soup-cli 0.75.0__tar.gz → 0.75.2__tar.gz

{soup_cli-0.75.0 → soup_cli-0.75.2}/.github/workflows/ci.yml

@@ -2,7 +2,11 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # `release/**` is here so a release branch gets the matrix on the exact
+    # tree that will be tagged. A pull request builds the MERGE of head and
+    # main, which for a release cut from an older tag is not the tree that
+    # ships, so a PR run cannot stand in for this one.
+    branches: [main, 'release/**']
   pull_request:
     branches: [main]
 
@@ -236,6 +240,13 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+      # The Web UI escaping tests run `safe_html.js` under node, and skip when
+      # node is absent. Runner images happen to ship one, so the skip would be
+      # silent: pin it, or the only tests that execute the real escaping logic
+      # can disappear without anything turning red.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
       - name: Pin the HF cache to a deterministic path
         # Set here and not in the job-level `env:` block: the `runner` context
         # is not available there (only github / needs / strategy / matrix /

{soup_cli-0.75.0 → soup_cli-0.75.2}/CHANGELOG.md

@@ -12,6 +12,44 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.75.2] - 2026-10-01
+
+### Changed
+
+- Outbound endpoint checks now refuse a private, link-local or reserved IP literal over `https` as well as `http`. This covers `soup data generate --api-base`, the vLLM provider and the commands that use it, judge URLs in `soup eval judge`, eval-gate suites, `soup ship --judge-model` / `eval.ship.judge_model` and `training.online_dpo_judge`, and the Web UI chat proxy. Loopback still works; address a LAN server by its hostname. `training.online_dpo_judge` is now checked when soup.yaml loads, not only when the trainer starts.
+
+- `soup data generate --api-base` and the Web UI chat proxy no longer treat `http://0.0.0.0` as local; use `localhost` or `127.0.0.1`.
+
+- `100.64.0.0/10` and `fec0::/10` literals are now treated as non-public by every check that already refused private addresses (webhooks, the OTLP endpoint, telemetry, hub endpoints over HTTP, and `soup ingest --pull`, where `--allow-private-host` admits them).
+
+- Every check that refuses private addresses now also recognizes an IP literal written with non-ASCII digits or label separators, which an HTTP client folds to ASCII before it connects.
+
+### Fixed
+
+- `soup ship` checks `--judge-model` before it builds the base and tuned models; it used to load both and only then stop with a usage error.
+
+- The Web UI chat proxy answers 400, not 500, for an endpoint URL that does not parse.
+
+### Security
+
+- Hardening of outbound endpoint validation. A security advisory with details and upgrade guidance will be published alongside this release.
+
+## [0.75.1] - 2026-09-21
+
+### Fixed
+
+- **A layer-streamed LoRA adapter saved as ZERO tensors under peft 0.21.0 (#1005 in #1010).** peft 0.21 selects an adapter's tensors by the prefixes it reads off `model.named_modules()` and keeps the matching `state_dict()` entries, where 0.20 filtered by the `lora_` substring; the streaming wrapper's module and parameter names carried `.inner.` while its `state_dict()` keys were canonical, so `trainer.save_model()`, every `save_steps` checkpoint and `get_peft_model_state_dict()` returned nothing, and nothing raised. The wrapper now enumerates the inner layer's tree at its own prefix (`named_modules()` / `named_children()`, with `train()` / `apply()` / `_apply()` reaching the inner layer explicitly), so names and keys are one spelling — which also keeps transformers' weight-decay grouping, built from `named_children()`, from silently dropping every LoRA parameter into the no-decay group. **Any adapter saved with `stream_layers: true` on peft>=0.21 before this fix holds zero tensors (a 40-byte `adapter_model.safetensors`, no error at save time) and cannot be recovered — re-train it on a Soup with this fix, or with `peft<0.21`.** Naming only; nothing on the streamed forward path changes. Ten peft-version-independent tests pin names == keys against a resident LoRA model; the four tests that documented the old asymmetry are inverted rather than deleted. No `peft<0.21` pin.
+
+- **A Ctrl+C arriving immediately after the Lambda controller started could still leave the instance running (#1073 in #1078).** `submit_lambda_run` spawned the controller outside the `try` that absorbs interrupts, so a SIGINT delivered between `Popen` returning and the waiting loop being entered — or one landing on the "still waiting" notice, which is written from the interrupt handler — unwound the parent while the controller was still terminating the paid instance in its `finally` block. The spawn and the notice now sit inside the guarded region: once the child exists, every path leads back to `proc.wait()` and the controller's exit code remains what the function returns. An interrupt raised before the child exists still propagates unchanged, and a `wait()` failure that is not an interrupt still surfaces rather than being retried.
+
+- `soup runs clean` now accepts `--no-keep-weights` to delete whole non-best checkpoints; `--keep-weights` (the default) keeps weights on every supported Click version — on Click 8.1 it previously deleted whole checkpoints (#1057)
+
+- **Cloud runs keep their outputs and their cleanup (#1058).** `soup train --cloud modal` now writes run outputs to the `soup-outputs` Modal volume and downloads them to the local output directory when the run ends (also after a failed run); previously checkpoints were lost with the container. `soup train --cloud lambda --cloud-submit`: pressing Ctrl+C now waits for the controller to terminate the Lambda instance; previously the controller was killed 0.25 s later and the instance could keep running (Linux/macOS).
+
+### Security
+
+- Hardening across the CLI, the inference server, the Web UI, MCP execution, config parsing and `.can` handling. A security advisory with details and upgrade guidance will be published alongside this release.
+
 ## [0.75.0] - 2026-09-12
 
 ### Added
@@ -4650,7 +4688,8 @@ what a fine-tune forgets and leaks.
   `SECURITY.md` (~220 KB). `SECURITY.md` is now a concise security policy; the
   detailed hardening notes remain in git history and the GitHub Releases notes.
 
-[Unreleased]: https://github.com/MakazhanAlpamys/Soup/compare/v0.75.0...HEAD
+[Unreleased]: https://github.com/MakazhanAlpamys/Soup/compare/v0.75.1...HEAD
+[0.75.1]: https://github.com/MakazhanAlpamys/Soup/compare/v0.75.0...v0.75.1
 [0.75.0]: https://github.com/MakazhanAlpamys/Soup/compare/v0.74.0...v0.75.0
 [0.74.0]: https://github.com/MakazhanAlpamys/Soup/compare/v0.73.3...v0.74.0
 [0.73.1]: https://github.com/MakazhanAlpamys/Soup/compare/v0.73.0...v0.73.1

{soup_cli-0.75.0 → soup_cli-0.75.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: soup-cli
-Version: 0.75.0
+Version: 0.75.2
 Summary: Fine-tune and post-train LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -241,39 +241,20 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.75.0 — the same `soup.yaml` trained a different recipe on MLX than on transformers,
-silently.** Six training options were validated, documented, accepted — and read by nothing
-on that backend. **All 60 pull requests in this release came from outside the maintainer**,
-by 22 people.
-
-- **Breaking: an unknown config key now refuses the load.** v0.74 warned and named this
-  release as the deadline. A typo like `quantizaton`, or a key that only exists on a newer
-  Soup, used to be dropped while the run proceeded with the setting not applied; it now
-  fails on the CLI (exit 1) and in the API (`ValueError`), naming the field you probably
-  meant. The detector applies the root-level `lora:` remap the schema has honoured
-  since v0.40.1, so that spelling is accepted, not refused; the two `soup fetch examples`
-  files using it moved to the canonical `training.lora`. Every recipe and template loads
-  clean, key names are escaped before they reach the terminal, and the scan is bounded.
-- **MLX honours the config it accepted.** `train_on_responses_only`, `warmup_ratio` /
-  `scheduler` / `weight_decay` / `optimizer`, `max_grad_norm`, `gradient_accumulation_steps`
-  and `gradient_checkpointing` were each validated and then dropped on `backend: mlx`. Only
-  8 of the 32 optimizer names have an MLX equivalent; the other 24 are refused by name
-  instead of silently becoming AdamW. MLX also drives the live dashboard, the tracker and
-  `soup ui`, and `soup doctor --config` lists the settings a backend does not read.
-- **Validation loss existed nowhere.** It was computed on every backend and thrown away:
-  no metrics column, no event field, nothing on the panel. It is now recorded, streamed
-  and displayed.
-- **Breaking: `grpo_variant: gspo` is the published sequence-level objective**
-  (arXiv:2507.18071), replacing a column-centering heuristic in which a padding token also
-  shifted the gradient of every row sharing its column. Existing gspo configs will not
-  reproduce prior runs.
-- **Web UI read endpoints and SSE require auth**, with short-lived single-use tickets
-  instead of a token in a query string; `--public` no longer serves `/docs` and
-  `/openapi.json` to the LAN; and a training subprocess no longer hangs when nothing
-  reads its output.
-- **`torch>=2.6.0`** closes v0.74.0's known limitation: at 2.5.1 `trl>=0.29` could not
-  import and every preference trainer was dead. Also fixed: `training.loraplus_lr_ratio`
-  crashed every run that set it, and `packing: true` raised on TRL 0.29.
+**v0.75.2 — outbound endpoint checks refuse private addresses.** A security patch on top
+of v0.75.1 with one hardening change; everything merged since v0.75.0 ships in the next
+minor release.
+
+- **Endpoint URLs can no longer name a private address directly.** The
+  `soup data generate --api-base` URL, the vLLM provider, judge URLs (`soup eval judge`,
+  eval-gate suites, `soup ship --judge-model`, `training.online_dpo_judge`) and the Web UI
+  chat proxy refuse a private, link-local or reserved IP literal over `https` as well as
+  `http`. Loopback still works; address a server on your network by its hostname. Details
+  in an advisory published with this release.
+- **`http://0.0.0.0` is no longer treated as local** by `soup data generate --api-base` and
+  the Web UI chat proxy; use `localhost` or `127.0.0.1`.
+- **`100.64.0.0/10` and `fec0::/10` count as non-public** wherever private addresses were
+  already refused, including webhooks, the OTLP endpoint and `soup ingest --pull`.
 
 > Python **3.10–3.12** only. On 3.13+, pip used to resolve untested PyTorch wheels that
 > crash in the native extension before Soup runs at all.

{soup_cli-0.75.0 → soup_cli-0.75.2}/README.md

@@ -87,39 +87,20 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.75.0 — the same `soup.yaml` trained a different recipe on MLX than on transformers,
-silently.** Six training options were validated, documented, accepted — and read by nothing
-on that backend. **All 60 pull requests in this release came from outside the maintainer**,
-by 22 people.
-
-- **Breaking: an unknown config key now refuses the load.** v0.74 warned and named this
-  release as the deadline. A typo like `quantizaton`, or a key that only exists on a newer
-  Soup, used to be dropped while the run proceeded with the setting not applied; it now
-  fails on the CLI (exit 1) and in the API (`ValueError`), naming the field you probably
-  meant. The detector applies the root-level `lora:` remap the schema has honoured
-  since v0.40.1, so that spelling is accepted, not refused; the two `soup fetch examples`
-  files using it moved to the canonical `training.lora`. Every recipe and template loads
-  clean, key names are escaped before they reach the terminal, and the scan is bounded.
-- **MLX honours the config it accepted.** `train_on_responses_only`, `warmup_ratio` /
-  `scheduler` / `weight_decay` / `optimizer`, `max_grad_norm`, `gradient_accumulation_steps`
-  and `gradient_checkpointing` were each validated and then dropped on `backend: mlx`. Only
-  8 of the 32 optimizer names have an MLX equivalent; the other 24 are refused by name
-  instead of silently becoming AdamW. MLX also drives the live dashboard, the tracker and
-  `soup ui`, and `soup doctor --config` lists the settings a backend does not read.
-- **Validation loss existed nowhere.** It was computed on every backend and thrown away:
-  no metrics column, no event field, nothing on the panel. It is now recorded, streamed
-  and displayed.
-- **Breaking: `grpo_variant: gspo` is the published sequence-level objective**
-  (arXiv:2507.18071), replacing a column-centering heuristic in which a padding token also
-  shifted the gradient of every row sharing its column. Existing gspo configs will not
-  reproduce prior runs.
-- **Web UI read endpoints and SSE require auth**, with short-lived single-use tickets
-  instead of a token in a query string; `--public` no longer serves `/docs` and
-  `/openapi.json` to the LAN; and a training subprocess no longer hangs when nothing
-  reads its output.
-- **`torch>=2.6.0`** closes v0.74.0's known limitation: at 2.5.1 `trl>=0.29` could not
-  import and every preference trainer was dead. Also fixed: `training.loraplus_lr_ratio`
-  crashed every run that set it, and `packing: true` raised on TRL 0.29.
+**v0.75.2 — outbound endpoint checks refuse private addresses.** A security patch on top
+of v0.75.1 with one hardening change; everything merged since v0.75.0 ships in the next
+minor release.
+
+- **Endpoint URLs can no longer name a private address directly.** The
+  `soup data generate --api-base` URL, the vLLM provider, judge URLs (`soup eval judge`,
+  eval-gate suites, `soup ship --judge-model`, `training.online_dpo_judge`) and the Web UI
+  chat proxy refuse a private, link-local or reserved IP literal over `https` as well as
+  `http`. Loopback still works; address a server on your network by its hostname. Details
+  in an advisory published with this release.
+- **`http://0.0.0.0` is no longer treated as local** by `soup data generate --api-base` and
+  the Web UI chat proxy; use `localhost` or `127.0.0.1`.
+- **`100.64.0.0/10` and `fec0::/10` count as non-public** wherever private addresses were
+  already refused, including webhooks, the OTLP endpoint and `soup ingest --pull`.
 
 > Python **3.10–3.12** only. On 3.13+, pip used to resolve untested PyTorch wheels that
 > crash in the native extension before Soup runs at all.

{soup_cli-0.75.0 → soup_cli-0.75.2}/README.tr.md

@@ -1,4 +1,4 @@
-<!-- synced-from: README.md sha256:5ceff359925678608a55dc8a4d522221b75668b10e659aa4f0dd05a28f2eb1c4 -->
+<!-- synced-from: README.md sha256:aca2a4e15b1d8c4055ac1b650f9fd514bdfdc024e7d9dd86211a0796263d1d4b -->
 <p align="center">🌍 <a href="README.md">English</a> | <strong>Türkçe</strong></p>
 
 <p align="center">
@@ -88,39 +88,22 @@ yerine altyapıyla boğuşarak geçiriyor. Soup bunu çözer.
 
 ## Yenilikler
 
-**v0.75.0 — aynı `soup.yaml`, MLX'te transformers'takinden farklı bir tarif eğitiyordu,
-sessizce.** Altı eğitim seçeneği doğrulanıyor, belgeleniyor, kabul ediliyor — ve o arka uçta
-hiçbir şey tarafından okunmuyordu. **Bu sürümdeki 60 pull request'in tamamı bakımcı dışından
-geldi**, 22 kişiden.
-
-- **Geriye dönük uyumsuz: bilinmeyen bir yapılandırma anahtarı artık yüklemeyi reddediyor.**
-  v0.74 uyarı vermiş ve son tarih olarak bu sürümü adlandırmıştı. `quantizaton` gibi bir yazım
-  hatası ya da yalnızca daha yeni bir Soup'ta bulunan bir anahtar eskiden atılıyor ve
-  çalıştırma o ayar uygulanmadan devam ediyordu; artık CLI'da (çıkış kodu 1) ve API'de
-  (`ValueError`) başarısız oluyor ve muhtemelen kastettiğiniz alanı adlandırıyor. Dedektör,
-  şemanın v0.40.1'den beri tanıdığı üst düzey `lora:` yeniden eşlemesini uyguluyor; yani bu
-  yazım reddedilmiyor, kabul ediliyor. Onu kullanan iki `soup fetch examples` dosyası kanonik
-  `training.lora` biçimine taşındı. Her tarif ve şablon temiz yükleniyor, anahtar adları
-  terminale ulaşmadan önce kaçışlanıyor ve tarama sınırlı.
-- **MLX, kabul ettiği yapılandırmaya uyuyor.** `train_on_responses_only`, `warmup_ratio` /
-  `scheduler` / `weight_decay` / `optimizer`, `max_grad_norm`, `gradient_accumulation_steps`
-  ve `gradient_checkpointing`, `backend: mlx` üzerinde tek tek doğrulanıp sonra düşürülüyordu.
-  32 optimizer adından yalnızca 8'inin MLX karşılığı var; diğer 24'ü sessizce AdamW'ye
-  dönüşmek yerine adıyla reddediliyor. MLX ayrıca canlı panoyu, izleyiciyi ve `soup ui`'yi
-  sürüyor; `soup doctor --config` ise bir arka ucun okumadığı ayarları listeliyor.
-- **Doğrulama kaybı hiçbir yerde yoktu.** Her arka uçta hesaplanıp atılıyordu: metrik sütunu
-  yok, olay alanı yok, panoda hiçbir şey yok. Artık kaydediliyor, akıtılıyor ve gösteriliyor.
-- **Geriye dönük uyumsuz: `grpo_variant: gspo`, yayımlanmış dizi düzeyi hedef fonksiyonudur**
-  (arXiv:2507.18071); bir dolgu belirtecinin aynı sütunu paylaşan her satırın gradyanını da
-  kaydırdığı sütun merkezleme sezgiselinin yerini alıyor. Mevcut gspo yapılandırmaları önceki
-  çalıştırmaları yeniden üretmeyecek.
-- **Web arayüzünün okuma uç noktaları ve SSE, kimlik doğrulama gerektiriyor**; sorgu
-  dizesindeki bir belirteç yerine kısa ömürlü, tek kullanımlık biletlerle. `--public` artık
-  `/docs` ve `/openapi.json`'ı yerel ağa sunmuyor; eğitim alt süreci de çıktısını kimse
-  okumadığında artık askıda kalmıyor.
-- **`torch>=2.6.0`**, v0.74.0'ın bilinen sınırlamasını kapatıyor: 2.5.1'de `trl>=0.29` içe
-  aktarılamıyor ve her tercih eğiticisi ölüydü. Ayrıca düzeltildi: `training.loraplus_lr_ratio`
-  onu ayarlayan her çalıştırmayı çökertiyordu ve `packing: true` TRL 0.29'da hata veriyordu.
+**v0.75.2 — giden uç nokta denetimleri özel adresleri reddediyor.** v0.75.1'in üzerine
+tek bir sıkılaştırma değişikliği içeren bir güvenlik yaması; v0.75.0'dan bu yana
+birleştirilen her şey bir sonraki ara sürümde geliyor.
+
+- **Uç nokta URL'leri artık özel bir adresi doğrudan gösteremiyor.**
+  `soup data generate --api-base` URL'si, vLLM sağlayıcısı, yargıç URL'leri (`soup eval judge`,
+  eval-gate paketleri, `soup ship --judge-model`, `training.online_dpo_judge`) ve Web
+  arayüzünün sohbet vekili; özel, bağlantı-yerel (link-local) veya ayrılmış bir IP
+  değişmezini yalnızca `http` üzerinden değil `https` üzerinden de reddediyor. Geri döngü
+  (loopback) çalışmaya devam ediyor; ağınızdaki bir sunucuya ana makine adıyla erişin.
+  Ayrıntılar bu sürümle birlikte yayımlanan bir danışma belgesinde.
+- **`http://0.0.0.0` artık yerel sayılmıyor**: `soup data generate --api-base` ve Web
+  arayüzünün sohbet vekili için `localhost` veya `127.0.0.1` kullanın.
+- **`100.64.0.0/10` ve `fec0::/10` herkese açık olmayan adres sayılıyor**: web kancaları,
+  OTLP uç noktası ve `soup ingest --pull` dahil, özel adreslerin zaten reddedildiği her
+  yerde.
 
 > Yalnızca Python **3.10–3.12**. 3.13+ sürümlerinde pip, Soup daha hiç çalışmadan yerel
 > eklentide çöken, test edilmemiş PyTorch tekerleklerini çözümlüyordu.

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/adapters-and-governance.md

@@ -524,7 +524,8 @@ soup adapters verify ./adapter --public-key trusted.pub
 ```
 
 `verify` fails closed — any tamper, wrong/missing/unreadable key, or a
-signature from an untrusted key marks the adapter invalid. Signing keys and
+signature from an untrusted key marks the adapter invalid. With `--public-key`,
+an adapter whose signature record is not `ed25519` is also invalid. Signing keys and
 trusted public keys are symlink-rejected and size-capped but **not**
 cwd-contained (keys are secrets that live outside the project). Signature
 persists as `.soup-signature.json` (atomic write). `sigstore` keyless signing

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/backends-and-ops.md

@@ -221,6 +221,12 @@ soup train --config soup.yaml --cloud modal --gpu a100 --cloud-submit
 `soup_modal_app.py` builds an image with `soup-cli[train]` pinned to your running version, writes
 the embedded config inside the container, and runs `soup train` on the chosen GPU.
 
+Run outputs are written to the `soup-outputs` Modal volume (created on first use), in a directory
+named after the run (`soup-<12 hex>`), so checkpoints outlive the container. When the run ends,
+including after a failed run, the app downloads every file in that directory into your local
+output directory and prints a `modal volume get soup-outputs /<run name> <output dir> --force`
+command that retries the download; that command places the files under `<output dir>/<run name>`.
+
 ### RunPod (Planned)
 
 RunPod support is currently in development and descoped from live CLI dispatch pending automated
@@ -233,6 +239,10 @@ Lambda uses an instance rather than a serverless function. The generated local c
 secret-free cloud-init script as API `user_data`, waits for it over SSH, copies the configured
 output back, and requests instance termination in a `finally` block. Keep the controller running
 until it reports that termination succeeded; shutting down the guest does not terminate billing.
+Pressing Ctrl+C during `--cloud-submit` interrupts the controller, which still runs that `finally`
+block, and `soup` waits for it to terminate the instance and exit rather than killing it; the only
+way to skip that cleanup is to kill the controller process itself (for example with `kill` from
+another terminal), which can leave the instance running.
 
 Register the public half of an SSH key with Lambda first, then set:
 
@@ -373,7 +383,7 @@ soup runs clean run_202611...
 soup runs clean --all --dry-run
 ```
 
-By default, the `clean` command operates in "surgical mode" (`--keep-weights`), deleting huge optimizer state files (`optimizer.pt`) from lesser checkpoints to save gigabytes, but keeping their lightweight evaluation weights just in case you want to load them later.
+By default, the `clean` command operates in "surgical mode" (`--keep-weights`), deleting huge optimizer state files (`optimizer.pt`) from lesser checkpoints to save gigabytes, but keeping their lightweight evaluation weights just in case you want to load them later. Pass `--no-keep-weights` to delete whole non-best checkpoints instead (the checkpoint with the lowest loss is always kept); combine it with `--dry-run` to see what would go first.
 
 
 ## Alternative Model Hubs
@@ -397,6 +407,9 @@ The endpoint validator follows the same SSRF rules as `HF_ENDPOINT`: only `http`
 
 The hub adapter is schema-only in this release; the live downloader and uploader land in v0.51.1.
 
+`soup push --hub modelscope` authenticates with `--token` or `MODELSCOPE_API_TOKEN`; `--hub modelers`
+with `--token` or `MODELERS_TOKEN`. Neither reads `HF_TOKEN`.
+
 
 ## TensorBoard Integration
 

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/commands.md

@@ -437,3 +437,4 @@ mutating tools (`train_start`, `export`) are gated behind `--allow-mutating`
 - **Subprocess Isolation:** Execution runs the Soup CLI as an isolated subprocess (`shell=False`, `stdin=DEVNULL`, `cwd` pinned to server startup directory). Child stdout/stderr is redirected to `.soup/mcp-runs/<run_id>.log` to avoid corrupting the MCP JSON-RPC stdio stream.
 - **Concurrency & Disconnects:** Enforces 1 active execution at a time, gated on a persisted run whose process is still alive — so a **restarted** server does not launch a second training while a child from a previous server is still running, and a stale record whose process is gone never blocks execution. A `launching` record (committed before the child process exists, pid not yet written) blocks restart capacity too: it is indistinguishable from "about to spawn", so treating it as live is the safe direction after a crash in that window. If a server crash leaves that row behind, `soup mcp runs reconcile --expunge-launching` removes rows older than five minutes and prints every removed `run_id`; use `--older-than-seconds N` to choose another positive threshold. The command refuses the whole operation if any candidate records a PID that is still alive. Launches run in background (fire-and-forget). Disconnecting the MCP client does not terminate an already-running subprocess.
 - **Config Snapshotting & Input Revalidation:** At plan time (`train_start`), the validated config is snapshotted to `.soup/mcp-runs/<run_id>/config.yaml`, and execution uses this snapshot rather than the original mutable config path. External protected inputs (such as datasets and model/checkpoint directories or files) are not frozen in the snapshot; instead, their content digests (computed via SHA-256 for regular files, or deterministic recursive content hashing over sorted relative file paths for directory trees, bounded by file-count and total-byte safety limits) are recorded at plan time and revalidated immediately before spawn. Modifying an external protected input between plan and execute invalidates the token. Modifying the original config path after planning has no effect because execution strictly uses the snapshotted config. Snapshotting freezes only the configuration itself, not external filesystem assets.
+- **Every Local Input Is Pinned:** A train plan pins every local file or directory the run reads (model, datasets, reward/teacher/PRM models, reward `.py` files, unlearning sets); an input outside the working directory is refused at plan time, and an input that did not exist at plan time must still not exist at execution.

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/evaluation.md

@@ -218,6 +218,8 @@ tasks:
     judge_model: ollama://llama3.1        # SSRF-allowlisted scheme
 ```
 
+`judge_model` accepts `ollama://<model>`, `http://localhost:<port>/<model>` or `https://<host>/<model>`. An `https://` judge URL uses `OPENAI_API_KEY` only when its host is `api.openai.com`; other hosts are called as an OpenAI-compatible server without that key.
+
 Baselines may be a registry reference (`registry://<name-or-id>`), a file path, or omitted for the first run. Any structured exception (`ValueError`, `FileNotFoundError`, `OSError`) during the gate is treated as a regression under `on_regression: stop`.
 
 

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/performance-and-quantization.md

@@ -516,6 +516,15 @@ output: ./output
 >
 > If that prints anything, the adapter is affected. From v0.72.1 a streamed adapter is byte-for-byte in the same layout as an ordinary LoRA run.
 
+> **peft 0.21.0 (released 2026-09-15) saved a streamed adapter EMPTY on every Soup before the #1005 fix — re-run those trainings.** peft 0.21 selects the adapter tensors to save by the prefixes it reads off `model.named_modules()`; the streaming wrapper's module names carried an `.inner.` segment its saved keys did not, so `trainer.save_model()`, every `save_steps` checkpoint and `PeftModel.save_pretrained()` wrote a 40-byte `adapter_model.safetensors` holding **zero** tensors, training reported success, and `--resume` loaded nothing. The training itself was correct — only the file is empty, and nothing in it can be recovered. Check with:
+>
+> ```bash
+> python -c "from safetensors.torch import load_file; \
+> print(len(load_file('adapter_model.safetensors')))"
+> ```
+>
+> `0` means the adapter is lost. Fixed on `main` by PR #1010 (the wrapper now reports canonical names, so peft 0.20 and 0.21 both save every tensor; no `peft<0.21` pin); the next release carries it. Until you run a Soup with that fix, `pip install "peft<0.21"` is the workaround.
+
 **Troubleshooting:**
 - **"trainable LoRA parameters remain on the meta device"** — PEFT attached an
   adapter without real storage and Soup refused the run before installing the

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/serving-and-export.md

@@ -425,7 +425,7 @@ curl http://localhost:8000/v1/adapters
 # → {"adapters": [{"name": "chat", "active": true}, ...], "active": "chat"}
 ```
 
-Names are validated against `^[a-zA-Z0-9][a-zA-Z0-9-]*$`; activate/deactivate calls are thread-safe behind a lock.
+Names are validated against `^[a-zA-Z0-9][a-zA-Z0-9-]*$`; activate/deactivate calls are thread-safe behind a lock. Activate/deactivate also check the `Host` and `Origin` headers (see [Server-Side Tool Endpoints](#server-side-tool-endpoints)).
 
 ### Multi-Tenant Vector Bank (`soup serve --bank`)
 
@@ -559,6 +559,8 @@ soup ui
 
 **Security:** The Web UI generates a random auth token at startup (printed to console). Every private endpoint — mutating (start/stop training, delete runs, inspect data, validate config) and reading (runs, metrics, system, recipes, SSE streams) — requires an `Authorization: Bearer <token>` header. `/` and `/api/health` stay open so the dashboard can load. CORS is restricted to the served origin. Data inspection is sandboxed to the working directory.
 
+**Content policy.** Every Web UI response carries a `Content-Security-Policy` that allows scripts only from the UI's own origin and the pinned Chart.js file (no inline script, no `eval`), plus `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer` and `X-Frame-Options: DENY`. Chart.js is loaded with a Subresource Integrity hash, so the browser refuses it if the CDN serves different bytes. The UI's markup carries no inline event handlers, and every server- or dataset-derived value is escaped before it is rendered. The loopback-only `/docs`, `/docs/oauth2-redirect` and `/redoc` pages are the one exception to the policy header, because FastAPI's interactive docs start from an inline script.
+
 **Interactive API docs are loopback-only.** `/openapi.json`, `/docs`, `/docs/oauth2-redirect` and `/redoc` serve on a loopback bind and are **absent** (404) on any other, including `soup ui --public`. This is deliberate rather than incidental: the schema exposes no run data, configuration or logs, but it does describe every route, parameter and request/response shape, and on a LAN bind that is free reconnaissance. Gating them behind the token instead was rejected — `/docs` is a browser navigation and Swagger cannot attach a Bearer header to it, so gating would break the page for a developer while leaving `/openapi.json` readable by any HTTP client. If you need the schema while bound publicly, read it from a loopback instance of the same version.
 
 ```bash
@@ -767,3 +769,14 @@ Three POST routes are now available on `soup serve`:
   HTTP 501 when strict OS isolation is unavailable (including on Windows or restricted
   Linux containers).
 
+Tool routes, `/v1/thumbs` and adapter activate/deactivate accept requests only when the
+`Host` header names the bound address (any loopback name for a loopback bind) and any
+`Origin` header names the same; otherwise they answer 421 or 403.
+
+The generation routes (`/v1/chat/completions`, `/v1/messages`) and the adapter listing
+(`GET /v1/adapters`) carry the narrower half of that check: a request whose `Origin` names
+another site is refused with 403, so a page the operator merely visits cannot drive
+generation on their server or enumerate the loaded adapters — CORS alone would only stop
+that page *reading* the reply, not sending the request. Requests that carry no `Origin` at
+all — curl, the OpenAI/Anthropic SDKs, a reverse proxy — are unaffected, and `Host` is not
+checked on these routes, so a proxy can still front them under its own hostname.

{soup_cli-0.75.0 → soup_cli-0.75.2}/docs/training.md

@@ -646,6 +646,8 @@ The judge is Soup's own OpenAI-compatible `JudgeEvaluator` adapted to TRL's
 `BasePairwiseJudge` (swap-debiased: a winner is only recorded when both A,B and
 B,A orders agree). Recipe: `online-dpo-smollm2-135m`. Proof-of-mechanism was
 validated on SmolLM2-135M with a synthetic judge (not a production RLHF claim; #286).
+An `https://` judge URL uses `OPENAI_API_KEY` only when its host is `api.openai.com`; other
+hosts are called as an OpenAI-compatible server without that key.
 
 
 ## Weighted Multi-Objective Preference Loss

{soup_cli-0.75.0 → soup_cli-0.75.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.75.0"
+version = "0.75.2"
 description = "Fine-tune and post-train LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"

{soup_cli-0.75.0 → soup_cli-0.75.2}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune and post-train LLMs in one command."""
 
-__version__ = "0.75.0"
+__version__ = "0.75.2"

{soup_cli-0.75.0 → soup_cli-0.75.2}/src/soup_cli/cans/run.py

@@ -18,7 +18,7 @@ from pathlib import Path
 from typing import Callable, Optional
 
 from soup_cli.cans.schema import DeployTarget, Manifest
-from soup_cli.cans.unpack import extract_can, inspect_can
+from soup_cli.cans.unpack import extract_can, inspect_can, read_config
 from soup_cli.utils.paths import is_under_cwd
 
 _RUN_TIMEOUT_SECONDS = 60 * 60 * 24  # 24h max — generous; user kills with ^C
@@ -130,10 +130,27 @@ def _deploy_target(target: DeployTarget, extract_dir: Path) -> int:
             "--name", target.name,
         ])
     if target.kind == "gguf":
-        # Already extracted — just confirm presence.
+        # Already extracted — just confirm presence, but verify the manifest's
+        # path really resolves inside extract_dir first. ``target.path`` comes
+        # from the can, so an absolute path (pathlib drops the left operand
+        # when the right one is absolute), a ``..`` segment, or a symlink
+        # planted in the can would otherwise reach an arbitrary file on disk.
+        # Same containment pattern as the kind=ollama branch above; the
+        # DeployTarget field validator is the first line, this is the second.
         if not target.path:
             raise ValueError("deploy_target kind=gguf requires 'path'")
-        gguf_path = (extract_dir / target.path).resolve()
+        extract_real = os.path.realpath(str(extract_dir))
+        gguf_real = os.path.realpath(str(extract_dir / target.path))
+        try:
+            common = os.path.commonpath([extract_real, gguf_real])
+        except ValueError:  # different drives on Windows — never contained
+            common = ""
+        if common != extract_real or gguf_real == extract_real:
+            raise ValueError(
+                f"deploy gguf path '{target.path}' escapes the can extract "
+                f"dir - refusing"
+            )
+        gguf_path = Path(gguf_real)
         if not gguf_path.exists():
             raise FileNotFoundError(f"deploy gguf path not found: {gguf_path}")
         return 0
@@ -180,6 +197,10 @@ def run_can(
 
     # Read manifest first — surface schema errors before any side effects.
     manifest = inspect_can(str(src))
+    # The extracted config.yaml is handed to ``soup train``, whose loader has
+    # no size or expansion limit of its own; read it through the capped reader
+    # first so an oversized or alias-amplified config is refused here.
+    read_config(str(src))
 
     if not yes:
         if confirm_callback is None:

{soup_cli-0.75.0 → soup_cli-0.75.2}/src/soup_cli/cans/schema.py

@@ -8,6 +8,8 @@ from typing import Literal, Optional
 
 from pydantic import BaseModel, Field, field_validator
 
+from soup_cli.utils.yaml_limits import check_expanded_nodes
+
 CAN_FORMAT_VERSION = 3  # v0.71.3 #182: attestations field (additive over v2)
 SUPPORTED_CAN_FORMAT_VERSIONS = (1, 2, 3)
 
@@ -28,6 +30,11 @@ def validate_attestation_statement(stmt: object) -> dict:
     """
     if not isinstance(stmt, dict):
         raise ValueError("attestation must be a dict (in-toto Statement)")
+    # Before json.dumps: a statement loaded from YAML may share references
+    # (anchors / aliases) whose serialised form is exponentially larger. Every
+    # node costs at least one byte of JSON, so a statement within the byte cap
+    # below has fewer nodes than _MAX_ATTESTATION_BYTES and always passes.
+    check_expanded_nodes(stmt, "attestation", limit=_MAX_ATTESTATION_BYTES)
     type_field = stmt.get("_type")
     predicate_type = stmt.get("predicateType")
     if not isinstance(type_field, str) or not type_field:

{soup_cli-0.75.0 → soup_cli-0.75.2}/src/soup_cli/cans/unpack.py

@@ -11,14 +11,54 @@ import yaml
 
 from soup_cli.cans.schema import Manifest
 from soup_cli.utils.paths import is_under_cwd
-
-
-def _read_text_member(tar: tarfile.TarFile, name: str) -> str:
-    member = tar.getmember(name)
+from soup_cli.utils.yaml_limits import check_yaml_expanded_size
+
+#: Largest ``manifest.yaml`` read into memory. A manifest holds a handful of
+#: short fields plus at most 64 attestations of <= 1 MiB each, so a real one is
+#: far below this.
+MAX_MANIFEST_BYTES = 16 * 1024 * 1024
+#: Largest ``config.yaml`` read into memory; a training config is kilobytes.
+MAX_CONFIG_BYTES = 1 * 1024 * 1024
+#: Most members ``extract_can`` will write. ``soup can pack`` writes four.
+MAX_EXTRACT_MEMBERS = 10_000
+#: Largest total declared size of the regular files ``extract_can`` writes.
+#: ``soup can pack`` / ``fork`` write only small text members and refuse a can
+#: over 100 MB compressed, but a hand-assembled can may carry a GGUF for a
+#: ``deploy_targets`` entry (``cans/run.py:_deploy_target``). GGUF weights are
+#: already quantised and barely compress, and an 8B model at Q4_K_M is ~4.9 GB,
+#: so 8 GiB covers that case with margin while bounding what a small gzip
+#: stream can expand to on disk (deflate reaches ~1000:1 on repetitive input).
+MAX_EXTRACT_BYTES = 8 * 1024 * 1024 * 1024
+
+
+def _read_text_member(
+    tar: tarfile.TarFile, name: str, max_bytes: int,
+) -> tuple[str, int]:
+    """Return ``(text, byte_length)`` of a regular UTF-8 member, size-capped."""
+    try:
+        member = tar.getmember(name)
+    except KeyError as exc:
+        raise ValueError(f"can has no member '{name}'") from exc
+    if not member.isfile():
+        raise ValueError(f"member '{name}' in can is not a regular file")
+    if member.size > max_bytes:
+        raise ValueError(
+            f"member '{name}' in can is too large "
+            f"({member.size} > {max_bytes} bytes)"
+        )
     extracted = tar.extractfile(member)
     if extracted is None:
         raise ValueError(f"cannot read member '{name}' from can")
-    return extracted.read().decode("utf-8")
+    # The header size is not trusted alone: the read itself is bounded.
+    raw = extracted.read(max_bytes + 1)
+    if len(raw) > max_bytes:
+        raise ValueError(
+            f"member '{name}' in can is too large (> {max_bytes} bytes)"
+        )
+    try:
+        return raw.decode("utf-8"), len(raw)
+    except UnicodeDecodeError as exc:
+        raise ValueError(f"member '{name}' in can is not valid UTF-8: {exc}") from exc
 
 
 def inspect_can(path: str) -> Manifest:
@@ -33,8 +73,11 @@ def inspect_can(path: str) -> Manifest:
     if not can_path.exists():
         raise FileNotFoundError(f"can not found: {path}")
     with tarfile.open(can_path, mode="r:gz") as tar:
-        manifest_text = _read_text_member(tar, "manifest.yaml")
+        manifest_text, manifest_bytes = _read_text_member(
+            tar, "manifest.yaml", MAX_MANIFEST_BYTES,
+        )
     data = yaml.safe_load(manifest_text) or {}
+    check_yaml_expanded_size(data, "manifest.yaml", source_bytes=manifest_bytes)
     return Manifest(**data)
 
 
@@ -46,8 +89,9 @@ def read_config(path: str) -> dict[str, Any]:
     if not can_path.exists():
         raise FileNotFoundError(f"can not found: {path}")
     with tarfile.open(can_path, mode="r:gz") as tar:
-        cfg_text = _read_text_member(tar, "config.yaml")
+        cfg_text, cfg_bytes = _read_text_member(tar, "config.yaml", MAX_CONFIG_BYTES)
     data = yaml.safe_load(cfg_text) or {}
+    check_yaml_expanded_size(data, "config.yaml", source_bytes=cfg_bytes)
     if not isinstance(data, dict):
         raise ValueError("config.yaml must deserialise to a mapping")
     return data
@@ -100,5 +144,30 @@ def extract_can(path: str, dest_dir: str) -> Path:
     dest = Path(dest_dir)
     dest.mkdir(parents=True, exist_ok=True)
     with tarfile.open(can_path, mode="r:gz") as tar:
+        _check_extract_bounds(tar)
         _safe_extract(tar, dest)
     return dest
+
+
+def _check_extract_bounds(tar: tarfile.TarFile) -> None:
+    """Refuse a can whose member count or total file size is over the limits.
+
+    Runs before anything is written, so a refused can leaves no partial
+    output. Iterates lazily so the count stops the header scan early.
+    """
+    count = 0
+    total = 0
+    for member in tar:
+        count += 1
+        if count > MAX_EXTRACT_MEMBERS:
+            raise ValueError(
+                f"can has too many members (> {MAX_EXTRACT_MEMBERS}); "
+                "refusing to extract"
+            )
+        if member.isfile():
+            total += member.size
+            if total > MAX_EXTRACT_BYTES:
+                raise ValueError(
+                    f"can expands to more than {MAX_EXTRACT_BYTES} bytes; "
+                    "refusing to extract"
+                )