freesolo-flash-dev 1.0.1__tar.gz → 1.0.2__tar.gz

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: freesolo-flash-dev
-Version: 1.0.1
+Version: 1.0.2
 Summary: Flash — managed LoRA post-training (SFT/GRPO/OPD) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/flash/cli/training_doc.py

@@ -154,6 +154,47 @@ flash undeploy <run-id>          # tear the endpoint down
 flash export --adapter-id <run-id> --repository <you>/<repo>  # copy adapter weights to your HF repo
 ```
 
+### Loading an exported adapter locally (transformers + peft)
+
+Flash trains the Qwen3.5/3.6 family against the full multimodal module tree, so adapter
+weights saved by the worker carry a `language_model.` infix in their tensor keys
+(`base_model.model.model.language_model.layers.*`). During `flash export`, adapters that
+can be represented in the text-only namespace are normalized to
+`base_model.model.model.layers.*`. When an export retains non-LM tensors, it keeps the
+multimodal namespace instead. Do not infer the namespace solely from whether `flash export`
+was used: inspect the keys. For normalized keys, load with vanilla peft and
+`AutoModelForCausalLM`:
+
+```python
+from peft import PeftModel
+from transformers import AutoModelForCausalLM
+
+base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3.5-0.8B")  # qwen3.5 causal-lm class
+model = PeftModel.from_pretrained(base, "<you>/<repo>")
+```
+
+**Before you trust any local eval, check the key namespace matches the model class you
+loaded.** peft does NOT error on mismatched keys — it emits a `UserWarning` about missing
+adapter keys and silently applies *nothing*, so you would benchmark the bare base model
+believing it is your adapter. If the inspected keys carry the `language_model.` infix,
+load the base with the multimodal class whose parameters live under that namespace instead:
+
+```python
+# infixed keys (base_model.model.model.language_model.layers.*) need the multimodal class:
+from transformers import AutoModelForImageTextToText
+
+base = AutoModelForImageTextToText.from_pretrained("Qwen/Qwen3.5-0.8B")
+# qwen3.5/3.6 dense models resolve to Qwen3_5ForConditionalGeneration
+# qwen3.6-35b-a3b (moe) resolves to Qwen3_5MoeForConditionalGeneration
+model = PeftModel.from_pretrained(base, "<you>/<repo>")
+```
+
+To check which form you have, read the safetensors key names (stdlib, no torch needed):
+the JSON header of `adapter_model.safetensors` lists every tensor key. Rule of thumb:
+`model.layers.*` keys pair with `AutoModelForCausalLM`; `model.language_model.layers.*`
+keys pair with the `*ForConditionalGeneration` class. After loading, confirm the adapter
+actually applied: outputs (or a probe metric) must differ from the bare base model.
+
 The rest of this file is about doing the above *well* — designing a reward that teaches,
 and deciding honestly whether a run improved.
 
@@ -221,6 +262,7 @@ spending another GPU run:
 | Run looks stuck after disconnecting | Terminal stopped streaming but the job may still be alive | Ctrl-C detaches. Use `flash log <run-id> --follow` to reattach, `flash log <run-id>` for the console/error output, or `flash cancel <run-id>` if you intentionally want to stop it. |
 | Final checkpoint regresses | Last step is worse than an earlier checkpoint | Run `flash checkpoints <run-id>`, deploy a specific step with `flash deploy <run-id>/step-N`, and compare with held-out probes before exporting or relying on the final adapter. |
 | Export fails before upload | CLI says no HuggingFace token | Pass `flash export --api-key hf_...`, or set `HF_TOKEN` in your shell, `.env`, or `.env.local`. Exports are private unless you pass `--public`. |
+| Exported adapter is a silent no-op locally | peft warns about missing adapter keys and local eval matches the bare base model | The adapter's key namespace does not match the loaded model class. `model.layers.*` keys pair with `AutoModelForCausalLM`; `model.language_model.layers.*` keys pair with `Qwen3_5ForConditionalGeneration` / `Qwen3_5MoeForConditionalGeneration` (via `AutoModelForImageTextToText`). See "Loading an exported adapter locally". |
 | SFT loss improves but quality does not | Train loss falls while held-out behavior stalls or degrades | Keep a held-out split outside training. Deploy and score that split; if quality drops, reduce epochs or improve data instead of adding more passes. |
 | Cost surprises | A quick experiment uses more GPU time than intended | Start with `--dry-run` and `--cost`, keep `epochs` and `max_examples` small for smoke tests, and scale only after reward/data wiring is proven. Setup time is reported for observability; customer cost is based on training-loop GPU time. |
 

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/flash/runner/verified_revisions.py

@@ -3,13 +3,17 @@
 from __future__ import annotations
 
 import contextlib
-import fcntl
 import json
 import os
 import tempfile
 from collections.abc import Callable, Iterator
 from contextlib import contextmanager
 
+try:
+    import fcntl
+except ImportError:  # pragma: no cover - linux production fails closed below
+    fcntl = None
+
 from flash.schema import parse_adapter_revision
 
 _LEDGER_SUFFIX = ".verified-revisions"
@@ -29,6 +33,8 @@ def _paths(run_id: str) -> tuple[str, str, str]:
 
 @contextmanager
 def _locked_ledger(run_id: str, *, exclusive: bool) -> Iterator[tuple[str, str]]:
+    if fcntl is None:
+        raise RuntimeError("interprocess verified-revision locking is unavailable")
     runs_dir, ledger_path, lock_path = _paths(run_id)
     fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
     with os.fdopen(fd, "a+") as lock_file:

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/flash/serve/export.py

@@ -14,6 +14,7 @@ import shutil
 import struct
 import tempfile
 from pathlib import Path
+from typing import BinaryIO
 
 from flash._logging import get_logger
 from flash.serve.deploy import ServingError
@@ -29,11 +30,11 @@ _TEMP_MERGED_BASE_MODEL_RE = re.compile(
 _MAX_SAFETENSORS_HEADER_BYTES = 100 * 1024 * 1024
 
 # module-path segments outside the language model; mirrors _VL_EXCLUDE_SEGMENTS in
-# flash/engine/worker/lora.py. today's managed adapters never touch these (the worker
-# excludes them from lora), so their presence means a genuinely multimodal adapter whose
-# vision keys the text-only strip cannot represent. normalizing only the lm keys of such
-# an adapter would produce a mixed namespace that matches no transformers class, so the
-# normalization must skip the file entirely and export it as trained.
+# flash/engine/worker/lora.py. managed adapters can contain inert non-lm lora entries when
+# broad target-module names select vision or mtp modules, so key presence alone is not a
+# reason to preserve the mixed namespace. only a nonzero lora_b contribution, or an
+# unrecognized non-lm tensor, proves the adapter genuinely trains those modules and must
+# keep the file unchanged.
 _NON_LM_KEY_SEGMENTS = (".visual.", ".vision_tower.", ".multi_modal_projector.", ".mtp.")
 
 
@@ -41,6 +42,42 @@ def _references_non_lm_modules(key: str) -> bool:
     return any(segment in key for segment in _NON_LM_KEY_SEGMENTS)
 
 
+def _non_lm_tensor_is_live(
+    source: BinaryIO,
+    key: str,
+    descriptor: object,
+    *,
+    data_start: int,
+    file_size: int,
+) -> bool:
+    is_lora_a = ".lora_A." in key
+    is_lora_b = ".lora_B." in key
+    if is_lora_a and not is_lora_b:
+        return False
+    if not is_lora_b or is_lora_a:
+        return True
+    if not isinstance(descriptor, dict):
+        raise ValueError(f"safetensors descriptor for {key!r} is not an object")
+    offsets = descriptor.get("data_offsets")
+    if (
+        not isinstance(offsets, list)
+        or len(offsets) != 2
+        or any(not isinstance(offset, int) or isinstance(offset, bool) for offset in offsets)
+    ):
+        raise ValueError(f"safetensors data_offsets for {key!r} are invalid")
+    lo, hi = offsets
+    data_size = file_size - data_start
+    if lo < 0 or hi < lo or hi > data_size:
+        raise ValueError(
+            f"safetensors data_offsets for {key!r} are outside the {data_size}-byte data section"
+        )
+    source.seek(data_start + lo)
+    tensor_bytes = source.read(hi - lo)
+    if len(tensor_bytes) != hi - lo:
+        raise ValueError(f"safetensors tensor data for {key!r} is truncated")
+    return any(tensor_bytes)
+
+
 def _strip_language_model_infix(key: str) -> str:
     # mirrors _LANGUAGE_MODEL_INFIX namespace semantics in flash/engine/worker/lora.py
     infix = ".language_model."
@@ -90,18 +127,23 @@ def _normalize_export_adapter_keys(adapter_dir: Path) -> bool:
             if not isinstance(header, dict):
                 raise ValueError("safetensors header is not a JSON object")
 
-            non_lm = [
-                key
-                for key in header
-                if key != "__metadata__" and _references_non_lm_modules(key)
-            ]
-            if non_lm:
-                logger.info(
-                    "exported adapter touches non-lm modules (e.g. %s); keeping the "
-                    "multimodal key namespace unchanged",
-                    non_lm[0],
-                )
-                return False
+            data_start = 8 + header_length
+            for key, descriptor in header.items():
+                if key == "__metadata__" or not _references_non_lm_modules(key):
+                    continue
+                if _non_lm_tensor_is_live(
+                    source,
+                    key,
+                    descriptor,
+                    data_start=data_start,
+                    file_size=file_size,
+                ):
+                    logger.info(
+                        "exported adapter has live non-lm weights (e.g. %s); keeping the "
+                        "multimodal key namespace unchanged",
+                        key,
+                    )
+                    return False
 
             normalized: dict[str, object] = {}
             remapped = 0
@@ -124,6 +166,7 @@ def _normalize_export_adapter_keys(adapter_dir: Path) -> bool:
                 separators=(",", ":"),
             ).encode("utf-8")
             new_header += b" " * (-len(new_header) % 8)
+            source.seek(data_start)
             with tempfile.NamedTemporaryFile(
                 mode="wb",
                 dir=path.parent,

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/flash/server/_deps.py

@@ -29,16 +29,47 @@ def require_key(authorization: str | None = Header(default=None)) -> dict:
     return key
 
 
-def owned_run(run_id: str, key: dict):
-    """Load a run's status iff `key` owns it; 404 otherwise (don't leak existence)."""
-    if db.run_owner(run_id) != key["id"]:
-        raise HTTPException(status_code=404, detail=f"unknown run_id: {run_id}")
+def _load_status(run_id: str):
+    """Resolve `run_id` to its status via the module (so `app.get_status` patches are honored)."""
     try:
         return _app.get_status(run_id)
     except FileNotFoundError as exc:
         raise HTTPException(status_code=404, detail=str(exc)) from exc
 
 
+def owned_run(run_id: str, key: dict):
+    """Load a run's status iff `key` owns it; 404 otherwise (don't leak existence)."""
+    if db.run_owner(run_id) != key["id"]:
+        raise HTTPException(status_code=404, detail=f"unknown run_id: {run_id}")
+    return _load_status(run_id)
+
+
+def readable_run(run_id: str, key: dict, org_id: str | None = None):
+    """Load a run's status for READ-only endpoints (`/logs`, `/worker`) via one of two paths.
+
+    Mirrors the env-delete posture (a user key carries its own identity; the org-agnostic
+    internal key is the trusted platform caller):
+      * exact-key owner -- the API key that created the run. This is the `flash log` CLI path.
+      * internal/service key + matching ``X-Freesolo-Org-Id`` -- the platform web proxy. The
+        browser has no per-run API key, so the platform authenticates the user, checks org
+        membership on the mirror row, then calls with the internal key and the run's org here.
+        The header is honored only for the internal key and only when it matches the run's
+        PERSISTED org, so a proxy bug can never cross orgs. A non-owner user key does reach this
+        check but fails the ``auth_kind == "internal"`` gate, so its org header is never honored.
+    404 (never 403) on every failure so we never leak whether a run exists.
+    """
+    if db.run_owner(run_id) == key["id"]:
+        return _load_status(run_id)
+    org = (org_id or "").strip()
+    if key.get("auth_kind") == "internal" and org:
+        from flash.runner import _status_org_id
+
+        status = _load_status(run_id)
+        if _status_org_id(status) == org:
+            return status
+    raise HTTPException(status_code=404, detail=f"unknown run_id: {run_id}")
+
+
 def _require_bool(payload: dict, field: str, default: bool) -> bool:
     """Read ``payload[field]`` as a real JSON boolean; 400 on non-bool. Never coerce — "false" (str) is truthy."""
     value = payload.get(field, default)

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/flash/server/routes/runs.py

@@ -7,7 +7,7 @@ import logging
 import os
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, Header, HTTPException
 
 from flash.runner import (
     DeploymentRevocationError,
@@ -19,7 +19,14 @@ from flash.runner import (
 from flash.schema import train_schema_metadata
 from flash.server import app as _app
 from flash.server import db
-from flash.server._deps import _parse_spec, _require_bool, _runtime_secrets, owned_run, require_key
+from flash.server._deps import (
+    _parse_spec,
+    _require_bool,
+    _runtime_secrets,
+    owned_run,
+    readable_run,
+    require_key,
+)
 from flash.spec import JobSpec
 
 _LOG = logging.getLogger("flash.server.runs")
@@ -255,8 +262,13 @@ def run_status(run_id: str, key: Annotated[dict, Depends(require_key)]):
 
 
 @router.get("/v1/runs/{run_id}/logs")
-def run_logs(run_id: str, key: Annotated[dict, Depends(require_key)], offset: int = 0):
-    status = owned_run(run_id, key)
+def run_logs(
+    run_id: str,
+    key: Annotated[dict, Depends(require_key)],
+    offset: int = 0,
+    x_freesolo_org_id: Annotated[str | None, Header()] = None,
+):
+    status = readable_run(run_id, key, x_freesolo_org_id)
     log_path = runs_file_path(run_id, ".log")
     chunk, end = "", max(0, offset)
     if os.path.exists(log_path):
@@ -280,8 +292,12 @@ def run_logs(run_id: str, key: Annotated[dict, Depends(require_key)], offset: in
 
 
 @router.get("/v1/runs/{run_id}/worker")
-def run_worker_output(run_id: str, key: Annotated[dict, Depends(require_key)]):
-    status = owned_run(run_id, key)
+def run_worker_output(
+    run_id: str,
+    key: Annotated[dict, Depends(require_key)],
+    x_freesolo_org_id: Annotated[str | None, Header()] = None,
+):
+    status = readable_run(run_id, key, x_freesolo_org_id)
     return {"run_id": run_id, "worker": _app._worker_artifacts(JobSpec.from_dict(status.spec))}
 
 

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "freesolo-flash-dev"
-version = "1.0.1"
+version = "1.0.2"
 description = "Flash — managed LoRA post-training (SFT/GRPO/OPD) for Freesolo environments, driven by the `flash` CLI"
 readme = "README.md"
 # RunPod Flash supports Python 3.11-3.12 (not 3.13 yet).
@@ -113,7 +113,7 @@ artifacts = ["flash/py.typed"]
 # auto-published by .github/workflows/publish-dev.yml: a push to `dev` whose version isn't yet on
 # PyPI publishes it; pushes that don't change it find it already published and no-op. So cutting a
 # dev-channel release = bump this (and [project].version) and merge to `dev`.
-version = "1.0.1"
+version = "1.0.2"
 
 [tool.pytest.ini_options]
 pythonpath = ["."]

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/tests/test_export.py

@@ -305,18 +305,52 @@ def test_export_adapter_key_collision_leaves_safetensors_unchanged(monkeypatch):
     assert uploaded["weights"] == source_bytes
 
 
+def test_export_adapter_normalizes_lm_keys_with_inert_vision_weights(tmp_path):
+    from flash.serve import export
+
+    lm_a = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_A.default.weight"
+    lm_b = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_B.default.weight"
+    vision_a = "base_model.model.model.visual.blocks.0.attn.qkv.lora_A.default.weight"
+    vision_b = "base_model.model.model.visual.blocks.0.attn.qkv.lora_B.default.weight"
+    header = {
+        lm_a: {"dtype": "F16", "shape": [1], "data_offsets": [0, 2]},
+        lm_b: {"dtype": "F16", "shape": [1], "data_offsets": [2, 4]},
+        vision_a: {"dtype": "F16", "shape": [1], "data_offsets": [4, 6]},
+        vision_b: {"dtype": "F16", "shape": [1], "data_offsets": [6, 8]},
+    }
+    data = b"\x01\x02\x03\x04\x05\x06\x00\x00"
+    path = tmp_path / "adapter_model.safetensors"
+    path.write_bytes(_safetensors_bytes(header, data))
+
+    assert export._normalize_export_adapter_keys(tmp_path) is True
+
+    normalized_header, normalized_data = _parse_safetensors_bytes(path.read_bytes())
+    normalized_lm_a = lm_a.replace(".language_model.", ".", 1)
+    normalized_lm_b = lm_b.replace(".language_model.", ".", 1)
+    assert set(normalized_header) == {normalized_lm_a, normalized_lm_b, vision_a, vision_b}
+    assert normalized_header[normalized_lm_a] == header[lm_a]
+    assert normalized_header[normalized_lm_b] == header[lm_b]
+    assert normalized_header[vision_a] == header[vision_a]
+    assert normalized_header[vision_b] == header[vision_b]
+    assert normalized_data == data
+
+
 def test_export_adapter_with_vision_keys_leaves_safetensors_unchanged(monkeypatch):
-    # a genuinely multimodal adapter (lora on the vision tower) must not be normalized:
+    # a genuinely multimodal adapter with nonzero vision lora_b must not be normalized:
     # stripping only its lm keys would leave a mixed namespace no transformers class loads.
     uploaded: dict = {}
-    lm_key = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_A.default.weight"
-    vision_key = "base_model.model.model.visual.blocks.0.attn.proj.lora_A.default.weight"
+    lm_a = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_A.default.weight"
+    lm_b = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_B.default.weight"
+    vision_a = "base_model.model.model.visual.blocks.0.attn.proj.lora_A.default.weight"
+    vision_b = "base_model.model.model.visual.blocks.0.attn.proj.lora_B.default.weight"
     source_bytes = _safetensors_bytes(
         {
-            lm_key: {"dtype": "F16", "shape": [1], "data_offsets": [0, 2]},
-            vision_key: {"dtype": "F16", "shape": [1], "data_offsets": [2, 4]},
+            lm_a: {"dtype": "F16", "shape": [1], "data_offsets": [0, 2]},
+            lm_b: {"dtype": "F16", "shape": [1], "data_offsets": [2, 4]},
+            vision_a: {"dtype": "F16", "shape": [1], "data_offsets": [4, 6]},
+            vision_b: {"dtype": "F16", "shape": [1], "data_offsets": [6, 8]},
         },
-        b"\x01\x02\x03\x04",
+        b"\x01\x02\x03\x04\x05\x06\x07\x08",
     )
 
     def fake_snapshot_download(*, local_dir, **kw):
@@ -357,6 +391,44 @@ def test_export_adapter_with_vision_keys_leaves_safetensors_unchanged(monkeypatc
     assert uploaded["weights"] == source_bytes
 
 
+def test_export_adapter_with_out_of_bounds_non_lm_offsets_is_unchanged(tmp_path):
+    from flash.serve import export
+
+    lm_key = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_A.default.weight"
+    vision_b = "base_model.model.model.visual.blocks.0.attn.proj.lora_B.default.weight"
+    source_bytes = _safetensors_bytes(
+        {
+            lm_key: {"dtype": "F16", "shape": [1], "data_offsets": [0, 2]},
+            vision_b: {"dtype": "F16", "shape": [1], "data_offsets": [2, 5]},
+        },
+        b"\x01\x02\x00\x00",
+    )
+    path = tmp_path / "adapter_model.safetensors"
+    path.write_bytes(source_bytes)
+
+    assert export._normalize_export_adapter_keys(tmp_path) is False
+    assert path.read_bytes() == source_bytes
+
+
+def test_export_adapter_with_unrecognized_non_lm_tensor_is_unchanged(tmp_path):
+    from flash.serve import export
+
+    lm_key = "base_model.model.model.language_model.layers.0.mlp.up_proj.lora_A.default.weight"
+    vision_saved = "base_model.model.model.visual.proj.modules_to_save.default.weight"
+    source_bytes = _safetensors_bytes(
+        {
+            lm_key: {"dtype": "F16", "shape": [1], "data_offsets": [0, 2]},
+            vision_saved: {"dtype": "F16", "shape": [1], "data_offsets": [2, 4]},
+        },
+        b"\x01\x02\x00\x00",
+    )
+    path = tmp_path / "adapter_model.safetensors"
+    path.write_bytes(source_bytes)
+
+    assert export._normalize_export_adapter_keys(tmp_path) is False
+    assert path.read_bytes() == source_bytes
+
+
 def test_export_adapter_without_safetensors_still_exports(monkeypatch):
     uploaded: dict = {}
     bin_weights = b"legacy-adapter-weights"

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/tests/test_server_api.py

@@ -1145,6 +1145,115 @@ def test_worker_output_route(api, monkeypatch):
     assert api.get(f"/v1/runs/{run_id}/worker", headers=_bearer(other)).status_code == 404
 
 
+def test_internal_key_reads_logs_and_worker_with_matching_org(api, monkeypatch):
+    # The platform web proxy has no per-run API key, so it reads a user's run logs with the shared
+    # internal key plus the run's org in X-Freesolo-Org-Id. The header is honored ONLY for the
+    # internal key and ONLY when it matches the run's persisted org. All failures are 404 so run
+    # existence is never leaked, and a rejected request must not trigger the expensive worker fetch.
+    import flash.server.app as app_mod
+
+    owner = _login()
+    org = f"org-{owner.removeprefix(_USER_PREFIX)}"
+    run_id = api.post(
+        "/v1/runs", json={"spec": SPEC, "dry_run": True}, headers=_bearer(owner)
+    ).json()["run_id"]
+    with open(os.path.join(_orch.RUNS_DIR, f"{run_id}.log"), "w") as f:
+        f.write("orchestrator line\n")
+
+    worker_calls = {"n": 0}
+
+    def counting_worker(spec):
+        worker_calls["n"] += 1
+        return {"console_sft.txt": "worker stdout\n"}
+
+    monkeypatch.setattr(app_mod, "_worker_artifacts", counting_worker)
+
+    internal = _bearer("fslo-internal-test")
+    matched = {**internal, "X-Freesolo-Org-Id": org}
+
+    logs = api.get(f"/v1/runs/{run_id}/logs", headers=matched)
+    assert logs.status_code == 200, logs.text
+    assert logs.json()["logs"] == "orchestrator line\n"
+    worker = api.get(f"/v1/runs/{run_id}/worker", headers=matched)
+    assert worker.status_code == 200, worker.text
+    assert worker.json()["worker"] == {"console_sft.txt": "worker stdout\n"}
+    assert worker_calls["n"] == 1
+
+    # wrong org, empty/whitespace org, or no header at all -> 404, and none of these rejected
+    # /worker requests reach the expensive artifact fetch (the call count stays at 1).
+    for headers in (
+        {**internal, "X-Freesolo-Org-Id": "org-someone-else"},
+        {**internal, "X-Freesolo-Org-Id": ""},
+        {**internal, "X-Freesolo-Org-Id": "   "},
+        internal,
+    ):
+        assert api.get(f"/v1/runs/{run_id}/logs", headers=headers).status_code == 404
+        assert api.get(f"/v1/runs/{run_id}/worker", headers=headers).status_code == 404
+    assert worker_calls["n"] == 1
+
+
+def test_org_header_is_ignored_for_non_internal_keys(api):
+    # A non-owner user key can't read another tenant's logs even if it forges the org header: the
+    # header is consulted only for the internal service key, so the owner check still governs users.
+    owner = _login()
+    org = f"org-{owner.removeprefix(_USER_PREFIX)}"
+    run_id = api.post(
+        "/v1/runs", json={"spec": SPEC, "dry_run": True}, headers=_bearer(owner)
+    ).json()["run_id"]
+
+    intruder = _login()
+    forged = {**_bearer(intruder), "X-Freesolo-Org-Id": org}
+    assert api.get(f"/v1/runs/{run_id}/logs", headers=forged).status_code == 404
+    assert api.get(f"/v1/runs/{run_id}/worker", headers=forged).status_code == 404
+
+    # the real owner still reads its own run with no org header (unchanged CLI path).
+    assert api.get(f"/v1/runs/{run_id}/logs", headers=_bearer(owner)).status_code == 200
+
+
+def test_internal_org_header_does_not_widen_owner_only_endpoints(api):
+    # readable_run only governs the read-only /logs and /worker endpoints. /status, /cancel, and
+    # /checkpoints stay owner-only via owned_run, so the internal key plus a matching org header
+    # must NOT grant access to them.
+    owner = _login()
+    org = f"org-{owner.removeprefix(_USER_PREFIX)}"
+    run_id = api.post(
+        "/v1/runs", json={"spec": SPEC, "dry_run": True}, headers=_bearer(owner)
+    ).json()["run_id"]
+
+    matched = {**_bearer("fslo-internal-test"), "X-Freesolo-Org-Id": org}
+    assert api.get(f"/v1/runs/{run_id}", headers=matched).status_code == 404
+    assert api.post(f"/v1/runs/{run_id}/cancel", headers=matched).status_code == 404
+    assert api.get(f"/v1/runs/{run_id}/checkpoints", headers=matched).status_code == 404
+
+
+def test_internal_key_cannot_read_run_without_persisted_org(api, monkeypatch):
+    # A run with no persisted org context cannot be matched by the internal path even with a
+    # non-empty header: _status_org_id is empty, so it never equals a real org and fails closed.
+    import flash.server.app as app_mod
+
+    owner = _login()
+    run_id = api.post(
+        "/v1/runs", json={"spec": SPEC, "dry_run": True}, headers=_bearer(owner)
+    ).json()["run_id"]
+
+    real_get_status = app_mod.get_status
+
+    def stripped(rid):
+        status = real_get_status(rid)
+        if rid == run_id:
+            status.platform_context = None
+            status.billing_context = None
+        return status
+
+    monkeypatch.setattr(app_mod, "get_status", stripped)
+
+    internal = _bearer("fslo-internal-test")
+    for org in ("org-anything", f"org-{owner.removeprefix(_USER_PREFIX)}"):
+        headers = {**internal, "X-Freesolo-Org-Id": org}
+        assert api.get(f"/v1/runs/{run_id}/logs", headers=headers).status_code == 404
+        assert api.get(f"/v1/runs/{run_id}/worker", headers=headers).status_code == 404
+
+
 def test_latest_error_artifact_name_picks_highest_attempt(monkeypatch):
     """The logs fetcher resolves the newest attempt-scoped error file, so a retried-then-failed run
     surfaces the FINAL attempt's traceback, not attempt0's stale one."""

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/tests/test_verified_revisions.py

@@ -2,6 +2,8 @@ from __future__ import annotations
 
 import json
 import multiprocessing
+import subprocess
+import sys
 from pathlib import Path
 
 import pytest
@@ -199,3 +201,30 @@ def test_verified_revision_ledger_survives_new_process(monkeypatch, tmp_path):
 
     assert process.exitcode == 0
     assert output.get(timeout=2) == (revision,)
+
+
+def test_verified_revision_ledger_fails_closed_without_fcntl(monkeypatch):
+    # fcntl is unix-only; on platforms without it the ledger must fail closed
+    # rather than silently skip its cross-process lock.
+    from flash.runner import verified_revisions
+
+    monkeypatch.setattr(verified_revisions, "fcntl", None)
+    with pytest.raises(RuntimeError, match="verified-revision locking is unavailable"):
+        verified_revisions.read_verified_adapter_revisions("run-without-fcntl")
+
+
+def test_cli_import_chain_survives_missing_fcntl():
+    # reproduces the windows `flash login` crash: fcntl is unix-only, so the cli
+    # import chain (flash.cli -> flash.runner -> verified_revisions) must not
+    # hard-depend on it. blocking fcntl mimics a platform that lacks the module.
+    code = (
+        "import sys; sys.modules['fcntl'] = None; "
+        "import flash.runner.verified_revisions; "
+        "import flash.cli"
+    )
+    result = subprocess.run(
+        [sys.executable, "-c", code],
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, result.stderr

{freesolo_flash_dev-1.0.1 → freesolo_flash_dev-1.0.2}/uv.lock

@@ -1024,7 +1024,7 @@ wheels = [
 
 [[package]]
 name = "freesolo-flash"
-version = "1.0.1"
+version = "1.0.2"
 source = { editable = "." }
 
 [package.optional-dependencies]