2 Commits

Author	SHA1	Message	Date
Alpamys	4f54179ea4	fix(security): backfill Rich markup escape in legacy adapters commands ... Closes #174. Picked up after PR #175 (dreamer0129) went quiet — the list/info path was clean, but compare() escaped only inside the highlight branch, leaving a shared crafted base_model = "[link=evil] click[/]" un-escaped on equal-value rows. Fix follows the "escape always at the value layer, decoration wraps after" pattern mirroring v0.57.0 `adapters diff` / `info`: - list_adapters: wrap base / lora_r / peft_type / rel_path with rich.markup.escape() before table.add_row(); also escape adapter_path in the JSONDecodeError fallback. - info: wrap base_model / peft_type / task_type / lora_r / lora_alpha / lora_dropout / modules_str inside the Rich Panel f-string; also escape adapter_path.name in the Panel title. - compare: escape val1_str / val2_str unconditionally; [yellow] highlight wraps already-escaped values when they differ. Equal-value rows now also escape (was the v0.57.0 known-limitation gap). +4 regression tests in tests/test_adapters.py::TestAdaptersMarkupEscape: - test_list_escapes_crafted_base_model — asserts no ANSI hyperlink sequence (\x1b]8;) leaks from a crafted [link=http://evil/...] payload. - test_info_escapes_crafted_base_model — same assertion for Panel. - test_compare_escapes_equal_crafted_values — the specific regression for the PR #175 review gap (identical crafted values on both sides must NOT smuggle live markup through the equal-branch). - test_compare_escapes_differing_crafted_values — highlight branch also escapes. Closes v0.57.0 Known Limitation (9). Verified locally: - ruff check soup_cli/commands/adapters.py tests/test_adapters.py -> clean - pytest tests/test_adapters.py --no-cov -> 20 passed	2026-05-20 00:12:05 +05:00
Alpamys	dee9317dde	feat: v0.22.0 — Training Profiler, Multi-Adapter Serving, Data Sampling, Adapter Management ... New commands: - `soup profile` — estimate memory, speed, GPU requirements before training (--config, --gpu, --json flags) - `soup adapters list/info/compare` — LoRA adapter management - `soup data sample` — intelligent dataset sampling (random/diverse/hard strategies) - `soup serve --adapters` — multi-adapter serving with adapter selection New files: - soup_cli/utils/profiler.py — memory/speed estimation engine - soup_cli/commands/profile.py — profile CLI command - soup_cli/commands/adapters.py — adapter management CLI Security: - Multi-adapter: adapter path traversal protection (resolve + relative_to) - Multi-adapter: adapter name validation (alphanumeric + hyphens only) - Multi-adapter: unknown adapter → 404, no adapter name leakage in errors - Multi-adapter: /v1/adapters returns names only (no filesystem paths) - Multi-adapter: --adapters rejected for non-transformers backends - Data sample: output path confinement (resolve + relative_to(cwd)) 101 new tests (1890 total), 66 test files, 65.5% coverage, ruff clean.	2026-04-03 12:54:24 +05:00