MakazhanAlpamys/Soup v0.44.0

v0.44.0 - Live Dashboard & UX

on GitHub

What's New

21 features across 4 themes that close the polish gap with Unsloth Studio, axolotl, and LlamaFactory.

Live Monitoring

• soup monitor - Rich Live nvidia-smi-driven dashboard: Util / Mem / VRAM / Temp / Power per GPU. --refresh 0.25-30 interval, --once for a single snapshot. Apple Silicon hint deferred to v0.44.1.
• EMA + p95/p99 tail latencies - soup_cli.utils.tail_latency ships pure-Python update_ema / percentile / summarise_latency with MAX_SAMPLES=1_000_000 DoS cap.
• SSE training-stream schema - TrainEvent frozen dataclass + format_sse_frame (W3C SSE wire format).
• Phone-visible URL + ASCII QR - build_phone_url enforces scheme allowlist, loopback-only HTTP, IPv6 auto-bracketing per RFC 3986; token in query string so the server actually receives it.
• llama-server timings parser + KV-cache bar - tolerates missing keys; clamps kv_cache_pct to [0, 100].
• Tool-call timer + thread-safe buffer - ToolOutputsBuffer is collections.deque(maxlen=1000) with truncated previews.

UX Fixes

• Ctrl+C graceful save - first SIGINT writes a checkpoint and continues, second stops cleanly.
• .checkpoint_now trigger file - touch <output_dir>/.checkpoint_now to force a save (cwd-contained, symlink-rejected at the trigger).
• Desktop / .command / .cmd shortcut builders - generate .desktop / .command / .cmd launchers with shell-metacharacter rejection.
• Onboarding wizard helper - render_onboarding_yaml({base, dataset, task, quantization, epochs}) returns a fully-validated soup.yaml.

Web UI

• Plugin registry - drop-in soup_cli/ui/plugins/*.py files register tabs via register_tab(name=..., title=..., render=...). Kebab-case allowlist + 32-tab cap + idempotent re-register.
• Env knobs - API_HOST / API_PORT / API_KEY for the FastAPI server, GRADIO_HOST / GRADIO_PORT for any Gradio sub-UI.

Standalone CLIs

• soup fetch examples llama-3.1-8b-lora - bundled catalog of ready-to-edit configs (examples / configs / deepspeed_configs namespaces). Symlink-rejection at write target + commonpath check on the bundled source.
• soup quantize <model> --to gguf --bits 4 - ergonomic alias that prints the equivalent soup export invocation (escaped via shlex.quote).
• soup merge-sharded-fsdp-weights - planner that discovers FSDP shard files; live torch-side consolidation in v0.44.1.
• soup delinearize-llama4 - planner for Llama 4 expert weight reshape; live runtime in v0.44.1.
• soup llama <subcommand> - closed-allowlist proxy to llama.cpp binaries (cli / mtmd-cli / gguf-split / server / quantize) with filtered child env that drops HF_TOKEN / OPENAI_API_KEY / ANTHROPIC_API_KEY / SOUP_*.
• Standalone sweep config - soup_cli.utils.sweep_config.load_sweep_yaml accepts a separate sweep.yaml for version-controlled hyperparameter search; strict scalar value allowlist + MappingProxyType immutability.
• Reasoning parser allowlist - validate_parser_name over a closed set (deepseek-r1 / qwen3 / phi4 / openthinker) for soup serve --reasoning-parser. Runtime hook in v0.44.1.

Install / Upgrade

pip install --upgrade soup-cli

Security

• soup fetch: symlink-rejection at write target (TOCTOU defence) + bundled-source os.path.commonpath check (catalog-escape defence).
• soup llama: child-env allowlist drops HF_TOKEN / OPENAI_API_KEY / ANTHROPIC_API_KEY before exec.
• Phone-URL token: routed through query string ?token=... not URL fragment (so the server actually sees it).
• .checkpoint_now trigger: os.lstat + S_ISLNK rejection at the trigger target before write.
• Onboarding wizard: output field cwd-containment via shared is_under_cwd.
• Sweep config: strict scalar allowlist on param values rejects nested dicts/lists smuggled through YAML.
• All frozen dataclasses with collection fields: Tuple / MappingProxyType for genuine immutability (matches v0.32.0 / v0.39.0 / v0.41.0 policy).

Known Limitations

1. Live SSE endpoint - schema + frame formatter ship; /api/train/stream FastAPI route in v0.44.1.
2. Phone visibility CLI flag - soup ui --public --auth-token + QR print at startup deferred to v0.44.1.
3. soup merge-sharded-fsdp-weights + soup delinearize-llama4 - planners only; live torch-side runtime in v0.44.1.
4. soup llama <sub> - llama.cpp binaries are not bundled; must be on PATH (actionable FileNotFoundError when missing).
5. --reasoning-parser - allowlist ships; runtime hook into the inference loop in v0.44.1.
6. Apple Silicon soup monitor - prints a yellow advisory and exits with nvidia-smi unavailable rc=1; powermetrics parser in v0.44.1.

Test count: 5628 -> 5820 (+192 net new tests).