MakazhanAlpamys/Soup v0.53.7

v0.53.7 — Data Forge + Pipeline live (wave 1)

on GitHub

What's New

11 items: 6 v0.42/v0.47 deferrals + 5 v0.53.6 stub-to-live carry-overs.

Data Forge & Pipeline (live)

• #111 soup data forge --judge-provider {ollama,anthropic,vllm} — lazy v0.20.0 providers; localhost-only SSRF, env-only API keys, scheme allowlist
• #112 soup data decontaminate --benchmark-file <path> — operator-supplied JSONL corpus; cwd-contained, symlink-rejected; extends bundled --benchmarks
• #87 prompt_strategy: module:fn runtime — importlib resolver, lru_cache-backed, per-row hook in SFT formatter
• #86 soup data preprocess AOT tokenize — Arrow shards + cache_key metadata; SFT + Pretrain wrappers short-circuit on format='pre_tokenized' + matching cache hash
• #88 soup data ingest markdown heading split — one JSONL row per # heading section with level field; preamble row carries null section

Inference Server (live)

• #102 POST /v1/messages Anthropic-compatible endpoint on both transformers and vLLM backends; loopback-only CORS
• #102 Streaming SSE /v1/messages — Anthropic event-shape (message_start → content_block_delta → message_delta + message_stop); Cache-Control: no-store + header-injection defence on model+msg_id
• #103 POST /v1/tools/python — RLVR sandbox wrapper, 5s timeout, 64KB code cap, Bearer auth gate
• #103 POST /v1/tools/web_search — WebSearchConfig.domain_allowlist deny-by-default, 5-result cap, snippet null-byte strip, Bearer auth

Runtime (live)

• #106 run_recipe live for 6 NODE_KINDS (seed / llm_text / code / judge / validator / sampler); atomic checkpoint via tempfile.mkstemp + os.replace; resume rehydrates from per-node .node-<name>.jsonl sidecars; failed_reason path-redacted
• #105 instantiate_trainer_plugins live for cce_plugin / grokfast / spectrum / llmcompressor / sonicmoe / math_verify — lazy imports + friendly pip-install advisory on missing dep

Install/Upgrade

pip install -U soup-cli

Or via Docker:

docker pull ghcr.io/makazhanalpamys/soup:v0.53.7

Security

1 CRITICAL + 11 HIGH + 17 MEDIUM + 10 LOW review findings addressed.

Highlights:

• POST /v1/tools/bash reverted to HTTP 501 — security review caught that /bin/sh -c spawns a child outside the RLVR sandbox's OS-level isolation (unshare(CLONE_NEWNET) / macOS sandbox-exec / socket-patch). Deferred to v0.53.8 pending container/namespace work.
• _node_seed symlink check now os.lstat on RAW path BEFORE realpath (v0.33.0 #22 TOCTOU parity)
• _save_checkpoint + sampler use atomic tempfile.mkstemp + os.replace
• failed_reason path-redacted via os.path.basename + 256-char cap (v0.34.0 crash.py policy)
• resolve_prompt_strategy narrowed except to TypeError only (signature-shape ValueError now propagates)
• assert isinstance(spec, str) replaced with explicit raise TypeError (survives python -O)
• Tool endpoint Bearer auth gate (opt-in via auth_token kwarg)
• SSE model+msg_id stripped of CRLF/NUL/oversize before frame-embedding (header-injection defence)
• vLLM /v1/messages CORS restricted to loopback-only (was wildcard)

Known Limitations

1. POST /v1/tools/bash returns HTTP 501 — /bin/sh -c child-process escapes RLVR sandbox isolation; deferred to v0.53.8 pending container/namespace work.
2. prompt_strategy imports an operator-named module — trusted-input policy; do NOT use with operator-controlled YAML on shared CI hosts.
3. /v1/tools/web_search uses httpx with hard 5s timeout + 5-result cap; production callers wanting concurrency/retries should wrap externally.
4. run_recipe resume rehydrates from per-node sidecar files; if the operator deletes those between runs, resume hits a missing-file error rather than silently re-executing.
5. Streaming /v1/messages SSE event shape matches Anthropic SDK ≥0.21; older clients parsing only data: lines without event: headers may need an adapter.

Test Count

8051 → 8162 (+111 in tests/test_v0537.py). 190 test files. CI green across Ubuntu/macOS/Windows × Python 3.9/3.11/3.12.

🤖 Generated with Claude Code