The model config, vision-check, and embedding-check requests appended the Hugging Face token as ?hf_token=..., which leaks it into server access logs, proxy logs, and browser history for gated/private models. Send it via the existing X-Unsloth-HF-Token header (hubTokenHeader) instead, and read it on the backend through the standard get_hf_token dependency, matching the picker's template routes. Also drop two catch-block comments that just restated the code. |
||
|---|---|---|
| .. | ||
| data_recipe | ||
| .gitkeep | ||
| __init__.py | ||
| auth.py | ||
| chat_history.py | ||
| datasets.py | ||
| export.py | ||
| inference.py | ||
| llama.py | ||
| mcp_servers.py | ||
| models.py | ||
| preview.py | ||
| prompts.py | ||
| providers.py | ||
| rag.py | ||
| settings.py | ||
| training.py | ||
| training_history.py | ||
| training_vram.py | ||