this by attaching a 50 MB plain-text file to a chat message and watching Studio base64-encode it into the JSON body; uvicorn has no enforced cap so the only previous guard was the per-file 50 MB ceiling that data-recipe upload routes already enforce. The new middleware extends that ceiling to the OpenAI-compat path that the Chat attachments flow through. Verified: a 200 MB JSON POST to /v1/chat/completions returns HTTP 413 "Request body too large (209,715,264 bytes; max 104,857,600)". A small valid request continues to reach the handler. _inject_bootstrap is gated behind UNSLOTH_STUDIO_INJECT_BOOTSTRAP. The previous default was to inline window.__UNSLOTH_BOOTSTRAP__ = {username, password} into the first-boot HTML whenever requires_password_change was true, which exposed the plaintext bootstrap password to any browser extension, page script, or LAN caller on -H 0.0.0.0. The bootstrap password remains in the on-disk .bootstrap_password file (mode 0o600) where it has always lived; users typing it into a current-password field is the right UX. /api/health unauthenticated returns {"status":"healthy","timestamp": ...} only; the previous payload (version, device_type, chat_only, desktop_protocol_version, supports_desktop_auth, studio_root_id, native_path_leases_supported) is preserved for callers that present a valid Bearer token, so internal launchers and sibling-Studio detection (which compares studio_root_id) keep working. /recipes -> /data-recipes 308 redirect. The Data Recipes page lives at /data-recipes; users typing /recipes hit the SPA catch-all and saw "Not Found". The redirect also preserves any tail path, so /recipes/<rest> -> /data-recipes/<rest>. Verified end to end with curl: CSP / XFO / X-Content-Type-Options / Referrer-Policy / Permissions-Policy all present on /, server header is now unsloth-studio (uvicorn's own banner is suppressed via server_header=False in run.py from the auth-batch commit). Followed the /recipes redirect lands on the SPA HTML. * studio: bound TrainingStartRequest hyperparameters at the schema level POST /api/train/start accepted any value for learning_rate, batch_size, max_steps, max_seq_length, warmup_steps, warmup_ratio, num_epochs, save_steps, weight_decay, gradient_accumulation_steps, lora_r, lora_alpha and lora_dropout, including -1, 0, 1e9, and non-numeric strings like 'abc' or 'two' (which silently coerce to 0 in the trainer). Probing showed the API returning 200 to learning_rate=-1 and batch_size=0; only max_steps had any partial clamping. This commit adds field_validator on every numeric hyperparameter. Bounds are chosen wide enough to span realistic single-host configurations (B200 with 180 GB of memory comfortably fits the upper end) while rejecting the values that always produce broken training: - learning_rate: parses str/float, requires 0 < lr < 1.0. Non-numeric input raises with "learning_rate must be parseable as float (got 'abc')" instead of silently coercing to 0. - batch_size: [1, 1024]. - gradient_accumulation_steps: [1, 4096]. - num_epochs: [1, 1000]. - max_steps: [1, 1_000_000]. - max_seq_length: [1, 131072]. - warmup_steps: [0, max_steps]. - warmup_ratio: [0.0, 1.0]. - save_steps: [0, 1_000_000]. - weight_decay: [0, 10] (typical 0..0.1). - lora_r: [1, 512]. - lora_alpha: [1, 1024]. - lora_dropout: [0.0, 1.0). Each validator names the offending field in its ValueError message so the 422 response body identifies which input is bad. The learning_rate validator returns its result as str (the schema field type is str("2e-4") for backwards compatibility) so existing call sites that float() the value continue to work. Verified: - learning_rate=-1 -> 422 "learning_rate must be > 0 (got -1.0); typical range is 1e-6 .. 1e-3". - learning_rate='abc' -> 422 "must be parseable as float". - batch_size=-1 / 0 / 999999 -> 422 "batch_size must be in [1, 1024]". - batch_size='two' -> 422 (pydantic int parser). - max_steps=0 / -5 -> 422 "must be a positive int". - max_seq_length=200000 -> 422 "must be in [1, 131072]". - warmup_ratio=2.5 -> 422 "must be in [0.0, 1.0]". - lora_dropout=1.5 -> 422 "must be in [0.0, 1.0)". - Valid request with learning_rate='2e-4', batch_size=1, max_steps=5 passes validation and the training run starts as normal. * studio: redact image-decode errors, clean checkpoint dirs on cancel, tolerate Stop-button + tool-result message shapes Three small fixes that fall under "do not let the audit findings become user-visible papercuts". routes/inference.py - image-decode error redaction (the audit hit this with a 0-byte / malformed / wrong-extension image upload). The three image-normalise sites previously raised HTTPException(400, detail=f"Failed to process image: {e}"). When PIL raised UnidentifiedImageError(io.BytesIO(raw)) the message string included "<_io.BytesIO object at 0x7e40a5d7bf60>", leaking both the Python class name (confirming the PIL/io stack) and a heap address (mildly useful for ASLR-bypass chaining if another memory-corruption bug is ever found). Each site now catches UnidentifiedImageError and returns the generic "Unsupported or corrupt image format"; the fall-through generic except returns "Failed to process image". No exception-repr is interpolated into a response body anywhere along these paths. core/training/training.py - checkpoint cleanup on cancel. When a user clicks Cancel Training, the trainer flips _cancel_requested=True and the supervisor force-terminates the subprocess. The trainer writes checkpoint-<step> directories under output_dir every save_steps; previously these survived the cancel and accumulated on disk (the audit recorded ~67 MB stuck after a 200-step cancel with save_steps=20). New helper _cleanup_cancelled_checkpoints(output_dir) globs checkpoint-<int> entries and removes them. It is gated by a realpath containment check against outputs_root() so it cannot accidentally rmtree anything outside the configured outputs root. force_terminate() invokes the helper after the subprocess join when _cancel_requested is true. Stop-and-Save runs are unaffected because that path keeps _cancel_requested=False. models/inference.py - chat message shape tolerance. Two related frontend interactions used to crash the request validator: - After the Stop button truncates a generation, the frontend retained {role:"assistant", content:""} in the conversation history and replayed it on the next send. ChatMessage previously required role="assistant" to have non-empty content or tool_calls, so the next message returned 422 and the thread was permanently broken. The validator now normalises empty assistant content to None so the request round-trips and the trailing empty turn can be ignored downstream. - The frontend's second-round tool POST drops the streamed tool_call_id, hitting the strict-spec check "role=tool requires tool_call_id". The validator now synthesises an opaque id (call_<8 hex>) when missing, so the request reaches the handler and the model's final summarising response gets generated. The proper fix lives in the frontend (carry the streamed id through the second POST) and will follow. Verified end to end with curl: HTTP 400 (model not loaded) on both the empty-assistant history shape and the tool-result-without-id shape, instead of HTTP 422 from the schema validator. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: tighten code comments from security-hardening pass Trim verbose docstrings and inline finding references added in the previous commits in this branch. Functionality unchanged. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: await get_current_subject in /api/health and make refresh-token consumption atomic The /api/health auth probe called get_current_subject(creds) without awaiting it. The coroutine object is truthy, so any caller presenting a Bearer header (valid or not) received the full diagnostic payload including version, device_type, studio_root_id, etc. Await the coroutine and treat HTTPException as 'fall back to the minimal liveness payload'. consume_refresh_token did SELECT then DELETE WHERE id under default autocommit isolation. Two concurrent POST /api/auth/refresh requests could both win the SELECT before either DELETE ran, defeating single-use refresh-token rotation. Replace with a single DELETE ... WHERE token_hash = ? AND expires_at >= ? RETURNING ... statement so the validate-and-delete lands as one atomic op under SQLite's write lock (3.45.1 supports RETURNING; min was 3.35). * studio: enforce body cap on chunked uploads and drop unsafe-inline from script-src MaxBodyMiddleware previously only inspected the declared Content-Length header; clients omitting it or sending Transfer-Encoding: chunked bypassed the cap and could still drive an OOM via the downstream JSON / file readers on /v1/chat/completions, /api/inference, /api/data-recipe, /api/datasets, /api/train, /api/export. Rewrite as a raw ASGI middleware that drains and counts http.request frames, replies 413 once the running total exceeds UNSLOTH_STUDIO_MAX_BODY_MB before invoking the FastAPI handler, and replays the buffered body to downstream so route code that calls request.json() / await request.body() works unchanged. CSP previously included 'unsafe-inline' on script-src, which defeats the main XSS protection. The frontend bundle does not need inline scripts; the only inline <script> the backend ever emits is _inject_bootstrap, which is opt-in via UNSLOTH_STUDIO_INJECT_BOOTSTRAP. Drop 'unsafe-inline' from script-src by default; when _inject_bootstrap fires, generate a per-response nonce, embed it on the inlined <script>, and have SecurityHeadersMiddleware splice 'nonce-XXX' into the CSP for that one response (the internal x-internal-script-nonce header is popped before the response leaves the server). 'unsafe-inline' stays on style-src for Vite-injected styles. * studio: drop empty assistant sentinel before passthrough ChatMessage._validate_role_shape normalises role="assistant", content="" (the post-Stop sentinel emitted by the frontend) to content=None so the in-process path can drop it via _extract_content_parts. The passthrough path then ran m.model_dump(exclude_none=True), which strips the now-None content key entirely, sending {"role":"assistant"} to llama-server / the OpenAI-compat backend. That fails upstream and leaves the user without a recoverable Stop->resume. Add _drop_empty_assistant_sentinels and call it at both passthrough message origins: _openai_messages_for_passthrough (covers /v1/chat/completions and the Responses API which routes through it) and the anthropic_messages_to_openai output before _anthropic_passthrough_*. Assistant messages that carry only tool_calls (no content) are preserved. * studio/tests: cover audit-fix surfaces and rebase pre-existing tests Adds and updates pytest coverage for the four bot-flagged audit fixes landed earlier in this branch and rebases two pre-existing tests that were broken by the relaxed-validator and /api/health auth-gate changes. studio/backend/tests/test_middleware.py (new) MaxBodyMiddleware: small protected, large declared, unprotected passthrough, chunked-upload-over-cap rejection (the regression for the original Content-Length-only gap), and chunked-under-cap replay. SecurityHeadersMiddleware: script-src no longer carries 'unsafe-inline', style-src still does, default headers (XFO/XCTO/Referrer-Policy/Permissions-Policy/server), and the internal x-internal-script-nonce header is consumed by the middleware and converted to 'nonce-XXX' in the CSP. /api/health: no auth -> minimal, invalid Bearer -> minimal (the await regression), valid Bearer -> full diagnostic payload. studio/backend/tests/test_desktop_auth.py consume_refresh_token: second-call returns None, expired returns None, and a 64-thread concurrent pile-up against the same hash produces exactly one successful consumer (regression for the SELECT-then-DELETE race). test_health_response_reports_desktop_capability_fields: rebase against the new health_check(request) signature by going through TestClient with a real bearer instead of asyncio.run-ing the handler directly. studio/backend/tests/test_openai_tool_passthrough.py Pin the new ChatMessage tolerance: assistant without content or tool_calls is tolerated (normalises content -> None), empty-string and empty-list assistant content normalise to None, and a missing / empty tool_call_id on role='tool' is synthesised as call_<hex> rather than raising. Tests for _drop_empty_assistant_sentinels cover the three drop shapes (empty string, empty list, missing content key), preservation of assistant text and tool_calls-only messages, and end-to-end through _openai_messages_for_passthrough. studio/backend/main.py SecurityHeadersMiddleware.dispatch used response.headers.pop(...) for the nonce-header handoff; Starlette's MutableHeaders has no pop. Read-then-del so the internal handoff header is still stripped before the response leaves the server. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio/tests: rebase three more pre-existing CI tests against this branch CI on PR #5375 was red on three tests that were tuned for behaviour predating this branch. Updates each so the assertions match what the audit fixes intentionally changed; no production code touched. studio/backend/tests/test_trained_model_scan.py test_scan_trained_models_includes_lora_and_full_finetune_outputs passed an absolute tmp_path through scan_trained_models, which now runs resolve_output_dir / _assert_contained against outputs_root(). Repoint outputs_root() at tmp_path via monkeypatch so the fixture dirs land under the configured root and the realpath containment check passes. tests/test_studio_install_workspace_guard.py test_health_endpoint_exposes_studio_root_id_not_raw_path read the first 1500 bytes after @app.get("/api/health") and asserted on the studio_root_id literal. The handler grew (unauth short-circuit + await dependency gate) and the literal slid past the byte window. Replace the fixed window with a slice up to the next top-level @app.* decorator so the test surveys the whole handler regardless of size. tests/studio/studio_api_smoke.py The "login burst (5x wrong pw) -> 401 each" assertion was tagged "When/if we add one, this assertion updates in the same PR." We added the per-IP rate-limit in routes/auth.py (_LOGIN_MAX_FAILS=5/60s) but missed the assertion update. Rewrite the burst probe to observe the new invariant: at least one 401, eventual transition to 429, and Retry-After present on the 429. Adds a small _login_with_headers helper since the existing login() helper drops response headers. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * ci(studio-ui): set UNSLOTH_STUDIO_INJECT_BOOTSTRAP=1 for Playwright Studios The Chat UI Playwright test drives the first-boot change-password form, which (per playwright_chat_ui.py step "1. Change-password through the UI") pre-seeds the hidden current_password field from window.__UNSLOTH_BOOTSTRAP__. That global is only emitted when the backend's _inject_bootstrap path fires, which since the security pass on this branch is gated behind UNSLOTH_STUDIO_INJECT_BOOTSTRAP and defaults to off. Without the global, the React form's current_password validator never satisfies, the submit button stays disabled, and the composer.wait_for() probe times out on /change-password. Re-enable injection only for the CI Studios that drive the chat UI across linux/mac/windows. Production deployments are unaffected: the env var has to be explicitly opted into, and the on-disk auth/.bootstrap_password remains the source of truth for human users typing the password in by hand. Covers all eight Studio launch sites: the primary chat-ui boot and the "extra UI tests" boot for each of the three OSes, plus the pipeTransport JSON-crash retry relaunches in the macOS workflow that re-spawn Studio mid-job. A follow-up frontend PR will add a visible current_password input so the form satisfies its own validator without needing the bootstrap auto-fill at all; once that lands this CI knob can come back out. * studio/sandbox: drop unshare(CLONE_NEWNET); add trusted-host allowlist; block sandbox file uploads; raise CPU rlimit default to 600 s CLONE_NEWNET inside _sandbox_preexec silently killed every outbound HTTP request from sandboxed Python whenever the kernel allowed unprivileged user namespaces. requests.get('https://huggingface.co'), urllib.request.urlopen('https://en.wikipedia.org/wiki/...'), socket.connect(('arxiv.org', 443)) all failed despite the AST visitor intending to allow them. The bash blocklist (curl / wget / nc / ssh / scp / sftp / rsync / socat / eval / source) plus the AST-level metadata-host denylist still carry the network policy after this change; CLONE_NEWNET was redundant with both. Add _TRUSTED_PUBLIC_HOST_LITERALS + _TRUSTED_PUBLIC_HOST_SUFFIXES (~100 informational hosts: Wikipedia language subdomains, Wikimedia, Wikidata, Google search, Bing, DuckDuckGo, HuggingFace, GitHub, raw.githubusercontent.com, arXiv, StackOverflow / Stack Exchange, MDN, docs.python.org, PyTorch / TensorFlow / NumPy / pandas docs, pypi / files.pythonhosted.org / npmjs / crates.io, ReadTheDocs, arXiv, Britannica, BBC / Reuters / Nature / Science, NASA / CDC / NIH / WHO open data, api.weather.gov). The visitor now blocks literal hosts that are neither metadata nor trusted with a short LLM-readable string so the model can retry with an allowed source instead of choking on a multi-line error. Block upload-shape calls regardless of host: requests.post / put / patch / delete / request with files= or data=open(...) / data=bytes_literal; httpx equivalents; urllib.request.urlopen / Request with data=...; HuggingFace upload_file / upload_folder / upload_large_folder / create_commit (module-level FQ paths AND method-name match on any receiver). Message: "Blocked: file upload disallowed in sandbox". Bump UNSLOTH_STUDIO_SANDBOX_CPU_S default 300 -> 600 s so long agentic chains that span multiple tool calls don't get SIGXCPU'd mid-stride. Env-var override path is unchanged. Host normalisation now strips trailing dot, userinfo @, and explicit port before allowlist / denylist comparison so trailing-DNS-dot, userinfo-smuggling, and explicit-:443 URLs are decided correctly. * studio: raise default request-body cap from 100 MB to 500 MB UNSLOTH_STUDIO_MAX_BODY_MB default goes 100 -> 500 to comfortably cover vision + audio + multi-recipe-batch JSON payloads. The MaxBodyMiddleware stream-counting logic from this branch's earlier 06ec088 already handles chunked bodies up to the new cap; env-var override path is unchanged for callers that want a tighter limit. * studio/auth: restore /api/auth/status.default_username to 'unsloth' This branch's earlier b39e9a4 changed default_username to None on the public /api/auth/status endpoint so the username field didn't leak to unauthenticated callers. In practice this regressed third-party clients (and the in-tree React login form's pre-fill UX) without adding meaningful security: the bootstrap password is the actual secret, and the username 'unsloth' is the documented default. Pin default_username to storage.DEFAULT_ADMIN_USERNAME ('unsloth') and tighten the response model so the field is required rather than Optional. Anyone who needs anonymisation can still reach for an allow-list deployment with auth disabled. * studio/training: raise max_seq_length / batch_size / lora_r / lora_alpha caps This branch's 7102815 introduced field validators with conservative caps. The follow-up loosens them so long-context experiments and high-rank LoRA exploration aren't gated at the schema layer: _MAX_BATCH_SIZE 1024 -> 4096 _MAX_SEQ_LENGTH 131_072 -> 2_000_000 (2M tokens) lora_r cap 512 -> 16_384 (_MAX_LORA_R) lora_alpha cap 1024 -> 32_768 (_MAX_LORA_ALPHA) _MAX_GRAD_ACCUM / _MAX_STEPS / _MAX_EPOCHS / lora_dropout / warmup_ratio / weight_decay are unchanged. Hardware (VRAM, host RAM, kernel launch latency) is now the binding constraint at the new caps, which is the correct ordering -- the validator stays a sanity check on -1 / 0 / 'abc' style garbage, not a usability gate. * studio/tests: cover sandbox allowlist + upload block + raised training caps studio/backend/tests/test_sandbox_tools.py (new): TestMetadataHostDenylist -- short "Blocked: cloud-metadata host" message on AWS IMDS, GCP metadata, Alibaba ECS, AWS IPv6 IMDS, 169.254/16. TestTrustedHostAllowlist -- Wikipedia (any language subdomain), Google, DuckDuckGo, HF, raw GitHub, arXiv, StackOverflow / family, MDN, docs.python.org, pypi, BBC, api.weather.gov, NumPy / PyTorch docs. TestUntrustedHostBlock -- example.com / random unlisted host rejected with the short "Blocked: host not in sandbox allowlist; use an allowed informational source" message. Dynamic URLs (computed var) still pass -- documented limit of static analysis. TestHostNormalization -- trailing dot, explicit :443, uppercase, userinfo-@-smuggle all decided correctly without false-block / false-pass. TestUploadDenylist -- requests / httpx / urllib.urlopen with files= / data=open / data=bytes, HfApi().upload_file / upload_folder / create_commit, module-level huggingface_hub.upload_folder. POST json= to trusted host still passes. TestSandboxCpuRlimitDefault -- pin UNSLOTH_STUDIO_SANDBOX_CPU_S=600 default and confirm CLONE_NEWNET source line is gone. TestMaxBodyDefault -- pin UNSLOTH_STUDIO_MAX_BODY_MB=500 default. studio/backend/tests/test_studio_train_validation.py (new): Pin at-cap-accepts / over-cap-rejects boundaries for max_seq_length=2_000_000, batch_size=4_096, lora_r=16_384, lora_alpha=32_768 so a future regression that tightens them back without explicit user opt-in is caught. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: tighten code comments across the security-hardening pass * studio: always inject bootstrap credentials on first boot The UNSLOTH_STUDIO_INJECT_BOOTSTRAP gate added an extra terminal-to-browser copy-paste on every fresh install. In practice the LAN credential leak it guarded against is narrow: the password is one-time, the user rotates it on the very next click, the default Studio bind is 127.0.0.1, and -H 0.0.0.0 already exposes the entire API surface. Drop the gate so the inject fires whenever a bootstrap password is still pending. The CSP nonce wiring stays in place; the inline script remains the only inline script the backend ever emits. The three Playwright UI smoke workflows lose their UNSLOTH_STUDIO_INJECT_BOOTSTRAP=1 lines along with the explanatory comment blocks since the inject now happens by default. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Wasim Yousef Said <wasimysdev@gmail.com>	2026-05-13 06:12:18 -07:00
Wasim Yousef Said	0a54d001ec	Harden Tauri release flow (#5341) ... * Harden Tauri backend preflight and startup Require managed Studio root IDs to match before attaching to existing backends, close the concurrent backend-start window, and tighten frontend Tauri detection to Tauri-specific signals. * Add Tauri backend manageability guards Gate desktop backend compatibility on explicit manageability fields, add external-conflict handling for unsafe backend states, and protect update/repair paths from mutating active non-owned Studio backends. Track Tauri-owned backends with local owner metadata for verified orphan cleanup only. * Split Tauri preflight probes into modules Move preflight types, version checks, managed install probing, and backend probing into focused submodules while preserving behavior and keeping implementation files under the release-readiness size target. * Use desktop-specific Tauri updater channel Point the desktop updater at a same-repo desktop-latest manifest and publish that channel from non-draft desktop releases after validating the Tauri-generated latest.json. * Add Linux desktop update policy * Add owned backend lifecycle guards * Adopt verified desktop-owned backends * Validate desktop backend readiness * Trim Tauri release hardening code * Require desktop backend 2026.5.3 * Handle desktop backend edge cases * Fail stalled desktop backend startup * Fix desktop update edge cases * Avoid secret-gating adopted watchdog * Fix desktop update comparison guards * Automate desktop release versioning * Serialize desktop release workflow * tests: follow preflight.rs split into preflight/{backend,managed,types,version}.rs PR #5341 splits studio/src-tauri/src/preflight.rs into a directory of submodules. The cmd.env_remove("UNSLOTH_STUDIO_HOME") + STUDIO_HOME calls now live in preflight/managed.rs instead of preflight.rs, so test_tauri_preflight_scrubs_studio_home_env counted zero matches in the old single-file location and failed with "assert 0 >= 2". Read whichever shape is on disk: preflight.rs at the old path plus every *.rs under preflight/ (current PR has 2 occurrences in preflight/managed.rs). The guard intent is unchanged: at least 2 env_remove calls covering run_cli_probe and probe_cli_capability, plus the single commands.rs scrub in check_install_status. Verified locally: pytest tests/test_studio_install_workspace_guard.py::test_tauri_preflight_scrubs_studio_home_env passes. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Avoid browser Tauri hostname detection * Restore shutdown flag after failed stop --------- Co-authored-by: Daniel Han <danielhanchen@gmail.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-05-12 20:30:20 -07:00
Daniel Han	7be10852cb	install: support STUDIO_HOME / UNSLOTH_STUDIO_HOME for custom install paths (#5190) ... * install: support STUDIO_HOME / UNSLOTH_STUDIO_HOME for custom install paths Currently install.sh and install.ps1 hardcode all install paths off $HOME / $env:USERPROFILE with no env-var fallback. This blocks workspace-isolated installs (CI sandboxes, per-PR test environments, multi-tenant boxes) unless the entire HOME / USERPROFILE is faked, which also relocates ~/.gitconfig, ~/.ssh, and other unrelated state. Add an opt-in env-var override that does only what is needed. Resolution priority (highest first): 1. HOME / USERPROFILE explicitly redirected vs the password-database default. Detected via getent (Linux), dscl (macOS), or [Environment]::GetFolderPath (Windows). Best-effort: when the detection mechanism is unavailable the check is skipped and we fall through to step 2. 2. UNSLOTH_STUDIO_HOME, if set. 3. STUDIO_HOME, if set (alias for convenience; the variable name already matches the internal var install.sh sets). 4. Default: legacy $HOME/.unsloth/studio (or $USERPROFILE\.unsloth\studio on Windows). Identical to today's behavior when no env var is set. When an env var override fires: * DATA_DIR is nested inside ($STUDIO_HOME/share, or $StudioHome\share on Windows) so the runtime launcher and shortcuts find studio.conf in the same place install-time wrote it. * The unsloth CLI shim lands at $STUDIO_HOME/bin/unsloth (Unix) or $StudioHome\bin\unsloth.exe (Windows). On Windows the shim already lives under $StudioHome; the change only redirects DATA_DIR and skips the persistent registry PATH update. * Persistent shell PATH modifications are skipped (no .bashrc / .zshrc / .profile append on Unix; no Add-ToUserPath on Windows). Caller is expected to invoke via absolute path or add the bin dir to PATH explicitly. Avoids polluting the user's profile with a workspace-scoped path that may be deleted. The Unix launcher script is the only piece that must read DATA_DIR at runtime (it sources studio.conf from there). The hardcoded DATA_DIR inside the LAUNCHER_EOF heredoc is replaced with an @@DATA_DIR@@ placeholder substituted via sed at install time, using the same approach the script already uses for other install-time substitutions. Default path behavior is unchanged: when no env var is set and HOME is not redirected, install.sh / install.ps1 produce exactly the same file layout as today. Test scenarios verified locally on install.sh: * Default (no env vars) -> $HOME/.unsloth/studio (legacy) * HOME=/tmp/x -> /tmp/x/.unsloth/studio * UNSLOTH_STUDIO_HOME=/tmp/y -> /tmp/y as STUDIO_HOME root * STUDIO_HOME=/tmp/z (alias) -> /tmp/z as STUDIO_HOME root * HOME redirect + env var (HOME wins) -> install follows HOME * Unwritable override -> exits with clear ERROR message * install: priority change -- env vars now win over HOME redirect Flip the resolution order so explicit env vars take precedence over HOME / USERPROFILE redirection. New priority (highest first): 1. UNSLOTH_STUDIO_HOME, if set. 2. STUDIO_HOME, if set. 3. HOME / USERPROFILE explicitly redirected. 4. Default. Rationale: the env vars are explicit single-purpose signals (the user typed UNSLOTH_STUDIO_HOME=... specifically to redirect Studio). HOME redirection is broader and incidental -- the user may have redirected HOME for unrelated reasons (workspace tools, container builds) without wanting Studio to follow it. When both are set, the more specific signal should win. When only HOME is redirected (no env var), behavior is unchanged from the previous commit: install follows $HOME. * install: address review feedback (sed escape, downstream propagation, edge cases) Fixes from gemini-code-assist + chatgpt-codex-connector + reviewer.py 20-parallel run on the open PR. install.sh: * Escape sed replacement metacharacters before substituting @@DATA_DIR@@. Two-stage escape: ' -> '\'' for safe single-quote shell embedding, then \, &, | for sed replacement string + chosen delimiter. Heredoc switched to single-quoted DATA_DIR='@@DATA_DIR@@' so we only need single-quote escaping at runtime. Verified end-to-end with paths containing & and | (the sed delimiter). * Pass UNSLOTH_STUDIO_HOME into both setup.sh invocations (--local and PyPI paths) so the downstream install resolves the same Studio root install.sh picked. * macOS .app stub: replace hardcoded exec "$HOME/.local/share/unsloth/launch-studio.sh" with exec "$_css_data_dir/launch-studio.sh" so the .app launches the resolved launcher even in env-override mode. * Use mkdir -p -- and cd -- when validating the env override so paths starting with - cannot be misread as flags. install.ps1: * Drop .Guid from [guid]::NewGuid().Guid: the property does not exist; the probe filename was always identical and not unique. Default ToString() on System.Guid produces the canonical UUID string we want. * Guard LOCALAPPDATA before Join-Path to avoid aborting the installer in service / CI contexts where LOCALAPPDATA is unset (Join-Path under $ErrorActionPreference='Stop' would otherwise throw). Computed once into $defaultDataDir; both 'profile' and 'default' branches reuse it. * Set $env:UNSLOTH_STUDIO_HOME for the duration of the 'unsloth studio setup' subprocess so studio/setup.ps1 and unsloth_cli see the same install root install.ps1 picked. Restored in a finally block. studio/setup.sh: * Honor UNSLOTH_STUDIO_HOME / STUDIO_HOME (alias) when resolving STUDIO_HOME, VENV_DIR, VENV_T5_*_DIR. Falls back to the legacy $HOME/.unsloth/studio when no override is set. studio/setup.ps1: * Same change in PowerShell: honor $env:UNSLOTH_STUDIO_HOME / $env:STUDIO_HOME for $StudioHome / $VenvDir resolution. unsloth_cli/commands/studio.py: * Replace the module-level constant STUDIO_HOME = Path.home() / ".unsloth" / "studio" with a resolver that honors UNSLOTH_STUDIO_HOME / STUDIO_HOME before falling through to the legacy default. Same precedence the installers use. Verified locally: 6 install.sh scenarios still produce correct paths (default, HOME redirect, env var, alias, both, bad override). New sed-escape unit tests pass for paths containing & and |. Python resolver matches priority: UNSLOTH_STUDIO_HOME > STUDIO_HOME > default. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * install.sh: portable sed (no -i.bak) per gemini review feedback GNU sed -i.bak vs BSD/macOS sed -i.bak vs BusyBox sed have subtly different semantics. Use the POSIX-portable redirect-then-mv pattern instead. Functionally identical, runs everywhere. * studio: persist UNSLOTH_STUDIO_HOME so fresh shells find custom installs Without this, a custom-root install (UNSLOTH_STUDIO_HOME=/work/studio bash install.sh --local) only worked in the same shell that ran the installer. Closing the terminal and reopening lost the env var, the PATH was deliberately not persisted, and the Python CLI fell back to ~/.unsloth/studio. Result: 'Studio not set up' or quietly operating on a stale legacy install. Three persistence layers, all backwards-compatible (default installs emit zero changes): 1. Unix studio.conf install.sh now writes 'export UNSLOTH_STUDIO_HOME=...' next to UNSLOTH_EXE in studio.conf when in env-override mode. The launcher sources studio.conf at startup so the exec'd binary gets the var. Default installs do not write this line; studio.conf stays byte-identical to before. 2. Windows launch-studio.ps1 install.ps1 prepends '$env:UNSLOTH_STUDIO_HOME = ...' to the generated launcher when in env-override mode. Default installs produce the same launcher content as before. 3. Python sys.prefix inference storage_roots.studio_root() and unsloth_cli/commands/studio.py now infer the install root from sys.prefix when no env var is set (Path(sys.prefix).parent for unsloth_studio venvs). Catches direct invocations of <STUDIO_HOME>/bin/unsloth that bypass the launcher entirely. unsloth_cli/commands/studio.py also re-exports the resolved UNSLOTH_STUDIO_HOME via os.environ.setdefault so child processes (setup script, backend run.py) inherit it. Backend storage roots (storage_roots.studio_root, cache_root) now respect the env var via the shared resolver. run.py PID file, transformers_version.py T5 venvs, and model_config.py vision-check venv all switch to studio_root() so custom installs are self-contained. studio/setup.ps1: T5 sidecar venvs now resolve under $StudioHome (was $env:USERPROFILE\.unsloth\studio\.venv_t5_*). studio/setup.sh + studio/setup.ps1: llama.cpp build dir nests under $STUDIO_HOME / $StudioHome when env-override is active, otherwise keeps the legacy ~/.unsloth/llama.cpp. Verified locally: * studio.conf write block: env-override mode emits the export line; default mode does not (byte-identical to today). * PowerShell heredoc interpolation: correct output for both modes. * studio_root() resolver: default, UNSLOTH_STUDIO_HOME, STUDIO_HOME alias, and sys.prefix-based inference all return correct paths. * cache_root() now derives from studio_root(). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * install: tilde expansion + macOS .app stub safe-quoting Two fixes from running a 25-scenario simulation sweep against install.sh across path edge cases (spaces, apostrophes, ampersands, pipes, backslashes, dollar signs, Unicode, trailing slash, relative paths). 1. UNSLOTH_STUDIO_HOME=~/foo was landing as literal '~/foo' (env vars are not subject to tilde expansion). Added a POSIX-portable case block in install.sh, install.ps1, studio/setup.sh, studio/setup.ps1 that expands a leading ~ or ~/ to $HOME / $env:USERPROFILE. The prefix-removal pattern is single-quoted ('${var#'~/'}') so the shell does not tilde-expand the pattern back to $HOME/ before matching -- a subtle dash/bash gotcha. 2. macOS .app stub used an unquoted heredoc ('<< STUB_EOF'), so any $VAR / backtick / etc in the path would expand at .app launch time. Switched to single-quoted heredoc ('<< 'STUB_EOF'') with a placeholder + sed substitution + single-quoted shell embedding, matching the @@DATA_DIR@@ pattern already used for launch-studio.sh. Verified: 25/25 simulation scenarios pass on Linux dash + bash, including paths with $VAR, &, |, \\, ', spaces, and Unicode. End-to-end install in env-mode + fresh-shell launcher invocation confirmed: studio binds to /api/health from a clean env, and sys.prefix-based inference correctly returns the workspace root. * install: stop accidentally treating default installs as env-override Reviewer.py 20-runs cycle 1 found a unanimous P1 regression: a default 'unsloth studio update' relocates llama.cpp from ~/.unsloth/llama.cpp to ~/.unsloth/studio/llama.cpp, because the CLI was re-exporting UNSLOTH_STUDIO_HOME unconditionally and install.sh / install.ps1 were passing it into setup.{sh,ps1} unconditionally. The setup scripts treated the var's mere presence as "env-override mode" and relocated the llama.cpp build dir away from the legacy path, breaking the runtime backend's _find_llama_server_binary lookup on default installs. Fixes: * unsloth_cli/commands/studio.py: _resolve_studio_home now returns (path, is_custom). Re-export only when is_custom -- a real env override or a sys.prefix inference that resolves to a non-legacy path. Default installs leave UNSLOTH_STUDIO_HOME unset. * install.sh: gate UNSLOTH_STUDIO_HOME on $_STUDIO_HOME_REDIRECT == env before calling setup.sh. Use 'env $VARS bash setup.sh' so the var is set only for the subprocess, never leaked. * install.ps1: gate $env:UNSLOTH_STUDIO_HOME on $StudioRedirectMode -eq 'env' before invoking 'unsloth studio setup'. Restore prior value in finally block (unset if it wasn't set). * studio/setup.sh + setup.ps1: decide llama.cpp install root from the resolved $STUDIO_HOME (not from env-var presence). If the resolved path equals the legacy default ($HOME/.unsloth/studio), fall back to ~/.unsloth/llama.cpp. This makes setup robust against a stale UNSLOTH_STUDIO_HOME inherited from a parent process that happens to point at the legacy default. * studio/backend/core/inference/llama_cpp.py: - _find_llama_server_binary() now searches studio_root() / llama.cpp AND the legacy ~/.unsloth/llama.cpp (de-duped). Custom-root installs become discoverable; default installs unaffected. - kill_orphaned_servers ownership allowlist also includes studio_root() / llama.cpp so custom-root processes are cleanable. Verified locally: * 25/25 sim scenarios still pass (path edge cases unchanged). * setup.sh unit test: default-mode lands UNSLOTH_HOME at $HOME/.unsloth; env-mode lands at $STUDIO_HOME. * Python CLI unit test: default-mode returns is_custom=False and does NOT setdefault UNSLOTH_STUDIO_HOME; env-mode sets is_custom=True. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * install: || exit 1 on STUDIO_HOME subshell (dash set -e gap) Gemini review feedback: in dash, set -e does not trigger on subshell failures inside variable assignments. If 'cd -- "$_override" && pwd' fails, STUDIO_HOME stays empty and DATA_DIR collapses to /share. Add explicit '|| exit 1' on both install.sh:187 and setup.sh:413. * install.sh: argv-safe setup invocation for paths with spaces Cycle 2 reviewer.py 20-runs found a unanimous P1: passing the env-var through 'env $_STUDIO_ENV_FOR_SETUP' word-splits on whitespace, so a custom root like '/tmp/Unsloth Studio' becomes 'UNSLOTH_STUDIO_HOME= /tmp/Unsloth' followed by env trying to exec 'Studio'. Replaced with a tiny helper that prepends the env-var directly to the argv (no string-form intermediary), so spaces are preserved as a single argument. Default-mode invocation skips the env-var entirely. Verified: 'UNSLOTH_STUDIO_HOME=/tmp/test space/studio' now reaches setup.sh as a single value. * studio: tighten sys.prefix inference + Tauri env handling + llama.cpp env Cycle 3 reviewer.py findings (3 P1s converging): * sys.prefix inference too broad: a developer venv named 'unsloth_studio' was being treated as a custom Studio root. Narrow with an installer- sentinel check (presence of share/studio.conf or bin/unsloth shim inside the parent dir) in both unsloth_cli/commands/studio.py and studio/backend/utils/paths/storage_roots.py. * Tauri studio/src-tauri/src/process.rs::find_unsloth_binary() hardcoded ~/.unsloth/studio. Honor UNSLOTH_STUDIO_HOME / STUDIO_HOME (in that priority order) before falling back to legacy. * unsloth-zoo's GGUF export binds LLAMA_CPP_DEFAULT_DIR at import time from UNSLOTH_LLAMA_CPP_PATH. For env-override installs, persist UNSLOTH_LLAMA_CPP_PATH alongside UNSLOTH_STUDIO_HOME in studio.conf (Unix), in the generated PowerShell launcher (Windows), and via os.environ.setdefault in the Python CLI when running on a custom root, so GGUF export uses the custom-root llama.cpp build instead of the legacy ~/.unsloth/llama.cpp. Default behaviour unchanged: no env vars are written to studio.conf in default mode, no LLAMA_CPP_PATH is set, and the dev-venv inference falls through to legacy when no installer sentinels are present. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: desktop_auth env-aware + legacy-root llama.cpp consistency - desktop_auth.rs: honor UNSLOTH_STUDIO_HOME / STUDIO_HOME for the .desktop_secret path so Tauri desktop login works against custom-root installs instead of always reading ~/.unsloth/studio/auth/. - install.sh / install.ps1 / unsloth_cli/commands/studio.py: when an env override resolves to the legacy default ($HOME/.unsloth/studio), set UNSLOTH_LLAMA_CPP_PATH to ~/.unsloth/llama.cpp (matching setup.sh / setup.ps1's legacy-equality branch). Previously the persisted value pointed at $STUDIO_HOME/llama.cpp, which was a non-existent location and broke unsloth-zoo's import-time GGUF binding for that edge case. * studio: tauri studio_root helper + marker-file persistence + ~ expansion Address cycle-5 reviewer findings: - Add studio/src-tauri/src/studio_root.rs: shared resolver with UNSLOTH_STUDIO_HOME / STUDIO_HOME (priority order), tilde expansion (~, ~/..., ~\...), installer-written marker fallback, then ~/.unsloth/studio. 5 unit tests cover the expansion paths. - Tauri lookups now go through the shared resolver: - process.rs::find_unsloth_binary - desktop_auth.rs::desktop_secret_path - main.rs::setup_logging (tauri.log under custom root) - commands.rs::open_logs_dir (opens custom root dir) - install.rs work_dir uses parent of resolved root (avoids creating a stray ~/.unsloth on a custom-root install) - install.sh / install.ps1 (env-mode only): write ~/.unsloth/studio-home marker so the desktop app launched from Finder/Start Menu (no shell env inheritance) still resolves the custom root. - install.sh / install.ps1 non-interactive completion: when StudioRedirectMode=env, print the absolute custom-root shim path since the persistent rc/registry PATH update is intentionally skipped in env-override mode. - unsloth_cli/commands/studio.py: replace setdefault() with truthy-check so a blank UNSLOTH_STUDIO_HOME / UNSLOTH_LLAMA_CPP_PATH in the parent env doesn't suppress the inferred custom root. 40/40 cargo test --bins pass. * studio: validate marker file + write in --tauri mode + propagate to subprocess Cycle-6 reviewer follow-ups: - studio_root.rs marker resolver now validates the persisted path before using it. A stale ~/.unsloth/studio-home pointing at a deleted/moved workspace is ignored (resolution falls back to the legacy default rather than hijacking it). Validation accepts share/studio.conf sentinel or bin/unsloth shim. Trailing newline strip uses trim_end_matches(['\n','\r']) so paths whose content legitimately has leading/trailing spaces survive. - install.sh / install.ps1: marker write moved out of the launcher generation path so it runs before the Tauri-mode early exit. Both shell-launcher and Tauri-installed env-mode roots now persist the marker. Removed the duplicate marker write that was previously inside install.ps1's $studioHomeExport block. - studio/src-tauri/src/install.rs: pass UNSLOTH_STUDIO_HOME to the installer subprocess (when not already in scope) so app-initiated repair / update flows reach the same root the running app uses. cargo test --bins -- --test-threads=1: 44/44 pass (4 new tests for marker validation: sentinel accepted, bin shim accepted, empty dir rejected, missing path rejected). * studio: fix Tauri legacy-fallback regression + stale marker cleanup Cycle-7 reviewer follow-ups (regression I introduced in cycle 6): - studio_root.rs: add StudioRootSource enum + resolve_studio_root_with_source(). Lets callers distinguish a real custom override (Env / Marker) from the legacy fallback (Default). - studio/src-tauri/src/install.rs: only forward UNSLOTH_STUDIO_HOME to the installer subprocess when the resolution source is Env or Marker. The Default fallback must NOT be passed -- install.sh / install.ps1 treat any non-empty UNSLOTH_STUDIO_HOME as env-override mode and would relocate DATA_DIR to $STUDIO_HOME/share and _LOCAL_BIN to $STUDIO_HOME/bin (regressing default Tauri repair / update flows from the legacy ~/.local/share/unsloth and ~/.local/bin). - install.sh / install.ps1: clear stale marker on default / HOME-redirect installs. A user who first installed with UNSLOTH_STUDIO_HOME=/work/studio then later reinstalls without env vars no longer has the desktop app hijacked by ~/.unsloth/studio-home pointing at the old custom root. - install.sh / install.ps1: when env mode wins over a redirected HOME / USERPROFILE, write the marker into the OS-reported real profile home (getent / dscl on Unix; [Environment]::GetFolderPath on Windows) so a later desktop launch from the user's normal session still finds it. Falls back to the current HOME / USERPROFILE. cargo test --bins -- --test-threads=1: 45/45 pass (1 new for the source enum invariants). * install: scrub stale marker from real-home on HOME-redirect cleanup Cycle-8 reviewer follow-up: the previous cleanup branch only removed \$HOME/.unsloth/studio-home, leaving a stale marker in the real password-database home after a prior env-mode install. A later default install with redirected HOME / USERPROFILE would still see the desktop app resolving the old custom root. - install.sh: compute the real password-database home (via getent / dscl) unconditionally, and scrub markers from BOTH \$HOME and the real-home in the default / HOME-redirect cleanup branch. - install.ps1: build a profile-candidate list (current USERPROFILE + OS-reported real profile) and remove markers from EVERY candidate in the default / profile-redirect cleanup branch. bash -n + cleanup smoke verified. * revert: drop Tauri env-var support + marker file mechanism Keep this PR scoped to shell installer + Python backend env-var support. Tauri desktop integration with custom Studio roots is deferred to a separate, focused PR. Reverts to pre-PR state: - studio/src-tauri/src/process.rs (find_unsloth_binary) - studio/src-tauri/src/desktop_auth.rs (auth_secret_path) - studio/src-tauri/src/main.rs (setup_logging tauri.log path) - studio/src-tauri/src/commands.rs (open_logs_dir) - studio/src-tauri/src/install.rs (work_dir + subprocess env) - studio/src-tauri/src/studio_root.rs DELETED Removes from install.sh / install.ps1: - ~/.unsloth/studio-home marker write/read/cleanup - HOME-redirect-aware marker location logic What this PR keeps (the original scope): - install.sh / install.ps1: UNSLOTH_STUDIO_HOME / STUDIO_HOME env-var resolver with HOME-redirect detection, tilde expansion, legacy fallback. Default installs are byte-identical to pre-PR. - studio/setup.sh / studio/setup.ps1: legacy-equality llama.cpp path. - studio.conf / launcher persists UNSLOTH_STUDIO_HOME + UNSLOTH_LLAMA_CPP_PATH for fresh shells (env-mode only). - unsloth_cli/commands/studio.py: env > sys.prefix sentinel > legacy resolver, conditional re-export. - studio/backend/utils/paths/storage_roots.py: same resolver. - Backend modules use storage_roots (run.py, model_config.py, transformers_version.py, llama_cpp.py). cargo test --bins -- --test-threads=1: 34/34 pass (pre-PR baseline). bash -n install.sh: clean. * install: cycle-10 fixes (default launcher, --tauri guard, env-mode shortcuts, win PATH) - install.sh launcher: default and HOME-redirect installs keep the legacy DATA_DIR=\"\$HOME/.local/share/unsloth\" runtime form so a later shell with a different \$HOME still resolves DATA_DIR. Only env-mode bakes the resolved absolute path. Restores byte-identical default behavior. - install.sh / install.ps1: fail fast when --tauri is combined with UNSLOTH_STUDIO_HOME / STUDIO_HOME. The desktop app still resolves the legacy ~/.unsloth/studio root, so a custom-root --tauri install would yield a desktop app that cannot find its binary or auth secret. Print the right alternative. - install.sh / install.ps1: skip persistent desktop / Start-Menu shortcuts in env-override mode. Workspace-scoped installs would otherwise leave launchers pointing at a path the user may delete. Default and HOME/profile-redirect installs keep the shortcut. - install.ps1: re-prepend env-override \$ShimDir AFTER Refresh-SessionPath. Refresh rebuilds PATH as Machine > User > current \$env:Path, so a previously-installed legacy User PATH entry would otherwise win precedence over the current-session env-override shim. bash -n install.sh, pwsh parser install.ps1 + setup.ps1: clean. cargo test --bins -- --test-threads=1: 34/34 (Tauri unchanged). * install: cycle-11 fixes (env-mode launcher writes, --tauri legacy passthrough, run.py llama path) - install.sh / install.ps1: env-mode no longer skips the entire create_studio_shortcuts / New-StudioShortcuts function. Move the early-return INSIDE those functions, just before the persistent desktop / Start-Menu shortcut creation. The runtime launcher (launch-studio.sh / launch-studio.ps1), studio.conf with UNSLOTH_STUDIO_HOME / UNSLOTH_LLAMA_CPP_PATH exports, and the icon ARE always written so env-mode shims can resolve via fresh shells. - install.sh / install.ps1: --tauri guard passes through when the override resolves to the legacy default ($HOME/.unsloth/studio / %USERPROFILE%\.unsloth\studio). The desktop app already uses that path, so explicit-equality is a supported edge case (matches the llama.cpp legacy-equality branch). - studio/backend/run.py: when launched directly (bypassing the unsloth CLI), set UNSLOTH_STUDIO_HOME and UNSLOTH_LLAMA_CPP_PATH before the rest of import chain runs so unsloth-zoo's import-time LLAMA_CPP_DEFAULT_DIR binding picks up the custom-root build. Only set when STUDIO_ROOT is a real custom override; legacy default installs leave them unset. bash -n install.sh, pwsh parser install.ps1: clean. python ast parse studio/backend/run.py: clean. cargo test --bins -- --test-threads=1: 34/34 pass (Tauri unchanged). * install: cycle-12 fixes (--tauri trailing slash + main.py uvicorn env) - install.sh / install.ps1 --tauri legacy passthrough: strip trailing separators before comparing the override to the legacy default. Previously UNSLOTH_STUDIO_HOME=\"\$HOME/.unsloth/studio/\" (with trailing slash) was rejected even though it resolves to the supported legacy root. - studio/backend/main.py: when launched directly via \`uvicorn main:app\` from a custom-root venv (bypassing both unsloth_cli and run.py), export UNSLOTH_STUDIO_HOME and UNSLOTH_LLAMA_CPP_PATH before any unsloth-zoo import so its import-time LLAMA_CPP_DEFAULT_DIR binding picks up the custom-root build. Only sets when STUDIO_ROOT is a real custom override. bash -n install.sh, pwsh parser install.ps1, python ast main.py: clean. Smoke probe: UNSLOTH_STUDIO_HOME=\$HOME/.unsloth/studio/ install.sh --tauri no longer exits with the unsupported-custom-root error. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * install.ps1: skip CWD-relative venv migration in env-override mode The legacy ~/unsloth_studio venv migration path on Windows reads %USERPROFILE%\unsloth_studio\Scripts\python.exe (a fixed home-relative path). Under env-override mode this would Move-Item the user's pre-existing default-install venv into $StudioHome\unsloth_studio, breaking the default install and contaminating the workspace root. Gate the migration on $StudioRedirectMode -ne 'env' so workspace-scoped installs leave the user's default-install venv untouched. No Linux equivalent: install.sh migrates from \$STUDIO_HOME/.venv which is already env-mode-aware (points at the workspace root, not \$HOME). * install: cycle-14 fixes (Tauri env scrub + setup.ps1 missing-root error) Tauri does not honor UNSLOTH_STUDIO_HOME / STUDIO_HOME / UNSLOTH_LLAMA_CPP_PATH yet -- the desktop app's Rust paths use the legacy ~/.unsloth/studio root. If the user's shell has these env vars set, spawned Python subprocesses would diverge from the Rust paths (custom-root Python <-> legacy-root Rust). Scrub the three env vars at all Tauri subprocess spawn sites: - process.rs: backend launch - desktop_auth.rs: provision-desktop-auth subprocess - install.rs: install.sh / install.ps1 invoked from the desktop app (also prevents the --tauri guard from rejecting an inherited override). setup.ps1: when UNSLOTH_STUDIO_HOME points at a non-existent directory, 'Resolve-Path -LiteralPath' threw a confusing PSObject error under $ErrorActionPreference = "Stop". Test-Path the override first and emit a friendly "run install.ps1 to create the install root" message instead. * install: cycle-15 fixes (preserve UNSLOTH_LLAMA_CPP_PATH + add update.rs scrub) UNSLOTH_LLAMA_CPP_PATH is a pre-existing custom-llama.cpp-directory override the Python backend (studio/backend/core/inference/llama_cpp.py) and unsloth-zoo intentionally support. It is unrelated to the Studio install root. Cycle 14 over-scrubbed it from the Tauri spawn sites, regressing desktop GGUF/llama.cpp workflows for users who set it in their shell. - process.rs / desktop_auth.rs / install.rs: stop scrubbing UNSLOTH_LLAMA_CPP_PATH; only scrub UNSLOTH_STUDIO_HOME and STUDIO_HOME. - update.rs: missed Tauri spawn site -- add the same UNSLOTH_STUDIO_HOME / STUDIO_HOME scrub so 'unsloth studio update' from the desktop app updates the legacy-root install Tauri actually manages. Verified: cargo test --bins -- --test-threads=1 -> 34/34 pass. * install.sh: document apostrophe-escape derivation inline The shell quoting at install.sh:642 / 659 / 679 / 680 / 823 has been flagged as broken across multiple review cycles, but every end-to-end verification (DATA_DIR=\"a b's&c|d\$e\" -> generated launcher -> source -> recovered exact input) passes. The proposed "8 backslash" fix would double the escape and actually break what currently works. Strengthen the inline comments to spell out the derivation: - shell pattern \"s/'/'\\\\''/g\" passes \"s/'/'\\''/g\" to sed (\\\\ -> \\) - sed replacement '\\'' yields close-quote / escaped-quote / open-quote - stage 2 (\\, &, |) only needed where the value is then sed-replaced into a launcher template via s|@@DATA_DIR@@|VALUE|g studio.conf is written via printf, not sed, so it only needs stage 1. No behavior change, only inline doc to head off future false positives. * install/setup .ps1: use -LiteralPath for $StudioHome-derived paths Pre-PR, $StudioHome was hardcoded to %USERPROFILE%\.unsloth\studio -- no wildcard characters possible. The PR introduces UNSLOTH_STUDIO_HOME / STUDIO_HOME, so $StudioHome (and every path derived from it: $VenvDir, $VenvPyExe, $UnslothExe, $UnslothHome, $LlamaCppDir, $VenvT5_*, etc.) can now contain bracket characters that PowerShell would interpret as wildcards. Reproducer (from cycle 17 review 20): pwsh> Test-Path 'studio[abc]/Scripts/python.exe' False pwsh> Test-Path -LiteralPath 'studio[abc]/Scripts/python.exe' True Switch the relevant Test-Path / Remove-Item / New-Item / Move-Item calls in install.ps1 and studio/setup.ps1 to -LiteralPath. Sites where the path is fixed (the shim under %LOCALAPPDATA%\Microsoft\WindowsApps, $RepoRoot from -PSCommandPath) keep the wildcard-aware form. * install/setup .ps1: fix New-Item -LiteralPath regression from cycle 17 Cycle 17 added -LiteralPath to all $StudioHome-derived path operations, but New-Item has no -LiteralPath parameter (verified pwsh 7.6 syntax: "New-Item [-Path] <string[]> [-ItemType <string>] ..."). Every directory- creation site would throw "A parameter cannot be found that matches parameter name 'LiteralPath'" at runtime, blocking T5 sidecar setup, llama.cpp parent creation, and StudioHome creation. Likewise, "Split-Path -LiteralPath $X -Parent" cannot mix LiteralPath with -Parent (separate parameter sets). The default LiteralPath mode already returns the parent. Switch to [System.IO.Directory]::CreateDirectory($X), which natively takes a literal path, and drop the trailing -Parent on Split-Path. Verified end-to-end on a bracketed path "/tmp/...[abc]": - CreateDirectory: created - Test-Path -LiteralPath: detects - nested CreateDirectory(Split-Path -LiteralPath ...): works * install/setup .ps1: extend -LiteralPath sweep to remaining \$StudioHome paths Cycle 17/18 missed several wildcard-aware operations on user-controlled \$StudioHome-derived paths. Reviewers identified remaining sites: install.ps1: - \$UnslothExePath (Test-Path / Resolve-Path) at the shortcut creator - \$VenvDir (Get-ChildItem) at the no-torch-runtime resolver - \$ShimDir (New-Item Directory -- replaced with .NET CreateDirectory) - \$ShimExe (Test-Path / Remove-Item / re-prepend guards) -- the shim lives at \$StudioHome\\bin\\unsloth.exe in env-override mode, so it inherits bracket sensitivity from \$StudioHome. - \$UnslothExe (Copy-Item fallback) when HardLink fails. studio/setup.ps1: - \$LlamaServerBin (Test-Path) at the prebuilt-bundle / source-build validation gates (3 sites). \$LlamaServerBin lives under \$BuildDir under \$LlamaCppDir under \$UnslothHome under \$StudioHome. New-Item HardLink keeps -Path because creating a non-existent target with brackets succeeds (verified via direct pwsh smoke test). * install: cycle-20 fixes (more setup.ps1 -LiteralPath + shell-quote launch hints) setup.ps1: extend -LiteralPath sweep to remaining \$BuildDir-derived paths that the cycle-19 commit missed: - \$CmakeCacheFile (Test-Path + Select-String -Path) - \$buildTmp (10 Test-Path / Remove-Item sites in source-build cleanup) - \$QuantizeBin (Test-Path) - \$altBin (Test-Path) These all live under \$BuildDir -> \$LlamaCppDir -> \$UnslothHome -> \$StudioHome, which is now user-controlled via UNSLOTH_STUDIO_HOME. Bracket characters in the override would silently skip rebuild detection or leave stale build artifacts. install.sh: shell-quote the launch-instruction substep lines for env- override mode. UNSLOTH_STUDIO_HOME values containing spaces or apostrophes (e.g. "/tmp/O'Brien Studio") would print copy-paste- unsafe commands -- the install succeeded but the printed launch instructions split at the space. Now wraps with the canonical '\\''-style escape so the printed lines parse with bash -n. Verified end-to-end: - printed shim line: '/tmp/O'\''Brien Studio/bin/unsloth' studio ... - bash -n on the printed line passes. * install.ps1: -LiteralPath for macOS-stub-launcher \$appDir-derived paths The shortcut/launcher generator at install.ps1:418-693 writes the stub launcher, .vbs, and icon under \$appDir = \$StudioDataDir, which in env-override mode is \$StudioHome\share. Cycle 17/19/20 missed the following wildcard-aware ops on these paths: - Test-Path \$appDir (with New-Item Directory swap to .NET CreateDirectory) - Set-Content -Path \$launcherVbs (for the WSH .vbs stub) - Test-Path / Copy-Item \$bundledIcon (bundled icon copy) - Test-Path / Remove-Item \$iconPath (icon header validation) In env-override mode \$StudioHome can contain bracket characters; without -LiteralPath the .vbs write fails outright and the icon validation can either skip a present icon or fail to delete a malformed one. (The COM shortcut creation downstream returns early in env-override mode, so its path values don't need this treatment.) * install: don't override pre-existing UNSLOTH_LLAMA_CPP_PATH in launchers Cycle 14/15 established UNSLOTH_LLAMA_CPP_PATH as a pre-existing custom-llama.cpp-directory override the Python backend and unsloth-zoo intentionally support, independent of the Studio install root. The launchers (studio.conf sourced by Unix launch-studio.sh, and the PowerShell launch-studio.ps1) were unconditionally re-exporting it, which silently overrides a user's pre-existing value when they invoke the launcher from a shell where UNSLOTH_LLAMA_CPP_PATH is already set. Make the assignment conditional in both launchers: install.sh studio.conf: if [ -z "\${UNSLOTH_LLAMA_CPP_PATH:-}" ]; then export UNSLOTH_LLAMA_CPP_PATH='...' fi install.ps1 launch-studio.ps1: if (-not \$env:UNSLOTH_LLAMA_CPP_PATH) { \$env:UNSLOTH_LLAMA_CPP_PATH = '...' } UNSLOTH_STUDIO_HOME stays unconditional: the launcher is bound to a specific install, so its STUDIO_HOME must always match that install. * install.sh: harden --tauri legacy resolver against CDPATH and symlinks Reviewer cycle 23 (inst 19) noted that the bare \`cd -- ... && pwd\` form in the --tauri legacy comparison can echo a CDPATH-prefixed path when the user has CDPATH set in their environment, contaminating the resolved absolute path used in the legacy-equality check. Switch to \`CDPATH= cd -P -- ... && pwd -P\` so: - CDPATH= clears the cd-prefix-echo behavior - -P / pwd -P resolves any symlinks to a canonical path No behavior change for users without CDPATH set; correctness fix for users who have it set in their shell. * install + llama_cpp backend: cycle-24 hardening Three real findings from cycle 24 reviewers: 1. install.sh:231 + studio/setup.sh:413 -- main \$STUDIO_HOME resolvers used the same bare \`cd -- ... && pwd\` form that cycle 23 only fixed for the --tauri guard. Switch both to: \$(CDPATH= cd -P -- "\$override" && pwd -P) so relative custom-root values don't get CDPATH-prefixed or have the cd-on-CDPATH stdout newline contaminate the captured value. 2. install.sh --tauri legacy root used logical \$HOME/.unsloth/studio while the override side was canonicalized via pwd -P. A symlinked \$HOME (e.g. /home/alice -> /u/alice) made the comparison fail even when both sides pointed at the same directory. Canonicalize the legacy side too when the dir exists. 3. studio/backend/core/inference/llama_cpp.py:_find_llama_server_binary searched \$STUDIO_HOME/llama.cpp first then ~/.unsloth/llama.cpp in default-mode installs. setup.sh / setup.ps1 only install llama.cpp under \$STUDIO_HOME/llama.cpp in env-override mode; in default mode it always lives at ~/.unsloth/llama.cpp. The post-PR search would pick up a stale partial install at ~/.unsloth/studio/llama.cpp over the real legacy binary. Mirror setup's legacy-equality check: when studio_root() resolves equal to ~/.unsloth/studio, search ONLY the legacy ~/.unsloth/llama.cpp. Otherwise (env-override custom root), search custom first, legacy fallback. * install + setup: canonicalize legacy-equality comparison sites Cycle 24 made \$STUDIO_HOME canonical via 'CDPATH= cd -P -- ... && pwd -P', but the legacy-equality comparison sites still used the bare logical "\$HOME/.unsloth/studio" string. With a symlinked \$HOME (e.g. /home/alice -> /u/alice), the comparison fails even when both sides point at the same dir, and llama.cpp ends up under a custom-root path the Python backend's legacy comparison cannot find. Reviewer cycle 25 inst 2 reproduced this with HOME=/tmp/link -> /tmp/real and UNSLOTH_STUDIO_HOME=\$HOME/.unsloth/studio: setup.sh resolves UNSLOTH_HOME to /tmp/real/.unsloth/studio while the backend search resolves both physically equal and looks at /tmp/link/.unsloth/llama.cpp. Canonicalize the legacy side at all four sites: - install.sh:695 (create_studio_shortcuts llama.cpp path) - studio/setup.sh:577 (UNSLOTH_HOME selection) - install.ps1:462 (launcher UNSLOTH_LLAMA_CPP_PATH path) - studio/setup.ps1:1829 (UnslothHome selection) Apply CDPATH= cd -P -- ... && pwd -P (Unix) or Resolve-Path -LiteralPath (Windows) when the legacy dir exists. unsloth_cli/commands/studio.py already does this via Path.resolve(). * llama_cpp: gate _kill_orphaned_servers studio-root allowlist on env-override Cycle 24 fixed _find_llama_server_binary to only search \$STUDIO_HOME/llama.cpp when STUDIO_HOME is a real env override (not the legacy default), but the symmetric _kill_orphaned_servers allowlist still appended _sr() / "llama.cpp" unconditionally. In default mode _sr() resolves to ~/.unsloth/studio, so ~/.unsloth/studio/llama.cpp would be treated as a Studio-owned install root for the orphan-kill scan even though the default installer does not own that path. A llama-server process running there from a different tool or a stale partial install would be killed. Apply the same legacy-equality check used in _find_llama_server_binary and the install/setup scripts: only add _sr()/"llama.cpp" to the allowlist when STUDIO_HOME != legacy default. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * setup.sh + setup.ps1: canonicalize both sides of legacy-equality check Proactive audit pass found one real asymmetry the cycle-by-cycle review process had not yet flagged: - install.sh:704 / install.ps1:469 are gated on env-mode and only run when STUDIO_HOME has already been canonicalized (cycle 24). Symmetric. - studio/setup.sh:577 / studio/setup.ps1:1829 run UNCONDITIONALLY, including in default mode. In default mode STUDIO_HOME is set to the bare logical \$HOME/.unsloth/studio (setup.sh:416) or Join-Path \$env:USERPROFILE ".unsloth\\studio" (setup.ps1:1480). Cycle 25 canonicalized only the legacy side, creating an asymmetry under symlinked \$HOME / junctioned %USERPROFILE%. Result of the asymmetry: a default-mode install on a host with \$HOME=/tmp/link -> /tmp/real treats the legacy default as a custom root, putting llama.cpp at \$STUDIO_HOME/llama.cpp instead of ~/.unsloth/llama.cpp -- and the Python backend's _find_llama_server_binary (which uses .resolve() on both sides) then can't find the install. Fix: canonicalize STUDIO_HOME on the fly at the comparison site, in both setup.sh and setup.ps1. Symmetric with the now-canonicalized legacy side from cycle 25, regardless of which mode set STUDIO_HOME. The other two comparison sites (install.sh:704, install.ps1:469) are already symmetric because they only run when STUDIO_HOME comes from the env-override resolution path that already does pwd -P / Resolve-Path. unsloth_cli/commands/studio.py + studio/backend/run.py + main.py + llama_cpp.py already use .resolve() on both sides -- symmetric. * install.ps1: env-override resolution uses .NET API for literal paths Gemini code-review (review 4177641398, commit 2ea2c91) caught two remaining New-Item -Path sites in the env-override resolution block that the cycle 18 sweep missed: - Line 123: New-Item -ItemType Directory -Path \$envOverride - Line 132: New-Item -ItemType File -Path \$probe (writability test) Both use -Path which interprets square brackets as wildcards. For a user with UNSLOTH_STUDIO_HOME=C:\\workspaces\\studio[abc], both calls would fail before the install starts. New-Item also has no -LiteralPath in PowerShell 5.1. Replace both with the .NET API: - [System.IO.Directory]::CreateDirectory(\$envOverride) - [System.IO.File]::WriteAllText(\$probe, "") -- closes the file handle before the Remove-Item below. End-to-end verified with /tmp/test-envoverride-[abc]-* path: CreateDirectory + WriteAllText + Test-Path -LiteralPath all work. * comments: condense multiline blocks added by this PR Across the 27-cycle review process, comments accumulated as multiline blocks explaining each fix's history (cycle numbers, prior bugs, reviewer rationale). Compress every block to 1-2 lines that capture just the WHY, dropping cycle references and history that belongs in the PR description / commit log instead. Net: 268 deletions / 124 insertions (-144 lines) of comments only. Behavior unchanged. Verified: bash -n, pwsh parser, python ast.parse, cargo check all pass. * install.ps1: use 'return' over 'exit 1' for Install-UnslothStudio bail-outs Per Gemini review #4177659001: when users run install.ps1 via 'irm ... | iex', 'exit 1' inside the function terminates the entire PowerShell process and closes the user's terminal. 'return' bails out of the function while keeping the shell open, matching existing error sites at lines 34, 50, 57. Three sites fixed: --tauri+env-override guard, env-override mkdir/access failure, and write-probe failure. The 'exit' calls at lines 591/611 are inside a generated launcher here-string (a separate top-level .ps1 that runs as its own process), so they correctly stay as 'exit'. * install.{sh,ps1}: address Gemini review #4177680451 Three medium fixes: 1. install.sh redirection detection: canonicalize both sides of the $HOME vs passwd-DB comparison via 'CDPATH= cd -P -- ... && pwd -P' so a trailing slash on $HOME (or symlink-vs-realpath mismatch with getent/dscl output) doesn't misfire the redirection branch. 2. install.sh shim symlink: 'ln -sf' into an existing directory creates the link INSIDE it ($_LOCAL_BIN/unsloth/unsloth instead of the intended file). Pre-strip a real (non-symlink) directory at $_LOCAL_BIN/unsloth before linking. 3. install.ps1 ShimExe: add -Recurse to Remove-Item so the launcher refresh recovers if $ShimExe somehow exists as a directory rather than a file (would otherwise drop into the catch and skip the shim update). * install.ps1: use 'throw' over 'return' for fatal validation failures Cycle 28 reviewer.py (12/8 RC/APPROVE) caught a regression introduced by the previous Gemini-review fix (#4177659001 -> commit 393e676b). 'return' inside Install-UnslothStudio kept iex'd terminals alive but made 'pwsh -File install.ps1' exit with code 0 on fatal validation failures (--tauri+custom-root rejected, STUDIO_HOME unwritable, etc.), so CI / wrapper scripts treated failed installs as successful. 'throw' satisfies both constraints: - pwsh -File install.ps1: exits with code 1 (CI sees failure) - irm | iex: shows error to user, does NOT close the host terminal Three sites: --tauri+env-override guard, mkdir/access failure, write-probe failure. Verified throw -> exit code 1 under pwsh -File. * install.ps1 launcher: single-quote child -Command path Cycle 28 P2 finding: the generated launch-studio.ps1 builds the child PowerShell -Command string with the executable path inside double quotes, so a custom Studio root containing PowerShell metacharacters (\$, backtick) re-expands in the child shell. Example: D:\work\\\$job\studio -> child reparses \$job and runs the wrong path. Fix: single-quote the path inside the child command and double any apostrophes (PowerShell's literal-quote-escape form) so paths like "O'Brien Studio & x|y" or "C:\work\\\$bad\studio" survive verbatim. * install: harden custom Studio root handling - install.sh shim refresh: refuse to recursively delete a real directory at $_LOCAL_BIN/unsloth before creating the symlink. The previous rm -rf could destroy unrelated user data living at that path. - install.ps1 shim refresh: drop -Recurse from Remove-Item on $ShimExe and refuse early when the shim path is a directory; mirrors the install.sh guard so a directory at $StudioHome\bin\unsloth.exe is not blown away. - install.ps1 PATH wiring: remove the redundant first $ShimDir prepend in env-override mode; the post-Refresh-SessionPath prepend is the one that takes effect, and the duplicate left $ShimDir in $env:Path twice. - install.ps1 manual launch instructions: single-quote the printed shim and Activate.ps1 paths so '$' / backtick metacharacters in custom roots do not reparse when the user copies and pastes the command. - studio/setup.sh: validate writability of UNSLOTH_STUDIO_HOME with the same [ -w ] check install.sh already has, so a read-only override fails with a clear message instead of an obscure uv pip permission error. - Drop the STUDIO_HOME alias everywhere (storage_roots.py, studio.py, install.sh, studio/setup.sh, install.ps1, studio/setup.ps1). The name is too generic and an ambient STUDIO_HOME from unrelated tooling could silently redirect the install. Only UNSLOTH_STUDIO_HOME is honored. - unsloth_cli/commands/studio.py: defer UNSLOTH_STUDIO_HOME / UNSLOTH_LLAMA_CPP_PATH re-export from import time into a helper invoked by the studio app callback. Importing the module no longer mutates os.environ as a side effect, so test runners and CLI introspection stop leaking those vars into unrelated subprocesses. - studio/backend/core/inference/llama_cpp.py: replace set-mutation inside list comprehension with an explicit dedup loop for readability. * install: harden custom Studio root edge cases - install.ps1 shim refresh: move the directory-collision preflight outside the lock-handling try/catch. The previous throw inside the try block was swallowed by the surrounding catch and downgraded to a "Continuing with the existing launcher" warning, leaving the install in a broken state with no usable shim on disk. - storage_roots.py / unsloth_cli/commands/studio.py: tighten the bin-shim sentinel from .exists() to .is_file(). A directory at the candidate bin/unsloth (or bin/unsloth.exe) path would otherwise false-positive the venv inference and pick the wrong Studio root. - storage_roots.py / unsloth_cli/commands/studio.py: wrap the env-var override Path(...).expanduser().resolve() in try/except (OSError, ValueError), matching the defensive pattern already used in studio/backend/main.py and studio/backend/run.py. An invalid override (unresolvable network drive, bad characters) now falls back to the un-resolved path instead of crashing at import time. * install: fail fast on missing custom root, allow brackets in shim path - install.ps1 shim hardlink: switch the New-Item -ItemType HardLink call from -Path to -LiteralPath so a custom Studio root containing bracket characters does not fail under PowerShell's wildcard-aware -Path parameter. Matches the -LiteralPath usage on every other Test-Path / Remove-Item / Copy-Item call against the same shim path. - studio/setup.sh override branch: replace the silent mkdir -p of the override directory with an existence check that exits 1 with a clear message. setup.sh runs against an existing install (via 'unsloth studio update'), so a typo in UNSLOTH_STUDIO_HOME must not materialize an empty workspace dir. Brings the Unix flow in line with setup.ps1, which already errors on a missing override root. * llama_cpp: scope orphan-server kill to the active install root _kill_orphaned_servers used to unconditionally include the legacy ~/.unsloth/llama.cpp tree in install_roots, even when the running Studio is in env-override mode and operates out of a custom root. On a single OS user running both a default-install Studio and a custom-root Studio concurrently, the custom Studio would kill the default Studio's llama-server during startup orphan cleanup. Hoist _is_custom_root out of the import try/catch so the legacy- append decision sees it (default to False on ImportError so default mode behaviour is unchanged), and gate the legacy ~/.unsloth/llama.cpp append on `not _is_custom_root`. * install: harden custom-root .venv migration and shim hardlink - install.sh / install.ps1 OLD-layout .venv migration: gate on default-mode only. Without the guard, pointing UNSLOTH_STUDIO_HOME at a workspace that already has .venv (e.g. an unrelated Python project) caused the torch validation to fail and the installer to recursively remove the user's project venv. Mirrors the existing env-mode skip on the CWD-relative venv migration immediately below. - install.ps1 shim hardlink: revert to New-Item -ItemType HardLink -Path. -LiteralPath is not accepted on the HardLink ItemType in any PowerShell version, so the previous form always threw and silently fell back to Copy-Item, breaking hardlink-update propagation. Bracket characters in $ShimExe are still defended by the directory-collision preflight added earlier. - storage_roots.py / unsloth_cli/commands/studio.py: strip whitespace from the UNSLOTH_STUDIO_HOME env var before the truthy check so a blank " " override does not become a real path with trailing spaces (which would silently break every downstream Studio path operation). * Studio paths: tolerate stat / resolve failures during root inference - storage_roots._infer_studio_home_from_venv: wrap the share/studio.conf and bin/shim is_file() sentinel checks in try/except OSError. A PermissionError on a restricted candidate dir would otherwise propagate out of studio_root() and crash module import in run.py / main.py / transformers_version.py / model_config.py at server startup. - llama_cpp._kill_orphaned_servers: broaden the studio_root() guard from ImportError-only to (ImportError, OSError, ValueError) so transient resolve / sentinel failures do not crash the orphan-killer at server startup. Matches _find_llama_server_binary's existing pattern. - llama_cpp._find_llama_server_binary: nest the inner resolve() in its own try/except and fall back to unresolved-path comparison instead of dropping the custom search root entirely. A transient resolve() error on the legacy path no longer loses the custom-root llama.cpp lookup. * Add Studio install-root resilience tests * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: isolate custom-root installs from default-install state - llama.cpp discovery in env-override mode no longer falls back to the legacy ~/.unsloth/llama.cpp tree. The orphan-cleanup path already excludes that root in custom mode; aligning discovery prevents a custom-root Studio from launching a sibling install's binary it then refuses to manage. Users who want a shared build set UNSLOTH_LLAMA_CPP_PATH explicitly. - Generated POSIX launcher (install.sh heredoc) namespaces LOCK_DIR with a hash of DATA_DIR and persists the launched port to $DATA_DIR/studio.port; in env-override mode the fast-path attaches only to a port we ourselves wrote, never to a sibling Studio that happens to be healthy on 8888..8908. - Generated Windows launcher (install.ps1 heredoc) bakes a per-install $portFile and SHA-256-suffixed mutex name, mirroring the POSIX side; Find-HealthyStudioPort uses the port file in env-override mode. - studio/setup.sh and studio/setup.ps1 require an .unsloth-studio-owned marker before deleting $STUDIO_HOME/.venv_t5*, $STUDIO_HOME/llama.cpp, and the sidecar T5 venvs in env-override mode. The marker is dropped after fresh creation so subsequent runs of 'unsloth studio update' proceed cleanly. Mirrors the existing .venv guard in install.sh. - Wrap bare Path.resolve() calls on the legacy STUDIO_HOME constant in studio/backend/main.py, studio/backend/run.py, and unsloth_cli/commands/studio.py in the same try/except (OSError, ValueError) used adjacently, so a restricted parent or recursive symlink on $HOME does not crash module import / CLI startup. * Studio: guard env-mode workspace against destructive cleanup - install.sh and install.ps1 unconditionally rm -rf / Remove-Item the new-layout $STUDIO_HOME/unsloth_studio when it has a python; in env-override mode that path is a user-chosen workspace, mirroring the .venv migration concern the .venv branch already guards. Refuse to remove an existing $STUDIO_HOME/unsloth_studio that lacks Studio sentinels (share/studio.conf or bin/unsloth). - studio/setup.ps1 only checked Test-Path -PathType Container on the custom root; setup.sh and install.ps1 both also write-probe via WriteAllText / Remove-Item. Add the matching probe so 'unsloth studio update' against an ACL-restricted root fails fast with a clear message instead of erroring later while creating sidecar venvs. * Add Studio install/setup workspace-isolation tests * Studio: tighten installer rationale comments - install.sh: collapse a 5-line restatement into 3 lines, naming env-mode behavior up front and the byte-identical pre-override fallback after. - install.ps1: correct misleading hardlink comment that claimed the directory-collision preflight guards against wildcard expansion; bracket characters in $ShimExe still glob-expand here, with the Copy-Item -LiteralPath fallback handling them. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Split: keep only 2 file(s) * Studio: harden env-mode workspace guards across installers and update path Tightens the UNSLOTH_STUDIO_HOME custom-root protections so destructive installer paths cannot displace unrelated user data when the override points at a workspace. install.sh / install.ps1: env-mode sentinel that gates rm -rf $VENV_DIR / Remove-Item $VenvDir now requires share/studio.conf or the bin/unsloth(.exe) shim to be a real file or symlink. Previously a directory at bin/unsloth or bin\unsloth.exe satisfied the check (-e and bare Test-Path accept any path type), so a workspace with unrelated content under unsloth_studio plus a sibling directory at bin/unsloth could be wiped. studio/setup.ps1: stale-venv rebuild branch now mirrors install.ps1's env-mode guard before Remove-Item -LiteralPath $VenvDir -Recurse -Force. Without this, "unsloth studio update" pointed at a custom workspace whose unsloth_studio venv fails torch validation deletes the venv even when the root carries no Studio sentinels. studio/setup.sh / studio/setup.ps1: prebuilt llama.cpp install path now calls _assert_studio_owned_or_absent / Assert-StudioOwnedOrAbsent before invoking install_llama_prebuilt.py, and writes the .unsloth-studio-owned marker on success. install_llama_prebuilt.py uses os.replace() to move any existing install_dir aside before staging, so an unrelated $STUDIO_HOME/llama.cpp could otherwise be displaced before the existing source-build ownership guard ever ran. * Studio: gate ownership guards on canonical custom-root and add venv marker Tightens UNSLOTH_STUDIO_HOME ownership semantics so they fire only for a genuinely custom root, never for an explicit override that resolves to the legacy default. Adds an in-VENV marker that lets a partial install be repaired and provides a strong primary sentinel for the deletion guard. studio/setup.sh + studio/setup.ps1: hoist the canonical $STUDIO_HOME vs legacy-default comparison so it sits next to the marker definition, derive _STUDIO_HOME_IS_CUSTOM / $StudioHomeIsCustom once, and gate the _assert_studio_owned_or_absent / Assert-StudioOwnedOrAbsent helpers and the prebuilt llama.cpp marker writes on that flag instead of raw env-var presence. UNSLOTH_STUDIO_HOME=$HOME/.unsloth/studio (legacy override) no longer trips the guard for pre-PR T5 sidecar venvs or llama.cpp dirs that predate the .unsloth-studio-owned marker. The duplicate canonical block inside the llama.cpp section is removed; the new flag is reused. studio/setup.ps1: Assert-StudioOwnedOrAbsent's marker check now requires -PathType Leaf so a directory at .unsloth-studio-owned cannot satisfy it. The in-place git-sync branch in the source-build path now calls Mark-StudioOwned after a successful sync so a later prebuilt-update path does not fail Assert-StudioOwnedOrAbsent on the same root. install.sh + install.ps1: write $VENV_DIR/.unsloth-studio-owned right after uv venv succeeds and accept it as the primary sentinel in the env-mode deletion guard. This recovers from a partial install that was previously unrepairable, and is a stronger sentinel than sibling shim files (the marker is inside the venv that is about to be wiped, so an unrelated workspace cannot accidentally satisfy it). install.sh: drop the standalone -L test on $STUDIO_HOME/bin/unsloth in the deletion guard. -L returns true for any symlink including symlinks to directories and broken symlinks; -f already accepts the legitimate file-targeted symlink shape created by ln -s at install.sh:1864. * Studio: close residual workspace-isolation gaps for custom roots Four follow-on hardenings that close the remaining cross-root leaks the custom-root install plumbing still left open. studio/setup.ps1 in-place git-sync: when the source-build path finds an existing $LlamaCppDir/.git, it ran git remote set-url, checkout -B, and clean -fdx in place before any ownership check. The previous fix marked the tree as Studio-owned AFTER the sync but did not guard the BEFORE case, so an unrelated workspace .git could be silently rewritten on the first source-build under a custom UNSLOTH_STUDIO_HOME. Add the same Assert-StudioOwnedOrAbsent guard already used by the prebuilt path and the temp-dir swap path (gated on $StudioHomeIsCustom for parity). Launcher port-file workspace isolation: the env-mode launchers' fast path attached to any backend listening on the cached port that returned a healthy /api/health, even when that backend belonged to a different install root. studio/backend/main.py /api/health now returns the resolved studio_root; install.sh _check_health and install.ps1 Test-StudioHealth verify it against UNSLOTH_STUDIO_HOME when set, so a stale studio.port pointing at a sibling Studio is rejected instead of opening the wrong UI. studio/src-tauri preflight + commands: the Tauri desktop app stays on the legacy root by design. process.rs / install.rs / desktop_auth.rs / update.rs already strip UNSLOTH_STUDIO_HOME and STUDIO_HOME from their CLI subprocesses, but preflight.rs run_cli_probe / probe_cli_capability and commands.rs check_install_status did not, so a desktop launch from a shell carrying those env vars produced status reflecting a different root than the desktop manages. Mirror the existing scrub. install.sh shim install: the previous `rm -f -- $_shim_path; ln -s ...` pair leaves a window with no shim if interrupted. Use ln -sfn for an atomic replace; the -n flag prevents descent into a symlink-to-directory target (the existing directory guard above already rejects a real dir). * Studio: replace launcher root verify with hex digest baked at install time The previous launcher identity check returned the absolute resolved Studio install root from /api/health and matched it against $UNSLOTH_STUDIO_HOME in the launcher. Three problems that this commit closes: - POSIX launcher used a raw bash `case` against the JSON-encoded value, so paths containing characters that JSON escapes (e.g. /tmp/back\slash, /tmp/O"Brien) caused the launcher to reject its own healthy backend. - /api/health is unauthenticated and Studio supports `-H 0.0.0.0`, so any reachable client could read the absolute install path (username, home dir, workspace name, CI checkout path). - The verification was gated on $UNSLOTH_STUDIO_HOME being set at runtime, so a default-mode launcher would attach to a sibling env-mode Studio listening on the same port instead of starting its own. The fix replaces the raw path with a SHA-256 hex digest computed at install time and baked into the generated launcher (mirroring how @@DATA_DIR@@ is substituted today): studio/backend/main.py: /api/health now returns `studio_root_id = sha256(str(_studio_root()))` instead of the raw `studio_root` path. install.sh: computes `_css_studio_root_id` once from $STUDIO_HOME using python3, bakes `_EXPECTED_STUDIO_ROOT_ID='@@STUDIO_ROOT_ID@@'` into the launcher heredoc, and adds `s|@@STUDIO_ROOT_ID@@|...|g` to the existing sed pipeline for ALL modes (env / home / default). _check_health verifies the baked id substring-matches the JSON response. Hex-only so no shell or sed escape corner cases. install.ps1: same shape on Windows. SHA256 the $StudioHome bytes, lower hex, bake `$_ExpectedStudioRootId = '...'` into the launcher heredoc. Test-StudioHealth now compares `$resp.studio_root_id -eq $_ExpectedStudioRootId` unconditionally (no special-case for env-mode). Default-mode launchers also bake their expected id, so two coexisting Studio installs on the same machine can no longer cross-attach. * Studio: harden launcher root-id and split install-time mode from runtime env - install.sh launcher: compute studio_root_id with the venv Python (uv-managed systems may not have system python3) and canonicalize STUDIO_HOME with cd -P/pwd -P so default and home-redirect modes match the backend's Path(sys.prefix).resolve() canonicalization. Fail fast instead of silently baking an empty discriminator. - install.sh launcher heredoc: gate PORT_FILE / namespaced LOCK_DIR on a baked install-time mode flag (@@INSTALLED_IS_ENV_MODE@@) instead of the runtime UNSLOTH_STUDIO_HOME variable so a sourced custom-root studio.conf cannot flip a default-mode launcher into env-mode behavior with stale state. - studio/backend/main.py: cache the studio_root_id digest at module load so /api/health does not recompute hashlib + filesystem probes on every poll. - studio/backend/core/inference/llama_cpp.py: widen the studio_root() probe except clause from ImportError to (ImportError, OSError, ValueError) so it matches the sibling _kill_orphaned_servers handler and tolerates Path.resolve failures from broken symlinks or odd codecs. * Studio: align launcher root-id digest with backend canonicalization - studio/backend/main.py: hash the already-resolved _STUDIO_ROOT_RESOLVED instead of recomputing str(_studio_root()); the default fallback in storage_roots returns Path.home()/.unsloth/studio without .resolve(), so on systems where $HOME is a symlink (NFS / AFS / Docker) the cached digest now matches install.sh's cd -P/pwd -P canonicalization and the launcher no longer rejects its own healthy backend. - install.ps1: canonicalize $StudioHome via Resolve-Path before the SHA256 compute (env-mode already resolves at line 121, only default and profile branches were raw); a junctioned USERPROFILE now produces the same digest the backend computes via Path.resolve() for the same install. - install.sh launcher template: substitute the non-user-controlled @@STUDIO_ROOT_ID@@ and @@INSTALLED_IS_ENV_MODE@@ placeholders before the user-controlled @@DATA_DIR@@ pass so a $DATA_DIR that contains the literal placeholder text cannot be mutated by the second sed. * Studio: tighten installer rationale comments * Studio install: extend workspace-guard test coverage Add behavioral coverage for env-mode workspace guards across install.sh, install.ps1, studio/setup.sh, studio/setup.ps1, the launcher root-id discriminator, and the backend's /api/health response. Also refresh the custom-mode llama.cpp resilience assertion so it matches the implementation that intentionally excludes the legacy tree from search_roots. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Honor STUDIO_HOME alias, fix workspace-guard test harness, harden rollback The PR title and description promise STUDIO_HOME as a priority-2 alias to UNSLOTH_STUDIO_HOME, but the implementation only read the longer name in all six resolution sites. Wire the alias through install.sh, install.ps1, studio/setup.sh, studio/setup.ps1, the Python storage_roots resolver, and the unsloth_cli studio resolver. UNSLOTH_STUDIO_HOME wins when both are set (more specific signal beats the generic alias). Whitespace-only values are now treated as unset to match the Python resolvers' .strip() semantics, preventing install/runtime layout drift where the installer would create a literal " " directory while the backend fell through to the legacy default. Error messages and the substep status line report the env-var name the user actually set ("UNSLOTH_STUDIO_HOME=..." vs "STUDIO_HOME=...") so diagnostics stay accurate under either spelling. Test harness fix: tests/test_studio_install_workspace_guard.py extracted the install.sh venv-replacement block, but after the merge that block delegates to _start_studio_venv_replacement (defined further up in install.sh, not in the extracted snippet). Five sentinel-positive tests echoed RESULT=ok but never moved $VENV_DIR. Add a single _INSTALL_GUARD_STUBS constant that stands in a minimal mv-based stub plus a no-op substep, and route every inline test script through a new _build_install_guard_script() helper. All 50 tests now pass (was 45/50). Rollback hardening: Start-StudioVenvRollback / Restore-StudioVenvRollback / Complete-StudioVenvRollback in install.ps1 used plain Test-Path, Move-Item, Remove-Item against paths derived from $StudioHome. With a custom UNSLOTH_STUDIO_HOME containing brackets (the very motivation for the broader -LiteralPath sweep this PR set out to do), rollback would silently misbehave under wildcard interpretation, turning a recoverable install error into a destroyed env. Same fix for the --local Tauri overlay block (Test-Path / Copy-Item / Get-FileHash on $VenvDir-derived paths). * Replace studio_root_id path-hash with per-install opaque id The previous design computed studio_root_id as sha256 of the resolved $STUDIO_HOME path, both at install time (baked into the launcher) and at backend startup (returned via /api/health). This worked but had three weaknesses: 1. Information disclosure on -H 0.0.0.0: anyone reaching /api/health could confirm a guessed install path (username, workspace name, etc.) by replaying the same hash. 2. Canonicalization brittleness: launcher (cd -P/pwd -P) and backend (Path.resolve()) had to produce identical strings, which required careful symlink/junction handling on every site (cycles 17-27 of the PR review history were entirely about closing this drift). 3. Stale-launcher attach: an uninstall + reinstall at the same path produced the same hash, so a launcher from the previous install would silently attach to the new (incompatible) backend. Replace the path-hash with a per-install opaque id: - install.sh and install.ps1 generate 32 bytes from the platform CSPRNG (/dev/urandom on POSIX with a python3 secrets fallback; RandomNumberGenerator.Create().GetBytes on Windows) and persist it to $STUDIO_HOME/share/studio_install_id with mode 0600. Atomic temp-file-rename so a crash mid-install can't leave a half-written id. The check 'if [ ! -s "$_css_id_file" ]' / Test-Path makes generation idempotent across re-runs (so re-running install.sh doesn't invalidate previously-baked launchers in the same install root). - studio/backend/main.py replaces hashlib.sha256 with _read_studio_install_id(), which reads $STUDIO_HOME/share/studio_install_id once at module load. Validates the content against ^[0-9a-f]{64}$ so malformed/truncated/uppercase/wrong-length content returns "" and triggers the launcher's existing "no baked id, accept any healthy Unsloth backend" fallback path. - /api/health field name (studio_root_id) and wire format (64 hex chars) preserved for compatibility with launchers already shipped via earlier PR iterations. Tests: - Drop test_install_sh_root_id_matches_backend_resolved_under_symlinked_home and test_install_ps1_canonicalizes_studio_home_before_root_id_hash -- the entire reason these existed (cd -P/Resolve-Path/Path.resolve() digest agreement under symlinks/junctions) is moot when the id comes from a file rather than from the path. - Drop test_main_py_studio_root_id_hashes_resolved_root_not_unresolved (no more hashing). - Rewrite test_main_py_studio_root_id_caches_at_module_load to assert the file-read pattern; add test_main_py_read_studio_install_id_validates_hex_and_handles_missing to pin the exact rejection rules (empty / non-hex / wrong case / wrong length all -> ""). - Rewrite test_install_sh_create_shortcuts_uses_venv_python_first as test_install_sh_create_shortcuts_seeds_id_from_csprng_with_python_fallback with a behavioral subprocess check that re-invocation is idempotent. - Rename test_check_health_handles_path_with_backslash_via_hash to test_check_health_handles_arbitrary_id_token (the JSON-escape concern it pinned is preserved -- ids are hex-only by construction -- but the test no longer derives the id from a path). - Add test_install_sh_install_id_survives_symlinked_studio_home as a regression test pinning that the new design has zero canonicalization drift across symlinked parents. - Update test_install_sh_bakes_studio_root_id_into_launcher and test_install_ps1_bakes_studio_root_id_into_launcher to assert the CSPRNG seed and the file location. 49/49 tests pass. Behavioral verification: install.sh-style generation is idempotent across runs, three parallel installs at different roots get distinct ids, reinstall at the same path produces a new id (so stale launchers correctly fail to attach to the new backend), and symlinked-\$HOME no longer causes launcher/backend disagreement. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han <unslothai@gmail.com>	2026-05-05 23:17:40 -07:00
Roland Tannous	35ab5da93c	Default Studio host to 127.0.0.1 and prompt before auto-start (#5267) ... Studio bound to 0.0.0.0 by default and the installer silently auto-started a server at end of install, exposing it on the network without consent and contradicting the privacy-first / local-only guarantee. - studio/backend/run.py: run_server() and argparse --host default to 127.0.0.1 - unsloth_cli/commands/studio.py: studio_default() and run() --host default to 127.0.0.1 - install.sh: drop -H 0.0.0.0 from generated launcher template; replace silent auto-start with a [Y/n] prompt; add cloud/network note to manual hint - install.ps1: drop -H 0.0.0.0 from PowerShell launcher template; replace silent auto-start with a Read-Host [Y/n] prompt; add cloud/network note - studio/setup.sh: drop -H 0.0.0.0 from launch hint; add cloud/network note - README.md: simplify launch examples to `unsloth studio -p 8888`; note -H 0.0.0.0 is available for cloud/LAN use Tests: - studio/backend/tests/test_host_defaults.py - tests/studio/test_cli_studio_defaults.py - tests/sh/test_install_host_defaults.sh	2026-05-04 13:03:16 +04:00
Wasim Yousef Said	a5eb2e3d50	Add tauri (#5144) ... * add unsloth studio desktop app * Fix review findings - studio/src-tauri/tauri.conf.json: retarget updater to staging repo (danielhanchen/unsloth-staging-2); switch to unslothai/unsloth on upstream merge. - studio/src-tauri/linux/postremove.sh: drop the interactive read loop and the /home/* iteration. Package maintainer scripts must stay non-interactive and must not touch other users' data. - studio/frontend/src/app/auth-guards.ts: honor tauriAutoAuth() boolean. Failed auto-auth now redirects to /login; requireGuest/requirePasswordChangeFlow only redirect to /chat when auth succeeds. The new early-return on failed auth is intentional so the login / change-password flows remain reachable when desktop auth is not yet established. - studio/frontend/src/config/env.ts: keep fetched=false on health failure so later calls retry instead of caching the client-side platform guess. - studio/src-tauri/src/install.rs: pick the available system package manager (apt-get, dnf, zypper, pacman); AppImage bundles run on non-Debian distros. - studio/frontend/src/lib/open-link.ts + markdown-text/sources callers: return boolean from openLink so callers only preventDefault on handled URLs; relative hrefs now navigate natively. - studio/frontend/src/features/settings/tabs/about-tab.tsx: fetch(apiUrl(...)) so the version request targets the backend port in desktop mode. The bare /api/health predates the Tauri webview (blame: the earlier onboarding commit, which ran with same-origin frontend/backend); in desktop mode the webview origin is tauri://localhost so the bare path fails. - install.ps1: gate the install_python_stack.py hotfix on a sentinel comment instead of a content regex; append the sentinel after applying so reruns are unambiguous. - unsloth_cli/commands/studio.py _write_auth_secret: use the atomic mkstemp + os.replace path on Windows too; chmod calls are wrapped in try/except OSError. - studio/src-tauri/src/preflight.rs probe_existing_backends: fan out the health probes concurrently; desktop-auth status still runs sequentially per candidate. reqwest::Client is internally Arc-wrapped so the in-loop .clone() is a refcount bump, not a deep clone; annotated inline. - studio/src-tauri/src/preflight.rs run_cli_probe: wait() after kill() to reap the child, matching probe_cli_capability. - studio/src-tauri/src/process.rs + main.rs: add stop_backend_detached and use it from the tray quit handler so the 5s graceful-wait does not block the Tauri main loop. RunEvent::Exit keeps the synchronous safety-net call. - studio/backend/main.py: drop the permissive localhost CORS regex in api-only mode; the explicit allow_origins list is sufficient. - .github/workflows/release-desktop.yml: drop max-parallel: 1 so platform builds run in parallel, and lift releaseBody to an env var so the three tauri-action invocations share one source of truth. * Fix review findings (loop 2) - studio/backend/auth/storage.py update_password: clear_desktop_secret() alongside clear_bootstrap_password() so rotating the admin password also revokes any previously provisioned .desktop_secret. Without this, an old local desktop credential keeps minting fresh admin tokens via /api/auth/desktop-login after a password rotation. - studio/src-tauri/src/desktop_auth.rs provision_desktop_auth: wrap cmd.output().await in tokio::time::timeout(30s). DESKTOP_AUTH_LOCK is held across the whole desktop_auth flow, and previously a hanging `unsloth studio provision-desktop-auth` subprocess would pin the lock indefinitely and freeze every subsequent desktop_auth call. * Add review tests * Consolidate review tests Merge review-added tests into the existing studio/backend/tests/test_desktop_auth.py (the PR's authoritative desktop-auth test file). Drops three scaffolding files under tests/python/ in favor of five focused tests next to the tests they extend: - test_update_password_clears_desktop_secret (runtime) - test_update_password_on_unknown_user_leaves_desktop_secret_intact (runtime) - test_cli_provisioning_delegates_to_storage_create_desktop_secret (source-level) - test_cli_connect_auth_db_reads_storage_db_path (source-level) - test_desktop_auth_provision_has_bounded_timeout (Rust source-level) * Revert auth-guards.ts Tauri branches to unconditional form The review loop on PR 5144 introduced a regression: the isTauri branch of requireAuth redirected to /login when tauriAutoAuth() returned false, and requireGuest / requirePasswordChangeFlow silently fell through on the same condition. The Tauri desktop app authenticates via a local auto-generated secret; it must never surface /login or /change-password to the user. A failed auto-auth should let the startup layer retry, not expose a password form. Restore the three Tauri branches to the author's original unconditional form (requireAuth: return; requireGuest / requirePasswordChangeFlow: throw redirect({to: '/chat'})). Keep the rest of the review fixes -- the apiUrl() fetch wrapping, authRedirect helper, and fetchAuthStatus refactor are all legitimate improvements and are preserved. * Revert release-desktop.yml to author's version The review loop's workflow-file tweaks (drop max-parallel: 1, lift releaseBody to an env var) are cosmetic. OAuth tokens cannot push workflow-file changes, and fine-grained PATs cannot honor maintainerCanModify on a third-party fork. Reverting the workflow file to wasimysaid's version lets the push go through without needing a classic PAT with both repo and workflow scopes. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: Lee Jackson <130007945+Imagineer99@users.noreply.github.com> Co-authored-by: Daniel Han <danielhanchen@gmail.com> Co-authored-by: Daniel Han <unslothai@gmail.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-04-23 04:50:10 -07:00
Daniel Han	9a261aec5f	Studio: Expose openai and anthropic compatible external API end points (#4956) ... * Studio: add API key authentication for programmatic access External users want to hit the Studio API (chat completions with tool calling, training, export, etc.) without going through the browser login flow. This adds sk-unsloth- prefixed API keys that work as a drop-in replacement for JWTs in the Authorization: Bearer header. Backend: - New api_keys table in SQLite (storage.py) - create/list/revoke/validate functions with SHA-256 hashed storage - API key detection in _get_current_subject before the JWT path - POST/GET/DELETE /api/auth/api-keys endpoints on the auth router Frontend: - /api-keys page with create form, one-time key reveal, keys table - API Keys link in desktop and mobile navbar - Route registered with requireAuth guard Zero changes to any existing route handler -- every endpoint that uses Depends(get_current_subject) automatically works with API keys. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Use actual origin in API key usage examples The examples on /api-keys were hardcoded to localhost:8888 which is wrong for remote users. Use window.location.origin so the examples show the correct URL regardless of where the user is connecting from. * Add `unsloth studio run` CLI command for one-liner model serving Adds a `run` subcommand that starts Studio, loads a model, creates an API key, and prints a ready-to-use curl command -- similar to `ollama run` or `vllm serve`. Usage: unsloth studio run -m unsloth/Qwen3-1.7B-GGUF --gguf-variant UD-Q4_K_XL * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add end-to-end tests for `unsloth studio run` and API key usage Tests the 4 usage examples from the API Keys page: 1. curl basic (non-streaming) chat completions 2. curl streaming (SSE) chat completions 3. OpenAI Python SDK streaming completions 4. curl with tools (web_search + python) Also tests --help output, invalid key rejection, and no-key rejection. All 7 tests pass against Qwen3-1.7B-GGUF. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add /v1/completions, /v1/embeddings, /v1/responses endpoints and --parallel support - llama_cpp.py: accept n_parallel param, pass to llama-server --parallel - run.py: plumb llama_parallel_slots through to app.state - inference.py: add /completions and /embeddings as transparent proxies to llama-server, add /responses as application-level endpoint that converts to ChatCompletionRequest; thread n_parallel through load_model - studio.py: set llama_parallel_slots=4 for `unsloth studio run` path * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Make /v1/responses endpoint match OpenAI Responses API format The existing /v1/responses shim returned Chat Completions format, which broke OpenAI SDK clients using openai.responses.create(). This commit replaces the endpoint with a proper implementation that: - Returns `output` array with `output_text` content parts instead of `choices` with `message` - Uses `input_tokens`/`output_tokens` instead of `prompt_tokens`/ `completion_tokens` in usage - Sets `object: "response"` and `id: "resp_..."` - Emits named SSE events for streaming (response.created, response.output_text.delta, response.completed, etc.) - Accepts all OpenAI Responses API fields (tools, store, metadata, previous_response_id) without erroring -- silently ignored - Maps `developer` role to `system` and `input_text`/`input_image` content parts to the internal Chat format Adds Pydantic schemas for request/response models and 23 unit tests covering schema validation, input normalisation, and response format. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: add Anthropic-compatible /v1/messages endpoint (#4981) * Add Anthropic-compatible /v1/messages endpoint with tool support Translate Anthropic Messages API format to/from internal OpenAI format and reuse the existing server-side agentic tool loop. Supports streaming SSE (message_start, content_block_delta, etc.) and non-streaming JSON. Includes offline unit tests and e2e tests in test_studio_run.py. * Add enable_tools, enabled_tools, session_id to /v1/messages endpoint Support the same shorthand as /v1/chat/completions: enable_tools=true with an optional enabled_tools list uses built-in server tools without requiring full Anthropic tool definitions. session_id is passed through for sandbox isolation. max_tokens is now optional. * Strip leaked tool-call XML from Anthropic endpoint content Apply _TOOL_XML_RE to content events in both streaming and non-streaming tool paths, matching the OpenAI endpoint behavior. * Emit custom tool_result SSE event in Anthropic stream Adds a non-standard tool_result event between the tool_use block close and the next text block, so clients can see server-side tool execution results. Anthropic SDKs ignore unknown event types. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Split /v1/messages into server-side and client-side tool paths enable_tools=true runs the existing server-side agentic loop with built-in tools (web_search/python/terminal). A bare tools=[...] field now triggers a client-side pass-through: client-provided tools are forwarded to llama-server and any tool_use output is returned to the caller with stop_reason=tool_use for client execution. This fixes Claude Code (and any Anthropic SDK client) which sends tools=[...] expecting client-side execution but was previously routed through execute_tool() and failing with 'Unknown tool'. Adds AnthropicPassthroughEmitter to convert llama-server OpenAI SSE chunks into Anthropic SSE events, plus unit tests covering text blocks, tool_use blocks, mixed, stop reasons, and usage. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fix httpcore GeneratorExit in /v1/messages passthrough stream Explicitly aclose aiter_lines() before the surrounding async with blocks unwind, mirroring the prior fix in external_provider.py (a41160d3) and cc757b78's RuntimeError suppression. * Wire stop_sequences through /v1/messages; warn on tool_choice Plumb payload.stop_sequences to all three code paths (server-side tool loop, no-tool plain, client-side passthrough) so Anthropic SDK clients setting stop_sequences get the behavior they expect. The llama_cpp backend already accepted `stop` on both generate_chat_ completion and generate_chat_completion_with_tools; the Anthropic handler simply wasn't passing it. tool_choice remains declared on the request model for Anthropic SDK compatibility (the SDK often sets it by default) but is not yet honored. Log a structured warning on each request carrying a non- null tool_choice so the silent drop is visible to operators. * Wire min_p / repetition_penalty / presence_penalty through /v1/messages Align the Anthropic endpoint's sampling surface with /v1/chat/completions. Adds the three fields as x-unsloth extensions on AnthropicMessagesRequest and threads them through all three code paths: server-side tool loop, no-tool plain, and client-side passthrough. The passthrough builder emits "repeat_penalty" (not "repetition_penalty") because that is llama-server's field name; the backend methods already apply the same rename internally. * Fix block ordering and prev_text reset in non-streaming tool path _anthropic_tool_non_streaming was building the response by appending all tool_use blocks first, then a single concatenated text block at the end — losing generation order and merging pre-tool and post-tool text into one block. It also never reset prev_text between synthesis turns, so the first N characters of each post-tool turn were dropped (where N = length of the prior turn's final cumulative text). Rewrite to build content_blocks incrementally in generation order, matching the streaming emitter's behavior: deltas within a turn are merged into the trailing text block, tool_use blocks interrupt the text sequence, and prev_text is reset on tool_end so turn N+1 diffs against an empty baseline. Caught by gemini-code-assist[bot] review on #4981. * Make test_studio_run.py e2e tests pytest-compatible Add a hybrid session-scoped studio_server fixture in conftest.py that feeds base_url / api_key into the existing e2e test functions. Three invocation modes are now supported: 1. Script mode (unchanged) — python tests/test_studio_run.py 2. Pytest + external server — point at a running instance via UNSLOTH_E2E_BASE_URL / UNSLOTH_E2E_API_KEY env vars, no per-run GGUF load cost 3. Pytest + fixture-managed server — pytest drives _start_server / _kill_server itself via --unsloth-model / --unsloth-gguf-variant, CI-friendly The existing _start_server / _kill_server helpers and main() stay untouched so the script entry point keeps working exactly as before. Test function signatures are unchanged — the (base_url, api_key) parameters now resolve via the new fixtures when running under pytest. * Rename test_studio_run.py -> test_studio_api.py The file is entirely about HTTP API endpoint testing (OpenAI-compatible /v1/chat/completions, Anthropic-compatible /v1/messages, API key auth, plus a CLI --help sanity check on the command that runs the API). None of its tests cover training, export, chat-UI, or internal-Python-API concerns. The old name misleadingly suggested "tests for the unsloth studio run CLI subcommand" — the new name reflects the actual scope. Updates: - git mv the file (rename tracked, history preserved) - Rewrite opening docstring to state the API surface focus and call out what is explicitly out of scope - Update all 4 Usage-block path references to the new filename - LOG_FILE renamed to test_studio_api.log - conftest.py fixture import rewritten from test_studio_run to test_studio_api, plus 7 docstring/comment references updated No functional changes to test logic, signatures, or main(). --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> * Fix httpcore asyncgen cleanup in /v1/messages and /v1/completions The earlier fix in 985e92a9 was incomplete: it closed aiter_lines() explicitly but still used `async with httpx.AsyncClient()` / `async with client.stream()` inside the generator. When the generator is orphaned (e.g. client disconnects mid-stream and Starlette drops the StreamingResponse iterator without explicitly calling aclose()), Python's asyncgen finalizer runs the cleanup in a DIFFERENT task than the one that originally entered the httpx context managers. The `async with` exits then trigger httpcore's HTTP11ConnectionByteStream .aclose(), which enters anyio.CancelScope.__exit__ with a mismatched task and raises RuntimeError("Attempted to exit cancel scope in a different task"). That error escapes any user-owned try/except because it happens during GC finalization. Replace `async with` with manual client/response lifecycle in both /v1/messages passthrough and /v1/completions proxy. Close the response and client in a finally block wrapped in `try: ... except Exception: pass`. This suppresses RuntimeError (and other Exception subclasses) from the anyio cleanup noise while letting GeneratorExit (a BaseException, not Exception) propagate cleanly so the generator terminates as Python expects. Traceback observed in user report: File ".../httpcore/_async/connection_pool.py", line 404, in __aiter__ yield part RuntimeError: async generator ignored GeneratorExit ... File ".../anyio/_backends/_asyncio.py", line 455, in __exit__ raise RuntimeError( RuntimeError: Attempted to exit cancel scope in a different task * Expand unsloth studio run banner with SDK base URL and more curl examples Add an explicit "OpenAI / Anthropic SDK base URL" line inside the info box so SDK users don't accidentally copy the bare server URL (without /v1) into their OpenAI/Anthropic SDK constructors and hit 404s. Replace the single /v1/chat/completions curl example with three labeled blocks: chat/completions, Anthropic /messages, and OpenAI Responses. The Anthropic example includes max_tokens (Anthropic SDKs require it even though Studio accepts None). All examples derived from a computed sdk_base_url so the /v1 prefix stays in sync if the public path ever changes. * Hash API keys with HMAC-SHA256 + persistent server secret Stores the HMAC secret in a new app_secrets singleton table. Fixes CodeQL py/weak-sensitive-data-hashing alert on storage.py:74-76, 394-395. Refresh tokens stay on plain SHA-256 (unchanged _hash_token) so existing user sessions survive upgrade — API keys are new on this branch so there is no migration. * Use PBKDF2 for API key hashing per CodeQL recommendation HMAC-SHA256 was still flagged by py/weak-sensitive-data-hashing. Switch to hashlib.pbkdf2_hmac, which is in CodeQL's recommended allowlist (Argon2/scrypt/bcrypt/PBKDF2). Persistent server-side salt stays in app_secrets for defense-in-depth. 100k iterations to match auth/hashing.py's password hasher. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> Co-authored-by: Roland Tannous <rolandtannous@gravityq.ai>	2026-04-13 21:08:11 +04:00
Wasim Yousef Said	8e977445d4	Let recipes use the model loaded in Chat (#4840) ... * feat: inject local model provider into recipe jobs via JWT * feat: auto-generate JWT for local model providers in recipes * feat: add is_local flag to model provider config types and utils * fix(studio): skip endpoint validation for local providers * feat(studio): add local/external model source toggle to provider dialog * feat(studio): thread localProviderNames through model config dialog chain * feat(studio): show 'Local model (Chat)' label for local model_provider configs * fix: hardcode loopback for local endpoint, clear stale creds on toggle * fix: document TOCTOU/JWT rotation, add deferred import comments, fix is_local serialization * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix(studio): clear stale local model state on provider toggle and validation * fix(studio): override empty local endpoint in validation and skip model gate for unused providers * fix(studio): resolve loopback port from app.state, clear stale local provider fields, sync model id on toggle Address review feedback on the local-model-provider flow: - Backend (jobs.py): _resolve_local_v1_endpoint now reads the actual bound port from app.state.server_port (set in run.py after binding) instead of parsing it out of request.base_url, which is wrong behind any reverse proxy or non-default port. The two duplicated urlparse blocks are gone. - Backend (jobs.py): defensively pop api_key_env, extra_headers, extra_body from local providers so a previously external provider that flipped to local cannot leak invalid JSON or rogue auth headers into the local /v1 call. Also dedupe the post-loop assignment and tighten the local-name intersection so empty names cannot match. - Backend (jobs.py): hoist datetime and urllib.parse imports to the top import block for consistency with the rest of the file. - Backend (run.py): expose the bound port on app.state.server_port after the uvicorn server is constructed. - Frontend (model-provider-dialog.tsx): clear extra_headers and extra_body when toggling to local mode. Hidden inputs would otherwise keep stale JSON blocking validate/run. - Frontend (model-config-dialog.tsx): factor the local-aware provider selection logic into applyProviderChange and call it from both onValueChange and onBlur, so manually typing a provider name and tabbing away keeps the model field consistent. - Frontend (recipe-studio.ts store): handle both directions of the is_local toggle in the cascade. external -> local now backfills model: "local" on already-linked model_configs so they pass validation immediately, mirroring the existing local -> external clear path. - Frontend (validate.ts + build-payload.ts): thread localProviderNames into validateModelConfigProviders and skip the "model is required" check for local-linked configs. Local providers do not need a real model id since the inference endpoint uses the loaded Chat model. * fix(studio): narrow store cascade types, sync model placeholder on graph relink and node removal, harden ephemeral port path Loop 2 review fixes: - recipe-studio.ts: type-narrow next.is_local by also checking next.kind === "model_provider". TS otherwise raised TS2339 because next was typed as the union NodeConfig after the spread. The behavior is unchanged but the code now compiles cleanly. - model-config-dialog.tsx: convert the lastProviderRef / providerInputRef ref-during-render pattern (pre-existing react-hooks/refs lint error) to a useEffect that syncs providerInputRef from config.provider. The combobox blur path still uses applyProviderChange and remains stable. - recipe-graph-connection.ts: when a graph drag links a model_provider to a model_config, mirror the dialog applyProviderChange behavior: fill model: "local" if the new provider is local and the model field is blank, clear model when relinking from a local placeholder to an external provider, otherwise leave the model alone. - reference-sync.ts: when a referenced provider node is removed, clear the synthetic model: "local" placeholder along with the provider field, so a future relink to an external provider does not pass validation with a stale value that fails at runtime. - run.py: only publish app.state.server_port when the bound port is a real positive integer; for ephemeral binds (port==0) leave it unset and let request handlers fall back to request.base_url. - jobs.py: _resolve_local_v1_endpoint also falls back when app.state.server_port is non-positive, and uses `is None` instead of the truthy fallback so a literal 0 is handled correctly. * fix(studio): strict is_local check, narrow loaded-model gate to LLM-reachable configs, add scope-server port fallback Loop 3 review fixes: - jobs.py, validate.py: require `is_local is True` instead of truthy check. Malformed payloads such as is_local: "false" or is_local: 1 would otherwise be treated as local and silently rewritten to the loopback endpoint. - jobs.py: _resolve_local_v1_endpoint now tries request.scope["server"] (the actual uvicorn-assigned (host, port) tuple) as a second resolution step before falling back to parsing request.base_url. This covers direct-uvicorn startup paths and ephemeral binds that never publish app.state.server_port. - jobs.py: new _used_llm_model_aliases helper collects the set of model_aliases that an LLM column actually references, and the "Chat model loaded" gate is now only triggered when a local provider is reachable from that set. Orphan model_config nodes on the canvas no longer block unrelated recipe runs. * fix(studio): force skip_health_check on local-linked configs, skip JSON parsing for local providers, local-aware inline editor Loop 4 review fixes: - jobs.py: after rewriting local providers, also force skip_health_check: true on any model_config linked to a local provider. The /v1/models endpoint only advertises the real loaded model id, so data_designer's default model-availability health check would otherwise fail against the placeholder "local" id before the first chat completion call. The inference route already ignores the model id in chat completions, so skipping the check is safe. - builders-model.ts: buildModelProvider now short-circuits for local providers and emits only { name, endpoint: "", provider_type, is_local } without running parseJsonObject on the hidden extra_headers/extra_body inputs. Imported or hydrated recipes with stale invalid JSON in those fields no longer block client-side validate/run. - inline-model.tsx: the model_config branch now accepts an optional localProviderNames prop and mirrors the dialog applyProviderChange behavior. Changing provider to/from a local one auto-fills or clears the "local" placeholder consistently with the other edit paths. - recipe-graph-node.tsx: derive localProviderNames from the store via useMemo (stable identity) and pass it through renderNodeBody to <InlineModel>. Hooks order is preserved by declaring them above the early return for markdown_note nodes. - run.py: minor comment tweak - loop 3 already added the scope-server fallback path, note that in the comment. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: danielhanchen <info@unsloth.ai>	2026-04-08 03:48:22 -07:00
Daniel Han	6d83ad9a28	fix(studio): avoid UnicodeEncodeError on Windows cp1252 consoles (#4699) ... * fix(studio): replace unicode emoji in print() to avoid cp1252 crash on Windows On Windows the default console encoding is cp1252 which cannot encode unicode emoji like U+2705 or U+26A0. bare print() calls with these characters cause a UnicodeEncodeError at runtime. - run.py: replace emoji with ASCII status prefixes [OK] and [WARNING] - format_conversion.py: remove duplicate print() that mirrors the logger.info() call on the next line, and drop the emoji from the log message since loggers handle encoding separately * fix(studio): apply same emoji/print cleanup to parallel VLM conversion path The parallel URL-based conversion logic has the same duplicate print() with emoji that was fixed in the sequential path. Remove the bare print() and drop the emoji from the logger.info() call. * Treat install_python_stack.py failure as fatal in setup.ps1 On Linux/Mac, setup.sh runs under set -euo pipefail so a non-zero exit from install_python_stack.py aborts the installer. On Windows, setup.ps1 had no exit code check -- if the Python script crashed (eg from the cp1252 UnicodeEncodeError), the installer silently continued past the dependency loop and reported success. Studio would then fail at launch with ModuleNotFoundError for structlog, fastapi, and other deps that were never installed. Capture $LASTEXITCODE and exit 1 if the dependency installer fails, matching the error handling pattern already used for PyTorch install. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-30 06:40:47 -07:00
Wasim Yousef Said	887b8cb1c2	fix: add auth + UX improvements to shutdown button (#4642) ... * Studio shutdown button * fix: add auth to shutdown endpoint and improve UX - Add JWT auth (Depends(get_current_subject)) to POST /api/shutdown - Use authFetch instead of bare fetch in shutdown dialog - Only show beforeunload prompt when training is running - Remove Ctrl+W/Cmd+W interception (browsers don't allow it) - Store shutdown task on app.state to prevent GC --------- Co-authored-by: Datta Nimmaturi <venkatadattasainimmaturi@gmail.com> Co-authored-by: Daniel Han <danielhanchen@gmail.com>	2026-03-27 04:36:08 -07:00
Lee Jackson	0233fe7f9c	studio: setup log styling (#4494) ... * refactor(studio): unify setup terminal output style and add verbose setup mode * studio(windows): align setup.ps1 banner/steps with setup.sh (ANSI, verbose) * studio(setup): revert nvcc path reordering to match main * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio(setup): restore fail-fast llama.cpp setup flow * studio(banner): use IPv6 loopback URL when binding :: or ::1 * Fix IPv6 URL bracketing, try_quiet stderr, _step label clamp - Bracket IPv6 display_host in external_url to produce clickable URLs - Redirect try_quiet failure log to stderr instead of stdout - Clamp _step label to column width to prevent negative padding * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add sandbox integration tests for PR #4494 UX fixes Simulation harness (tests/simulate_pr4494.py) creates an isolated uv venv, copies the real source files into it, and runs subprocess tests for all three fixes with visual before/after demos and edge cases. Standalone bash test (tests/test_try_quiet.sh) validates try_quiet stderr redirect across 8 scenarios including broken-version contrast. 39 integration tests total (14 IPv6 + 15 try_quiet + 10 _step), all existing 75 unit tests still pass. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Truncate step() labels in setup.sh to match PS1 and Python The %-15s printf format pads short labels but does not truncate long ones. Change to %-15.15s so labels wider than 15 chars are clipped, matching the PowerShell .Substring(0,15) and Python label[:15] logic. * Remove sandbox integration tests from PR These test files are not part of the styling fix and should not ship with this PR. * Show error output on failure instead of suppressing it - install_python_stack.py: restore _red for patch_package_file warnings (was downgraded to _dim) - setup.ps1: capture winget output and show on failure for CUDA, Node, Python, and OpenSSL installs (was piped to Out-Null) - setup.ps1: always show git pull failure warning, not just in verbose mode * Show winget error output for Git and CMake installs on failure Same capture-and-print-on-failure pattern already used for Node, Python, CUDA, and OpenSSL winget installs. * fix: preserve stderr for _run_quiet error messages in setup.sh The step() helper writes to stdout, but _run_quiet's error header was originally sent to stderr (>&2). Without the redirect, callers that separate stdout/stderr would miss the failure headline while still seeing the log body on stderr. Add >&2 to both step calls inside _run_quiet to match main's behavior. * feat: add --verbose flag to setup and update commands Wire UNSLOTH_VERBOSE=1 through _run_setup_script() so that 'unsloth studio update --verbose' (and the deprecated 'setup') passes the flag to setup.sh / setup.ps1 / install_python_stack.py. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han <danielhanchen@gmail.com>	2026-03-27 03:12:48 -07:00
Daniel Han	6d6008a1ef	Add PID file tracking and unsloth studio stop command (#4598) ... * Add PID file tracking and `unsloth studio stop` command On macOS the .app shortcut launches Studio via osascript into a Terminal window, then the launcher script exits. The server process runs outside of the launcher's context with no PID file, so there is no straightforward way to find or stop it. This adds: - PID file at ~/.unsloth/studio/studio.pid, written after the server starts and removed on graceful shutdown or via atexit - `unsloth studio stop` command that reads the PID file and sends SIGTERM (or taskkill on Windows) to shut down the server The PID file is only removed if it still contains the current process ID, avoiding races when a new server instance replaces a crashed one. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Move atexit PID cleanup into run_server() The atexit registration was only in the __main__ block, so it did not cover the `unsloth studio` CLI path that calls run_server() directly via studio_default(). Moving it into run_server() ensures the PID file is cleaned up on unexpected exit regardless of entry point. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-03-25 08:27:27 -07:00
Daniel Han	5916bcb2e3	Fix Studio port conflict detection for loopback addresses (#4532) ... * Fix port conflict detection when loopback address is held by another process * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Use getaddrinfo for IPv6 host support, restore emojis in terminal output * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Guard against conn.pid being None in _get_pid_on_port psutil.net_connections() can return entries with pid=None when the current user lacks privileges to see the owning process (common on macOS without root, Windows without admin, and some Linux configs). psutil.Process(None) does not raise -- it silently returns the current process, which would make the warning incorrectly blame Unsloth Studio itself for blocking the port. Skip entries with pid=None so the caller falls back to the generic "port is already in use" message instead. * Update studio/backend/run.py Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2026-03-23 22:34:47 -07:00
Daniel Han	797ddd201e	Fix Studio silently exiting on Windows without error output (#4527) ... * Fix Studio silently exiting on Windows without error output On Windows, `unsloth studio` launches a child process via subprocess.Popen to run the server in the studio venv. If the child crashes (e.g. due to a missing package), the parent just calls typer.Exit(rc) with no message -- the user sees "Launching Unsloth Studio... Please wait..." and then the prompt returns with zero feedback. Root cause: `data_designer_unstructured_seed` is imported at the top level in seed.py. If this package is not installed in the studio venv, the entire import chain (seed.py -> routes/__init__.py -> main.py -> run_server()) crashes with ModuleNotFoundError. Since run.py has no try/except around run_server() and studio.py does not report nonzero exit codes, the failure is completely silent. Changes: - run.py: wrap run_server() in try/except, print clear error with traceback to stderr. Also reconfigure stderr encoding on Windows so tracebacks with non-ASCII paths do not cause secondary failures. - studio.py: print an error message when the child process exits with a nonzero code on Windows, so the user knows something went wrong. - seed.py: make data_designer_unstructured_seed import optional with a try/except fallback. The server starts normally and only returns HTTP 500 if the unstructured seed endpoints are actually called. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Skip Anaconda/Miniconda Python when creating Studio venv on Windows Conda-bundled CPython ships modified DLL search paths that prevent torch from loading c10.dll on Windows. The Studio server fails silently at startup because the venv was created with conda's Python. Standalone CPython (python.org, winget, uv) does not have this issue. Both install.ps1 and setup.ps1 now skip any Python binary whose path contains conda, miniconda, anaconda, miniforge, or mambaforge when selecting the interpreter for the studio venv. If only conda Python is available, the scripts print an error with instructions to install standalone CPython. * Fix multi-file preview crash and improve setup.ps1 Python discovery Addresses review findings [10/10] and [8/10]: 1. seed.py: _read_preview_rows_from_multi_files() had a hard import of build_multi_file_preview_rows inside the function body, bypassing the optional-plugin guard. Moved it into the top-level try/except block and added a None guard matching the other functions. 2. setup.ps1: Python discovery now probes py.exe (Python Launcher) first, uses Get-Command -All to look past conda entries that shadow standalone CPython further down PATH, skips WindowsApps stubs, and resolves the actual executable path so venv creation does not re-resolve back to a conda interpreter. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Check sys.base_prefix to catch venvs created from conda Python A venv created from conda Python (e.g. C:\Users\danie\.venv) has a path that does not contain "conda", but sys.base_prefix still points to the conda install (e.g. C:\Users\danie\miniconda3). The previous path-only check missed this case entirely. Both install.ps1 and setup.ps1 now use a Test-IsConda helper that checks both the executable path AND sys.base_prefix against the conda/miniconda/anaconda/miniforge/mambaforge pattern. This catches: - Direct conda Python executables - Venvs created from conda Python (base_prefix reveals the origin) * Fix install.ps1 passing version string to uv venv instead of resolved path Find-CompatiblePython returned a bare version string (e.g. "3.13") which was passed to `uv venv --python 3.13`. uv performs its own interpreter discovery and can resolve that version string back to a conda Python, defeating the entire conda-skip logic. Now Find-CompatiblePython returns a hashtable with both .Version (for display) and .Path (the resolved absolute executable path). The venv is created with `uv venv --python <absolute-path>`, ensuring uv uses the exact interpreter we validated. * Quote resolved Python path in uv venv call for paths with spaces --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-03-22 08:23:03 -07:00
Daniel Han	100b8857f2	Fix Studio crash on Anaconda/conda-forge Python (#4484) ... * Fix Studio crash on Anaconda Python due to platform._sys_version() parse failure Anaconda and conda-forge modify sys.version to include distributor metadata between pipe characters, e.g.: 3.12.4 | packaged by Anaconda, Inc. | (main, ...) [MSC v.1929 ...] Python's platform._sys_version() has a hardcoded regex that cannot parse this format, raising ValueError. CPython closed this as "not planned" (cpython#102396) since Anaconda modified the binary. This breaks the import chain: run.py -> structlog -> rich -> attrs, which calls platform.python_implementation() at module scope. Fix: before any library imports, strip the pipe segments, parse the cleaned version string via the standard parser, and cache the result under the original sys.version key so all subsequent platform calls hit the cache. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add defensive fallback for unpaired pipe edge cases in version patch Address Gemini review suggestion: if the paired-pipe regex leaves residual pipes (hypothetical single-pipe distributor metadata), fall back to extracting the version number and the parenthesized build info directly. Wrap the entire patch in try/except so unexpected version string formats degrade gracefully instead of crashing the patch itself. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Refactor into shared _platform_compat module, cover colab.py entrypoint Address reviewer feedback: 1. Extract the Anaconda/conda-forge sys.version fix into a shared _platform_compat.py module that wraps platform._sys_version() with a retry-on-ValueError fallback. This is more robust than cache-seeding because it handles all future platform._sys_version() calls, not just the first one. 2. Import the fix from both run.py and colab.py entrypoints, so Studio no longer crashes on Anaconda Python regardless of the launch path. 3. The wrapper is idempotent (guarded by a flag) and handles edge cases: paired pipes (Anaconda, conda-forge), unpaired pipes (hypothetical), and standard CPython strings (no-op since ValueError is never raised). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Replace monkey-patch with cache-prime, fix colab.py duplicate sys.path, cover main.py - Rewrite _platform_compat.py: replace function-wrapping monkey-patch with one-shot cache seed (_seed_sys_version_cache). Parses cleaned sys.version once and seeds platform._sys_version_cache so the stdlib parser never sees the problematic Anaconda/conda-forge pipe-delimited string. No function replacement, no idempotency flag, no reload edge cases. - colab.py: remove duplicate backend_path sys.path insertion after _bootstrap_studio_venv(). The early insertion (before _platform_compat import) already covers it. This also fixes backend/ ending up behind venv site-packages in sys.path ordering. - run.py: move PYTHONWARNINGS=ignore before _platform_compat import to preserve original intent of suppressing warnings early. - main.py: add sys.path + _platform_compat import before route imports, covering the direct `uvicorn main:app` launch path. - Add test_platform_compat.py with 7 tests covering Anaconda, conda-forge, and standard CPython version strings, plus the loggers import chain. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Remove test_platform_compat.py from PR * Handle Format B conda-forge version strings with duplicate paren groups Some conda-forge builds produce sys.version with the build info both before and after the pipe label (e.g. "3.9.7 (default, ...) | packaged by conda-forge | (default, ...) \n[GCC 7.5.0]"). After stripping the pipe segment, two consecutive (...) groups remain, which still fails platform._sys_version(). Add a second regex pass to drop the duplicate paren group. * Guard _sys_version call with try/except to avoid making things worse If the cleaned version string is still unparseable by the stdlib regex (e.g. nested parens, exotic multi-pipe formats), silently give up instead of letting ValueError propagate at import time -- which would be a worse crash than the original deferred one. --------- Co-authored-by: Daniel Han <danielhanchen@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-03-22 05:36:55 -07:00
Velsa	981f477e31	fix: reconfigure stdout to UTF-8 on Windows to prevent UnicodeEncodeError on startup (#4493) ... * fix: reconfigure stdout UTF-8 on Windows to prevent UnicodeEncodeError from emoji * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: default frontend_path when None to fix blank page when venv is pre-activated * Restore Windows UTF-8 stdout fix dropped in earlier commit The cp1252 console encoding on Windows cannot render emoji characters used in startup messages (e.g. print("✅ Frontend loaded ...")). This causes UnicodeEncodeError and crashes the server before it starts. Place sys.stdout.reconfigure(encoding="utf-8", errors="replace") at the top of run_server(), unconditionally before any print() or structlog call, so all emoji output is covered -- including the frontend status messages and silent=True paths that the original placement missed. Guarded by sys.platform == "win32" and hasattr check, so it is a no-op on Linux/macOS and safe in non-standard stdout environments (Jupyter, piped IO). * fix: preserve run_server(None) as headless, fix CLI frontend kwarg Remove the frontend_path=None fallback in run_server() that changed None from "headless/API-only" to "mount bundled frontend", breaking backwards compatibility for embedders. The blank-page bug was actually caused by the CLI wrappers always passing frontend_path=frontend (even when frontend=None), which overrode run_server()'s default. Fix studio.py and ui.py to only pass frontend_path when the user explicitly sets --frontend. * fix: use timeout loop for shutdown event in ui command Match studio_default()'s shutdown loop that uses a 1-second timeout on Event.wait(). Without a timeout, the bare wait() blocks at the C level on Linux, preventing Python from delivering SIGINT (Ctrl+C). --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han <danielhanchen@gmail.com>	2026-03-22 04:49:59 -07:00
Manan Shah	6f129a214b	Fix Install commands for Windows + 1 line installs (#4447) ... * One liner setup for unsloth studio * Fix install scripts: system deps, activation bugs, curl/wget support - install.sh: detect platform (macOS/Linux/WSL) and check for missing system dependencies (cmake, git, build-essential, libcurl4-openssl-dev). Prompt user once for permission to install all missing packages via brew (macOS) or sudo apt-get (Linux/WSL). Add wget fallback via download() helper since curl is not always present on minimal Linux installs. Fix nested curl|sh stdin stealing by downloading uv installer to a tempfile first. Replace venv activation (no-op in a pipe subshell) with explicit --python flag for uv pip install and direct venv binary invocation. Add idempotency guard for venv creation. Redirect stdin on unsloth studio setup to prevent pipe consumption. On macOS, check for Xcode Command Line Tools and trigger install if missing. - install.ps1: wrap script body in Install-UnslothStudio function so that errors use return instead of exit (exit kills the terminal when run via irm|iex). Remove activate.ps1 invocation entirely -- use explicit --python path for uv pip install and & $UnslothExe for studio setup. This avoids both the child-scope activation bug (& vs dot-source) and the execution policy error on default Windows systems. Add winget availability check with clear error message. Fix PATH refresh to append registry paths instead of replacing the session PATH. Add uv installer fallback via astral.sh PowerShell script if winget install does not put uv on PATH. Broaden Python version check to accept 3.11-3.13. Add idempotency guard for venv creation. - README.md: add wget one-liner alternative for systems without curl. * Fix Tailwind CSS v4 .gitignore bug on Windows (#4444) - Add .gitignore hiding workaround to setup.ps1 (matching existing setup.sh logic) so venv .gitignore files containing "*" don't prevent Tailwind's oxide scanner from finding .tsx source files - Add CSS size validation to setup.sh, setup.ps1, and build.sh to catch truncated Tailwind builds early - Remove stray force-rebuild overrides that made the "skip build if current" cache check dead code in both setup scripts - Add rm -rf dist to build.sh to force clean rebuilds for wheel packaging * Change default port 8000 to 8888, fix installer bugs, improve UX - Change default Studio port from 8000 to 8888 across all entry points (run.py, studio.py, ui.py, colab.py, vite.config.ts, setup scripts) - Update launch banner: "Launching with studio venv..." to "Launching Unsloth Studio... Please wait..." - Add "Open your web browser" banner and rename labels (Local -> Local Access, External -> Worldwide Web Address) - Fix venv idempotency: check for bin/python instead of just directory existence, clean up partial venvs on retry - Fix build.sh CSS validation: handle empty CSS case that silently bypassed the check with "integer expression expected" - Fix install.sh sudo handling: try apt-get without sudo first (works when root), then escalate with per-package tracking and user prompt - Fix install.ps1: check exit code from studio setup, fail on error - Add pciutils to WSL GGUF build dependencies - Apply same smart apt-get escalation pattern to studio/setup.sh * Use detected Python version for venv, abort on non-apt Linux - install.ps1: detect existing Python 3.11/3.12/3.13 and use that version for venv creation instead of always forcing 3.13 - install.sh: exit with error on non-apt Linux distros when required packages cannot be auto-installed, instead of silently continuing * Make sudo permission prompt more prominent with warning banner * Add Accept [Y/n] sudo prompt to studio/setup.sh for consistency * Fix native command exit code handling and sudo decline flow install.ps1: Add $LASTEXITCODE checks after winget (Python), uv venv, and uv pip install calls. $ErrorActionPreference only catches PowerShell cmdlet errors, not native executable failures. The Python check also handles winget returning non-zero for "already installed". setup.sh: Skip llama-server build when user declines sudo or sudo is unavailable. Previously the script continued to section 8 which would fail with confusing errors (e.g. "gcc: command not found") since build-essential was never installed. * Move rm -rf llama.cpp inside build branch to preserve existing install When _SKIP_GGUF_BUILD is set (user declined sudo or sudo unavailable), the previous rm -rf would destroy an already-working llama-server before the skip check ran. Move it inside the else branch so existing builds are preserved when the rebuild is skipped. --------- Co-authored-by: Daniel Han <danielhanchen@users.noreply.github.com> Co-authored-by: Daniel Han <danielhanchen@gmail.com>	2026-03-19 02:09:09 -07:00
Daniel Han	0acd1c7eec	studio: improve onboarding UX, tooltips, and training defaults (#4355) ... * studio: improve onboarding UX, tooltips, and training defaults - Change splash text to "Train and run LLMs locally" - Add "Chat Only" card with BubbleChatIcon to skip directly to chat - Add Skip/Skip to Chat buttons in sidebar and footer - Back button on step 1 returns to splash screen instead of being disabled - Change "Watch video guide" to "Get started with our guide" with new URL - Update intro text to mention all model types + chat - Make all tooltips clickable (in addition to hover) via React context - Strip surrounding quotes from pasted HF tokens - Rename "Eval Split" to "Evaluation Split" - Add SparklesIcon to "Auto Detect" format option - Change step 4 heading to "Choose your training parameters" - Default max_steps to 60 - Learning rate displayed in scientific notation with +/- stepper - Context length options capped by model's max_position_embeddings (via AutoConfig) - Fix "QLORA"/"LORA" to "QLoRA"/"LoRA" in summary step - Backend: add max_position_embeddings to model config endpoint * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * compare for 2 diff models * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * resolving gemini comments * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: disable thinking for Qwen3.5 <9B and always for AI Assist - Change Qwen3.5 thinking threshold from <=2B to <9B (0.8B, 2B, 4B all disable thinking by default; 9B+ enables it) - Always pass enable_thinking=False in AI Assist helper calls (_run_with_helper and _generate_with_backend) regardless of chat thinking settings * studio: address PR review comments - Extract _get_max_position_embeddings helper to DRY config extraction - Fix "Skip to Chat" to navigate to /chat on step 1 (was /studio) * fix: comment out debug print statements * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: skip Shiki highlighting for incomplete SVG code fences While streaming SVG content, the syntax highlighter (Shiki) re-parses the entire growing SVG on every token, blocking the main thread and freezing the code area until the fence closes. Show a plain-text preview for incomplete SVG fences instead, similar to how Mermaid diagrams show a placeholder while streaming. * studio: fix default top_k from 50/40 to 20 for chat inference Per Qwen3.5 docs (unsloth.ai/docs/models/qwen3.5), top_k should be 20 for both thinking and non-thinking modes. The model-specific config in inference_defaults.json already had top_k=20 for Qwen3.5, but the generic fallback defaults were wrong: - Frontend DEFAULT_INFERENCE_PARAMS.topK: 50 -> 20 - Backend generate_chat_completion top_k: 40 -> 20 - Backend generate_chat_completion_with_tools top_k: 40 -> 20 - Frontend title generation top_k: 40 -> 20 * studio: set universal inference defaults for unknown models Default params for any model without specific config: temperature=0.6, top_p=0.95, top_k=20, min_p=0.01, presence_penalty=0.0, repetition_penalty=1.0 Models with entries in inference_defaults.json (Qwen3.5, Gemma-3, Llama, etc.) override these with their recommended values. Updated in: frontend DEFAULT_INFERENCE_PARAMS, backend Pydantic request models, and backend generate_chat_completion defaults. * studio: only trust_remote_code for unsloth/ models in AutoConfig Only set trust_remote_code=True when the model name starts with "unsloth/". All other models default to False for safety. * studio: move Generating spinner above the composer The "Generating" spinner was below the send message bar, causing the bar to jump up and down. Move it above the composer in both the regular thread view and the welcome/empty view. * studio: adjust toast close button position away from edge Move the X close button on toasts (like "Starting model...") from top-1.5 to top-3 and add right-3, giving more breathing room from the top-right corner. * studio: make Think button smaller with tighter icon-text gap Reduce gap from 1.5 to 0.5, padding from px-2.5/py-1 to px-2/py-0.5, and icon from size-3.5 to size-3. * studio: multiple onboarding and chat UX improvements - Move Generating spinner above composer (fixes jumping send bar) - Make Think button smaller with tighter icon-text gap - Chat card now inside grid (same size as Audio/Embeddings cards) - Rename "Chat Only" to "Chat" - Chat card requires Continue to proceed (no auto-advance) - Continue on Chat selection skips onboarding and goes to /chat - Tooltip (i) click on Chat card doesn't trigger navigation - Step 1 footer Back button goes back to splash (label is "Back") - Splash "Skip Onboarding" renamed to "Skip to Chat", navigates to /chat - Toast close button moved away from edge * studio: align Skip to Chat button, add Skip to footer - Sidebar "Skip to Chat" now uses primary (green) Button style with arrow icon, full width, aligned like step items. Shows on all steps. - Footer: added "Skip" outline button next to Continue that goes directly to /studio with progress saved (markOnboardingDone) * studio: change default max steps from 30 to 60 in toggle hook The DEFAULT_MAX_STEPS in use-max-steps-epochs-toggle.ts was still 30, used as fallback when toggling from epochs back to max steps. * studio: extend context length options to 262K CONTEXT_LENGTHS now includes 65536, 131072, 262144 in addition to the existing 512-32768 range. The onboarding step filters these by the model's max_position_embeddings (e.g. Nemotron-3-Nano-4B has 262144), showing powers of 2 up to the model's maximum. * studio: auto-select LoRA vs QLoRA based on model size and GPU memory After selecting a model in onboarding, detect the total model weight file size from HF Hub (safetensors/bin files). Then estimate memory needed: model_size_gb * 1.5 * context_scale, where context_scale is: - <=8192 tokens: 1.0x - >8192 tokens: 1.7x - >=16384 tokens: 2.0x - >=32768 tokens: 4.0x If the estimate fits in free GPU VRAM, default to LoRA (16-bit). Otherwise default to QLoRA (4-bit). Backend changes: - Add model_size_bytes to ModelDetails (models.py) - Add _get_model_size_bytes() using HfApi.repo_info (routes/models.py) - Add vram_free_gb to get_gpu_summary (hardware.py) Frontend changes: - Add autoSelectTrainingMethod() in training-config-store.ts - Called after model defaults are loaded - Add model_size_bytes to ModelConfigResponse type - Add vramFreeGb to HardwareInfo hook * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: rename "Importing ML libraries..." to "Importing Unsloth..." * studio: show model/dataset in training status, fix LoRA/QLoRA casing - Training status now shows 'Training "model_name"' and 'Dataset = ...' instead of generic "Starting training..." - Fix Studio progress section to show QLoRA/LoRA instead of QLORA/LORA * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: rename 'Skip to Chat' to 'Skip Onboarding' on splash screen * studio: add presence_penalty support for chat inference Add presence_penalty as a parameter across the full stack: - Backend: llama_cpp.py generate_chat_completion/with_tools, Pydantic models (inference.py), routes/inference.py pass-through - Frontend: InferenceParams type, DEFAULT_INFERENCE_PARAMS (0.0), chat-adapter.ts payload, chat-settings-sheet.tsx slider (0-2), model defaults loading from inference_defaults.json - Set Qwen3.5 default presence_penalty to 1.5 per official docs - Default for unknown models is 0.0 (off) * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: fix Chat card deselecting Text and aligning with other cards * studio: fix presence_penalty not loading from inference defaults The inference_config.py load_inference_config() was not including presence_penalty in the returned config dict, so the Qwen3.5 default of 1.5 from inference_defaults.json never reached the frontend. Added it to the config builder. * studio: add delete button for cached models in model selector Add trash icon on each downloaded model row (GGUF and safetensors) with confirmation dialog. Backend DELETE /api/models/delete-cached endpoint uses huggingface_hub scan_cache_dir + delete_revisions to cleanly remove cached repos, refusing if the model is currently loaded. * studio: restore inference defaults, reasoning, and tools on page refresh On page refresh with a model already loaded, the frontend was not re-applying model-specific inference defaults (presence_penalty, temperature, etc.) or restoring reasoning/tools support flags. Backend: Add inference config, supports_reasoning, supports_tools, and context_length to InferenceStatusResponse. Frontend: In the refresh callback, when an active model is detected, apply mergeRecommendedInference and restore reasoning/tools flags with proper Qwen3.5 size-based defaults. * studio: fix delete dialog closing before async completes Prevent AlertDialogAction's default close behavior with e.preventDefault() so the dialog stays open during deletion. Also block onOpenChange dismiss while deleting is in progress. * fix: add Dict and Any imports to inference models * studio: fix Qwen3.5 reasoning threshold in frontend load path The frontend loadModel handler had the old threshold (<=2) for disabling reasoning on small Qwen3.5 models. Changed to <9 to match the backend. This was causing 4B to not properly disable thinking by default when auto-loaded. * studio: move GGUF delete to per-variant level For GGUF repos, the trash icon now appears on each downloaded variant row inside the quantization expander instead of on the repo-level row. Backend accepts optional variant param to delete specific GGUF files (blob + symlink) rather than the entire repo cache. * studio: restore ggufContextLength on page refresh The Max Tokens slider was capped at 32768 on page refresh because ggufContextLength was not restored from the status response. Now set it from statusRes.context_length on reconnect. * fix: remove <think> from Qwen3.5 response template marker The train-on-responses-only feature uses template markers to find where the assistant response starts. The Qwen3.5 response marker included '<think>\n' which is only present when thinking mode is enabled. With thinking disabled (default for <9B), the marker never matched, causing 100% of samples to be dropped. Changed response marker from '<|im_start|>assistant\n<think>\n' to '<|im_start|>assistant\n' which works regardless of thinking mode. * studio: fix sloth ASCII art alignment in training overlay * fix: correct sloth ASCII art alignment to match Unsloth banner * studio: add Python and terminal tool calling to chat Register python and terminal tools alongside web search. Python executor validates imports (stdlib only) via unsloth_zoo rl_environments, runs code in a subprocess sandbox with 5-min timeout and cancel support. Terminal executor blocks dangerous commands (rm, sudo, etc.) and runs in a temp directory. Update llama_cpp tool loop to show tool-specific status messages and pass cancel_event through to executors. Rename composer toggle from "Search" to "Tools" and show TerminalIcon for execution status pills. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: fix Nemotron/transformers 5.x support, onboarding navigation, port binding Backend: - Dynamic transformers 5.x detection via tokenizer_config.json fetch (checks for TokenizersBackend class, cached per-model) - Bump transformers 5.x version from 5.2.0 to 5.3.0 across all workers, setup scripts (setup.sh, setup.ps1) - Auto-enable trust_remote_code for unsloth/* models needing transformers 5.x (workaround for NemotronH config parsing bug in transformers) - Auto-install mamba-ssm/causal-conv1d for SSM models (NemotronH, Falcon-H1) with --no-build-isolation --no-deps to avoid torch version conflicts - Add SO_REUSEADDR to port check in run.py (fixes Colab proxy stale connection falsely reporting port as in-use) Frontend: - Fix "Skip to Chat" navigation: use window.location.href instead of React Router navigate() to bypass useEffect redirect race - Fix "Skip Onboarding" on splash: navigates to /studio (not /chat) - Fix onboarding guard: only check isOnboardingDone() on initial mount - Fix Chat card on step 1: add sr-only spacer for consistent alignment - Fix Chat+Text both selected: clear RadioGroup value when Chat is selected * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: split tools toggle into Search and Code buttons Replace the single "Tools" toggle with two independent toggles: - "Search" (globe icon) enables web search only - "Code" (terminal icon) enables Python and terminal execution Add enabled_tools list field to the inference payload so the backend only registers the tools the user has toggled on. Both toggles appear in the main composer and the compare composer. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: fix tool calling import validation and error logging Replace unsloth_zoo-dependent import checker with a standalone ast-based validator using sys.stdlib_module_names. This properly blocks non-stdlib imports (numpy, requests, etc.) and returns a clear error message to the model so it can rewrite using only stdlib. Add full traceback to tool streaming error logs for debugging. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: parse gpt-oss harmony channels for clean safetensors chat output gpt-oss models emit multi-channel output via harmony protocol tokens (<|channel|>analysis<|message|>... and <|channel|>final<|message|>...). TextIteratorStreamer with skip_special_tokens=True strips the special tokens but leaves channel names concatenated with content, producing garbled output like "analysisWe need to...assistantfinalHello!". Add HarmonyTextStreamer that decodes with skip_special_tokens=False, parses harmony markup via regex, and emits <think>analysis</think> for the analysis channel and plain text for the final channel -- reusing the existing frontend reasoning UI. Also expose supports_reasoning=True for non-GGUF gpt-oss models in the /status endpoint so the frontend enables the Think toggle. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: use unsloth_zoo for Python sandbox validation Set UNSLOTH_IS_PRESENT=1 and import check_python_modules and check_signal_escape_patterns directly from unsloth_zoo instead of a standalone fallback. This gives us the full Unsloth validation including stdlib-only import checks and signal/timeout escape pattern detection. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: allow all imports in Python tool sandbox Remove stdlib-only import restriction. Keep signal escape pattern detection via unsloth_zoo for safety. * studio: fix ReadTimeout on tool streaming final pass The 0.5s read timeout used for cancel-checking during streaming also fires when waiting for the first response from llama-server (e.g. reasoning model thinking for 15+ seconds). Add _stream_with_retry() context manager that retries on ReadTimeout while checking cancel_event, so the model has unlimited time to think before producing the first token. Applied to both the regular streaming path and the tool-calling final pass. * fix: rewrite HarmonyTextStreamer with stateful incremental parsing The delta-on-transformed approach had two critical bugs: 1. Before the full <|channel|>X<|message|> pattern was complete, the strip-tokens fallback emitted "analysis" as plain text. Then when the regex matched, _transform returned a completely different format (<think>...</think>) and the delta was computed against the wrong base string, producing fragments like "think>", "nk>", ">". 2. Even with full matches, the closing </think> tag shifted position as content grew, so text[prev_len:] produced garbled deltas. Replace with stateful incremental parsing that: - Buffers until a complete channel+message pair is seen - Emits <think> once when analysis channel first appears - Streams analysis content deltas (computed on channel content directly) - Emits </think> once when final channel first appears - Streams final content deltas - Closes open think tags in end() Also skip the generic all_special_tokens stripping in _clean_generated_text for gpt-oss since HarmonyTextStreamer already produces clean output and the generic stripping was mangling <think> tags. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: strip all <|...|> tokens in gpt-oss cleanup, not just harmony subset The gpt-oss tokenizer has added tokens like <|return|> (id=200002) that are not part of the harmony channel protocol but can leak into output. The previous regex only stripped channel|message|start|end tokens. Broaden the _clean_generated_text regex for gpt-oss to <\|[a-z_]+\|> which catches all pipe-delimited tokens (return, constrain, reserved, etc.) without matching <think>/<\/think> tags. Verified: gpt-oss all_special_tokens are only <|return|>, <|reserved_200017|>, <|startoftext|> -- none overlap with <think>. The harmony tokens (channel, message, start, end) are added_tokens but not in all_special_tokens. * fix: hide config-only model repos from cached models list Repos that only have metadata/config files cached (no .safetensors or .bin weight files) were showing up in the Downloaded list with tiny sizes like "1.8 KB" or "24 KB". These are just leftover config snapshots from architecture checks, not usable models. Filter the cached-models endpoint to only include repos that contain actual model weight files (.safetensors or .bin). * studio: fix toast description text contrast in dark mode Add explicit !text-muted-foreground to toast description classNames so secondary text (e.g. "Releases VRAM and resets inference state.") is readable in dark mode. * studio: fix Chat card icon alignment with size-4 spacer Replace sr-only span (takes no space) with a size-4 shrink-0 div matching the RadioGroupItem dimensions in other cards, so the Chat icon aligns vertically with Text/Audio/Vision/Embeddings icons. --------- Co-authored-by: workspace <user@workspace.local> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Manan17 <shahmanan170602@gmail.com> Co-authored-by: Roland Tannous <rolandtannous@gravityq.ai>	2026-03-17 07:46:07 -07:00
Roland Tannous	08b5879101	fix: Ctrl+C not terminating backend on Linux (#4316) ... * fix: Ctrl+C not breaking out of backend on Linux threading.Event.wait() without a timeout blocks at the C level on Linux, preventing Python from delivering SIGINT. Use a 1-second timeout loop so the interpreter can process pending signals. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-03-16 11:58:09 +04:00
Roland Tannous	0818f78617	Graceful shutdown on Windows (signal handlers for Ctrl+C) (#4306) ... * fix: graceful shutdown on Windows (signal handlers for Ctrl+C) * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>	2026-03-16 03:01:15 +04:00
Daniel Han	928868f07d	studio: auto-find free port if requested port is in use ... If the requested port (default 8000) is already in use, auto- increment and try the next port, up to 20 attempts. Prints a message like "Port 8000 is in use, using port 8001 instead". Previously, if port 8000 was busy, uvicorn would fail with "[Errno 98] address already in use" and the studio would not start. Now it gracefully finds the next free port. Uses socket.bind() to check availability before starting uvicorn. Cross-platform (Linux, macOS, Windows).	2026-03-15 05:24:06 -07:00
Roland Tannous	47654cb91c	Final cleanup	2026-03-12 18:28:04 +00:00
Roland Tannous	a2baf80511	Update license headers	2026-03-12 17:23:10 +00:00
Roland Tannous	6f77c63229	refactor: remove project_root passing, use self-resolved paths and ~/.unsloth/studio ... - Workers now compute backend_path and venv_t5 locally via Path(__file__) - Moved .venv_t5 to ~/.unsloth/studio/.venv_t5 - Added ensure_studio_directories() call on server startup - Expanded CLI studio command into sub-app with setup subcommand	2026-03-11 20:32:18 +00:00
Roland Tannous	817f2e8dcc	feat: integrate structlog, configure workers for prod logging, and migrate print statements	2026-03-11 12:33:16 +00:00
Roland Tannous	d882678fe4	Add AGPL-3.0 SPDX headers to all source files	2026-03-09 20:17:45 +00:00
Roland Tannous	6b2a777f97	fix path in run_server	2026-02-14 05:06:17 +00:00
Roland Tannous	f07b919385	change default frontend path in run.py to studio/frontend/dist	2026-02-14 05:02:26 +00:00
Roland Tannous	5f155010f6	read external ips with fallback to standard notation 0.0.0.0	2026-02-13 10:28:20 +00:00
Roland Tannous	837596a9e7	feat: show external IP in startup banner	2026-02-13 10:23:12 +00:00
Roland Tannous	4c791bd5aa	feat(datasets): check-format to return preview samples	2026-02-12 11:25:47 +00:00
Roland Tannous	544d6944d1	root studio folder	2026-02-02 09:13:49 +00:00

Renamed from backend/run.py (Browse further)