soup-cli 0.75.0__tar.gz → 0.75.1__tar.gz

{soup_cli-0.75.0 → soup_cli-0.75.1}/.github/workflows/ci.yml

@@ -2,7 +2,11 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # `release/**` is here so a release branch gets the matrix on the exact
+    # tree that will be tagged. A pull request builds the MERGE of head and
+    # main, which for a release cut from an older tag is not the tree that
+    # ships, so a PR run cannot stand in for this one.
+    branches: [main, 'release/**']
   pull_request:
     branches: [main]
 
@@ -236,6 +240,13 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+      # The Web UI escaping tests run `safe_html.js` under node, and skip when
+      # node is absent. Runner images happen to ship one, so the skip would be
+      # silent: pin it, or the only tests that execute the real escaping logic
+      # can disappear without anything turning red.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
       - name: Pin the HF cache to a deterministic path
         # Set here and not in the job-level `env:` block: the `runner` context
         # is not available there (only github / needs / strategy / matrix /

{soup_cli-0.75.0 → soup_cli-0.75.1}/CHANGELOG.md

@@ -12,6 +12,22 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.75.1] - 2026-09-21
+
+### Fixed
+
+- **A layer-streamed LoRA adapter saved as ZERO tensors under peft 0.21.0 (#1005 in #1010).** peft 0.21 selects an adapter's tensors by the prefixes it reads off `model.named_modules()` and keeps the matching `state_dict()` entries, where 0.20 filtered by the `lora_` substring; the streaming wrapper's module and parameter names carried `.inner.` while its `state_dict()` keys were canonical, so `trainer.save_model()`, every `save_steps` checkpoint and `get_peft_model_state_dict()` returned nothing, and nothing raised. The wrapper now enumerates the inner layer's tree at its own prefix (`named_modules()` / `named_children()`, with `train()` / `apply()` / `_apply()` reaching the inner layer explicitly), so names and keys are one spelling — which also keeps transformers' weight-decay grouping, built from `named_children()`, from silently dropping every LoRA parameter into the no-decay group. **Any adapter saved with `stream_layers: true` on peft>=0.21 before this fix holds zero tensors (a 40-byte `adapter_model.safetensors`, no error at save time) and cannot be recovered — re-train it on a Soup with this fix, or with `peft<0.21`.** Naming only; nothing on the streamed forward path changes. Ten peft-version-independent tests pin names == keys against a resident LoRA model; the four tests that documented the old asymmetry are inverted rather than deleted. No `peft<0.21` pin.
+
+- **A Ctrl+C arriving immediately after the Lambda controller started could still leave the instance running (#1073 in #1078).** `submit_lambda_run` spawned the controller outside the `try` that absorbs interrupts, so a SIGINT delivered between `Popen` returning and the waiting loop being entered — or one landing on the "still waiting" notice, which is written from the interrupt handler — unwound the parent while the controller was still terminating the paid instance in its `finally` block. The spawn and the notice now sit inside the guarded region: once the child exists, every path leads back to `proc.wait()` and the controller's exit code remains what the function returns. An interrupt raised before the child exists still propagates unchanged, and a `wait()` failure that is not an interrupt still surfaces rather than being retried.
+
+- `soup runs clean` now accepts `--no-keep-weights` to delete whole non-best checkpoints; `--keep-weights` (the default) keeps weights on every supported Click version — on Click 8.1 it previously deleted whole checkpoints (#1057)
+
+- **Cloud runs keep their outputs and their cleanup (#1058).** `soup train --cloud modal` now writes run outputs to the `soup-outputs` Modal volume and downloads them to the local output directory when the run ends (also after a failed run); previously checkpoints were lost with the container. `soup train --cloud lambda --cloud-submit`: pressing Ctrl+C now waits for the controller to terminate the Lambda instance; previously the controller was killed 0.25 s later and the instance could keep running (Linux/macOS).
+
+### Security
+
+- Hardening across the CLI, the inference server, the Web UI, MCP execution, config parsing and `.can` handling. A security advisory with details and upgrade guidance will be published alongside this release.
+
 ## [0.75.0] - 2026-09-12
 
 ### Added
@@ -4650,7 +4666,8 @@ what a fine-tune forgets and leaks.
   `SECURITY.md` (~220 KB). `SECURITY.md` is now a concise security policy; the
   detailed hardening notes remain in git history and the GitHub Releases notes.
 
-[Unreleased]: https://github.com/MakazhanAlpamys/Soup/compare/v0.75.0...HEAD
+[Unreleased]: https://github.com/MakazhanAlpamys/Soup/compare/v0.75.1...HEAD
+[0.75.1]: https://github.com/MakazhanAlpamys/Soup/compare/v0.75.0...v0.75.1
 [0.75.0]: https://github.com/MakazhanAlpamys/Soup/compare/v0.74.0...v0.75.0
 [0.74.0]: https://github.com/MakazhanAlpamys/Soup/compare/v0.73.3...v0.74.0
 [0.73.1]: https://github.com/MakazhanAlpamys/Soup/compare/v0.73.0...v0.73.1

{soup_cli-0.75.0 → soup_cli-0.75.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: soup-cli
-Version: 0.75.0
+Version: 0.75.1
 Summary: Fine-tune and post-train LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -241,39 +241,27 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.75.0 — the same `soup.yaml` trained a different recipe on MLX than on transformers,
-silently.** Six training options were validated, documented, accepted — and read by nothing
-on that backend. **All 60 pull requests in this release came from outside the maintainer**,
-by 22 people.
-
-- **Breaking: an unknown config key now refuses the load.** v0.74 warned and named this
-  release as the deadline. A typo like `quantizaton`, or a key that only exists on a newer
-  Soup, used to be dropped while the run proceeded with the setting not applied; it now
-  fails on the CLI (exit 1) and in the API (`ValueError`), naming the field you probably
-  meant. The detector applies the root-level `lora:` remap the schema has honoured
-  since v0.40.1, so that spelling is accepted, not refused; the two `soup fetch examples`
-  files using it moved to the canonical `training.lora`. Every recipe and template loads
-  clean, key names are escaped before they reach the terminal, and the scan is bounded.
-- **MLX honours the config it accepted.** `train_on_responses_only`, `warmup_ratio` /
-  `scheduler` / `weight_decay` / `optimizer`, `max_grad_norm`, `gradient_accumulation_steps`
-  and `gradient_checkpointing` were each validated and then dropped on `backend: mlx`. Only
-  8 of the 32 optimizer names have an MLX equivalent; the other 24 are refused by name
-  instead of silently becoming AdamW. MLX also drives the live dashboard, the tracker and
-  `soup ui`, and `soup doctor --config` lists the settings a backend does not read.
-- **Validation loss existed nowhere.** It was computed on every backend and thrown away:
-  no metrics column, no event field, nothing on the panel. It is now recorded, streamed
-  and displayed.
-- **Breaking: `grpo_variant: gspo` is the published sequence-level objective**
-  (arXiv:2507.18071), replacing a column-centering heuristic in which a padding token also
-  shifted the gradient of every row sharing its column. Existing gspo configs will not
-  reproduce prior runs.
-- **Web UI read endpoints and SSE require auth**, with short-lived single-use tickets
-  instead of a token in a query string; `--public` no longer serves `/docs` and
-  `/openapi.json` to the LAN; and a training subprocess no longer hangs when nothing
-  reads its output.
-- **`torch>=2.6.0`** closes v0.74.0's known limitation: at 2.5.1 `trl>=0.29` could not
-  import and every preference trainer was dead. Also fixed: `training.loraplus_lr_ratio`
-  crashed every run that set it, and `packing: true` raised on TRL 0.29.
+**v0.75.1 — hardening, and cloud runs that keep what they produced.** A maintenance
+release on top of v0.75.0: no new training features, and a few defaults that change when
+you upgrade.
+
+- **Hardening across the CLI, the inference server, the Web UI, MCP execution, config
+  parsing and `.can` handling.** Details in an advisory published with this release.
+- **`soup runs clean` gained `--no-keep-weights`**, which deletes whole non-best
+  checkpoints rather than only their optimizer and scheduler states. `--keep-weights`
+  stays the default and now means the same thing on every supported Click version — on
+  Click 8.1 it used to delete whole checkpoints anyway.
+- **Cloud runs keep their outputs.** `soup train --cloud modal` writes run outputs to the
+  `soup-outputs` Modal volume and downloads them into your local output directory when the
+  run ends, including after a failed run; checkpoints used to disappear with the container.
+- **Ctrl+C on `soup train --cloud lambda --cloud-submit` waits for the controller** to
+  terminate the Lambda instance. The controller was previously killed a quarter of a
+  second later, which could leave a paid instance running (Linux/macOS).
+- **Upgrading changes a few defaults.** `soup push --hub modelscope` and `--hub modelers`
+  read `MODELSCOPE_API_TOKEN` and `MODELERS_TOKEN` rather than `HF_TOKEN`, so one hub's
+  token is never offered to another; and an `https` judge URL whose host is not
+  `api.openai.com` is treated as an OpenAI-compatible server and called without
+  `OPENAI_API_KEY`.
 
 > Python **3.10–3.12** only. On 3.13+, pip used to resolve untested PyTorch wheels that
 > crash in the native extension before Soup runs at all.

{soup_cli-0.75.0 → soup_cli-0.75.1}/README.md

@@ -87,39 +87,27 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.75.0 — the same `soup.yaml` trained a different recipe on MLX than on transformers,
-silently.** Six training options were validated, documented, accepted — and read by nothing
-on that backend. **All 60 pull requests in this release came from outside the maintainer**,
-by 22 people.
-
-- **Breaking: an unknown config key now refuses the load.** v0.74 warned and named this
-  release as the deadline. A typo like `quantizaton`, or a key that only exists on a newer
-  Soup, used to be dropped while the run proceeded with the setting not applied; it now
-  fails on the CLI (exit 1) and in the API (`ValueError`), naming the field you probably
-  meant. The detector applies the root-level `lora:` remap the schema has honoured
-  since v0.40.1, so that spelling is accepted, not refused; the two `soup fetch examples`
-  files using it moved to the canonical `training.lora`. Every recipe and template loads
-  clean, key names are escaped before they reach the terminal, and the scan is bounded.
-- **MLX honours the config it accepted.** `train_on_responses_only`, `warmup_ratio` /
-  `scheduler` / `weight_decay` / `optimizer`, `max_grad_norm`, `gradient_accumulation_steps`
-  and `gradient_checkpointing` were each validated and then dropped on `backend: mlx`. Only
-  8 of the 32 optimizer names have an MLX equivalent; the other 24 are refused by name
-  instead of silently becoming AdamW. MLX also drives the live dashboard, the tracker and
-  `soup ui`, and `soup doctor --config` lists the settings a backend does not read.
-- **Validation loss existed nowhere.** It was computed on every backend and thrown away:
-  no metrics column, no event field, nothing on the panel. It is now recorded, streamed
-  and displayed.
-- **Breaking: `grpo_variant: gspo` is the published sequence-level objective**
-  (arXiv:2507.18071), replacing a column-centering heuristic in which a padding token also
-  shifted the gradient of every row sharing its column. Existing gspo configs will not
-  reproduce prior runs.
-- **Web UI read endpoints and SSE require auth**, with short-lived single-use tickets
-  instead of a token in a query string; `--public` no longer serves `/docs` and
-  `/openapi.json` to the LAN; and a training subprocess no longer hangs when nothing
-  reads its output.
-- **`torch>=2.6.0`** closes v0.74.0's known limitation: at 2.5.1 `trl>=0.29` could not
-  import and every preference trainer was dead. Also fixed: `training.loraplus_lr_ratio`
-  crashed every run that set it, and `packing: true` raised on TRL 0.29.
+**v0.75.1 — hardening, and cloud runs that keep what they produced.** A maintenance
+release on top of v0.75.0: no new training features, and a few defaults that change when
+you upgrade.
+
+- **Hardening across the CLI, the inference server, the Web UI, MCP execution, config
+  parsing and `.can` handling.** Details in an advisory published with this release.
+- **`soup runs clean` gained `--no-keep-weights`**, which deletes whole non-best
+  checkpoints rather than only their optimizer and scheduler states. `--keep-weights`
+  stays the default and now means the same thing on every supported Click version — on
+  Click 8.1 it used to delete whole checkpoints anyway.
+- **Cloud runs keep their outputs.** `soup train --cloud modal` writes run outputs to the
+  `soup-outputs` Modal volume and downloads them into your local output directory when the
+  run ends, including after a failed run; checkpoints used to disappear with the container.
+- **Ctrl+C on `soup train --cloud lambda --cloud-submit` waits for the controller** to
+  terminate the Lambda instance. The controller was previously killed a quarter of a
+  second later, which could leave a paid instance running (Linux/macOS).
+- **Upgrading changes a few defaults.** `soup push --hub modelscope` and `--hub modelers`
+  read `MODELSCOPE_API_TOKEN` and `MODELERS_TOKEN` rather than `HF_TOKEN`, so one hub's
+  token is never offered to another; and an `https` judge URL whose host is not
+  `api.openai.com` is treated as an OpenAI-compatible server and called without
+  `OPENAI_API_KEY`.
 
 > Python **3.10–3.12** only. On 3.13+, pip used to resolve untested PyTorch wheels that
 > crash in the native extension before Soup runs at all.

{soup_cli-0.75.0 → soup_cli-0.75.1}/README.tr.md

@@ -1,4 +1,4 @@
-<!-- synced-from: README.md sha256:5ceff359925678608a55dc8a4d522221b75668b10e659aa4f0dd05a28f2eb1c4 -->
+<!-- synced-from: README.md sha256:b524929506f026bba7a1f4522d3273328123c696a31b72dd1c7c4bee993a8fd4 -->
 <p align="center">🌍 <a href="README.md">English</a> | <strong>Türkçe</strong></p>
 
 <p align="center">
@@ -88,39 +88,30 @@ yerine altyapıyla boğuşarak geçiriyor. Soup bunu çözer.
 
 ## Yenilikler
 
-**v0.75.0 — aynı `soup.yaml`, MLX'te transformers'takinden farklı bir tarif eğitiyordu,
-sessizce.** Altı eğitim seçeneği doğrulanıyor, belgeleniyor, kabul ediliyor — ve o arka uçta
-hiçbir şey tarafından okunmuyordu. **Bu sürümdeki 60 pull request'in tamamı bakımcı dışından
-geldi**, 22 kişiden.
-
-- **Geriye dönük uyumsuz: bilinmeyen bir yapılandırma anahtarı artık yüklemeyi reddediyor.**
-  v0.74 uyarı vermiş ve son tarih olarak bu sürümü adlandırmıştı. `quantizaton` gibi bir yazım
-  hatası ya da yalnızca daha yeni bir Soup'ta bulunan bir anahtar eskiden atılıyor ve
-  çalıştırma o ayar uygulanmadan devam ediyordu; artık CLI'da (çıkış kodu 1) ve API'de
-  (`ValueError`) başarısız oluyor ve muhtemelen kastettiğiniz alanı adlandırıyor. Dedektör,
-  şemanın v0.40.1'den beri tanıdığı üst düzey `lora:` yeniden eşlemesini uyguluyor; yani bu
-  yazım reddedilmiyor, kabul ediliyor. Onu kullanan iki `soup fetch examples` dosyası kanonik
-  `training.lora` biçimine taşındı. Her tarif ve şablon temiz yükleniyor, anahtar adları
-  terminale ulaşmadan önce kaçışlanıyor ve tarama sınırlı.
-- **MLX, kabul ettiği yapılandırmaya uyuyor.** `train_on_responses_only`, `warmup_ratio` /
-  `scheduler` / `weight_decay` / `optimizer`, `max_grad_norm`, `gradient_accumulation_steps`
-  ve `gradient_checkpointing`, `backend: mlx` üzerinde tek tek doğrulanıp sonra düşürülüyordu.
-  32 optimizer adından yalnızca 8'inin MLX karşılığı var; diğer 24'ü sessizce AdamW'ye
-  dönüşmek yerine adıyla reddediliyor. MLX ayrıca canlı panoyu, izleyiciyi ve `soup ui`'yi
-  sürüyor; `soup doctor --config` ise bir arka ucun okumadığı ayarları listeliyor.
-- **Doğrulama kaybı hiçbir yerde yoktu.** Her arka uçta hesaplanıp atılıyordu: metrik sütunu
-  yok, olay alanı yok, panoda hiçbir şey yok. Artık kaydediliyor, akıtılıyor ve gösteriliyor.
-- **Geriye dönük uyumsuz: `grpo_variant: gspo`, yayımlanmış dizi düzeyi hedef fonksiyonudur**
-  (arXiv:2507.18071); bir dolgu belirtecinin aynı sütunu paylaşan her satırın gradyanını da
-  kaydırdığı sütun merkezleme sezgiselinin yerini alıyor. Mevcut gspo yapılandırmaları önceki
-  çalıştırmaları yeniden üretmeyecek.
-- **Web arayüzünün okuma uç noktaları ve SSE, kimlik doğrulama gerektiriyor**; sorgu
-  dizesindeki bir belirteç yerine kısa ömürlü, tek kullanımlık biletlerle. `--public` artık
-  `/docs` ve `/openapi.json`'ı yerel ağa sunmuyor; eğitim alt süreci de çıktısını kimse
-  okumadığında artık askıda kalmıyor.
-- **`torch>=2.6.0`**, v0.74.0'ın bilinen sınırlamasını kapatıyor: 2.5.1'de `trl>=0.29` içe
-  aktarılamıyor ve her tercih eğiticisi ölüydü. Ayrıca düzeltildi: `training.loraplus_lr_ratio`
-  onu ayarlayan her çalıştırmayı çökertiyordu ve `packing: true` TRL 0.29'da hata veriyordu.
+**v0.75.1 — sıkılaştırma ve ürettiğini koruyan bulut çalıştırmaları.** v0.75.0'ın üzerine
+bir bakım sürümü: yeni eğitim özelliği yok, ama yükseltirken değişen birkaç varsayılan var.
+
+- **CLI, çıkarım sunucusu, Web arayüzü, MCP yürütmesi, yapılandırma ayrıştırması ve `.can`
+  işlemesi genelinde sıkılaştırma.** Ayrıntılar bu sürümle birlikte yayımlanan bir danışma
+  belgesinde.
+- **`soup runs clean` artık `--no-keep-weights` seçeneğini kabul ediyor**; bu seçenek, en
+  iyi olmayan kontrol noktalarını yalnızca optimizer ve zamanlayıcı durumlarıyla değil
+  bütünüyle siliyor. `--keep-weights` varsayılan olarak kalıyor ve artık desteklenen her
+  Click sürümünde aynı anlama geliyor — Click 8.1'de eskiden kontrol noktalarının tamamını
+  yine de siliyordu.
+- **Bulut çalıştırmaları çıktılarını koruyor.** `soup train --cloud modal`, çalıştırma
+  çıktılarını `soup-outputs` Modal birimine yazıyor ve çalıştırma bittiğinde — başarısız
+  bir çalıştırmadan sonra da — yerel çıktı dizininize indiriyor; kontrol noktaları eskiden
+  kapsayıcıyla birlikte kayboluyordu.
+- **`soup train --cloud lambda --cloud-submit` sırasında Ctrl+C artık denetleyicinin**
+  Lambda örneğini sonlandırmasını bekliyor. Denetleyici eskiden çeyrek saniye sonra
+  öldürülüyordu, bu da ücretli bir örneğin çalışmaya devam etmesine yol açabiliyordu
+  (Linux/macOS).
+- **Yükseltmek birkaç varsayılanı değiştiriyor.** `soup push --hub modelscope` ve
+  `--hub modelers`, `HF_TOKEN` yerine `MODELSCOPE_API_TOKEN` ve `MODELERS_TOKEN` okuyor;
+  böylece bir hub'ın belirteci hiçbir zaman başka bir hub'a sunulmuyor. Ayrıca ana
+  makinesi `api.openai.com` olmayan bir `https` yargıç URL'si, OpenAI uyumlu bir sunucu
+  olarak kabul edilip `OPENAI_API_KEY` olmadan çağrılıyor.
 
 > Yalnızca Python **3.10–3.12**. 3.13+ sürümlerinde pip, Soup daha hiç çalışmadan yerel
 > eklentide çöken, test edilmemiş PyTorch tekerleklerini çözümlüyordu.

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/adapters-and-governance.md

@@ -524,7 +524,8 @@ soup adapters verify ./adapter --public-key trusted.pub
 ```
 
 `verify` fails closed — any tamper, wrong/missing/unreadable key, or a
-signature from an untrusted key marks the adapter invalid. Signing keys and
+signature from an untrusted key marks the adapter invalid. With `--public-key`,
+an adapter whose signature record is not `ed25519` is also invalid. Signing keys and
 trusted public keys are symlink-rejected and size-capped but **not**
 cwd-contained (keys are secrets that live outside the project). Signature
 persists as `.soup-signature.json` (atomic write). `sigstore` keyless signing

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/backends-and-ops.md

@@ -221,6 +221,12 @@ soup train --config soup.yaml --cloud modal --gpu a100 --cloud-submit
 `soup_modal_app.py` builds an image with `soup-cli[train]` pinned to your running version, writes
 the embedded config inside the container, and runs `soup train` on the chosen GPU.
 
+Run outputs are written to the `soup-outputs` Modal volume (created on first use), in a directory
+named after the run (`soup-<12 hex>`), so checkpoints outlive the container. When the run ends,
+including after a failed run, the app downloads every file in that directory into your local
+output directory and prints a `modal volume get soup-outputs /<run name> <output dir> --force`
+command that retries the download; that command places the files under `<output dir>/<run name>`.
+
 ### RunPod (Planned)
 
 RunPod support is currently in development and descoped from live CLI dispatch pending automated
@@ -233,6 +239,10 @@ Lambda uses an instance rather than a serverless function. The generated local c
 secret-free cloud-init script as API `user_data`, waits for it over SSH, copies the configured
 output back, and requests instance termination in a `finally` block. Keep the controller running
 until it reports that termination succeeded; shutting down the guest does not terminate billing.
+Pressing Ctrl+C during `--cloud-submit` interrupts the controller, which still runs that `finally`
+block, and `soup` waits for it to terminate the instance and exit rather than killing it; the only
+way to skip that cleanup is to kill the controller process itself (for example with `kill` from
+another terminal), which can leave the instance running.
 
 Register the public half of an SSH key with Lambda first, then set:
 
@@ -373,7 +383,7 @@ soup runs clean run_202611...
 soup runs clean --all --dry-run
 ```
 
-By default, the `clean` command operates in "surgical mode" (`--keep-weights`), deleting huge optimizer state files (`optimizer.pt`) from lesser checkpoints to save gigabytes, but keeping their lightweight evaluation weights just in case you want to load them later.
+By default, the `clean` command operates in "surgical mode" (`--keep-weights`), deleting huge optimizer state files (`optimizer.pt`) from lesser checkpoints to save gigabytes, but keeping their lightweight evaluation weights just in case you want to load them later. Pass `--no-keep-weights` to delete whole non-best checkpoints instead (the checkpoint with the lowest loss is always kept); combine it with `--dry-run` to see what would go first.
 
 
 ## Alternative Model Hubs
@@ -397,6 +407,9 @@ The endpoint validator follows the same SSRF rules as `HF_ENDPOINT`: only `http`
 
 The hub adapter is schema-only in this release; the live downloader and uploader land in v0.51.1.
 
+`soup push --hub modelscope` authenticates with `--token` or `MODELSCOPE_API_TOKEN`; `--hub modelers`
+with `--token` or `MODELERS_TOKEN`. Neither reads `HF_TOKEN`.
+
 
 ## TensorBoard Integration
 

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/commands.md

@@ -437,3 +437,4 @@ mutating tools (`train_start`, `export`) are gated behind `--allow-mutating`
 - **Subprocess Isolation:** Execution runs the Soup CLI as an isolated subprocess (`shell=False`, `stdin=DEVNULL`, `cwd` pinned to server startup directory). Child stdout/stderr is redirected to `.soup/mcp-runs/<run_id>.log` to avoid corrupting the MCP JSON-RPC stdio stream.
 - **Concurrency & Disconnects:** Enforces 1 active execution at a time, gated on a persisted run whose process is still alive — so a **restarted** server does not launch a second training while a child from a previous server is still running, and a stale record whose process is gone never blocks execution. A `launching` record (committed before the child process exists, pid not yet written) blocks restart capacity too: it is indistinguishable from "about to spawn", so treating it as live is the safe direction after a crash in that window. If a server crash leaves that row behind, `soup mcp runs reconcile --expunge-launching` removes rows older than five minutes and prints every removed `run_id`; use `--older-than-seconds N` to choose another positive threshold. The command refuses the whole operation if any candidate records a PID that is still alive. Launches run in background (fire-and-forget). Disconnecting the MCP client does not terminate an already-running subprocess.
 - **Config Snapshotting & Input Revalidation:** At plan time (`train_start`), the validated config is snapshotted to `.soup/mcp-runs/<run_id>/config.yaml`, and execution uses this snapshot rather than the original mutable config path. External protected inputs (such as datasets and model/checkpoint directories or files) are not frozen in the snapshot; instead, their content digests (computed via SHA-256 for regular files, or deterministic recursive content hashing over sorted relative file paths for directory trees, bounded by file-count and total-byte safety limits) are recorded at plan time and revalidated immediately before spawn. Modifying an external protected input between plan and execute invalidates the token. Modifying the original config path after planning has no effect because execution strictly uses the snapshotted config. Snapshotting freezes only the configuration itself, not external filesystem assets.
+- **Every Local Input Is Pinned:** A train plan pins every local file or directory the run reads (model, datasets, reward/teacher/PRM models, reward `.py` files, unlearning sets); an input outside the working directory is refused at plan time, and an input that did not exist at plan time must still not exist at execution.

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/evaluation.md

@@ -218,6 +218,8 @@ tasks:
     judge_model: ollama://llama3.1        # SSRF-allowlisted scheme
 ```
 
+`judge_model` accepts `ollama://<model>`, `http://localhost:<port>/<model>` or `https://<host>/<model>`. An `https://` judge URL uses `OPENAI_API_KEY` only when its host is `api.openai.com`; other hosts are called as an OpenAI-compatible server without that key.
+
 Baselines may be a registry reference (`registry://<name-or-id>`), a file path, or omitted for the first run. Any structured exception (`ValueError`, `FileNotFoundError`, `OSError`) during the gate is treated as a regression under `on_regression: stop`.
 
 

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/performance-and-quantization.md

@@ -516,6 +516,15 @@ output: ./output
 >
 > If that prints anything, the adapter is affected. From v0.72.1 a streamed adapter is byte-for-byte in the same layout as an ordinary LoRA run.
 
+> **peft 0.21.0 (released 2026-09-15) saved a streamed adapter EMPTY on every Soup before the #1005 fix — re-run those trainings.** peft 0.21 selects the adapter tensors to save by the prefixes it reads off `model.named_modules()`; the streaming wrapper's module names carried an `.inner.` segment its saved keys did not, so `trainer.save_model()`, every `save_steps` checkpoint and `PeftModel.save_pretrained()` wrote a 40-byte `adapter_model.safetensors` holding **zero** tensors, training reported success, and `--resume` loaded nothing. The training itself was correct — only the file is empty, and nothing in it can be recovered. Check with:
+>
+> ```bash
+> python -c "from safetensors.torch import load_file; \
+> print(len(load_file('adapter_model.safetensors')))"
+> ```
+>
+> `0` means the adapter is lost. Fixed on `main` by PR #1010 (the wrapper now reports canonical names, so peft 0.20 and 0.21 both save every tensor; no `peft<0.21` pin); the next release carries it. Until you run a Soup with that fix, `pip install "peft<0.21"` is the workaround.
+
 **Troubleshooting:**
 - **"trainable LoRA parameters remain on the meta device"** — PEFT attached an
   adapter without real storage and Soup refused the run before installing the

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/serving-and-export.md

@@ -425,7 +425,7 @@ curl http://localhost:8000/v1/adapters
 # → {"adapters": [{"name": "chat", "active": true}, ...], "active": "chat"}
 ```
 
-Names are validated against `^[a-zA-Z0-9][a-zA-Z0-9-]*$`; activate/deactivate calls are thread-safe behind a lock.
+Names are validated against `^[a-zA-Z0-9][a-zA-Z0-9-]*$`; activate/deactivate calls are thread-safe behind a lock. Activate/deactivate also check the `Host` and `Origin` headers (see [Server-Side Tool Endpoints](#server-side-tool-endpoints)).
 
 ### Multi-Tenant Vector Bank (`soup serve --bank`)
 
@@ -559,6 +559,8 @@ soup ui
 
 **Security:** The Web UI generates a random auth token at startup (printed to console). Every private endpoint — mutating (start/stop training, delete runs, inspect data, validate config) and reading (runs, metrics, system, recipes, SSE streams) — requires an `Authorization: Bearer <token>` header. `/` and `/api/health` stay open so the dashboard can load. CORS is restricted to the served origin. Data inspection is sandboxed to the working directory.
 
+**Content policy.** Every Web UI response carries a `Content-Security-Policy` that allows scripts only from the UI's own origin and the pinned Chart.js file (no inline script, no `eval`), plus `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer` and `X-Frame-Options: DENY`. Chart.js is loaded with a Subresource Integrity hash, so the browser refuses it if the CDN serves different bytes. The UI's markup carries no inline event handlers, and every server- or dataset-derived value is escaped before it is rendered. The loopback-only `/docs`, `/docs/oauth2-redirect` and `/redoc` pages are the one exception to the policy header, because FastAPI's interactive docs start from an inline script.
+
 **Interactive API docs are loopback-only.** `/openapi.json`, `/docs`, `/docs/oauth2-redirect` and `/redoc` serve on a loopback bind and are **absent** (404) on any other, including `soup ui --public`. This is deliberate rather than incidental: the schema exposes no run data, configuration or logs, but it does describe every route, parameter and request/response shape, and on a LAN bind that is free reconnaissance. Gating them behind the token instead was rejected — `/docs` is a browser navigation and Swagger cannot attach a Bearer header to it, so gating would break the page for a developer while leaving `/openapi.json` readable by any HTTP client. If you need the schema while bound publicly, read it from a loopback instance of the same version.
 
 ```bash
@@ -767,3 +769,14 @@ Three POST routes are now available on `soup serve`:
   HTTP 501 when strict OS isolation is unavailable (including on Windows or restricted
   Linux containers).
 
+Tool routes, `/v1/thumbs` and adapter activate/deactivate accept requests only when the
+`Host` header names the bound address (any loopback name for a loopback bind) and any
+`Origin` header names the same; otherwise they answer 421 or 403.
+
+The generation routes (`/v1/chat/completions`, `/v1/messages`) and the adapter listing
+(`GET /v1/adapters`) carry the narrower half of that check: a request whose `Origin` names
+another site is refused with 403, so a page the operator merely visits cannot drive
+generation on their server or enumerate the loaded adapters — CORS alone would only stop
+that page *reading* the reply, not sending the request. Requests that carry no `Origin` at
+all — curl, the OpenAI/Anthropic SDKs, a reverse proxy — are unaffected, and `Host` is not
+checked on these routes, so a proxy can still front them under its own hostname.

{soup_cli-0.75.0 → soup_cli-0.75.1}/docs/training.md

@@ -646,6 +646,8 @@ The judge is Soup's own OpenAI-compatible `JudgeEvaluator` adapted to TRL's
 `BasePairwiseJudge` (swap-debiased: a winner is only recorded when both A,B and
 B,A orders agree). Recipe: `online-dpo-smollm2-135m`. Proof-of-mechanism was
 validated on SmolLM2-135M with a synthetic judge (not a production RLHF claim; #286).
+An `https://` judge URL uses `OPENAI_API_KEY` only when its host is `api.openai.com`; other
+hosts are called as an OpenAI-compatible server without that key.
 
 
 ## Weighted Multi-Objective Preference Loss

{soup_cli-0.75.0 → soup_cli-0.75.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.75.0"
+version = "0.75.1"
 description = "Fine-tune and post-train LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"

{soup_cli-0.75.0 → soup_cli-0.75.1}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune and post-train LLMs in one command."""
 
-__version__ = "0.75.0"
+__version__ = "0.75.1"

{soup_cli-0.75.0 → soup_cli-0.75.1}/src/soup_cli/cans/run.py

@@ -18,7 +18,7 @@ from pathlib import Path
 from typing import Callable, Optional
 
 from soup_cli.cans.schema import DeployTarget, Manifest
-from soup_cli.cans.unpack import extract_can, inspect_can
+from soup_cli.cans.unpack import extract_can, inspect_can, read_config
 from soup_cli.utils.paths import is_under_cwd
 
 _RUN_TIMEOUT_SECONDS = 60 * 60 * 24  # 24h max — generous; user kills with ^C
@@ -130,10 +130,27 @@ def _deploy_target(target: DeployTarget, extract_dir: Path) -> int:
             "--name", target.name,
         ])
     if target.kind == "gguf":
-        # Already extracted — just confirm presence.
+        # Already extracted — just confirm presence, but verify the manifest's
+        # path really resolves inside extract_dir first. ``target.path`` comes
+        # from the can, so an absolute path (pathlib drops the left operand
+        # when the right one is absolute), a ``..`` segment, or a symlink
+        # planted in the can would otherwise reach an arbitrary file on disk.
+        # Same containment pattern as the kind=ollama branch above; the
+        # DeployTarget field validator is the first line, this is the second.
         if not target.path:
             raise ValueError("deploy_target kind=gguf requires 'path'")
-        gguf_path = (extract_dir / target.path).resolve()
+        extract_real = os.path.realpath(str(extract_dir))
+        gguf_real = os.path.realpath(str(extract_dir / target.path))
+        try:
+            common = os.path.commonpath([extract_real, gguf_real])
+        except ValueError:  # different drives on Windows — never contained
+            common = ""
+        if common != extract_real or gguf_real == extract_real:
+            raise ValueError(
+                f"deploy gguf path '{target.path}' escapes the can extract "
+                f"dir - refusing"
+            )
+        gguf_path = Path(gguf_real)
         if not gguf_path.exists():
             raise FileNotFoundError(f"deploy gguf path not found: {gguf_path}")
         return 0
@@ -180,6 +197,10 @@ def run_can(
 
     # Read manifest first — surface schema errors before any side effects.
     manifest = inspect_can(str(src))
+    # The extracted config.yaml is handed to ``soup train``, whose loader has
+    # no size or expansion limit of its own; read it through the capped reader
+    # first so an oversized or alias-amplified config is refused here.
+    read_config(str(src))
 
     if not yes:
         if confirm_callback is None:

{soup_cli-0.75.0 → soup_cli-0.75.1}/src/soup_cli/cans/schema.py

@@ -8,6 +8,8 @@ from typing import Literal, Optional
 
 from pydantic import BaseModel, Field, field_validator
 
+from soup_cli.utils.yaml_limits import check_expanded_nodes
+
 CAN_FORMAT_VERSION = 3  # v0.71.3 #182: attestations field (additive over v2)
 SUPPORTED_CAN_FORMAT_VERSIONS = (1, 2, 3)
 
@@ -28,6 +30,11 @@ def validate_attestation_statement(stmt: object) -> dict:
     """
     if not isinstance(stmt, dict):
         raise ValueError("attestation must be a dict (in-toto Statement)")
+    # Before json.dumps: a statement loaded from YAML may share references
+    # (anchors / aliases) whose serialised form is exponentially larger. Every
+    # node costs at least one byte of JSON, so a statement within the byte cap
+    # below has fewer nodes than _MAX_ATTESTATION_BYTES and always passes.
+    check_expanded_nodes(stmt, "attestation", limit=_MAX_ATTESTATION_BYTES)
     type_field = stmt.get("_type")
     predicate_type = stmt.get("predicateType")
     if not isinstance(type_field, str) or not type_field: