3 Commits

Author	SHA1	Message	Date
Alpamys	7bee22052b	v0.10.10: Security hardening — Web UI auth, CORS, SSRF, path traversal protection ... Security fixes across all HTTP surfaces: - Web UI: Bearer token auth on mutating endpoints, CORS restricted to served origin, path traversal protection on /api/data/inspect, config validated before training, removed user-controlled config_path from API - Serve/vLLM: max_tokens capped at 16384, generic error messages (no stack traces) - Generate: SSRF protection (--api-base blocks non-HTTPS for remote URLs), --api-key deprecated in favor of OPENAI_API_KEY env var - Export: llama.cpp pinned to tag b5270 (supply-chain safety) - Push: --token deprecated in favor of HF_TOKEN env var - Rewards: warning before executing custom .py reward files - Tests: all 40 UI tests updated with auth headers, 666 tests pass Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-25 12:14:10 +05:00
Alpamys	6a76a1be32	Fix CI: lazy FastAPI imports, strip ANSI in test assertions — v0.7.2 ... - Move fastapi imports inside create_app() so STATIC_DIR is importable without fastapi installed (follows project lazy import convention) - Strip Rich ANSI escape codes in test_ui_command_options assertion - Bump to v0.7.2 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 21:05:31 +05:00
Alpamys	823e36eea8	Add Web UI for experiment management (Phase 8) — v0.7.0 ... - `soup ui` command launches local web interface at http://127.0.0.1:7860 - FastAPI backend with REST API: runs, metrics, config validation, training control, data inspection, templates, system info - Self-contained SPA frontend (Dashboard, New Training, Data Explorer, Model Chat) with Chart.js loss/LR charts - Auto-opens browser on launch (--no-browser to disable) - Config validation via new load_config_from_string() in config/loader.py - 40 new tests (530 total), ruff clean Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 20:55:22 +05:00