2 Commits

Author	SHA1	Message	Date
Alpamys	7bee22052b	v0.10.10: Security hardening — Web UI auth, CORS, SSRF, path traversal protection ... Security fixes across all HTTP surfaces: - Web UI: Bearer token auth on mutating endpoints, CORS restricted to served origin, path traversal protection on /api/data/inspect, config validated before training, removed user-controlled config_path from API - Serve/vLLM: max_tokens capped at 16384, generic error messages (no stack traces) - Generate: SSRF protection (--api-base blocks non-HTTPS for remote URLs), --api-key deprecated in favor of OPENAI_API_KEY env var - Export: llama.cpp pinned to tag b5270 (supply-chain safety) - Push: --token deprecated in favor of HF_TOKEN env var - Rewards: warning before executing custom .py reward files - Tests: all 40 UI tests updated with auth headers, 666 tests pass Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-25 12:14:10 +05:00
Alpamys	a2a0f2cab3	Phase 1.5: add soup chat, soup push, DPO trainer + smoke tests ... - soup chat --model ./path: interactive terminal chat with LoRA adapters (auto-detects base model, supports /quit /clear /system commands) - soup push --model ./path --repo user/model: upload to HuggingFace Hub (auto model card generation, token from env/cache/flag) - DPO trainer: full DPOTrainerWrapper with LoRA + quantization support (configurable dpo_beta, preference data format {prompt, chosen, rejected}) - Smoke tests: real SFT + DPO training with tiny-gpt2 (pytest -m smoke) - SFT trainer: fallback for models without chat_template - Updated README, schema, formats, pyproject.toml, .gitignore Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-23 21:18:19 +05:00