MakazhanAlpamys/Soup v0.40.2

v0.40.2 — Quick polish + v0.40.1 carry-overs

on GitHub

What's New

Closes 3 originally-scheduled GitHub issues plus 7 v0.40.1 long-tail UX papercuts. No new schema fields, no new trainers — pure polish.

Originally scheduled (3 issues):

• #36 — Eval-gate dashboard row. New pure formatter format_gate_row(state) in soup_cli/monitoring/display.py renders a one-liner like Gate: helpfulness 7.8 ✓ | math 0.82 ✗ (-0.06) | STOP for the live training panel. Hidden when eval-gate is disabled. Explicit passed is True so a missing field renders neutral, not a false-y red ✗. Supports stop / warn action suffixes.
• #50 — --hf-resume prefers local newer. prepare_hf_resume now skips snapshot_download entirely when the highest local checkpoint-N is greater-or-equal to the remote highest-N. Saves bandwidth and never overwrites a fresher local checkpoint with stale Hub state.
• #51 — soup deploy hf-space --template-dir <path>. Supply your own app.py + README.md (+ optional requirements.txt) instead of the built-in gradio-chat / streamlit-chat. Containment-checked, repo-id substitution validated before render, 256 KB cap per file, symlinks rejected (TOCTOU defence).

v0.40.1 carry-overs (7 papercuts):

• soup quickstart --output DIR — route data, config, and run dir under any directory you choose.
• soup runs --cwd-only — restrict listing to runs whose output_dir is under cwd; the global ~/.soup/experiments.db view is still default.
• soup infer / soup bench accept HF ids — when the local model path is missing AND the value isn't path-like (no ./, /, ~, C:\), it falls through to a HuggingFace download via transformers.from_pretrained. Path-like-but-missing surfaces a friendly FileNotFoundError.
• CLI flag aliases — data filter --min-coherence (alias for --coherence); data split --train accepted (informational, train is the implicit remainder); data register / unregister accept positional <name> and <path> alongside the --name / --path options, with conflict detection.
• --log-level plumbing complete — apply_logging_level now sets the root logger so third-party libraries (transformers / peft / trl) actually respect QUIET and DEBUG. The four tiers no longer produce byte-identical output.
• soup data dedup --threshold — verified already-exposed; no code change.
• ONNX/AWQ/GPTQ/TensorRT install hints — verified already-correct; no code change.

Install / Upgrade

pip install --upgrade soup-cli

PyPI auto-publishes via Trusted Publisher OIDC on tag push (~1–2 min). GHCR Docker image rebuilds on the release event (~10–15 min).

Security

• render_custom_template_dir (soup_cli/utils/hf_space.py) — is_under_cwd containment, validate_repo_id BEFORE {MODEL_REPO} substitution (matches v0.29.0 Part F policy), per-file 256 KB cap (matches v0.39.0 Part E policy), closed allowlist (app.py / README.md / requirements.txt only), symlinks + non-regular files rejected via os.lstat + stat.S_ISLNK (matches v0.33.0 #22 prune_checkpoints TOCTOU policy).
• prepare_hf_resume — _find_highest_local_checkpoint reads output_dir after the caller's is_under_cwd validation; silently drops non-directories + OSError.
• Path-containment standardisation. Several pre-existing pre-v0.40.2 sites switched from Path.resolve() + relative_to() to shared is_under_cwd (os.path.realpath + commonpath) for Windows 8.3 short-name safety: commands/data.py:register_data, commands/bench.py prompts file, commands/infer.py --output (late-evaluated to preserve test contracts).
• commands/runs.py:_filter_runs_by_cwd — uses os.path.realpath + commonpath, catches (ValueError, OSError) so cross-drive paths on Windows (D:\runs vs C:\project) drop silently rather than crash.
• commands/quickstart.py --output — is_under_cwd containment before mkdir(parents=True); rejects out-of-cwd targets with friendly message.

Known Limitations

• Custom HF Space templates always create the Space with space_sdk="gradio" regardless of the supplied app.py. Use --template streamlit-chat with the inline registry for Streamlit Spaces. Tracked for v0.40.3+.
• _resolve_model_source returns ("hf", repo_id) without validate_repo_id; transformers.from_pretrained will raise loudly on malformed ids, but a friendlier early-rejection could be added later.
• --trust-remote-code opt-in surface still excludes the 10 non-SFT trainers + 5 commands tracked under issue #63 (carry-over from v0.36.0).

Tests

4720 → 4756 (+36) across two new files (tests/test_v0402_part_a.py, tests/test_v0402_part_b.py). Five review agents (python / code / security / tdd / verification) all clean after fixes.