@tuned-tensor/cli 0.13.0-beta.0 → 0.13.0

package/README.md

@@ -8,19 +8,57 @@
 
 ## Cloud sunset
 
-This release unregisters the hosted API commands (`tt auth`, `tt push`,
-`tt balance`, `tt topup`, `tt cloud`, and the rest of the managed tree). The
-modules remain in the repository so they can be restored later. `tt local …`
-is kept as a hidden alias; new scripts should call `tt run`, `tt doctor`,
-`tt runs list`, and so on directly.
+This release unregisters the hosted API commands (`tt auth`, `tt publish`,
+`tt push`, `tt balance`, `tt topup`, `tt cloud`, and the rest of the managed
+tree). The modules remain in the repository so they can be restored later.
+`tt local …` is kept as a hidden alias; new scripts should call `tt run`,
+`tt doctor`, `tt runs list`, and so on directly.
+
+## Migrating from 0.11
+
+`0.13` is the local-only CLI. If you are coming from `0.11.0`:
+
+- Call `tt run`, `tt doctor`, and `tt serve` at the root. `tt local …` still
+  works as a hidden alias.
+- Hosted account commands (`tt auth`, `tt publish`, `tt push`, and the rest)
+  are unregistered.
+- `Qwen/Qwen3.5-2B` is pinned to Hugging Face snapshot
+  `15852e8c16360a2fea060d615a32b45270f8a8fc`. Prefetch, train, eval, and serve
+  reject any other revision.
+- `tt serve active` fails unless an adapter is activated. Activation requires
+  a `generalRegression` suite in `local-runner.json`.
+- `tt info` reports `status: local`.
 
 ## Install
 
+On Linux or macOS:
+
 ```bash
-npm install -g @tuned-tensor/cli
+curl -fsSL https://tunedtensor.com/install.sh | sh
 tt --version
 ```
 
+The installer bootstraps Node.js 22.19+ if needed, installs
+`@tuned-tensor/cli` with npm `--ignore-scripts`, and falls back to
+`~/.local` when the global npm prefix is not writable. Inspect it first
+with `curl -fsSL https://tunedtensor.com/install.sh | less`. Pin a
+dist-tag or version on `sh`, not `curl`:
+
+```bash
+curl -fsSL https://tunedtensor.com/install.sh | TT_VERSION=beta sh
+curl -fsSL https://tunedtensor.com/install.sh | TT_VERSION=0.13.0 sh
+```
+
+Or install the package directly:
+
+```bash
+npm install -g --ignore-scripts @tuned-tensor/cli
+tt --version
+```
+
+Uninstall with `npm uninstall -g @tuned-tensor/cli` (add
+`--prefix ~/.local` if the curl installer used that prefix).
+
 Node.js 22.19.0 or newer is required. Local training additionally needs
 [`uv`](https://docs.astral.sh/uv/) and a supported NVIDIA CUDA host; the locked
 Python runner ships with the npm package and is prepared on first use.
@@ -67,7 +105,7 @@ If a newer stable release is available it recommends
 checks are ignored.
 
 ```text
-tt v0.13.0-beta.0
+tt v0.13.0
 agent anthropic/claude-sonnet-4-5 · workflow model base
 ctrl+c stop/clear · ctrl+d exit · /help commands · tab complete
 
@@ -173,7 +211,8 @@ tt models verify local-<run-id>
 tt models serve local-<run-id> --config local-runner.json
 ```
 
-Local currently certifies text SFT with `Qwen/Qwen3.5-2B`,
+Local currently certifies text SFT with `Qwen/Qwen3.5-2B` (pinned to snapshot
+`15852e8c16360a2fea060d615a32b45270f8a8fc`),
 `nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16`, and
 `meta-models/Muse-Glimmer-30B`, using LoRA/PEFT and CUDA. The 30B/3B-active
 Nemotron path is intended for DGX Spark-class unified memory, uses activation
@@ -184,7 +223,9 @@ vision tower frozen and unused. Evaluation and serving may use CPU. Training
 artifacts, datasets, and model weights remain on the execution host.
 
 Activation is optional and requires the run to pass a configured
-`generalRegression` gate. Once activated, use
+`generalRegression` gate. Without that suite, `tt models activate` fails
+closed. `tt serve active` also fails closed if nothing is activated — it does
+not silently serve the protected base model. Once activated, use
 `tt serve active --config local-runner.json`.
 
 `tt serve base` does not automatically inject the adjacent project spec.

package/dist/{chunk-HDGBDHOB.js → chunk-YJYCGSHJ.js}

@@ -558,12 +558,14 @@ async function assertArtifactManifest(manifestPath, options = {}) {
 import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
 import { resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
+var QWEN_3_5_2B_REVISION = "15852e8c16360a2fea060d615a32b45270f8a8fc";
 var NEMOTRON_BF16_REVISION = "ce38b6ab8b252b4b8ee7165b4605e93191cafd73";
 var MUSE_GLIMMER_BF16_REVISION = "a4e59da52a7bc87ae7251dd5545c0dd437c44b68";
 var TRAINING_MODELS = [
   {
     id: "Qwen/Qwen3.5-2B",
     family: "qwen3_5",
+    defaultRevision: QWEN_3_5_2B_REVISION,
     modelLoader: "causal_lm",
     defaultLearningRate: 1e-5,
     defaultPerDeviceBatchSize: 1,
@@ -1403,7 +1405,7 @@ function localRuntimePackageRoot(moduleUrl) {
 // src/local-runtime/store.ts
 import { appendFile, copyFile as copyFile2, mkdir as mkdir3, readdir as readdir3, readFile as readFile4, rename as rename2, rm, stat as stat3, writeFile as writeFile3 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join2, resolve as resolve5 } from "path";
+import { dirname as dirname4, join as join2, resolve as resolve5, sep as sep2 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function isTerminalRunState(state) {
   return state.status === "stage_completed" || state.status === "completed" || state.status === "failed" || state.status === "cancelled" && state.current_stage === "cancelled" && Boolean(state.completed_at);
@@ -1476,6 +1478,11 @@ function compareCreatedAt(left, right) {
 function findByIdOrPrefix(records, id) {
   return records.find((record) => record.id === id) ?? records.find((record) => record.id.startsWith(id));
 }
+function isPathInside(root, candidate) {
+  const resolvedRoot = resolve5(root);
+  const resolvedCandidate = resolve5(candidate);
+  return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(`${resolvedRoot}${sep2}`);
+}
 function createLocalStore(root = defaultLocalHome()) {
   const resolvedRoot = resolve5(root);
   const paths = localStorePaths(resolvedRoot);
@@ -1853,11 +1860,19 @@ function createLocalStore(root = defaultLocalHome()) {
     },
     async getRunReport(id) {
       const state = await getRun(id);
-      if (state.report_path && await exists2(state.report_path)) {
-        return readJson2(state.report_path);
+      const candidates = [];
+      if (state.report_path) {
+        const reportPath = resolve5(state.report_path);
+        const allowedRoots = [resolvedRoot];
+        if (state.artifact_dir) allowedRoots.push(resolve5(state.artifact_dir));
+        if (allowedRoots.some((allowed) => isPathInside(allowed, reportPath))) {
+          candidates.push(reportPath);
+        }
+      }
+      candidates.push(runReportPath(state.id));
+      for (const path of candidates) {
+        if (await exists2(path)) return readJson2(path);
       }
-      const copiedReportPath = runReportPath(state.id);
-      if (await exists2(copiedReportPath)) return readJson2(copiedReportPath);
       throw new Error(`Run has no report yet: ${id}`);
     },
     async listModels() {
@@ -1875,7 +1890,7 @@ function createLocalStore(root = defaultLocalHome()) {
 import { createHash as createHash4 } from "crypto";
 import { createReadStream as createReadStream2 } from "fs";
 import { lstat as lstat3, mkdir as mkdir5, readFile as readFile5, readdir as readdir4, realpath as realpath2, stat as stat4 } from "fs/promises";
-import { isAbsolute as isAbsolute3, join as join5, relative as relative2, resolve as resolve8, sep as sep2 } from "path";
+import { isAbsolute as isAbsolute3, join as join5, relative as relative2, resolve as resolve8, sep as sep3 } from "path";
 
 // src/local-runtime/process-runner.ts
 import { createHash as createHash3 } from "crypto";
@@ -1904,6 +1919,7 @@ function buildBundledPythonCommand(entrypoint, args = []) {
   const commandArgs = [
     "run",
     "--frozen",
+    "--quiet",
     "--project",
     bundledProject,
     "python",
@@ -2221,7 +2237,7 @@ async function certifiedFileDigest(path, expected) {
 }
 function isStrictPhysicalDescendant(parent, child) {
   const candidate = relative2(parent, child);
-  return candidate !== "" && candidate !== ".." && !candidate.startsWith(`..${sep2}`) && !isAbsolute3(candidate);
+  return candidate !== "" && candidate !== ".." && !candidate.startsWith(`..${sep3}`) && !isAbsolute3(candidate);
 }
 async function verifySnapshotCacheLocation(path, modelId, revision, modelCache) {
   const repository = `models--${modelId.replaceAll("/", "--")}`;
@@ -2292,9 +2308,7 @@ async function verifyCertifiedLocalSnapshot(path, modelId, snapshotFiles, modelC
   const revision = defaultBaseModelRevision(modelId);
   if (!revision) return;
   const digests = certifiedFileDigests(modelId);
-  if (!digests) {
-    throw new Error(`No certified file digests are registered for pinned model ${modelId}.`);
-  }
+  if (!digests) return;
   if (!modelCache) {
     throw new Error(`A certified local snapshot for ${modelId} requires paths.modelCache.`);
   }
@@ -4797,4 +4811,4 @@ export {
   runLocalPipeline,
   runLocalFineTune
 };
-//# sourceMappingURL=chunk-HDGBDHOB.js.map
+//# sourceMappingURL=chunk-YJYCGSHJ.js.map