freesolo-flash-dev 1.0.85__tar.gz → 1.0.87__tar.gz

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/.env.example

@@ -66,6 +66,34 @@ FREESOLO_INTERNAL_KEY=
 # accepted unverified. Single tenant - see SELF_HOSTING.md before enabling.
 # FLASH_STANDALONE=1
 
+# --- optional: deployment topology ---
+# Where Flash keeps its local state: the saved login, the SQLite database, run records, and
+# results. Defaults to ~/.flash (= /root/.flash for the container's default user, which is the
+# path the Dockerfile declares as a VOLUME). Set this for a rootless container, a Kubernetes
+# PVC, a read-only home directory, or a systemd unit with ProtectHome. Everything moves
+# together, so point it at ONE durable location and mount a volume there.
+# FLASH_DATA_DIR=/var/lib/flash
+# Log verbosity for `flash-server`: DEBUG, INFO, WARNING, ERROR, CRITICAL. The server defaults
+# to INFO -- provider resolution, capability revocation, reaper startup, and degraded-config
+# warnings are all reported at INFO/WARNING. An unrecognized value falls back to the default
+# rather than blocking startup.
+# FLASH_LOG_LEVEL=INFO
+# `text` (default) or `json`. JSON emits one object per line for a structured log sink. The
+# same information is logged either way; only the punctuation differs.
+# FLASH_LOG_FORMAT=text
+# Bind address for `flash-server`. Defaults to 127.0.0.1; the container image passes 0.0.0.0
+# explicitly. The --host and --port flags win over both of these.
+# FLASH_SERVER_HOST=127.0.0.1
+# Port for `flash-server`, default 8080. Must be 1-65535: an unusable value stops startup
+# rather than silently binding the default, since a plane listening on the wrong port looks
+# healthy and is unreachable.
+# FLASH_SERVER_PORT=8080
+# How long (seconds) to wait for a SQLite lock held by another writer, default 30. Raise it on
+# networked storage, where a lock can be held far longer than on a local volume. This changes
+# only patience: journal mode, synchronous, and foreign keys are correctness settings and are
+# deliberately not configurable.
+# FLASH_SQLITE_BUSY_TIMEOUT_SECONDS=30
+
 # --- optional ---
 # Server token for the environment repository. Without it, environments hosted in a
 # private GitHub repo cannot be fetched; environments in public GitHub repos still work,
@@ -94,3 +122,9 @@ FLASH_CONTROL_PANEL_URL=https://flash.example.com
 # URL here does not get you past the guard, it just produces the same error. Set it to
 # YOUR serving deployment; the managed plane gets the hosted URL from the code default.
 # FREESOLO_SERVING_URL=https://serving.example.internal
+# Worker container image. Defaults to the published ghcr.io/freesolo-co/flash-worker tags
+# (per-GPU-arch kernel-cache variants, falling back to the base :cu128). Point it at your
+# own build to run a private worker; the CUDA driver floor still comes from the GPU class.
+# FLASH_WORKER_IMAGE=ghcr.io/your-org/flash-worker:cu128
+# Provider-side registry-credential id, required only when the image above is private.
+# FLASH_WORKER_IMAGE_REGISTRY_AUTH=

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/Dockerfile

@@ -5,9 +5,14 @@
 #     -e RUNPOD_API_KEY=... -e HF_TOKEN=... \
 #     -v flash-state:/root/.flash flash-control-plane
 #
-# All persistent state (key DB, run records, results) lives under ~/.flash (fixed paths,
-# = /root/.flash for the default root user) — mount a volume there. Run exactly ONE
-# container instance per state volume (state is local files + SQLite; no horizontal scaling).
+# All persistent state (key DB, run records, results) lives under ~/.flash (= /root/.flash for
+# the default root user) — mount a volume there. Run exactly ONE container instance per state
+# volume (state is local files + SQLite; no horizontal scaling).
+#
+# FLASH_DATA_DIR moves that root. The VOLUME below names the DEFAULT path, and Docker cannot
+# declare a volume at a path chosen at runtime, so a container that sets FLASH_DATA_DIR must
+# also mount its own volume at the new location — otherwise state lands on the container's
+# writable layer and disappears when the container is replaced.
 
 FROM python:3.12-slim
 
@@ -15,10 +20,7 @@ WORKDIR /app
 COPY . .
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates git curl \
-    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
-    && apt-get update && apt-get install -y --no-install-recommends infisical \
-    && rm -rf /var/lib/apt/lists/* \
-    && chmod +x /app/infisical-entrypoint.sh
+    && rm -rf /var/lib/apt/lists/*
 RUN pip install --no-cache-dir ".[server]"
 
 VOLUME /root/.flash
@@ -31,7 +33,8 @@ EXPOSE 8080
 # bake-kernel-cache.yml so the -smXX tags don't ship stale deps (the worker-image build posts a
 # reminder).
 
-# secret injection wrapper: no-op passthrough unless INFISICAL_CLIENT_ID is set, else
-# `infisical login` (universal-auth) then `infisical run --path /flash` before the server.
-ENTRYPOINT ["/app/infisical-entrypoint.sh"]
+# Secrets come from the container environment (-e, --env-file, or your orchestrator's secret
+# store), so this image needs no secret-manager tooling baked in. Pulling secrets from a manager
+# at container start is an opt-in overlay that wraps this image's entrypoint and inherits the CMD
+# below -- see deploy/infisical/ for a working example.
 CMD ["python", "-m", "flash.server", "--host", "0.0.0.0", "--port", "8080"]

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: freesolo-flash-dev
-Version: 1.0.85
+Version: 1.0.87
 Summary: Flash — managed LoRA post-training (SFT/GRPO/OPD) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/SELF_HOSTING.md

@@ -70,6 +70,39 @@ max_examples = 1000
 file, load it: `set -a && . ./.env && set +a && flash-server`, or
 `docker run --env-file .env ...`. Copy `.env.example` to start from a documented template.
 
+The process environment is the only contract, so a Kubernetes Secret, systemd
+`EnvironmentFile`, or any orchestrator's secret store works as-is. To pull secrets from a
+secret manager at container start instead, wrap the image's entrypoint; `deploy/infisical/`
+is a working example you can copy for another provider.
+
+### The state directory
+
+Everything the plane persists locally - the SQLite database of keys and run ownership, run
+records, results, and the CLI's saved login - lives under one root, `~/.flash` by default
+(`/root/.flash` in the container). Set `FLASH_DATA_DIR` to move it somewhere a rootless
+container, a mounted PVC, or a `ProtectHome` systemd unit can actually write:
+
+```bash
+FLASH_DATA_DIR=/var/lib/flash
+```
+
+Everything moves together, so back up or mount that one directory. In Docker, setting
+`FLASH_DATA_DIR` also means mounting your own volume at the new path - the image's `VOLUME`
+declaration names the default location, and state written anywhere else lands on the
+container's writable layer and is lost when the container is replaced.
+
+Run exactly **one** instance per state directory. State is local files plus SQLite; there is
+no horizontal scaling. On networked storage, where a lock can be held far longer than on a
+local disk, raise `FLASH_SQLITE_BUSY_TIMEOUT_SECONDS` (default 30).
+
+### Logs
+
+`flash-server` logs at INFO. Provider resolution, capability revocation, reaper startup, and
+degraded-configuration warnings are reported there and nowhere else, so that is the first
+place to look when the plane misbehaves. `FLASH_LOG_LEVEL` turns it up (`DEBUG`) or down
+(`WARNING`), and `FLASH_LOG_FORMAT=json` emits one JSON object per line for a structured log
+sink.
+
 ## Environments
 
 An environment is the Python package defining your task - dataset, rollout, reward. Point

freesolo_flash_dev-1.0.87/deploy/infisical/Dockerfile

@@ -0,0 +1,46 @@
+# OPT-IN Infisical overlay for the Flash control plane.
+#
+# Flash itself needs nothing from Infisical: it reads secrets from its process environment,
+# so the base image already works with `docker run --env-file`, a kubernetes Secret, or any
+# orchestrator's secret store. This overlay is for deployments that pull secrets from
+# Infisical at container start instead. See README.md in this directory.
+#
+# Build it against a published tag:
+#
+#   docker build -f deploy/infisical/Dockerfile \
+#     --build-arg FLASH_IMAGE=ghcr.io/freesolo-co/freesolo-flash:main \
+#     -t flash-control-plane-infisical .
+#
+# ...or against an image you just built yourself:
+#
+#   docker build -t flash-control-plane .
+#   docker build -f deploy/infisical/Dockerfile \
+#     --build-arg FLASH_IMAGE=flash-control-plane -t flash-control-plane-infisical .
+#
+# The build context is the repository root (that is where entrypoint.sh is copied from).
+
+ARG FLASH_IMAGE=ghcr.io/freesolo-co/freesolo-flash:main
+FROM ${FLASH_IMAGE}
+
+# The Infisical CLI comes from the vendor's apt repo, and is deliberately NOT installed by the
+# base image: the published artifact ships no vendor secret tooling and no vendor apt source.
+# (The base image's `COPY . .` does carry this directory's inert shell script, but nothing in
+# the base image ever executes it.)
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
+    && apt-get update && apt-get install -y --no-install-recommends infisical \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY deploy/infisical/entrypoint.sh /usr/local/bin/flash-infisical-entrypoint
+RUN chmod +x /usr/local/bin/flash-infisical-entrypoint
+
+# No-op passthrough unless INFISICAL_CLIENT_ID is set, otherwise `infisical login`
+# (universal-auth) then `infisical run` before the server.
+ENTRYPOINT ["/usr/local/bin/flash-infisical-entrypoint"]
+
+# CMD must be restated, and must stay in step with the base Dockerfile's CMD. Setting
+# ENTRYPOINT in a DERIVED image resets the inherited CMD to null, so without this line the
+# wrapper is handed no command at all and the container never starts the server. Do not
+# "deduplicate" this by deleting it.
+CMD ["python", "-m", "flash.server", "--host", "0.0.0.0", "--port", "8080"]

freesolo_flash_dev-1.0.87/deploy/infisical/README.md

@@ -0,0 +1,73 @@
+# Infisical secret injection (opt-in)
+
+Flash reads its secrets from the **process environment**. That is the whole contract, and it is
+all a deployment needs:
+
+```bash
+docker run -p 8080:8080 --env-file .env -v flash-state:/root/.flash \
+  ghcr.io/freesolo-co/freesolo-flash:main
+```
+
+Kubernetes Secrets, systemd `EnvironmentFile`, Docker secrets mounted into env, and every
+orchestrator secret store already produce that environment. **If that covers you, ignore this
+directory** — the published image has no Infisical CLI in it and does not need one.
+
+This overlay is for deployments that instead fetch secrets from [Infisical](https://infisical.com)
+at container start.
+
+## Using it
+
+Build the overlay on top of a Flash image:
+
+```bash
+docker build -f deploy/infisical/Dockerfile \
+  --build-arg FLASH_IMAGE=ghcr.io/freesolo-co/freesolo-flash:main \
+  -t flash-control-plane-infisical .
+```
+
+Run it with a universal-auth machine identity:
+
+```bash
+docker run -p 8080:8080 -v flash-state:/root/.flash \
+  -e INFISICAL_CLIENT_ID=... \
+  -e INFISICAL_CLIENT_SECRET=... \
+  -e INFISICAL_PROJECT_ID=... \
+  -e INFISICAL_PATH=/flash \
+  flash-control-plane-infisical
+```
+
+The wrapper logs in, then execs `infisical run -- <the base image's CMD>`, so the server sees the
+injected secrets as ordinary environment variables. It changes nothing about how Flash itself
+resolves configuration.
+
+You can also skip the overlay build and mount the script into the base image, provided the
+`infisical` binary is available inside the container.
+
+## Configuration
+
+| Variable                  | Required | Default | Purpose                                                                                                                                                                                                                                                                                                                            |
+| ------------------------- | -------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `INFISICAL_CLIENT_ID`     | yes      | unset   | Universal-auth machine identity. **Unset makes the wrapper a no-op passthrough**, so the container behaves exactly like the base image.                                                                                                                                                                                            |
+| `INFISICAL_CLIENT_SECRET` | yes      | unset   | Machine identity secret.                                                                                                                                                                                                                                                                                                           |
+| `INFISICAL_PROJECT_ID`    | yes      | unset   | Infisical project (workspace) id.                                                                                                                                                                                                                                                                                                  |
+| `INFISICAL_PATH`          | yes      | unset   | Secret folder path for this service, e.g. `/flash`.                                                                                                                                                                                                                                                                                |
+| `INFISICAL_ENV`           | no       | `prod`  | Environment slug. **A dev deployment that omits this loads production secrets.**                                                                                                                                                                                                                                                   |
+| `INFISICAL_KEEP`          | no       | empty   | Space-separated variable _names_ whose existing container values must win over the injected ones. `infisical run` overrides existing env, so these are re-applied after injection. Use it for values that are a property of where the container runs, like a `FREESOLO_BASE_URL` pointing at a service on the same Docker network. |
+
+`INFISICAL_TOKEN` is minted by the wrapper at startup. Do not set it yourself.
+
+A name listed in `INFISICAL_KEEP` that the container has **not** set is skipped, so the vault's
+value survives — a typo there costs you an override, not a credential. Setting a name to an empty
+string is treated as a deliberate choice and still wins over the vault. Entries must be shell
+identifiers; anything else aborts startup rather than being evaluated.
+
+## Failure behaviour
+
+The wrapper runs under `set -eu`: a failed login or a missing `INFISICAL_PROJECT_ID` /
+`INFISICAL_PATH` aborts container start rather than silently booting a control plane with no
+credentials. Flash's own startup preflight would reject that state anyway, but failing at the
+wrapper keeps the cause in the first line of the container log.
+
+Only `INFISICAL_CLIENT_ID` is checked for presence, because it is the switch. With it set and the
+rest missing, you get a hard failure — which is the intended outcome, not a fallback to unset
+secrets.

freesolo_flash_dev-1.0.87/deploy/infisical/entrypoint.sh

@@ -0,0 +1,76 @@
+#!/bin/sh
+# OPT-IN: wraps the flash control-plane command with infisical secret injection.
+#
+# The published image does NOT use this. Flash reads secrets from its process environment,
+# so `docker run -e ... / --env-file`, a kubernetes Secret, or any orchestrator's secret
+# store works with no wrapper at all. This file exists for deployments that pull secrets
+# from Infisical at container start; see deploy/infisical/README.md to opt in.
+#
+# fallback-safe: if INFISICAL_CLIENT_ID is unset this is a no-op passthrough and the
+# container behaves exactly as it does without the wrapper (reading its env_file / docker
+# env). Once the bootstrap machine-identity creds are present, secrets are pulled from
+# infisical at startup.
+#
+# expected env:
+#   INFISICAL_CLIENT_ID / INFISICAL_CLIENT_SECRET  universal-auth machine identity creds
+#   INFISICAL_PROJECT_ID                           the infisical project (workspace) id
+#   INFISICAL_ENV                                  env slug (prod | dev); default prod
+#   INFISICAL_PATH                                 folder path for this service (e.g. /flash)
+#   INFISICAL_KEEP                                 space-separated var names that must WIN over
+#                                                  infisical (docker-network overrides). infisical
+#                                                  run overrides existing env, so we re-apply these
+#                                                  AFTER injection via `env K=V`.
+set -eu
+
+# `exec "$@"` with ZERO arguments is a no-op that FALLS THROUGH to the injection path below,
+# where `set -u` then blames INFISICAL_CLIENT_ID for what is really a missing command. Setting
+# ENTRYPOINT in a derived image resets the inherited CMD to null, so an overlay that forgets to
+# restate CMD lands here. Fail with the actual cause instead.
+if [ "$#" -eq 0 ]; then
+  echo "flash infisical entrypoint: no command given (the image's CMD is empty)" >&2
+  exit 2
+fi
+
+if [ -z "${INFISICAL_CLIENT_ID:-}" ]; then
+  exec "$@"
+fi
+
+INFISICAL_TOKEN="$(infisical login --method=universal-auth \
+  --client-id="$INFISICAL_CLIENT_ID" \
+  --client-secret="$INFISICAL_CLIENT_SECRET" \
+  --silent --plain)"
+export INFISICAL_TOKEN
+
+# Re-apply the docker-network overrides AFTER infisical injection so they win. infisical
+# run overrides existing env, so we hand each KEEP var to `env` as its own quoted `K=V`
+# argument — values that contain spaces or shell metacharacters survive intact. (Building
+# an unquoted string and word-splitting it would corrupt such values, and a leading space
+# would make `env` choke.) INFISICAL_KEEP itself is a whitespace-separated list of variable
+# NAMES, so splitting *it* is intentional.
+# shellcheck disable=SC2086
+for k in ${INFISICAL_KEEP:-}; do
+  # These names are expanded inside `eval` below, so refuse anything that is not a shell
+  # identifier instead of executing it.
+  case $k in
+    [!A-Za-z_]* | *[!A-Za-z0-9_]*)
+      echo "flash infisical entrypoint: INFISICAL_KEEP entry is not a variable name: $k" >&2
+      exit 2
+      ;;
+  esac
+  # Only re-apply names the container actually SET. An unset name expands to nothing, and
+  # handing `env` a bare `K=` would overwrite the injected secret with an empty string --
+  # so a typo'd or absent KEEP entry would silently WIPE a credential rather than leave the
+  # vault's value alone. `${K+set}` distinguishes unset from set-but-empty, so an explicitly
+  # empty container value still wins (that is a deliberate choice by whoever wrote it).
+  eval "keep_is_set=\${$k+set}"
+  [ "${keep_is_set:-}" = set ] || continue
+  set -- "$k=$(eval "printf '%s' \"\${$k}\"")" "$@"
+done
+unset keep_is_set
+
+exec infisical run \
+  --projectId "$INFISICAL_PROJECT_ID" \
+  --env "${INFISICAL_ENV:-prod}" \
+  --path "$INFISICAL_PATH" \
+  --silent \
+  -- env "$@"

freesolo_flash_dev-1.0.87/flash/_logging.py

@@ -0,0 +1,100 @@
+"""Package logging helpers."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+
+_ROOT_NAME = "flash"
+
+LOG_LEVEL_ENV = "FLASH_LOG_LEVEL"
+LOG_FORMAT_ENV = "FLASH_LOG_FORMAT"
+
+_TEXT_FORMAT = "%(levelname)s %(name)s: %(message)s"
+
+
+class _JsonFormatter(logging.Formatter):
+    """One JSON object per line, for deployments that ship logs to a structured sink.
+
+    This formats the SAME record the text formatter would, through the same
+    ``record.getMessage()`` path. Nothing is added to the payload that the text line does not
+    already carry, so choosing a format cannot change what ends up in the log -- only how it is
+    punctuated. Anything a caller must not log stays un-logged in both formats.
+    """
+
+    def format(self, record: logging.LogRecord) -> str:
+        payload = {
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+        }
+        if record.exc_info:
+            payload["exception"] = self.formatException(record.exc_info)
+        return json.dumps(payload, default=str)
+
+
+def _resolve_level(verbosity: int, level: int | None, default_level: int) -> int:
+    """Explicit level wins, then -v flags, then FLASH_LOG_LEVEL, then the caller's default.
+
+    A caller that passed an explicit level or counted -v flags has said what it wants for this
+    invocation, so the environment does not override it. ``default_level`` is the opposite: it
+    is what the entrypoint would have used anyway, so an operator's FLASH_LOG_LEVEL beats it.
+    That ordering is what makes the variable useful -- the server defaults to INFO and can still
+    be turned down to WARNING or up to DEBUG without a code change.
+    """
+    if level is not None:
+        return level
+    if verbosity:
+        return {1: logging.INFO}.get(verbosity, logging.DEBUG)
+    configured = os.environ.get(LOG_LEVEL_ENV, "").strip().upper()
+    if configured:
+        # getLevelName maps a known name to its int; an unknown name comes back as the string
+        # "Level FOO", which is not an int -- so a typo falls back rather than raising at startup.
+        # A log level is not worth refusing to boot over.
+        resolved = logging.getLevelName(configured)
+        if isinstance(resolved, int):
+            return resolved
+    return default_level
+
+
+def _resolve_formatter() -> logging.Formatter:
+    if os.environ.get(LOG_FORMAT_ENV, "").strip().lower() == "json":
+        return _JsonFormatter()
+    return logging.Formatter(_TEXT_FORMAT)
+
+
+# NullHandler: keep library import silent; app opts in via configure_logging.
+_root = logging.getLogger(_ROOT_NAME)
+if not any(isinstance(h, logging.NullHandler) for h in _root.handlers):
+    _root.addHandler(logging.NullHandler())
+
+
+def get_logger(name: str | None = None) -> logging.Logger:
+    """Return a logger under the ``flash`` namespace (e.g. ``get_logger(__name__)``)."""
+    if not name or name == _ROOT_NAME:
+        return logging.getLogger(_ROOT_NAME)
+    if name.startswith(_ROOT_NAME + "."):
+        return logging.getLogger(name)
+    return logging.getLogger(f"{_ROOT_NAME}.{name}")
+
+
+def configure_logging(
+    verbosity: int = 0, level: int | None = None, default_level: int = logging.WARNING
+) -> None:
+    """Attach a console handler to the ``flash`` logger and set its level.
+
+    ``FLASH_LOG_LEVEL`` sets the level when the caller has not asked for a specific one, and
+    ``FLASH_LOG_FORMAT=json`` switches the console handler to one JSON object per line.
+    """
+    level = _resolve_level(verbosity, level, default_level)
+
+    logger = logging.getLogger(_ROOT_NAME)
+    logger.setLevel(level)
+    for h in [h for h in logger.handlers if getattr(h, "_flash_console", False)]:
+        logger.removeHandler(h)
+    handler = logging.StreamHandler()
+    handler.setLevel(level)
+    handler.setFormatter(_resolve_formatter())
+    handler._flash_console = True  # type: ignore[attr-defined]
+    logger.addHandler(handler)

freesolo_flash_dev-1.0.87/flash/_paths.py

@@ -0,0 +1,37 @@
+"""The one place Flash decides where its local state lives.
+
+Everything Flash persists on the machine it runs on -- the CLI's saved login, the control
+plane's SQLite database, run records and results, and the RunPod SDK's resource registry --
+hangs off a single root. ``FLASH_DATA_DIR`` moves that root; unset, it is ``~/.flash``, which
+is where every one of those things already lived.
+
+Why this module exists at all: four call sites used to spell ``~/.flash`` out for themselves.
+Nothing kept them in agreement, so a deployment could only relocate state by editing Python in
+four places and state could silently split if it edited three. Resolution is centralized here
+so there is exactly one answer to "where does Flash keep its files".
+
+The root is resolved per call rather than captured at import, because a process that sets the
+variable after importing flash (tests, embedders) would otherwise get the old answer.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+DATA_DIR_ENV = "FLASH_DATA_DIR"
+DEFAULT_DATA_DIR_NAME = ".flash"
+
+
+def data_dir() -> Path:
+    """The root under which Flash keeps its local state.
+
+    A relative ``FLASH_DATA_DIR`` is resolved against the current working directory, which makes
+    the path a process-lifetime-stable answer only if the process does not chdir. Absolute paths
+    are what a deployment should set; ``expanduser`` keeps ``~/...`` working for a human typing
+    it into a shell.
+    """
+    configured = os.environ.get(DATA_DIR_ENV, "").strip()
+    if configured:
+        return Path(configured).expanduser()
+    return Path.home() / DEFAULT_DATA_DIR_NAME

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/cli/TRAINING.md

@@ -850,7 +850,7 @@ with no reward to design. It supports `epochs` like SFT/GRPO and produces a LoRA
 
 - **Pick the teacher with `[train] teacher_model`; the key stays managed.** The teacher defaults to
   the managed **GLM 5.2** and is selectable from a fixed, managed allow-list:
-  `glm-5.2` (default), `kimi-k3`, or `qwen3.5-397b-a17b`. Every option is
+  `glm-5.2` (default), `kimi-k3`, `qwen3.5-397b-a17b`, or `deepseek-v4-pro`. Every option is
   a Parasail-hosted model reached through the control-plane broker, so there is nothing to export or
   declare. An opd run submits like any other, and a `PARASAIL_API_KEY` in your shell is ignored.
   Arbitrary bring-your-own teacher models or keys are not supported (the allow-list is curated to
@@ -886,7 +886,8 @@ max_examples = 2
 lora_rank = 32
 # teacher_model = "glm-5.2"                             # managed teacher to distil from; one of
 #                                                       # glm-5.2 (default) | kimi-k3 |
-#                                                       # qwen3.5-397b-a17b (key stays managed)
+#                                                       # qwen3.5-397b-a17b | deepseek-v4-pro
+#                                                       # (key stays managed)
 # kl_penalty_coef = 1.0                                 # reverse-KL scale
 ```
 

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/cli/__init__.py

@@ -13,7 +13,6 @@ from typing import NoReturn
 from flash import __version__
 from flash._channel import CLI_NAME
 from flash._logging import configure_logging
-from flash._update_check import emit_update_notice, maybe_start_update_check
 from flash.catalog import ALGORITHMS
 from flash.cli import render
 
@@ -766,7 +765,6 @@ def main(argv: list[str] | None = None) -> int:
     args = parser.parse_args(argv)
     configure_logging(verbosity=getattr(args, "verbose", 0))
     debug = getattr(args, "debug", False)
-    update_check = maybe_start_update_check()
     _warn_if_login_shadowed(args)
     try:
         return args.func(args)
@@ -798,5 +796,3 @@ def main(argv: list[str] | None = None) -> int:
         print(render.error(str(exc) or exc.__class__.__name__), file=sys.stderr)
         print(render.arrow(f"run `{cmd}` for the full traceback"), file=sys.stderr)
         return 1
-    finally:
-        emit_update_notice(update_check)

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/cli/env_setup.py

@@ -667,7 +667,8 @@ def cmd_env_setup(args) -> int:
             f"{max_examples_line}"
             "lora_rank = 32\n"
             '# teacher_model = "glm-5.2"   # teacher: glm-5.2 (default) | kimi-k3 |\n'
-            "#                             # qwen3.5-397b-a17b (key stays managed)\n"
+            "#                             # qwen3.5-397b-a17b | deepseek-v4-pro\n"
+            "#                             # (key stays managed)\n"
             "# GPU and HF artifacts are managed automatically by the platform: the GPU is\n"
             "# the cheapest fitting managed class, and artifacts live in a private environment-scoped repo.\n"
         )

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/cli/render.py

@@ -195,10 +195,7 @@ def _truecolor() -> bool:
 
 
 def _theme() -> str:
-    """Active theme: ``light`` or ``dark``. ``FLASH_THEME`` overrides; else inferred from ``COLORFGBG``."""
-    forced = os.environ.get("FLASH_THEME", "").strip().lower()
-    if forced in {"light", "dark"}:
-        return forced
+    """Active theme: ``light`` or ``dark``, inferred from ``COLORFGBG`` (the terminal's own signal)."""
     fgbg = os.environ.get("COLORFGBG", "")
     if fgbg:
         try:

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/client/config.py

@@ -1,6 +1,7 @@
 """Client-side credential storage: Flash API key + control-plane URL.
 
-Stored in ``~/.flash/config.json`` (0600). ``FREESOLO_API_KEY`` / ``FLASH_API_URL`` override.
+Stored in ``config.json`` (0600) under the Flash data dir, ``~/.flash`` unless
+``FLASH_DATA_DIR`` says otherwise. ``FREESOLO_API_KEY`` / ``FLASH_API_URL`` override.
 """
 
 from __future__ import annotations
@@ -10,6 +11,7 @@ from pathlib import Path
 
 from .._channel import CHANNEL, CLI_NAME
 from .._fileio import read_json_or_empty, secure_json_write
+from .._paths import data_dir
 
 PROD_API_URL = "https://flash.freesolo.co"
 DEV_API_URL = "https://flash-dev.freesolo.co"
@@ -22,7 +24,10 @@ def default_api_url(channel: str = CHANNEL) -> str:
 
 DEFAULT_API_URL = default_api_url()
 
-CONFIG_DIR = Path.home() / ".flash"
+# Resolved at import so the CLI reports one stable path for the life of a command: these appear
+# in user-facing messages ("the login saved in ..."), and a value that changed between the read
+# and the message would name a file the user was not told about.
+CONFIG_DIR = data_dir()
 CONFIG_PATH = CONFIG_DIR / "config.json"
 
 

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/engine/recipe.py

@@ -59,6 +59,21 @@ TEACHER_MODELS: dict[str, TeacherModel] = {
             ),
         ),
     ),
+    "deepseek-v4-pro": TeacherModel(
+        alias="deepseek-v4-pro",
+        model_id="parasail-deepseek-v4-pro",
+        display_name="DeepSeek V4 Pro",
+        usd_per_1m=(1.74, 3.48),
+        tokenizer_repo="deepseek-ai/DeepSeek-V4-Pro",
+        tokenizer_revision="b5968e9190ef611bbf34a7229255be88a0e937c1",
+        tokenizer_kind="tokenizer_json",
+        tokenizer_files=(
+            (
+                "tokenizer.json",
+                "8f9f37ca37fdc4f5fd36d5cf4d3b0e8392edb4e894fd10cc0d70b4957c8633cf",
+            ),
+        ),
+    ),
     "qwen3.5-397b-a17b": TeacherModel(
         alias="qwen3.5-397b-a17b",
         model_id="parasail-qwen35-397b-a17b",

{freesolo_flash_dev-1.0.85 → freesolo_flash_dev-1.0.87}/flash/engine/worker/opd_train.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import copy
 import hashlib
 import http.client
@@ -1817,11 +1818,50 @@ def _opd_multimodal_parquet_features():
     )
 
 
+# arrow expands every shared python reference into its own copy, and the opd row list is one
+# reference per prompt repeated across the whole horizon, so converting the rows in a single table
+# costs peak host ram proportional to horizon * prompts_per_step * prompt_bytes. that is the parent
+# worker's ram, not the gpu's, and the allocator sizes vram only -- a host-ram kill surfaces as a
+# generic child exit with oom:false. writing in fixed batches holds the peak flat instead
+# (measured: 24k rows of ~8k-token prompts, 6143 MB in one table vs 189 MB batched).
+_OPD_PARQUET_WRITE_BATCH_ROWS = 2000
+
+
 def _write_opd_parquet(rows: list[dict], path: str) -> None:
-    from datasets import Dataset
+    import pyarrow as pa
+    import pyarrow.parquet as pq
 
+    if not rows:
+        raise ValueError("refusing to write an empty OPD parquet")
     features = _opd_multimodal_parquet_features() if any("images" in row for row in rows) else None
-    Dataset.from_list(rows, features=features).to_parquet(path)
+    # pin one schema for every batch. multimodal takes it from the declared features exactly as the
+    # single-table write did; text infers it from the first batch so a later batch cannot silently
+    # infer a different type and be rejected mid-file.
+    schema = (
+        features.arrow_schema
+        if features is not None
+        else pa.Table.from_pylist(rows[:_OPD_PARQUET_WRITE_BATCH_ROWS]).schema
+    )
+    # write to a sibling temp file and rename only once every batch landed. closing a partially
+    # written ParquetWriter still emits a valid footer, so failing in place would leave a READABLE
+    # short file at `path` -- a truncated horizon that trains silently instead of raising.
+    partial = f"{path}.partial"
+    try:
+        writer = pq.ParquetWriter(partial, schema)
+        try:
+            for start in range(0, len(rows), _OPD_PARQUET_WRITE_BATCH_ROWS):
+                writer.write_table(
+                    pa.Table.from_pylist(
+                        rows[start : start + _OPD_PARQUET_WRITE_BATCH_ROWS], schema=schema
+                    )
+                )
+        finally:
+            writer.close()
+        os.replace(partial, path)
+    except BaseException:
+        with contextlib.suppress(OSError):
+            os.remove(partial)
+        raise
 
 
 # the verl bridge stores the empty-alignment skip under its own internal key,