Local UI to run and train LLMs and diffusion models. Supports GGUF, MLX, Qwen3.8, DeepSeek-V4, MiniMax-H3, Gemma 4, FLUX and more.
This report summarizes scanner evidence for unslothai/unsloth, a Python project with 77,708 GitHub stars. SynthScan examined 3,167,233 lines of code across 7353 source files, recording 83114 pattern matches distributed across 26 syntactic categories. The legacy adjusted pattern signal is 29.4 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 65837 finding(s).
Are imports declared and package/API names verified? 5335 finding(s).
Are wrappers, guards, and repeated structures necessary? 73619 finding(s).
Which changes need focused human review? 83114 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 83114 distinct pattern matches across 26 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | unsloth-cli.py | 62 | def _tokenizer_for_raw_text_loader(tokenizer, is_mlx): | CODE |
| LOW | unsloth-cli.py | 68 | def _raw_text_loader_for_backend( | CODE |
| LOW | unsloth-cli.py | 83 | def _train_with_legacy_save_control(trainer, is_mlx): | CODE |
| LOW | unsloth-cli.py | 101 | def _iter_quantization_methods(quantization): | CODE |
| LOW | unsloth-cli.py | 149 | def _save_or_push_model_with_mlx_ddp(model, tokenizer, args, is_mlx, trainer): | CODE |
| LOW | studio/install_whisper_prebuilt.py | 370 | def published_llama_ggml_tree(tag: Any, repo: Any = None) -> str | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 402 | def installed_llama_tree_repo() -> str | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 470 | def _ships_windows_gpu_ggml_module(llama_bin_dir: Path) -> bool: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 482 | def _ggml_stack_imports_libomp(llama_bin_dir: Path, backend: str) -> bool | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 512 | def slim_pairing_for_artifact( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 627 | def select_artifact_with_cpu_fallback( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 639 | def _slim_release_incompatibility(manifest: dict[str, Any], host: HostInfo) -> str | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 701 | def select_artifact_with_fallback( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 748 | def _download_host_latest_release_tag(repo: str) -> str | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 772 | def _resolve_release_via_download_host( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1259 | def load_whisper_prebuilt_metadata(install_dir: Path) -> dict[str, Any] | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1280 | def kept_install_needs_settling(install_dir: Path) -> bool: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1309 | def _backfill_runtime_file_records(install_dir: Path) -> None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1349 | def _wiring_matches_live_llama(install_dir: Path, marker: dict) -> bool: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1392 | def _backfill_slim_pairing_record(install_dir: Path) -> None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1533 | def resolve_newest_release_tag(repo: str) -> str: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1543 | def fetch_release_for_install( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1576 | def _bundle_matches_whisper_tag(bundle: ReleaseBundle, whisper_tag: str) -> bool: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1799 | def installed_paired_runtime_tree() -> str | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1809 | def installed_paired_runtime_id(install_dir: "Path | None" = None) -> str | None: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1825 | def _existing_install_is_intact( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1905 | def _api_newest_release_tag_for_upstream( | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1940 | def existing_install_current_without_plan( | CODE |
| LOW⚡ | studio/install_manifest.py | 1033 | def unsatisfied_closure_requirement( | CODE |
| LOW⚡ | studio/install_manifest.py | 1043 | def closure_unmet_requirements( | CODE |
| LOW | studio/install_manifest.py | 117 | def installed_requirements_root(root: Optional[Path] = None) -> Optional[Path]: | CODE |
| LOW | studio/install_manifest.py | 213 | def _installed_metadata_records(dist_name: str) -> List[Tuple[str, Optional[Path]]]: | CODE |
| LOW | studio/install_manifest.py | 272 | def pip_backup_metadata_paths(dist_name: str) -> List[Path]: | CODE |
| LOW | studio/install_manifest.py | 292 | def _metadata_is_inconsistent(dist_name: str, versions: Optional[List[str]] = None) -> bool: | CODE |
| LOW | studio/install_manifest.py | 590 | def consume_previous_manifest(root: Optional[Path] = None) -> None: | CODE |
| LOW | studio/install_manifest.py | 857 | def recorded_torch_flavor_was_pinned(root: Optional[Path] = None) -> bool: | CODE |
| LOW | studio/install_manifest.py | 990 | def installed_dependency_index() -> Optional[Dict[str, Tuple[str, List[str]]]]: | CODE |
| LOW | studio/install_manifest.py | 1743 | def _sidecar_file_check_disabled() -> bool: | CODE |
| LOW | studio/install_q4nx_converter.py | 61 | def converter_for_architecture(architecture: str, path: Path = PINS_PATH) -> str: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 644 | def source_archive_logical_name(upstream_tag: str) -> str: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 648 | def exact_source_archive_logical_name(source_commit: str) -> str: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 657 | def normalize_source_ref_kind(value: str | None) -> str | None: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 813 | def windows_cuda_arch_for_host(host: HostInfo) -> str: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 823 | def windows_cuda_install_kind_for_arch(arch: str) -> str: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 830 | def windows_cuda_upstream_asset_names( | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 963 | def upstream_source_archive_urls(tag: str) -> list[str]: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 971 | def commit_source_archive_urls(repo: str, source_commit: str) -> list[str]: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 979 | def release_asset_download_url( | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 1610 | def linux_runtime_dirs_for_required_libraries(required_libraries: Iterable[str]) -> list[str]: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 1614 | def detected_linux_runtime_lines() -> tuple[list[str], dict[str, list[str]]]: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 1622 | def github_release_asset_digests(repo: str, tag: str) -> dict[str, str]: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 2287 | def validated_checksums_for_bundle( | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 2294 | def _download_host_resolve_enabled() -> bool: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 2302 | def _release_asset_download_url(repo: str, tag: str, asset_name: str) -> str: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 2306 | def _download_host_latest_release_tag(repo: str) -> str | None: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 2310 | def _fetch_download_host_json(url: str) -> Any: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 2316 | def _download_host_resolved_release( | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 4687 | def overlay_directory_for_choice(install_dir: Path, choice: AssetChoice, host: HostInfo) -> Path: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 4696 | def paired_runtime_dll_patterns(choice: AssetChoice) -> list[str]: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 5648 | def download_validation_model(path: Path, cache_path: Path | None = None) -> None: | CODE |
| 61328 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 6386 | # ── Radeon repo wheel selection helpers ────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 6494 | # ── ROCm-on-WSL bootstrap for AMD Strix Halo (gfx1151) ─────────────────────── | COMMENT |
| MEDIUM | install.sh | 6959 | # ── Strix Halo / Strix Point: route to the AMD arch-specific index ─────────── | COMMENT |
| MEDIUM | studio/setup.sh | 32 | # ── Maintainer-editable defaults ────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/setup.sh | 48 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | studio/prebuilt_core.py | 1847 | # ════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | studio/prebuilt_core.py | 1850 | # ════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | studio/install_python_stack.py | 164 | # ── ROCm / AMD GPU support ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/install_python_stack.py | 7211 | # ── Color support ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/smoke-code-block-flicker-main.tsx | 64 | // ── CSS variants ──────────────────────────────────────────────────── Each variant is a stylesheet | COMMENT |
| MEDIUM | …ntend/tests/generation-tool-recovery-approvals.test.ts | 341 | // ── The check and the replay now run concurrently ─────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/code-tool-placement.test.ts | 38 | // ── the rule itself ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/code-tool-placement.test.ts | 120 | // ── the adapter has to actually use it ───────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/code-tool-placement.test.ts | 178 | // ── Whether the pill is offered at all ───────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/tool-approval-gone.test.ts | 115 | // ── The card's own wiring, pinned at the source ────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/credential-persistence.test.ts | 731 | // ── API key transport envelope ────────────────────────────────────── | COMMENT |
| MEDIUM | …rontend/tests/recommended-curated-row-metadata.test.ts | 35 | // ── search: a downloaded curated row stays findable ─────────────────────────── | COMMENT |
| MEDIUM | …rontend/tests/recommended-curated-row-metadata.test.ts | 71 | // ── row metadata: size chip + capability glyphs ─────────────────────────────── | COMMENT |
| MEDIUM | …rontend/tests/recommended-curated-row-metadata.test.ts | 164 | // ── wiring: the picker actually reads the fallbacks ─────────────────────────── | COMMENT |
| MEDIUM | …io/frontend/tests/seeded-approval-terminal-run.test.ts | 103 | // ── Arming must not hold the event stream closed ──────────────────────────── | COMMENT |
| MEDIUM | …io/frontend/tests/seeded-approval-terminal-run.test.ts | 152 | // ── The disarm has to cover every exit, not just the terminal one ─────────── | COMMENT |
| MEDIUM | …io/frontend/tests/code-plugin-engine-and-cache.test.ts | 54 | // ── 1. the engine the desktop CSP allows ─────────────────────────────── | COMMENT |
| MEDIUM | …io/frontend/tests/code-plugin-engine-and-cache.test.ts | 75 | // ── 2. the character budget ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …io/frontend/tests/code-plugin-engine-and-cache.test.ts | 257 | // ── 3. the compact cache key is a hint, not the answer ───────────────── | COMMENT |
| MEDIUM | …udio/frontend/tests/loaded-models-drag-restore.test.ts | 91 | // ── The wiring the geometry depends on ────────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/durable-gate.test.ts | 51 | // ── The gate itself: every term of the conjunction, as a truth table ───────────────────── | COMMENT |
| MEDIUM | …o/frontend/tests/loaded-models-platform-matrix.test.ts | 77 | // ── Chat runtime: the accelerator axis ────────────────────────────────── | COMMENT |
| MEDIUM | …o/frontend/tests/loaded-models-platform-matrix.test.ts | 136 | // ── Chat runtime: every audio_type the backend can emit ───────────────── | COMMENT |
| MEDIUM | …o/frontend/tests/loaded-models-platform-matrix.test.ts | 179 | // ── Diffusion: the device vocabulary, and the two engines ─────────────── | COMMENT |
| MEDIUM | …o/frontend/tests/loaded-models-platform-matrix.test.ts | 297 | // ── Dictation: three engines, and a "device" that is not a device ──────── | COMMENT |
| MEDIUM | …o/frontend/tests/loaded-models-platform-matrix.test.ts | 336 | // ── The merge, across a fully loaded host ─────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/prompt-queue-input-edges.test.ts | 46 | // ── the chord ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/prompt-queue-input-edges.test.ts | 104 | // ── the drag type ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/prompt-queue-input-edges.test.ts | 137 | // ── pending starts ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/frontend/tests/prompt-queue-input-edges.test.ts | 167 | // ── the pasted-text key ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 62 | // ── The pinned cached row, the shape #8893 was reported on ─────────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 62 | // ── The pinned cached row, the shape #8893 was reported on ─────────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 120 | // ── Windows spells one directory several ways, and means one directory ─────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 154 | // ── POSIX is case-SENSITIVE, and two files can differ by case alone ────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 174 | // ── The unpinned cached row: the repo id IS the load identifier ────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 192 | // ── A standalone .gguf: one file, no quant to choose between ───────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 217 | // ── Safetensors and MLX: no quant at all on either side ────────────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 256 | // ── Nothing is loaded ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 271 | // ── Older Unsloth backends, i.e. an install that predates these fields ──────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 301 | // ── A native-lease load withholds the raw path on every version ────────────── | COMMENT |
| MEDIUM | …dio/frontend/tests/resident-model-match-matrix.test.ts | 336 | // ── The documented false negative, pinned so it cannot drift into a true ───── | COMMENT |
| MEDIUM | …o/frontend/tests/code-plugin-embedded-grammars.test.ts | 148 | // ── HTML: the grammar pushes into javascript and css and back ────────── | COMMENT |
| MEDIUM | …o/frontend/tests/code-plugin-embedded-grammars.test.ts | 185 | // ── TSX: JSX children and an expression container ────────────────────── | COMMENT |
| MEDIUM | …o/frontend/tests/code-plugin-embedded-grammars.test.ts | 217 | // ── Markdown containing a fence: the grammar nests into itself ───────── | COMMENT |
| MEDIUM | …o/frontend/tests/code-plugin-embedded-grammars.test.ts | 255 | // ── Markdown whose nested fences open and close again ────────────────── | COMMENT |
| MEDIUM | …o/frontend/tests/code-plugin-embedded-grammars.test.ts | 320 | // ── Shell heredoc: the terminator is chosen by the document ──────────── | COMMENT |
| MEDIUM | …o/frontend/tests/code-plugin-embedded-grammars.test.ts | 349 | // ── Nested template literals: interpolation inside interpolation ─────── | COMMENT |
| MEDIUM | …/features/export/hooks/use-export-runtime-lifecycle.ts | 59 | // ── JSON log polling (tunnel-safe fallback) ────────────────────────── Runs for the whole | COMMENT |
| MEDIUM | studio/frontend/src/features/export/api/export-api.ts | 318 | // ───────────────────────────────────────────────────────────────────── Live export log stream | COMMENT |
| MEDIUM | studio/frontend/src/features/export/api/export-api.ts | 319 | // (Server-Sent Events) ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …io/backend/core/training/diffusion_training_service.py | 821 | # ── event pump ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …io/backend/core/training/diffusion_training_service.py | 520 | # ── lifecycle ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/backend/core/inference/sd_cpp_backend.py | 4464 | # ── Unload / status ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | studio/backend/core/inference/video.py | 1254 | # ── MiniMax-H3 modular precision tri-state ──────────────────────────────────── The modular workflow builds each | COMMENT |
| MEDIUM | studio/backend/core/inference/video.py | 1262 | # ── MiniMax-H3 modular precision tri-state ──────────────────────────────────── | COMMENT |
| 2666 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | studio/install_manifest.py | 459 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 600 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 727 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 805 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 829 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 894 | except Exception: | CODE |
| HIGH | studio/install_manifest.py | 241 | except Exception: | CODE |
| HIGH | studio/install_manifest.py | 355 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 369 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 455 | except (OSError, ValueError): | CODE |
| HIGH | studio/install_manifest.py | 508 | except (OSError, ValueError): | CODE |
| HIGH | studio/install_manifest.py | 363 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 579 | except OSError: | CODE |
| HIGH | studio/install_manifest.py | 504 | except ImportError: | CODE |
| HIGH | studio/nvidia_probe.py | 190 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 4796 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 5472 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 5796 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 5802 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 6822 | except subprocess.TimeoutExpired: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 6837 | except subprocess.TimeoutExpired: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 8541 | except Exception: # noqa: BLE001 | CODE |
| HIGH | studio/install_llama_prebuilt.py | 2588 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 2687 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 2706 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 2816 | except ValueError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 2939 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 3006 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 3021 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 3868 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 3880 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 3899 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 5120 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 6756 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 6830 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 4456 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 6707 | except Exception: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 7679 | except OSError: | CODE |
| HIGH | studio/install_llama_prebuilt.py | 7671 | except (OSError, AttributeError): | CODE |
| HIGH | studio/install_llama_prebuilt.py | 3237 | except Exception: | CODE |
| HIGH | studio/install_sd_cpp_prebuilt.py | 810 | except OSError: | CODE |
| HIGH | studio/install_sd_cpp_prebuilt.py | 619 | except OSError: | CODE |
| HIGH | studio/install_node_prebuilt.py | 900 | except Exception: # noqa: BLE001 | CODE |
| HIGH | studio/install_node_prebuilt.py | 968 | except Exception: # noqa: BLE001 | CODE |
| HIGH | studio/install_node_prebuilt.py | 785 | except Exception: # noqa: BLE001 | CODE |
| HIGH | studio/install_node_prebuilt.py | 1225 | except OSError: | CODE |
| HIGH | studio/install_node_prebuilt.py | 352 | except Exception: # noqa: BLE001 | CODE |
| HIGH | studio/install_node_prebuilt.py | 777 | except (OSError, AttributeError): | CODE |
| HIGH | studio/install_node_prebuilt.py | 614 | except (OSError, ValueError): | CODE |
| HIGH | studio/prebuilt_core.py | 98 | except Exception: | CODE |
| HIGH | studio/prebuilt_core.py | 2819 | except OSError: | CODE |
| HIGH | studio/prebuilt_core.py | 583 | except OSError: | CODE |
| HIGH | studio/prebuilt_core.py | 576 | except (OSError, AttributeError): | CODE |
| HIGH | studio/prebuilt_core.py | 881 | except Exception: | CODE |
| HIGH | studio/prebuilt_core.py | 1429 | except PermissionError: | CODE |
| HIGH | studio/install_python_stack.py | 148 | except Exception: | CODE |
| HIGH | studio/install_python_stack.py | 2277 | except Exception: | CODE |
| HIGH | studio/install_python_stack.py | 2439 | except OSError: | CODE |
| HIGH | studio/install_python_stack.py | 2666 | except Exception: | CODE |
| HIGH | studio/install_python_stack.py | 2705 | except Exception: | CODE |
| 1875 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | studio/install_llama_prebuilt.py | 7779 | # None is what expected_install_fingerprint hashed: null, not absent. | COMMENT |
| HIGH | studio/backend/core/rag/conversation_archive.py | 959 | # One predicate per frontend predicate of the same name. `sessionId` and `subject` are tested for ABSENCE, not null, | COMMENT |
| HIGH | studio/backend/core/inference/tool_loop_controller.py | 509 | """The subschema to read against, its one declared type, and whether it admits null; | STRING |
| HIGH | …udio/backend/core/inference/diffusion_compile_cache.py | 788 | # A manifest that decoded but is not an object. json.loads happily returns [] or null, and | COMMENT |
| HIGH | studio/backend/core/inference/llama_server_args.py | 1947 | (``--mlock``) runs its handler only for a truthy one (``opt.handler_void && is_truthy(value)``), | STRING |
| HIGH | studio/backend/core/inference/tool_call_parser.py | 2716 | """One ``.call`` value (string/number/true/false/null) at ``body[p:]``. Returns ``(value, | STRING |
| HIGH | studio/backend/core/inference/media_locality.py | 302 | # [null, null] marks a component this pipeline deliberately ships without. | COMMENT |
| HIGH⚡ | studio/backend/core/inference/wsl_host.py | 58 | (cat <&3 >/dev/null; kill -TERM -$child 2>/dev/null; sleep 10; kill -KILL -$child 2>/dev/null) & | CODE |
| HIGH⚡ | studio/backend/core/inference/wsl_host.py | 65 | if kill -0 -$child 2>/dev/null; then | CODE |
| HIGH⚡ | studio/backend/core/inference/wsl_host.py | 66 | kill -TERM -$child 2>/dev/null; sleep 5; kill -KILL -$child 2>/dev/null | CODE |
| HIGH | studio/backend/core/inference/wsl_host.py | 411 | "if command -v cc >/dev/null && command -v c++ >/dev/null " | CODE |
| HIGH | studio/backend/core/inference/wsl_host.py | 412 | "&& command -v make >/dev/null && test -f /usr/include/stdio.h; " | CODE |
| HIGH | studio/backend/core/inference/mxc_read_grants.py | 682 | stack.push(transaction) | CODE |
| HIGH⚡ | studio/backend/core/inference/mxc_probe.py | 132 | f"cat {shlex.quote(str(canary))} > {shlex.quote(str(read_capture))} 2>/dev/null; " | CODE |
| HIGH⚡ | studio/backend/core/inference/mxc_probe.py | 133 | f"printf bad > {shlex.quote(str(outside_write))} 2>/dev/null; " | CODE |
| HIGH⚡ | studio/backend/core/inference/mxc_probe.py | 135 | "cat inside.txt >/dev/null && printf 'UNSLOTH_MXC_TERMINAL_PROBE_OK\\n'" | CODE |
| HIGH | studio/backend/core/inference/gallery_flags.py | 66 | The container being a dict is not enough. ``{"archived": null}`` is a dict, and every reader | STRING |
| HIGH | studio/backend/core/inference/diffusion_nvfp4_linear.py | 165 | "this NVFP4 weight carries no per_tensor_scale, so the GEMM alpha is undefined; the " | CODE |
| HIGH | studio/backend/core/inference/tool_path_approval.py | 1898 | `cd /models && python -c "open('weights.gguf', 'w')"` writes through a RELATIVE path, which the | STRING |
| HIGH⚡ | studio/backend/core/inference/diffusion_probe_cache.py | 203 | tmp.unlink() # type: ignore[possibly-undefined] | CODE |
| HIGH | studio/backend/core/inference/os_sandbox.py | 766 | "sudo apt-get install -y apparmor-profiles && sudo install -m 644 " | CODE |
| HIGH | studio/backend/core/systemone/gguf_export_contract.py | 11 | "files": {"Q8_0": {"model": "model-Q8_0.gguf", "mmproj": "mmproj-Q8_0.gguf" | null}}, | STRING |
| HIGH⚡ | studio/backend/tests/test_diffusion_routes.py | 2159 | # Same for the precision fields added later: absent keys read back as null, and the PNG still | COMMENT |
| HIGH⚡ | studio/backend/tests/test_export_imatrix_compressed.py | 210 | assert "hf_token: params.token ?? params.loadToken ?? null," in gguf | CODE |
| HIGH | …dio/backend/tests/test_training_progress_stream_nan.py | 5 | non-finite-loss stretches (loss reported as null) instead of replaying the | STRING |
| HIGH | studio/backend/tests/test_local_model_dir_discovery.py | 126 | (b'{"downloadsFolder": null}', "null_value"), | CODE |
| HIGH⚡ | studio/backend/tests/test_sandbox_setup_plan.py | 218 | assert fields["manual_command"].startswith("sudo apt-get update && sudo apt-get") | CODE |
| HIGH⚡ | studio/backend/tests/test_sandbox_setup_plan.py | 229 | assert fields["manual_command"].startswith("apt-get update && apt-get") | CODE |
| HIGH | …o/backend/tests/test_resume_blocked_reason_surfaces.py | 148 | guard = source.split("if (!(detail.run.can_resume && outputDir))", 1)[1][:400] | CODE |
| HIGH | studio/backend/tests/test_anthropic_compaction.py | 441 | b'"content_block":{"type":"compaction","content":null,' | CODE |
| HIGH | studio/backend/tests/test_anthropic_compaction.py | 701 | b'"content_block":{"type":"compaction","content":null}}\n\n' | CODE |
| HIGH⚡ | …dio/backend/tests/test_chat_template_tool_call_rows.py | 331 | assert '"parameters": {"city": "Paris", "unit": null}' in result["dataset"][0]["text"] | STRING |
| HIGH | …dio/backend/tests/test_chat_template_tool_call_rows.py | 127 | result = _format([_tool_call_row('{"city": "Paris", "unit": null}')], _QWEN35_TEMPLATE) | STRING |
| HIGH | studio/backend/tests/test_safetensors_tool_loop.py | 804 | "<|tool_call>call:set_pref{enabled:true,attempts:5,threshold:1.5,nickname:null}<tool_call|>", | CODE |
| HIGH | studio/backend/tests/test_safetensors_tool_loop.py | 972 | '<|python_tag|>{"name":"foo","arguments":null}', | CODE |
| HIGH | studio/backend/tests/test_anthropic_fast_mode_edge.py | 38 | b'"role":"assistant","stop_reason":null,"usage":' | CODE |
| HIGH | studio/backend/tests/test_anthropic_fast_mode_edge.py | 50 | b'"role":"assistant","stop_reason":null,"usage":' | CODE |
| HIGH | studio/backend/tests/test_anthropic_fast_mode_edge.py | 409 | b'"role":"assistant","stop_reason":null,"usage":' | CODE |
| HIGH | studio/backend/tests/test_anthropic_fast_mode_edge.py | 346 | finish_reason=null); the frontend latches on | STRING |
| HIGH | studio/backend/tests/test_media_auto_switch.py | 1776 | ' "safety_checker": [null, null]}' | CODE |
| HIGH⚡ | studio/backend/tests/test_browser_routes.py | 97 | assert 'if (annotation || typeof code !== "string"' in shell | CODE |
| HIGH | studio/backend/tests/test_browser_routes.py | 67 | 'if (data && data.type === "unsloth:browser-command") page.contentWindow.postMessage(data, "*");', | CODE |
| HIGH | studio/backend/tests/test_openai_codex_subscription.py | 1384 | yield 'data: {"choices":[{"delta":{"tool_calls":[{"index":0,"id":"call_1","type":"function","function":{ | CODE |
| HIGH | studio/backend/tests/test_openai_codex_subscription.py | 1387 | yield 'data: {"choices":[{"delta":{"content":"The result is 42."},"finish_reason":null}]}' | CODE |
| HIGH | studio/backend/tests/test_openai_codex_subscription.py | 1463 | yield 'data: {"choices":[{"delta":{"tool_calls":[{"index":0,"id":"call_1","type":"function","function":{ | CODE |
| HIGH | studio/backend/tests/test_openai_codex_subscription.py | 1466 | yield 'data: {"choices":[{"delta":{"content":"done"},"finish_reason":null}]}' | CODE |
| HIGH⚡ | studio/backend/tests/test_chat_settings_payload.py | 268 | """A cleared seed is an explicit null, not an omission: the merge overwrites per | STRING |
| HIGH⚡ | studio/backend/tests/test_credential_routes.py | 360 | """A blank Max Tokens limit field serialises as null, not as an omission. | STRING |
| HIGH⚡ | studio/backend/tests/test_credential_routes.py | 362 | So every provider type has to accept the null, ChatGPT subscriptions included: an | STRING |
| HIGH | …/backend/tests/test_anthropic_fast_mode_and_refusal.py | 42 | b'"stop_reason":null,"usage":{"input_tokens":1,"output_tokens":1}}}\n\n' | CODE |
| HIGH | …/backend/tests/test_anthropic_fast_mode_and_refusal.py | 53 | b'"stop_reason":null,"usage":{"input_tokens":1,"output_tokens":1}}}\n\n' | CODE |
| HIGH | …/backend/tests/test_anthropic_fast_mode_and_refusal.py | 187 | b'"stop_reason":null,"usage":{"input_tokens":1,"output_tokens":1}}}\n\n' | CODE |
| HIGH | studio/backend/tests/test_library_routes.py | 952 | ("foo-merged", '{"base_model": null}'), | CODE |
| HIGH⚡ | studio/backend/tests/test_tool_call_parser_strict.py | 404 | calls = parse_tool_calls_from_text('[TOOL_CALLS][{"name":"get_time","arguments":null}]') | CODE |
| HIGH | studio/backend/tests/test_tool_call_parser_strict.py | 497 | text = '<|python_tag|>do.call(s="hi 😀", n=42, f=1.5, b=true, z=null)' | CODE |
| HIGH | studio/backend/tests/test_image_gallery.py | 441 | # `{"archived": null}` is still a dict, so a container-only check trusted it, and every reader | COMMENT |
| HIGH | studio/backend/tests/test_job_accounts.py | 265 | assert json.dumps(exported, separators = (",", ":")) == '[true,"done",null]' | CODE |
| HIGH⚡ | studio/backend/tests/test_openai_tool_passthrough.py | 3070 | line = 'data: {"choices":[{"index":0,"delta":{"content":"hello"},"finish_reason":null}]}' | CODE |
| HIGH⚡ | studio/backend/tests/test_openai_tool_passthrough.py | 3079 | '"mentions \\"reasoning_content\\" in text"},"finish_reason":null}]}' | CODE |
| HIGH⚡ | studio/backend/tests/test_openai_tool_passthrough.py | 3087 | '"finish_reason":null}]}' | CODE |
| 1672 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | install.sh | 8454 | except Exception: | CODE |
| LOW⚡ | install.sh | 8458 | except Exception: | CODE |
| LOW⚡ | install.sh | 8464 | except Exception: | CODE |
| LOW | install.sh | 2904 | except Exception: | CODE |
| LOW | install.sh | 6164 | except Exception: | CODE |
| LOW | install.sh | 6944 | except Exception: | CODE |
| LOW | install.sh | 8361 | except Exception: | CODE |
| LOW | studio/setup.sh | 1426 | except Exception: | CODE |
| LOW | studio/setup.sh | 3256 | except Exception: | CODE |
| LOW | studio/setup.sh | 4638 | except Exception: | CODE |
| LOW | studio/setup.sh | 4658 | except Exception: | CODE |
| LOW | studio/setup.sh | 4756 | except Exception: | CODE |
| LOW | studio/setup.sh | 5833 | except Exception: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 396 | except Exception as exc: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1610 | except Exception as exc: | CODE |
| LOW | studio/install_whisper_prebuilt.py | 1918 | except Exception as exc: # noqa: BLE001 - unreachable is a reason to do the work | CODE |
| LOW | studio/install_whisper_prebuilt.py | 2002 | except Exception as exc: # noqa: BLE001 - unreachable is a reason to do the work | CODE |
| LOW | studio/install_whisper_prebuilt.py | 2273 | except Exception as exc: # noqa: BLE001 - probe must never crash the caller | CODE |
| LOW | studio/install_whisper_prebuilt.py | 2308 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW⚡ | studio/install_manifest.py | 915 | except Exception: | CODE |
| LOW⚡ | studio/install_manifest.py | 920 | except Exception: | CODE |
| LOW⚡ | studio/install_manifest.py | 930 | except Exception: | CODE |
| LOW⚡ | studio/install_manifest.py | 1023 | except Exception: | CODE |
| LOW⚡ | studio/install_manifest.py | 1029 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 196 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 241 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 894 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 970 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1010 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1068 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1103 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1109 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1347 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1360 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1410 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1558 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1598 | except Exception: | CODE |
| LOW | studio/install_manifest.py | 1607 | except Exception: | CODE |
| LOW | studio/nvidia_probe.py | 105 | except Exception: | CODE |
| LOW | studio/nvidia_probe.py | 190 | except Exception: | CODE |
| LOW | studio/nvidia_probe.py | 240 | except Exception: | CODE |
| LOW | studio/nvidia_probe.py | 292 | except Exception: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 1632 | except Exception as exc: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 4683 | except Exception: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 5655 | except Exception as exc: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 5664 | except Exception as exc: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 6707 | except Exception: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 7480 | except Exception: # noqa: BLE001 - an unreadable runtime is "cannot tell", recorded as such | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 7492 | except Exception: # noqa: BLE001 - an unreadable scan is "cannot tell", which takes the full path | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 10446 | except Exception: | CODE |
| LOW⚡ | studio/install_llama_prebuilt.py | 10450 | except Exception: | CODE |
| LOW | studio/install_llama_prebuilt.py | 54 | except Exception: # an older checkout beside a newer setup script | CODE |
| LOW | studio/install_llama_prebuilt.py | 1074 | except Exception as exc: # noqa: BLE001 - the REST cause is the one worth reporting | CODE |
| LOW | studio/install_llama_prebuilt.py | 1142 | except Exception as exc: # noqa: BLE001 - report both causes, neither alone explains it | CODE |
| LOW | studio/install_llama_prebuilt.py | 1159 | except Exception as exc: # noqa: BLE001 - report both causes | CODE |
| LOW | studio/install_llama_prebuilt.py | 1172 | except Exception as exc: # noqa: BLE001 - one unreadable release is not the end of the walk | CODE |
| LOW | studio/install_llama_prebuilt.py | 1218 | except Exception: | CODE |
| LOW | studio/install_llama_prebuilt.py | 1584 | except Exception as exc: | CODE |
| LOW | studio/install_llama_prebuilt.py | 1910 | except Exception as exc: | CODE |
| LOW | studio/install_llama_prebuilt.py | 1930 | except Exception as exc: | CODE |
| 6900 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | studio/install_whisper_prebuilt.py | 56 | CODE | |
| LOW | studio/install_manifest.py | 18 | CODE | |
| LOW | studio/install_lemonade_prebuilt.py | 11 | CODE | |
| LOW | studio/install_q4nx_converter.py | 16 | CODE | |
| LOW | studio/nvidia_probe.py | 19 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 7 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 19 | CODE | |
| LOW | studio/install_sd_cpp_prebuilt.py | 12 | CODE | |
| LOW | studio/install_audio_cpp_prebuilt.py | 31 | CODE | |
| LOW | studio/install_node_prebuilt.py | 23 | CODE | |
| LOW | studio/install_mxc_prebuilt.py | 6 | CODE | |
| LOW | studio/prebuilt_core.py | 28 | CODE | |
| LOW | studio/install_python_stack.py | 12 | CODE | |
| LOW | studio/backend/cloudflare_tunnel.py | 12 | CODE | |
| LOW | studio/backend/run.py | 9 | CODE | |
| LOW | studio/backend/run.py | 9 | CODE | |
| LOW | studio/backend/run.py | 141 | CODE | |
| LOW | studio/backend/startup_banner.py | 6 | CODE | |
| LOW | studio/backend/lan_access.py | 20 | CODE | |
| LOW | studio/backend/colab.py | 14 | CODE | |
| LOW | studio/backend/main.py | 222 | CODE | |
| LOW | studio/backend/mcp_server.py | 9 | CODE | |
| LOW | studio/backend/loggers/handlers.py | 8 | CODE | |
| LOW | studio/backend/loggers/__init__.py | 4 | CODE | |
| LOW | studio/backend/loggers/__init__.py | 4 | CODE | |
| LOW | studio/backend/loggers/media_progress.py | 6 | CODE | |
| LOW | studio/backend/core/import_guards.py | 6 | CODE | |
| LOW | studio/backend/core/youtube_transcript.py | 16 | CODE | |
| LOW | studio/backend/core/library.py | 23 | CODE | |
| LOW | studio/backend/core/chat_originals.py | 17 | CODE | |
| LOW | studio/backend/core/_torchao_stub.py | 18 | CODE | |
| LOW | studio/backend/core/tool_healing.py | 25 | CODE | |
| LOW | studio/backend/core/agents_md.py | 6 | CODE | |
| LOW | studio/backend/core/_msvc_env.py | 8 | CODE | |
| LOW | studio/backend/core/_msvc_env.py | 204 | CODE | |
| LOW | studio/backend/core/research_runs.py | 6 | CODE | |
| LOW | studio/backend/core/research_runs.py | 40 | CODE | |
| LOW | studio/backend/core/research/citations.py | 11 | CODE | |
| LOW | studio/backend/core/research/redaction.py | 12 | CODE | |
| LOW | studio/backend/core/research/parsing.py | 11 | CODE | |
| LOW | studio/backend/core/research/prompts.py | 6 | CODE | |
| LOW | studio/backend/core/data_recipe/service.py | 4 | CODE | |
| LOW | …dio/backend/core/data_recipe/text_format_validators.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/__init__.py | 6 | CODE | |
| LOW | studio/backend/core/data_recipe/__init__.py | 6 | CODE | |
| LOW | studio/backend/core/data_recipe/export.py | 6 | CODE | |
| LOW | studio/backend/core/data_recipe/jsonable.py | 4 | CODE | |
| LOW | …/backend/core/data_recipe/local_callable_validators.py | 4 | CODE | |
| LOW | …/backend/core/data_recipe/local_callable_validators.py | 8 | CODE | |
| LOW | studio/backend/core/data_recipe/huggingface.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/worker.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/worker.py | 7 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/worker.py | 8 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/constants.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/__init__.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/__init__.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/types.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/parse.py | 4 | CODE | |
| LOW | studio/backend/core/data_recipe/jobs/manager.py | 4 | CODE | |
| LOW | studio/backend/core/external_import/codex.py | 11 | CODE | |
| 3498 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | studio/install_whisper_prebuilt.py | 906 | CODE | |
| LOW | studio/install_whisper_prebuilt.py | 1072 | CODE | |
| LOW | studio/install_whisper_prebuilt.py | 1349 | CODE | |
| LOW | studio/install_manifest.py | 213 | CODE | |
| LOW | studio/install_manifest.py | 375 | CODE | |
| LOW | studio/install_manifest.py | 1214 | CODE | |
| LOW | studio/install_manifest.py | 1319 | CODE | |
| LOW | studio/install_manifest.py | 1415 | CODE | |
| LOW | studio/install_manifest.py | 1625 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 1183 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 1286 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 1533 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 2876 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 2908 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 3603 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 3808 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 3847 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 3980 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 4204 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 4364 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 4567 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 4875 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 5034 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 5236 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 5931 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 6300 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 6557 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 6842 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 7115 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 7262 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 7624 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 8393 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 8429 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 8505 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 9913 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 10421 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 10481 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 11066 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 11199 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 11825 | CODE | |
| LOW | studio/install_llama_prebuilt.py | 7282 | CODE | |
| LOW | studio/install_sd_cpp_prebuilt.py | 538 | CODE | |
| LOW | studio/install_sd_cpp_prebuilt.py | 713 | CODE | |
| LOW | studio/install_audio_cpp_prebuilt.py | 535 | CODE | |
| LOW | studio/install_node_prebuilt.py | 310 | CODE | |
| LOW | studio/install_node_prebuilt.py | 582 | CODE | |
| LOW | studio/install_node_prebuilt.py | 717 | CODE | |
| LOW | studio/install_node_prebuilt.py | 1046 | CODE | |
| LOW | studio/install_node_prebuilt.py | 1135 | CODE | |
| LOW | studio/install_mxc_prebuilt.py | 104 | CODE | |
| LOW | studio/prebuilt_core.py | 538 | CODE | |
| LOW | studio/prebuilt_core.py | 754 | CODE | |
| LOW | studio/prebuilt_core.py | 796 | CODE | |
| LOW | studio/prebuilt_core.py | 841 | CODE | |
| LOW | studio/prebuilt_core.py | 1383 | CODE | |
| LOW | studio/prebuilt_core.py | 1628 | CODE | |
| LOW | studio/prebuilt_core.py | 2932 | CODE | |
| LOW | studio/install_python_stack.py | 397 | CODE | |
| LOW | studio/install_python_stack.py | 1757 | CODE | |
| LOW | studio/install_python_stack.py | 2005 | CODE | |
| 2187 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 901 | *) _uv_recorded="" ;; | COMMENT |
| LOW | install.sh | 1061 | UV_CACHE_DIR="$_uv_launch_cache" | COMMENT |
| LOW | install.sh | 2421 | # | COMMENT |
| LOW | install.sh | 2441 | # an unsigned one, so the shortcut would silently stop being created for exactly the | COMMENT |
| LOW | install.sh | 2641 | _css_ps1_win=$(wslpath -w "$_css_ps1_tmp" 2>/dev/null) | COMMENT |
| LOW | install.sh | 3001 | NF { gsub(/^[[:space:]]+|[[:space:]]+$/,""); if (index($0, want) == 1) { hits++; idx = NR-1 } } | COMMENT |
| LOW | install.sh | 3061 | *) _nv_idx="$_nv_tok" ;; | COMMENT |
| LOW | install.sh | 4521 | # Whether this run was TOLD to install ROCm torch, whatever else the host has: the automatic | COMMENT |
| LOW | install.sh | 4721 | } | COMMENT |
| LOW | install.sh | 4901 | } | COMMENT |
| LOW | install.sh | 5001 | # utils/hardware/amd.py::_amd_nodes_the_runtime_lacks question for question; the two halves | COMMENT |
| LOW | install.sh | 5061 | # A value as a single shell word, for a command the user is going to paste. NSS names are | COMMENT |
| LOW | install.sh | 5081 | # mode:PATH the mode denies the group too (a udev rule leaving one root:render 0600), | COMMENT |
| LOW | install.sh | 5101 | # on would all be read out of the name. Everything before it comes from the kernel | COMMENT |
| LOW | install.sh | 5121 | if (gname !~ /^[A-Za-z_][A-Za-z0-9_.-]*[$]?$/) { gname = "" } | COMMENT |
| LOW | install.sh | 5141 | # branched on. Unreachable while stat answers, and the direction that cannot | COMMENT |
| LOW | install.sh | 5521 | echo " [WARN] $_hsp_inferred reported with HSA_OVERRIDE_GFX_VERSION unset -- spoof confirmed." >&2 | COMMENT |
| LOW | install.sh | 6661 | # Read before the branches below and reported after them: a closed node is invisible | COMMENT |
| LOW | install.sh | 7161 | # rocm6.4 (2.8.0-2.9.1) same set | COMMENT |
| LOW | install.sh | 7521 | esac | COMMENT |
| LOW | install.sh | 7621 | } | COMMENT |
| LOW | install.sh | 7661 | fi | COMMENT |
| LOW | install.sh | 8761 | # the conda arm appends. All three flags are load-bearing: | COMMENT |
| LOW | install.sh | 8901 | && [ "$_STUDIO_HOME_REDIRECT" != "env" ]; then | COMMENT |
| LOW | pyproject.toml | 121 | # into dist/ during `npm run build`. Pure duplication. | COMMENT |
| LOW | pyproject.toml | 201 | # torch supported here, 2.6.0, requires `triton==3.2.0`, so any floor above | COMMENT |
| LOW | pyproject.toml | 221 | # and the compiled path is covered for the first time rather than resting on the eager | COMMENT |
| LOW | pyproject.toml | 241 | "datasets>=3.4.1,!=4.0.*,!=4.1.0,!=4.4.*,!=4.5.0,<5.0.0", | COMMENT |
| LOW | pyproject.toml | 261 | "transformers>=4.52.4,!=4.53.0,!=4.54.0,!=4.55.0,!=4.55.1,!=4.57.0,!=4.57.4,!=4.57.5,!=5.0.0,!=5.1.0,<=5.17.0", | COMMENT |
| LOW | pyproject.toml | 301 | "torchvision", | COMMENT |
| LOW | pyproject.toml | 321 | # resolves to all do: | COMMENT |
| LOW | pyproject.toml | 1801 | # gets the whole walk, and a handful of files in it download and merge real | COMMENT |
| LOW | build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | build.sh | 121 | # a packaging change that only shows up in the source tree. It is not uploaded. | COMMENT |
| LOW | studio/setup.sh | 1121 | fi | COMMENT |
| LOW | studio/setup.sh | 1241 | *) _setup_nv_idx="$_setup_nv_tok" ;; | COMMENT |
| LOW | studio/setup.sh | 1601 | COMMENT | |
| LOW | studio/setup.sh | 1701 | unset _uvk_lower | COMMENT |
| LOW | studio/setup.sh | 1741 | return 1 | COMMENT |
| LOW | studio/setup.sh | 2381 | COMMENT | |
| LOW | studio/setup.sh | 2621 | COMMENT | |
| LOW | studio/setup.sh | 2801 | # Stage both, then publish both, as install.sh does: the renames sit next to each | COMMENT |
| LOW | studio/setup.sh | 2961 | _unsloth_conda_env_active || return 0 | COMMENT |
| LOW | studio/setup.sh | 3001 | fi | COMMENT |
| LOW | studio/setup.sh | 3241 | fi | COMMENT |
| LOW | studio/setup.sh | 4421 | UNSLOTH_HOME="$STUDIO_HOME" | COMMENT |
| LOW | studio/setup.sh | 4941 | _PREBUILT_CMD+=(--published-release-tag "$UNSLOTH_LLAMA_RELEASE_TAG") | COMMENT |
| LOW | studio/setup.sh | 5501 | # Detect AMD GPU architecture (gfx target) | COMMENT |
| LOW | studio/setup.sh | 5941 | printf " ${C_DIM}%-15s${C_OK}%s${C_RST}\n" "launch" "unsloth studio -p 8888" | COMMENT |
| LOW | studio/install_manifest.py | 41 | # another's remove and its mutations and recreate a completion marker over a half-built venv. | COMMENT |
| LOW | studio/__init__.py | 1 | # SPDX-License-Identifier: AGPL-3.0-only | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 3181 | # no HIP mask (it selects via GGML_VK_VISIBLE_DEVICES), so auto-routing would hand | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 3301 | # setup.ps1 and _pick_rocm_gfx_target() both apply the shadowing-iGPU preference | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 3981 | upstream_assets = github_release_assets(UPSTREAM_REPO, llama_tag) | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 5001 | # The tail unique_install_side_path appends after "<name>.<label>-": | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 5161 | # symlinks = True, like the aside-move and rollback-restore copies below. The | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 5301 | restore_attempted = True | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 5821 | # CUDA 13 Windows wheel layout (the unsuffixed | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 8121 | # tree reported healthy while llama-server died in dyld. The names are | COMMENT |
| LOW | studio/install_llama_prebuilt.py | 8301 | # Versionless. Whether that is the loadable name depends on the family around | COMMENT |
| 1387 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 1529 | # Optional callers never elevate, in any mode: nothing on the consumer path builds anything, so neither the terminal | COMMENT |
| MEDIUM | install.sh | 3211 | # Tauri child exit 2 ([TAURI:NEED_SUDO]) asks the desktop app to elevate. | COMMENT |
| MEDIUM | install.sh | 4538 | # The veto is inside this function rather than in a wrapper, because every tests/sh harness | COMMENT |
| MEDIUM | install.sh | 4888 | # the paths are absolute, so a harness cannot otherwise reach this rule at all. | COMMENT |
| MEDIUM | studio/frontend/package-lock.json | 14153 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | studio/frontend/tests/stream-pacing-stall.test.ts | 5 | // catches the freeze class #7892 and #8845 fixed. A stall the harness fails to record is a | COMMENT |
| MEDIUM | studio/frontend/src/components/app-sidebar.tsx | 630 | // Absolutely-positioned extras over the row, e.g. a disclosure chevron. | COMMENT |
| MEDIUM | …d/src/components/assistant-ui/progressive-messages.tsx | 53 | * DOM readers (screenshot capture, the #9016 harness census) not necessarily in the React tree, and a thread can | COMMENT |
| MEDIUM | studio/frontend/src/lib/use-diffusion-pick-toast.tsx | 15 | // Match the load toast's styling for a seamless handoff. | COMMENT |
| MEDIUM | studio/backend/core/external_import/claude.py | 47 | # Slash-command echoes are the harness talking; captured command output is cut, it can follow a prompt. | COMMENT |
| MEDIUM | studio/backend/core/training/trainer.py | 3893 | # _online_prewarm_batches records how the run was configured and the A/B harness reads it back; a second call | COMMENT |
| MEDIUM | studio/backend/core/inference/diffusion_families.py | 714 | # deterministic, so same-seed LPIPS mixes trajectory divergence with harness noise) | COMMENT |
| MEDIUM | studio/backend/core/inference/diffusion_precision.py | 458 | # in fp8, and it is robust across encoder sizes, so only the vision tower / lm_head / T5 wo are excluded. | COMMENT |
| MEDIUM | studio/backend/core/inference/diffusion_speed.py | 1747 | # Families the overflow harness found to produce non-finite activations under fp16 accumulation. Empty by measurement: | COMMENT |
| MEDIUM | studio/backend/core/inference/video_wan_fused.py | 38 | # fused block calls since install (engagement evidence for tests and the A/B harness) | COMMENT |
| MEDIUM | …udio/backend/tests/test_export_multi_gpu_device_map.py | 24 | # Reuse the absolute-paths stub harness: loads core/export/export.py without torch/unsloth. | COMMENT |
| MEDIUM | studio/backend/tests/test_memory_estimate_platforms.py | 240 | # sys.platform + the WSL markers, through the harness that already owns them. | COMMENT |
| MEDIUM | studio/backend/tests/test_unmeasured_context_ceiling.py | 35 | # The no-GPU probe in this harness IS the Metal condition. | COMMENT |
| MEDIUM | …dio/backend/tests/test_parallel_slots_never_clamped.py | 21 | # Reuses the only harness in the suite that yields a real launched argv. | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_diffusion_speed.py | 470 | # default compiles with dynamic=True and no autotune mode: fast cold start, resolution-robust, sidesteps the CUDA-gr | COMMENT |
| MEDIUM | studio/backend/tests/test_metal_paravirtual_guard.py | 582 | # This harness is about the paravirtual gate, so vision is on; the toggle's | COMMENT |
| MEDIUM⚡ | …dio/backend/tests/test_metal_explicit_context_guard.py | 761 | # harness: ~3850 to ~4050 MiB (3300 leaves room for 768 tokens, 4100 tips over). | COMMENT |
| MEDIUM | …dio/backend/tests/test_metal_explicit_context_guard.py | 189 | # This harness does not model host RAM, and None is the documented way to say so: both | COMMENT |
| MEDIUM | …dio/backend/tests/test_mtp_partial_offload_evidence.py | 39 | # Reuse the module's dependency stubs, fixtures and launch harness. | COMMENT |
| MEDIUM | studio/backend/tests/test_anthropic_citations_edge.py | 23 | # ── shared SSE harness ─────────────────────────────────────── | COMMENT |
| MEDIUM | studio/backend/tests/test_sd_cpp_cudnn.py | 19 | # Sibling imports (the H3 load harness) need the tests dir on the path: pytest inserts rootdir, not this package. | COMMENT |
| MEDIUM | …o/backend/tests/test_keyless_api_access_adversarial.py | 414 | # What a harness that always sends the header emits with no key: the missing header. | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_rag_nudge_roster_compat.py | 646 | # sibling module's count-endpoint harness the same way pytest itself found it. | COMMENT |
| MEDIUM | studio/backend/tests/test_trained_model_scan.py | 147 | # Assert on the logger directly: robust to the logging backend (structlog vs stub). | COMMENT |
| MEDIUM | …/backend/tests/test_memory_estimate_contract_freeze.py | 49 | # and brings the route harness with it. Same import-for-side-effects pattern as | COMMENT |
| LOW | …/backend/tests/test_tensor_quant_kv_platform_matrix.py | 143 | # gone entirely, not just set to layer, so an extras --tensor-split cannot | COMMENT |
| MEDIUM | studio/backend/tests/test_external_tool_stream_abuse.py | 906 | # finish. ``release`` is only the harness's escape hatch if it never does. | COMMENT |
| MEDIUM | studio/backend/tests/test_external_tool_stream_abuse.py | 916 | # Tasks already running belong to this harness, not the tool loop, so the census is taken | COMMENT |
| MEDIUM | studio/backend/tests/test_external_tool_stream_abuse.py | 942 | # Census BEFORE the escape hatch, so a worker that only the harness could free still | COMMENT |
| MEDIUM | …dio/backend/tests/test_gpu_arch_gate_os_matrix_7624.py | 2809 | # harness builds a fresh backend per drive, so without this the assert | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_mtp_vram_budget.py | 607 | # robust to that and to any formatter line-wrapping. | COMMENT |
| MEDIUM⚡ | …udio/backend/tests/test_rocm_torch_explicit_request.py | 1071 | # single-quoted string arrives as a literal backslash-t, so a harness that inlined the | COMMENT |
| MEDIUM | …udio/backend/tests/test_rocm_torch_explicit_request.py | 187 | # would depend on the machine running the suite. Each harness names its own inventory. | COMMENT |
| MEDIUM | …udio/backend/tests/test_rocm_torch_explicit_request.py | 268 | # harness produced and read as "the flag did nothing". | COMMENT |
| MEDIUM | studio/backend/tests/test_provider_registry_filters.py | 132 | # Computer-use is an agentic harness, not a chat id. | COMMENT |
| MEDIUM | …/tests/test_length_truncated_reasoning_continuation.py | 773 | # A tokenizer this harness can actually run: llama-server is not here to render a | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_mmproj_placement_policy.py | 1747 | # The harness resolver re-supplies the drafter whatever the load decided. | COMMENT |
| MEDIUM | studio/backend/tests/test_resolved_flash_attn_plan.py | 116 | # The harness turns KV estimation off; seed a real shape (Qwen3-0.6B) for arithmetic. | COMMENT |
| MEDIUM | studio/backend/tests/test_export_converter_pin.py | 27 | # Reuse the absolute-paths stub harness: loads core/export/export.py without torch/unsloth. | COMMENT |
| MEDIUM | studio/backend/tests/test_research_runs_hardening.py | 1408 | """Serve ``responses`` in order to the completion path and record the sends. An entry that | STRING |
| MEDIUM | studio/backend/tests/test_setup_llama_cpp_backend.py | 353 | # errors out and the harness returns a bare "ARGS:". | COMMENT |
| MEDIUM | studio/backend/tests/test_llama_extra_args_platforms.py | 26 | # The placement harness (module stubs, a fake GGUF, a fake GPU probe, the captured | COMMENT |
| MEDIUM⚡ | …udio/backend/tests/test_amd_device_node_permissions.py | 4429 | # The helpers every tests/sh ROCm harness lifts alongside _has_amd_rocm_gpu. Adding a name | COMMENT |
| MEDIUM⚡ | …udio/backend/tests/test_amd_device_node_permissions.py | 4431 | # invariant checks: each name must appear in every harness that lifts the probe. | COMMENT |
| MEDIUM⚡ | …udio/backend/tests/test_amd_device_node_permissions.py | 4438 | # non-zero, which reads as "not requested" -- the default answer, so a harness would | COMMENT |
| MEDIUM | …udio/backend/tests/test_amd_device_node_permissions.py | 768 | # The route gate, true by default: this harness asks about the closed-node | COMMENT |
| MEDIUM | …udio/backend/tests/test_amd_device_node_permissions.py | 1140 | # so a harness that omits either measures a missing function rather than a rule. | COMMENT |
| MEDIUM | …udio/backend/tests/test_amd_device_node_permissions.py | 3683 | # _install_sh_hint gives: a harness that omits one measures a missing function | COMMENT |
| MEDIUM | …udio/backend/tests/test_amd_device_node_permissions.py | 4485 | # A harness that only stubs the probe (bad_arch_gate does this for some cases) still | COMMENT |
| MEDIUM | studio/backend/tests/test_local_llama_cpp_link.py | 213 | # stubs this at every one of its call sites for the same reason; this harness | COMMENT |
| MEDIUM | …kend/tests/test_auto_offload_ctx_fit_floor_coupling.py | 64 | # 4560 tokens at the 0.5 MiB/token rate the matrix harness prices: over the floor, | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_diffusion_backend.py | 4499 | # low_vram offloads every component; whole-module offload is the robust path and engages directly. | COMMENT |
| MEDIUM | …udio/backend/tests/test_llama_extra_args_end_to_end.py | 19 | # The harness (module stubs, a fake GGUF, a fake GPU probe, the captured Popen) | COMMENT |
| MEDIUM | studio/backend/tests/log_budget/replay.py | 79 | # took a minute" is a case the harness could not express at all, and therefore could | COMMENT |
| MEDIUM⚡ | studio/backend/assets/docs_ui/redoc.standalone.js | 2 | !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("null")):"function"==typeof de | CODE |
| 209 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pyproject.toml | 189 | # than pinned: the RAG store already treats a missing sqlite_vec as "RAG unavailable". | COMMENT |
| MEDIUM | studio/frontend/tests/context-window-visible.test.ts | 4 | // #8867: the bar rendered only once a token count existed, so a local model's context window was | COMMENT |
| MEDIUM | …end/src/components/assistant-ui/tool-ui-web-search.tsx | 108 | // gpt-5.x agentic search: `open_page` carries a url, `find_in_page` a url and a pattern. Older | COMMENT |
| MEDIUM | studio/backend/main.py | 1213 | # In Colab the kernel scaffolding injects scripts and fetch/WS from *.prod.colab.dev and | COMMENT |
| MEDIUM | studio/backend/main.py | 1432 | # RAG document uploads (knowledge base, thread, project): multipart, capped by RAG_MAX_UPLOAD_BYTES in the route and | COMMENT |
| MEDIUM | studio/backend/main.py | 1564 | # Uploads whose path carries an id (RAG documents), matched by a compiled pattern. | COMMENT |
| MEDIUM | studio/backend/core/youtube_transcript.py | 44 | # Roughly 25k tokens: a three hour video's captions would swallow the model's context window on their own. | COMMENT |
| MEDIUM | studio/backend/core/research_runs.py | 124 | # Below this loaded context the prompt scaffolding alone fills the window, so grounding is skipped. | COMMENT |
| MEDIUM | studio/backend/core/research_runs.py | 2875 | # tool_failed as well as step_failed: a tool error RAG rescued still records why. | COMMENT |
| MEDIUM | studio/backend/core/research_runs.py | 2922 | # fixed scaffold leaves. | COMMENT |
| MEDIUM | studio/backend/core/rag/conversation_archive.py | 38 | # Tool call ids this feature and the RAG auto-inject generate. Their results are retrieved passages, so archiving them | COMMENT |
| MEDIUM | studio/backend/core/rag/embeddings.py | 336 | # An adapter-backed embedding model reports through the PEFT integration's own logger, not a | COMMENT |
| MEDIUM | studio/backend/core/rag/folder_sync.py | 700 | # timestamp, and retiring it disables RAG for a project recreated with the same id, for good. | COMMENT |
| MEDIUM | studio/backend/core/inference/api_monitor.py | 42 | # Far above any real context window; larger means a broken upstream payload. | COMMENT |
| MEDIUM | studio/backend/core/inference/chat_template_helpers.py | 1184 | # The agentic loop re-sanitizes the catalog on every iteration, because a one-shot tool can retire between turns, | COMMENT |
| MEDIUM | studio/backend/core/inference/mcp_images.py | 730 | # This is opt-in: local loops use a context window instead of a provider cap. | COMMENT |
| MEDIUM | studio/backend/core/inference/mcp_images.py | 1236 | # what THIS cap protects, and llama-server is bounded by its context window | COMMENT |
| MEDIUM | studio/backend/core/inference/tool_call_parser.py | 392 | # Magistral wraps reasoning in ``[THINK]...[/THINK]``; a ``[TOOL_CALLS]`` inside that block is chain-of-thought, not a | COMMENT |
| MEDIUM | studio/backend/core/inference/stream_errors.py | 46 | # Worded around the chat client's own substring test. `chat-adapter.ts::isContextLimitError` matches "context window" | COMMENT |
| MEDIUM | studio/backend/core/inference/stream_errors.py | 47 | # (among others) and shows "Context limit reached: the conversation has filled the model's context window... or start a | COMMENT |
| MEDIUM | studio/backend/core/inference/external_provider.py | 5806 | # chain of thought across every local tool hop and misses the prompt cache on the turn after. | COMMENT |
| MEDIUM | studio/backend/core/inference/external_provider.py | 7547 | # vLLM and SGLang LoRA adapters use their base model's context window. | COMMENT |
| MEDIUM | studio/backend/core/inference/diffusion_ideogram4.py | 307 | # build at the target dtype: this ~8B scaffold loads FIRST, so the fp32 default can OOM a 64 GB host | COMMENT |
| MEDIUM | …/backend/core/inference/provider_model_capabilities.py | 117 | # Total context window. The frontend merges this payload over its bundled snapshot per model, | COMMENT |
| MEDIUM | studio/backend/core/inference/repetition_guard.py | 37 | # Ceiling on distinct windows held while scanning. Every fragment a context window can actually produce stays well | COMMENT |
| MEDIUM | studio/backend/core/inference/safetensors_agentic.py | 733 | # Forced first-pass RAG (mirrors the GGUF loop) so doc Qs don't lose to | COMMENT |
| MEDIUM | studio/backend/core/inference/safetensors_agentic.py | 783 | # RAG: cap knowledge-base searches per assistant turn (controller-agnostic). | COMMENT |
| MEDIUM | studio/backend/core/inference/safetensors_agentic.py | 1633 | # RAG: cap paraphrased KB re-searches that slip past the dup guard. | COMMENT |
| MEDIUM⚡ | studio/backend/core/inference/local_model_resolver.py | 916 | # Skip what Unsloth hides from its pickers (validation probe, RAG embed weights): not chat models, so never an | COMMENT |
| MEDIUM | studio/backend/tests/test_openai_auto_switch.py | 1721 | # The llama.cpp validation probe and RAG embedding weights are hidden from | COMMENT |
| MEDIUM | studio/backend/tests/test_openai_auto_switch.py | 5680 | # from these exact messages, and the tool loop opens it by splicing in what RAG retrieves. | COMMENT |
| MEDIUM | studio/backend/tests/conftest.py | 85 | # Avoid a cold torch subprocess in unrelated RAG tests. The probe tests re-enable it. | COMMENT |
| MEDIUM | studio/backend/tests/conftest.py | 1010 | # ── RAG fixtures ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …o/backend/tests/test_external_hosted_tool_selection.py | 210 | # The route drops the RAG tool without a scope, and no scope means no | COMMENT |
| MEDIUM⚡ | …o/backend/tests/test_external_hosted_tool_selection.py | 211 | # loop at all, so the automatic-RAG turn has to carry one to be the case | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_safetensors_tool_loop.py | 4643 | # the agentic loop is gated off and the real call is dropped. | COMMENT |
| MEDIUM | studio/backend/tests/test_safetensors_tool_loop.py | 697 | # strip must drop it so the raw chain-of-thought does not leak into the | COMMENT |
| MEDIUM | studio/backend/tests/test_safetensors_tool_loop.py | 782 | # chain-of-thought (llama.cpp test-chat.cpp:2285). | COMMENT |
| MEDIUM | studio/backend/tests/test_safetensors_tool_loop.py | 1029 | # agentic loop can collapse a looping model's repeated calls. | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_rag_unavailable_quiet.py | 104 | # "Is RAG switched off here" is not the question a locked database answers. | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_rag_unavailable_quiet.py | 262 | # RAG off until restart, and it must not leave the listings and the mutations | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_rag_unavailable_quiet.py | 263 | # disagreeing about whether RAG works. | COMMENT |
| MEDIUM | studio/backend/tests/test_rag_unavailable_quiet.py | 305 | # It already claims to be a no-op without RAG; raising out of startup so main.py | COMMENT |
| MEDIUM | studio/backend/tests/test_rag_unavailable_quiet.py | 352 | # "RAG is switched off on this machine". | COMMENT |
| MEDIUM | studio/backend/tests/test_rag_unavailable_quiet.py | 390 | # The 503 gate must not stand in the way of a machine where RAG does run. | COMMENT |
| MEDIUM | …/backend/tests/test_anthropic_fast_mode_and_refusal.py | 12 | https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals | STRING |
| MEDIUM | studio/backend/tests/test_lan_access_settings.py | 1179 | # ── settings orchestration ── | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_openai_tool_passthrough.py | 504 | # Empty tool output (mkdir, git add, ...) is routine in agentic loops; | COMMENT |
| MEDIUM | studio/backend/tests/test_api_monitor.py | 1337 | # A direct llama call (RAG caption/OCR) opens no row, logging may be off, and another | COMMENT |
| MEDIUM⚡ | …dio/backend/tests/test_openai_tool_result_fallbacks.py | 375 | # ── agentic search action variants ───────────────────────────────────── | COMMENT |
| MEDIUM | studio/backend/tests/test_bypass_permissions.py | 265 | # ── agentic loop forwards disable_sandbox, never gates under bypass ── | COMMENT |
| MEDIUM | studio/backend/tests/test_stt_sidecar.py | 125 | # orchestration tests run without PyTorch/Transformers/PyAV installed. | COMMENT |
| MEDIUM | studio/backend/tests/test_offline_embedding_minimal.py | 231 | # The RAG loader passes cache_folder=active_hf_hub_cache(), which overrides | COMMENT |
| MEDIUM | studio/backend/tests/test_provider_registry_filters.py | 132 | # Computer-use is an agentic harness, not a chat id. | COMMENT |
| MEDIUM | studio/backend/tests/test_model_picker_regression.py | 67 | "unsloth/bge-small-en-v1.5", # the RAG embedder repo | CODE |
| MEDIUM | studio/backend/tests/test_mcp_images.py | 1469 | # context window rather than to a provider's per-request image count. | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_ui_stream_events_gate.py | 312 | # build_synthetic_search_exchange brackets a RAG autoinjection with {"type": "status"} | COMMENT |
| MEDIUM | studio/backend/tests/test_permission_mode.py | 3175 | # only select always-safe tools (web_search / RAG) needs no stream and must not | COMMENT |
| MEDIUM | studio/backend/tests/test_parallel_slots_per_load.py | 384 | # --parallel N shrinks every context window. | COMMENT |
| MEDIUM | studio/backend/tests/test_gguf_tool_non_streaming.py | 28 | # The agentic loop runs one tool, then the model answers. Event shapes | COMMENT |
| 71 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | unsloth-cli.py | 0 | below is an instruction that describes a task, paired with an input that provides further context. write a response that | STRING |
| HIGH | studio/backend/utils/datasets/chat_templates.py | 0 | below is an instruction that describes a task, paired with an input that provides further context. write a response that | STRING |
| HIGH | …language_models/test_merge_model_perplexity_mistral.py | 0 | below is an instruction that describes a task, paired with an input that provides further context. write a response that | STRING |
| HIGH | …nguage_models/test_merged_model_perplexity_qwen_2_5.py | 0 | below is an instruction that describes a task, paired with an input that provides further context. write a response that | STRING |
| HIGH | studio/install_llama_prebuilt.py | 0 | true if a hipinfo outside the venv is on path. shutil.which returns only the first hit, so the venv hipinfo could shadow | STRING |
| HIGH | studio/install_python_stack.py | 0 | true if a hipinfo outside the venv is on path. shutil.which returns only the first hit, so the venv hipinfo could shadow | STRING |
| HIGH | studio/backend/utils/hardware/amd.py | 0 | true if a hipinfo outside the venv is on path. shutil.which returns only the first hit, so the venv hipinfo could shadow | STRING |
| HIGH | studio/backend/core/training/worker.py | 0 | activate the correct transformers version before any ml imports. | STRING |
| HIGH | studio/backend/core/inference/worker.py | 0 | activate the correct transformers version before any ml imports. | STRING |
| HIGH | studio/backend/core/export/worker.py | 0 | activate the correct transformers version before any ml imports. | STRING |
| HIGH | studio/backend/core/inference/stt_ggml_sidecar.py | 0 | cancel startup only when it belongs to this transcription. | STRING |
| HIGH | studio/backend/core/inference/stt_mtmd_sidecar.py | 0 | cancel startup only when it belongs to this transcription. | STRING |
| HIGH | studio/backend/core/inference/stt_sidecar.py | 0 | cancel startup only when it belongs to this transcription. | STRING |
| HIGH | studio/backend/core/inference/stt_sidecar.py | 0 | open ``source`` for reading with undecodable metadata ignored. pyav 19 removed ``metadata_errors`` from ``av.open``, so | STRING |
| HIGH | studio/backend/utils/datasets/audio_decode.py | 0 | open ``source`` for reading with undecodable metadata ignored. pyav 19 removed ``metadata_errors`` from ``av.open``, so | STRING |
| HIGH | unsloth/import_fixes.py | 0 | open ``source`` for reading with undecodable metadata ignored. pyav 19 removed ``metadata_errors`` from ``av.open``, so | STRING |
| HIGH | studio/backend/tests/test_install_resolve_prebuilt.py | 0 | stand-in for the digest github publishes; a fixture without one selects nothing. | STRING |
| HIGH | tests/studio/install/test_selection_logic.py | 0 | stand-in for the digest github publishes; a fixture without one selects nothing. | STRING |
| HIGH | …tudio/install/test_llama_kind_gate_matches_selector.py | 0 | stand-in for the digest github publishes; a fixture without one selects nothing. | STRING |
| HIGH | tests/studio/install/test_macos_version_compat.py | 0 | stand-in for the digest github publishes; a fixture without one selects nothing. | STRING |
| HIGH | studio/backend/tests/test_conversation_archive.py | 0 | an assistant turn whose only content is one function tool call. | STRING |
| HIGH | studio/backend/tests/test_gemini_provider.py | 0 | an assistant turn whose only content is one function tool call. | STRING |
| HIGH | …o/backend/tests/test_control_markup_neutralize_7066.py | 0 | an assistant turn whose only content is one function tool call. | STRING |
| HIGH | …io/backend/tests/test_amd_smi_inventory_matches_hip.py | 0 | amd-smi ``metric`` output for (amd-smi gpu id, used mib, total mib) triples. | STRING |
| HIGH | …end/tests/test_rocm_hip_unreachable_defers_to_torch.py | 0 | amd-smi ``metric`` output for (amd-smi gpu id, used mib, total mib) triples. | STRING |
| HIGH | …o/backend/tests/test_amd_smi_hip_index_and_coverage.py | 0 | amd-smi ``metric`` output for (amd-smi gpu id, used mib, total mib) triples. | STRING |
| HIGH | …io/backend/tests/test_rocm_stacked_visibility_masks.py | 0 | amd-smi ``metric`` output for (amd-smi gpu id, used mib, total mib) triples. | STRING |
| HIGH | …io/backend/tests/test_amd_smi_inventory_matches_hip.py | 0 | declare hip's own inventory: how many devices it opens, and the total memory it reports per physical id. empty totals me | STRING |
| HIGH | …o/backend/tests/test_amd_smi_hip_index_and_coverage.py | 0 | declare hip's own inventory: how many devices it opens, and the total memory it reports per physical id. empty totals me | STRING |
| HIGH | …o/backend/tests/test_rocm_vram_probe_no_hip_context.py | 0 | declare hip's own inventory: how many devices it opens, and the total memory it reports per physical id. empty totals me | STRING |
| HIGH | studio/backend/tests/test_studio_tool_loop.py | 0 | record every execute_tool call and return a canned result. | STRING |
| HIGH | studio/backend/tests/test_external_tool_stream_abuse.py | 0 | record every execute_tool call and return a canned result. | STRING |
| HIGH | studio/backend/tests/test_external_tool_edge_cases.py | 0 | record every execute_tool call and return a canned result. | STRING |
| HIGH | studio/backend/tests/test_mcp_stdio_sessions.py | 0 | wait out an asynchronous close. a discarded session is closed by the cleanup worker rather than on the request thread, s | STRING |
| HIGH | studio/backend/tests/test_mcp_http_sessions.py | 0 | wait out an asynchronous close. a discarded session is closed by the cleanup worker rather than on the request thread, s | STRING |
| HIGH | studio/backend/tests/test_mcp_session_resources.py | 0 | wait out an asynchronous close. a discarded session is closed by the cleanup worker rather than on the request thread, s | STRING |
| HIGH | …kend/tests/test_provider_max_output_tokens_contract.py | 0 | create table if not exists llm_providers ( id text not null primary key, provider_type text not null, display_name text | STRING |
| HIGH | studio/backend/tests/test_providers_db_models.py | 0 | create table if not exists llm_providers ( id text not null primary key, provider_type text not null, display_name text | STRING |
| HIGH | studio/backend/storage/providers_db.py | 0 | create table if not exists llm_providers ( id text not null primary key, provider_type text not null, display_name text | STRING |
| HIGH | studio/backend/tests/test_external_tool_stream_abuse.py | 0 | replays scripted turns; records what the loop asked for each time. | STRING |
| HIGH | …ckend/tests/test_external_tool_truncated_and_budget.py | 0 | replays scripted turns; records what the loop asked for each time. | STRING |
| HIGH | studio/backend/tests/test_external_tool_edge_cases.py | 0 | replays scripted turns; records what the loop asked for each time. | STRING |
| HIGH | studio/backend/tests/test_stt_sidecar.py | 0 | a server-wide default must not decide the outcome of these tests. placement here is asserted against no opinion, so a ho | STRING |
| HIGH | studio/backend/tests/test_audio_device_preference.py | 0 | a server-wide default must not decide the outcome of these tests. placement here is asserted against no opinion, so a ho | STRING |
| HIGH | studio/backend/tests/test_audio_device_guards.py | 0 | a server-wide default must not decide the outcome of these tests. placement here is asserted against no opinion, so a ho | STRING |
| HIGH | studio/backend/utils/xet_notice_settings.py | 0 | insert into chat_settings (key, value_json, updated_at) values (?, ?, ?) on conflict(key) do update set value_json = exc | STRING |
| HIGH | studio/backend/utils/chat_preferences_settings.py | 0 | insert into chat_settings (key, value_json, updated_at) values (?, ?, ?) on conflict(key) do update set value_json = exc | STRING |
| HIGH | studio/backend/storage/studio_db.py | 0 | insert into chat_settings (key, value_json, updated_at) values (?, ?, ?) on conflict(key) do update set value_json = exc | STRING |
| HIGH | studio/backend/utils/whisper_cpp_freshness.py | 0 | asset name -> size (bytes) for the newest published release of `repo`, selected exactly like fetch_latest_release_tag. n | STRING |
| HIGH | studio/backend/utils/llama_cpp_freshness.py | 0 | asset name -> size (bytes) for the newest published release of `repo`, selected exactly like fetch_latest_release_tag. n | STRING |
| HIGH | studio/backend/utils/prebuilt/freshness_flow.py | 0 | asset name -> size (bytes) for the newest published release of `repo`, selected exactly like fetch_latest_release_tag. n | STRING |
| HIGH | studio/backend/utils/whisper_cpp_freshness.py | 0 | newest-release asset sizes for `repo`, memoized (24h ttl). none when offline and never fetched. in-memory only, so a res | STRING |
| HIGH | studio/backend/utils/llama_cpp_freshness.py | 0 | newest-release asset sizes for `repo`, memoized (24h ttl). none when offline and never fetched. in-memory only, so a res | STRING |
| HIGH | studio/backend/utils/prebuilt/freshness_flow.py | 0 | newest-release asset sizes for `repo`, memoized (24h ttl). none when offline and never fetched. in-memory only, so a res | STRING |
| HIGH | studio/backend/utils/llama_cpp_update.py | 0 | status payload for a local-link install: unmanaged, no update offered. | STRING |
| HIGH | studio/backend/utils/whisper_cpp_update.py | 0 | status payload for a local-link install: unmanaged, no update offered. | STRING |
| HIGH | studio/backend/utils/prebuilt/update_flow.py | 0 | status payload for a local-link install: unmanaged, no update offered. | STRING |
| HIGH | studio/backend/storage/studio_db.py | 0 | insert into chat_messages (id, thread_id, parent_id, role, content_json, metadata_json, created_at) values (?, ?, ?, 'as | STRING |
| HIGH | studio/backend/storage/chat_generation_runs_db.py | 0 | insert into chat_messages (id, thread_id, parent_id, role, content_json, metadata_json, created_at) values (?, ?, ?, 'as | STRING |
| HIGH | studio/backend/storage/research_runs_db.py | 0 | insert into chat_messages (id, thread_id, parent_id, role, content_json, metadata_json, created_at) values (?, ?, ?, 'as | STRING |
| 18 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | studio/install_manifest.py | 792 | def set_no_torch_marker(no_torch: bool, root: Optional[Path] = None) -> None: | CODE |
| LOW⚡ | studio/backend/cloudflare_tunnel.py | 709 | def set_studio_tunnel_runtime_callback(callback: Optional[Callable[[bool], None]]) -> None: | CODE |
| LOW⚡ | studio/backend/cloudflare_tunnel.py | 742 | def _set_tunnel_url_locked(url: Optional[str]) -> None: | CODE |
| LOW⚡ | studio/backend/cloudflare_tunnel.py | 752 | def set_studio_tunnel_url_callback(callback: Optional[Callable[[Optional[str]], None]]) -> None: | CODE |
| LOW | studio/backend/cloudflare_tunnel.py | 632 | def set_on_exit(self, callback: Callable[["CloudflareTunnel"], None]) -> None: | CODE |
| LOW | studio/backend/cloudflare_tunnel.py | 677 | def _set_studio_tunnel_runtime_active(tunnel: CloudflareTunnel, active: bool) -> None: | CODE |
| LOW | studio/backend/cloudflare_tunnel.py | 771 | def _set_failed(generation: int, owner: str, port: int, error: str) -> None: | CODE |
| LOW | studio/backend/cloudflare_tunnel.py | 818 | def _set_online_locked(url: str) -> None: | CODE |
| LOW | studio/backend/loggers/__init__.py | 6 | __all__ = ["get_logger", "install_uvicorn_duplicate_exception_filter"] | CODE |
| LOW | studio/backend/core/__init__.py | 20 | __all__ = [ | CODE |
| LOW | studio/backend/core/_msvc_env.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/data_recipe/__init__.py | 8 | __all__ = ["JobManager", "get_job_manager"] | CODE |
| LOW | studio/backend/core/data_recipe/jobs/__init__.py | 6 | __all__ = ["JobManager", "get_job_manager"] | CODE |
| LOW | studio/backend/core/training/diffusion_clip_formats.py | 23 | __all__ = ["CLIP_EXTS"] | CODE |
| LOW | studio/backend/core/training/__init__.py | 8 | __all__ = [ | CODE |
| LOW | studio/backend/core/training/s3_dataset.py | 40 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/store.py | 459 | def set_archive_ordinal(conn: sqlite3.Connection, document_id: str, ordinal: int) -> None: | CODE |
| LOW | studio/backend/core/rag/ingestion.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/captioner.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/embed_llama_server.py | 48 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/pdf_ocr.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/__init__.py | 7 | __all__ = [ | CODE |
| LOW | studio/backend/core/rag/parsers.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/conversation_archive.py | 32 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/embeddings.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/retrieval.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/job_leases.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/folder_sync.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/rag/folder_sync.py | 1284 | def _set_job(job_id: str, **values) -> None: | CODE |
| LOW | studio/backend/core/rag/folder_sync.py | 1359 | def _update_mapping_metadata(folder_id: str, rel: str, metadata: dict, content_hash: str) -> None: | CODE |
| LOW | studio/backend/core/rag/folder_sync.py | 1631 | def update_progress() -> None: | CODE |
| LOW | studio/backend/core/inference/diffusion_memory.py | 373 | def _set_buffer(module: Any, name: str, tensor: Any) -> None: | CODE |
| LOW | studio/backend/core/inference/mxc_host_prep_job.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/memory_contract.py | 36 | __all__ = [ | CODE |
| LOW | studio/backend/core/inference/diffusion_attention.py | 2160 | def _set_hunyuan_null_mask(module: Any, enabled: bool) -> None: | CODE |
| LOW⚡ | studio/backend/core/inference/diffusion_cuda_graph.py | 1954 | def set_bypass(handles: Any, on: bool) -> None: | CODE |
| LOW | studio/backend/core/inference/diffusion_cuda_graph.py | 2289 | def _set_reason(pipe: Any, reason: str) -> None: | CODE |
| LOW | studio/backend/core/inference/api_monitor.py | 31 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/api_monitor.py | 364 | def set_terminal_callback(self, callback: Optional[TerminalCallback]) -> None: | CODE |
| LOW | studio/backend/core/inference/api_monitor.py | 501 | def set_progress(self, entry_id: Optional[str], progress: Optional[float]) -> None: | CODE |
| LOW | studio/backend/core/inference/api_monitor.py | 553 | def set_running_phase(self, entry_id: Optional[str], phase: Optional[str]) -> None: | CODE |
| LOW | studio/backend/core/inference/api_monitor.py | 775 | def set_reply(self, entry_id: Optional[str], text: str) -> None: | CODE |
| LOW | studio/backend/core/inference/api_monitor.py | 838 | def _settle_stop_reason_locked(entry: ApiMonitorEntry, completed: bool) -> None: | CODE |
| LOW | studio/backend/core/inference/chat_template_helpers.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/llama_video_input.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/skills.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/llama_server_args.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | studio/backend/core/inference/llama_keepwarm.py | 395 | def set_current_response_scope(scope) -> None: | CODE |
| LOW | studio/backend/core/inference/llama_keepwarm.py | 538 | def _set_last_unloaded(value) -> None: | CODE |
| LOW | studio/backend/core/inference/llama_keepwarm.py | 559 | def _set_kv_resume(value) -> None: | CODE |
| LOW | studio/backend/core/inference/media_locality.py | 535 | __all__ = [ | CODE |
| LOW | studio/backend/core/inference/sd_cpp_server.py | 70 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/diffusion_preview.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/sandbox_setup_job.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/mxc_read_grants.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/lemonade_server.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | studio/backend/core/inference/__init__.py | 26 | __all__ = [ | CODE |
| LOW | studio/backend/core/inference/media_switch_locks.py | 106 | __all__ = [ | CODE |
| LOW | studio/backend/core/inference/media_model_index.py | 523 | __all__ = [ | CODE |
| LOW | …io/backend/core/inference/diffusion_torchao_patches.py | 26 | logger = logging.getLogger(__name__) | CODE |
| 163 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | studio/install_whisper_prebuilt.py | 2019 | CODE | |
| LOW | studio/install_manifest.py | 645 | CODE | |
| LOW | studio/install_manifest.py | 1415 | CODE | |
| LOW | studio/backend/run.py | 2428 | CODE | |
| LOW | studio/backend/core/library.py | 87 | CODE | |
| LOW | studio/backend/core/research_runs.py | 1700 | CODE | |
| LOW | studio/backend/core/training/diffusion_checkpoint.py | 751 | CODE | |
| LOW | studio/backend/core/training/trainer.py | 393 | CODE | |
| LOW | studio/backend/core/training/trainer.py | 984 | CODE | |
| LOW | studio/backend/core/training/trainer.py | 1458 | CODE | |
| LOW | studio/backend/core/training/trainer.py | 2796 | CODE | |
| LOW | studio/backend/core/training/trainer.py | 3618 | CODE | |
| LOW | studio/backend/core/training/trainer.py | 1716 | CODE | |
| LOW | studio/backend/core/training/training.py | 768 | CODE | |
| LOW | studio/backend/core/training/training.py | 828 | CODE | |
| LOW | studio/backend/core/training/training.py | 865 | CODE | |
| LOW | studio/backend/core/rag/store.py | 250 | CODE | |
| LOW | studio/backend/core/rag/ingestion.py | 481 | CODE | |
| LOW | studio/backend/core/rag/tool.py | 224 | CODE | |
| LOW | studio/backend/core/inference/audio_cpp_backend.py | 463 | CODE | |
| LOW | studio/backend/core/inference/diffusion_prequant.py | 1719 | CODE | |
| LOW | studio/backend/core/inference/diffusion_memory.py | 4521 | CODE | |
| LOW | studio/backend/core/inference/diffusion_memory.py | 4662 | CODE | |
| LOW | studio/backend/core/inference/diffusion_memory.py | 4697 | CODE | |
| LOW | studio/backend/core/inference/diffusion_te_prequant.py | 504 | CODE | |
| LOW | studio/backend/core/inference/memory_contract.py | 83 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 2475 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 3406 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 4032 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 4461 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 4662 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 5812 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 8458 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 9340 | CODE | |
| LOW | studio/backend/core/inference/diffusion.py | 10219 | CODE | |
| LOW | …/backend/core/inference/diffusion_denoiser_prequant.py | 78 | CODE | |
| LOW | studio/backend/core/inference/checkpoint.py | 474 | CODE | |
| LOW | studio/backend/core/inference/llama_server_args.py | 926 | CODE | |
| LOW | studio/backend/core/inference/llama_server_args.py | 1389 | CODE | |
| LOW | studio/backend/core/inference/mlx_inference.py | 4624 | CODE | |
| LOW | studio/backend/core/inference/mlx_inference.py | 5277 | CODE | |
| LOW | studio/backend/core/inference/mlx_inference.py | 5430 | CODE | |
| LOW | studio/backend/core/inference/mlx_inference.py | 5743 | CODE | |
| LOW | studio/backend/core/inference/mlx_inference.py | 6010 | CODE | |
| LOW | studio/backend/core/inference/mlx_inference.py | 6116 | CODE | |
| LOW | studio/backend/core/inference/skill_mentions.py | 134 | CODE | |
| LOW | studio/backend/core/inference/external_provider.py | 1574 | CODE | |
| LOW | studio/backend/core/inference/external_provider.py | 2477 | CODE | |
| LOW | studio/backend/core/inference/external_provider.py | 4015 | CODE | |
| LOW | studio/backend/core/inference/external_provider.py | 5612 | CODE | |
| LOW | studio/backend/core/inference/diffusion_step_skip.py | 316 | CODE | |
| LOW | studio/backend/core/inference/sd_cpp_backend.py | 2737 | CODE | |
| LOW | studio/backend/core/inference/sd_cpp_backend.py | 2881 | CODE | |
| LOW | studio/backend/core/inference/sd_cpp_backend.py | 3792 | CODE | |
| LOW | studio/backend/core/inference/diffusion_comfy_quant.py | 271 | CODE | |
| LOW | studio/backend/core/inference/diffusion_comfy_quant.py | 896 | CODE | |
| LOW | studio/backend/core/inference/orchestrator.py | 1399 | CODE | |
| LOW | studio/backend/core/inference/orchestrator.py | 1685 | CODE | |
| LOW | studio/backend/core/inference/orchestrator.py | 1999 | CODE | |
| LOW | studio/backend/core/inference/orchestrator.py | 2759 | CODE | |
| 229 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 48 | "Replace <your-api-key> with the key from your dashboard.", | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 56 | "<your-api-key>", | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 58 | " <your-api-key>", | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 65 | render("Set the key:\n\n<your-api-key>\n\nThen restart."), | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 66 | /<p><your-api-key><\/p>/, | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 69 | ["<div>Use <your-api-key> here</div>", "Use <your-api-key> here"], | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 76 | "<details>\n<summary>Setup</summary>\nReplace <your-api-key> in /home/<user>/.env\n</details>", | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 77 | "Replace <your-api-key> in /home/<user>/.env", | CODE |
| HIGH⚡ | studio/frontend/tests/markdown-literal-tags.test.ts | 82 | assert.doesNotMatch(html, /<(your-api-key|code_snippet)/); | CODE |
| HIGH | studio/frontend/tests/markdown-literal-tags.test.ts | 112 | ["<center>Use <your-api-key> here</center>", "Use <your-api-key> here"], | CODE |
| HIGH | studio/frontend/tests/markdown-literal-tags.test.ts | 231 | value: "<your-api-key>\nwhere the key comes from", | CODE |
| HIGH | …o/frontend/tests/markdown-preview-literal-tags.test.ts | 84 | "Replace <placeholder> with your key.\n\nVec<T> holds values of type T. Option<Box<T>> too.\n\n<your-api-key>", | CODE |
| HIGH | …o/frontend/tests/markdown-preview-literal-tags.test.ts | 92 | assert.match(html, /<p><your-api-key><\/p>/, name); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | studio/frontend/tests/settings-search.test.ts | 66 | en.settings.resources.modelMemory.modelMemoryKeywords.includes(term), | CODE |
| CRITICAL | studio/frontend/tests/cache-rows-model-folder.test.ts | 61 | en.settings.resources.storage.caches.safety.includes("Downloaded models"), | CODE |
| CRITICAL | studio/backend/assets/docs_ui/redoc.standalone.js | 41 | `;class Aa extends n.PureComponent{render(){return n.createElement("div",{style:{textAlign:"center"}},n.createElement(_a | CODE |
| CRITICAL | unsloth/save.py | 1272 | state_dict["model.embed_tokens.weight"] = internal_model.model.embed_tokens.weight.data.to( | CODE |
| CRITICAL | unsloth/kernels/moe/grouped_gemm/kernels/tuning.py | 40 | properties = triton.runtime.driver.active.utils.get_device_properties( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | studio/backend/tests/test_cached_gguf_routes.py | 2297 | CODE | |
| MEDIUM | …dio/backend/tests/test_truststore_concurrent_policy.py | 192 | CODE | |
| MEDIUM | studio/backend/tests/test_openai_codex_subscription.py | 2983 | CODE | |
| MEDIUM | studio/backend/tests/test_credential_routes.py | 504 | CODE | |
| MEDIUM | studio/backend/tests/test_active_generations.py | 2029 | CODE | |
| MEDIUM | studio/backend/tests/test_stream_errors.py | 187 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 150 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 178 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 197 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 216 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 237 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 262 | CODE | |
| MEDIUM | studio/backend/tests/test_mlx_inference_backend.py | 289 | CODE | |
| MEDIUM | …/studio/install/test_install_whisper_prebuilt_logic.py | 380 | CODE | |
| MEDIUM | tests/studio/install/test_prebuilt_core.py | 1085 | CODE | |
| MEDIUM | unsloth/kernels/fast_lora.py | 677 | CODE | |
| MEDIUM | unsloth/kernels/fast_lora.py | 678 | CODE | |
| MEDIUM | unsloth/kernels/fast_lora.py | 680 | CODE | |
| MEDIUM | unsloth/kernels/fast_lora.py | 742 | CODE | |
| MEDIUM | unsloth/kernels/moe/autotune_cache.py | 358 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | studio/backend/core/training/training.py | 1990 | # Create the DB run row before the pump consumes events, so it appears in history during model | COMMENT |
| MEDIUM | studio/backend/core/training/training.py | 2302 | # Create the row if a start-time create failed; skipped while the pump is mid-create, whose create- | COMMENT |
| MEDIUM | studio/backend/tests/test_permission_mode.py | 4370 | # Creating an archive writes it; only extracting reads it. | COMMENT |
| MEDIUM | studio/backend/tests/test_studio_auth_guard.py | 1730 | # Defining a function does not run it, so `helper() { cd ../..; }; cat auth/config.json` reads | COMMENT |
| MEDIUM | studio/backend/utils/hardware/amd.py | 1793 | # Creating the group only gives the numeric owner a name; the account is | COMMENT |
| MEDIUM | tests/security/test_lint_workflow_triggers.py | 221 | # Defining a function is not calling it. | COMMENT |
| MEDIUM | tests/sh/test_setup_desktop_backend_version_fastpath.sh | 144 | # Create a mock venv that runs Python without site-packages, exercising setup's fallback parser. | COMMENT |
| MEDIUM | tests/sh/test_mac_intel_compat.sh | 144 | # Create a mock uname that returns Darwin | COMMENT |
| MEDIUM | tests/sh/test_mac_intel_compat.sh | 259 | # Create a mock uv that logs all calls instead of running them | COMMENT |
| MEDIUM | unsloth/kernels/moe/grouped_gemm/kernels/backward.py | 115 | # Define the descriptor inside the loop to predicate the store along M. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …dio/frontend/tests/profile-login-name-spelling.test.ts | 82 | const placeholders = jsxAttributeTexts(file, "placeholder"); | CODE |
| LOW | studio/frontend/public/reload-snapshot.js | 404 | var sensitiveAttributes = ["title", "aria-label", "alt", "placeholder"]; | CODE |
| LOW | …d/src/features/settings/stores/voice-settings-store.ts | 535 | * matching case-insensitively on word boundaries ("jane doe" -> "Jane Doe"). | COMMENT |
| LOW | studio/frontend/src/i18n/locales/en.ts | 1489 | entryPlaceholder: "Jane Doe", | CODE |
| LOW | studio/frontend/src/i18n/locales/sv.ts | 1579 | entryPlaceholder: "Jane Doe", | CODE |
| LOW | studio/backend/tests/test_cached_gguf_routes.py | 2513 | gguf.write_bytes(b"placeholder") | CODE |
| LOW⚡ | studio/backend/tests/test_rag_parsing.py | 487 | f"<w:p>{_r('Client: ')}<w:sdt><w:sdtPr/><w:sdtContent>{_r('Acme Corp')}</w:sdtContent></w:sdt></w:p>", | CODE |
| LOW | studio/backend/tests/test_safetensors_tool_loop.py | 1465 | assert args == {"name": "John Doe", "age": 30, "active": True, "score": 95.5} | CODE |
| LOW | studio/backend/tests/test_diffusion_training.py | 2108 | assert "placeholder" in msg | CODE |
| LOW | studio/backend/tests/test_openai_tool_passthrough.py | 2477 | {"role": "user", "content": [{"type": "text", "text": "placeholder"}]}, | CODE |
| LOW⚡ | studio/backend/tests/test_openai_auto_download.py | 1208 | assert "placeholder" in detail | CODE |
| LOW⚡ | studio/backend/tests/test_web_fetch_extraction.py | 3008 | assert "Jane Doe" in out | CODE |
| LOW | studio/backend/assets/docs_ui/redoc.standalone.js | 41 | `;class Aa extends n.PureComponent{render(){return n.createElement("div",{style:{textAlign:"center"}},n.createElement(_a | CODE |
| LOW | studio/backend/assets/docs_ui/redoc.standalone.js | 752 | `;var Md=Object.defineProperty,zd=Object.defineProperties,Fd=Object.getOwnPropertyDescriptors,Ud=Object.getOwnPropertySy | CODE |
| LOW⚡ | studio/backend/routes/browser.py | 836 | return value || node.getAttribute("placeholder") || node.getAttribute("aria-label") || ""; | CODE |
| LOW | studio/backend/hub/services/datasets/local_options.py | 274 | "dummy_data.zip", | CODE |
| LOW⚡ | tests/test_torchao_torch_symbol_skew.py | 84 | assert "placeholder" in repr(ph) | CODE |
| LOW⚡ | tests/test_torchao_aten_grouped_mm.py | 154 | with pytest.raises(RuntimeError, match = "placeholder"): | CODE |
| LOW⚡ | tests/test_installer_system32_guard.py | 529 | @pytest.mark.parametrize("profile_name", ["me", "Jane Doe", "O'Brien"]) | CODE |
| LOW | tests/test_installer_system32_guard.py | 503 | "Jane Doe", # space: `cd C:\Users\Jane Doe` binds 'Doe' as a second argument | CODE |
| LOW | tests/studio/playwright_code_block_flicker.py | 326 | f"{'engine':10} {'variant':12} {'collapses':>10} {'placeholder':>12} {'dips':>6} " | CODE |
| LOW⚡ | tests/python/test_virustotal_scan.py | 79 | "fake-key", | CODE |
| LOW⚡ | tests/python/test_virustotal_scan.py | 214 | assert headers["x-apikey"] == "fake-key" | CODE |
| LOW⚡ | tests/python/test_virustotal_scan.py | 215 | assert "fake-key" not in url | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker/unsloth_nb_view.py | 10 | # Usage: | COMMENT |
| LOW | docker/test_locally-rocm.sh | 11 | # Usage: | COMMENT |
| LOW | docker/build.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/build_whisper_cpp.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/install_gemma4_mlx.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/install_qwen3_6_mlx.sh | 10 | # Usage: | COMMENT |
| LOW | .github/scripts/assert-prompt-cache.sh | 32 | # Usage: | COMMENT |
| LOW | .github/scripts/agent-guides-drive.sh | 16 | # Usage: | COMMENT |
| LOW | .github/scripts/serve-unsloth-run.sh | 9 | # Usage: | COMMENT |
| LOW | .github/scripts/parity-install-side.sh | 6 | # Usage: | COMMENT |
| LOW | .github/scripts/clean-machine-env.sh | 19 | # Usage: | COMMENT |
| LOW | .github/scripts/boot-studio-api-only.sh | 6 | # Usage: | COMMENT |
| LOW | .github/scripts/wait-for-health.sh | 6 | # Usage: | COMMENT |
| LOW | .github/scripts/parity-find-unsloth.sh | 5 | # Usage: | COMMENT |
| LOW | .github/scripts/retry-with-apt-lock.sh | 53 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | studio/frontend/tests/streaming-render-schedule.test.ts | 889 | const line = "I cannot provide that information.\n\n"; | CODE |
| MEDIUM | …icker/components/model-selector/model-catalog.check.ts | 611 | // to the QLoRA estimator, which reads a pipeline as a language model (5B says 5.9 GB where Wan 2.2 | COMMENT |
| MEDIUM | …res/model-picker/components/model-selector/pickers.tsx | 2643 | // a model and chat loads it as a language model. | COMMENT |
| MEDIUM⚡ | studio/backend/tests/test_safetensors_tool_loop.py | 3748 | "The summary is ready, please let me know if you need anything else", | CODE |
| MEDIUM⚡ | studio/backend/tests/test_safetensors_tool_loop.py | 3749 | "The summary is ready. Please let me know if you need anything else!", | CODE |
| MEDIUM⚡ | studio/backend/tests/test_safetensors_tool_loop.py | 4630 | "</function>\n\nLet me know if you need anything else.", | CODE |
| MEDIUM | studio/backend/tests/test_safetensors_tool_loop.py | 3633 | "Let me know if you need anything else.", | CODE |
| LOW | unsloth/kernels/cross_entropy_loss.py | 372 | losses.masked_fill_(labels == -100, 0) # Don't forget to mask padding out! | CODE |
| LOW | unsloth/kernels/fast_lora.py | 85 | Don't forget to see our blog post for more details! | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …nd/src/features/settings/components/usage-examples.tsx | 292 | print(chunk.choices[0].delta.content or "", end="")` | CODE |
| HIGH | …nd/src/features/settings/components/usage-examples.tsx | 294 | print(chunk.choices[0].delta.content or "", end="")`; | CODE |
| HIGH | …rontend/src/features/chat/lib/resident-config-match.ts | 148 | * `LlamaCppBackend._runtime_matches_intent` that return False to force a repair. The rest are | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …io/backend/tests/test_gguf_xet_fallback_integration.py | 144 | def helper( | CODE |
| LOW | studio/backend/tests/test_export_offline_window.py | 29 | def handle_request(self, request): | CODE |
| LOW⚡ | studio/backend/tests/test_studio_auth_guard.py | 1624 | "def helper():\n" | CODE |
| LOW⚡ | studio/backend/tests/test_studio_auth_guard.py | 1633 | 'import os\ndef helper():\n os.chdir("../..")\nhelper()\n' | CODE |
| LOW | tests/test_dataclass_default_backfill.py | 65 | def helper(self): | CODE |
| LOW | tests/test_nvidia_smi_torch_mismatch_hint.py | 25 | def helper(): | CODE |
| LOW⚡ | tests/kaggle/test_t4_payload_assertions.py | 158 | failures = canary_failures({"run_index": 1, "generated": "def my_function():"}, require = True) | CODE |
| LOW | tests/kaggle/t4_smoke/run_t4_smoke.py | 1879 | # '#1\ndef my_function():...'. | COMMENT |
| LOW | tests/python/test_grpo_update_sampling_params.py | 75 | def helper(): | CODE |
| LOW | tests/python/test_posix_only_marks_import_on_windows.py | 355 | # are evaluated at the `def`, so `def helper(uid: os.geteuid()): ...` breaks | COMMENT |
| LOW⚡ | tests/python/test_posix_only_marks_import_on_windows.py | 565 | tree = ast.parse("import os\ndef helper(uid = os.geteuid()):\n return uid\n") | CODE |
| LOW⚡ | tests/python/test_posix_only_marks_import_on_windows.py | 621 | body = "import os\ndef helper(uid: os.geteuid() = 1) -> os.geteuid():\n return uid\n" | CODE |
| LOW⚡ | tests/python/test_posix_only_marks_import_on_windows.py | 626 | annotation_only = "import os\ndef helper(uid: os.geteuid()):\n return uid\n" | CODE |
| LOW | …sts/security/test_security_suite_stays_import_light.py | 720 | "def helper():\n" | CODE |
| LOW | tests/security/test_scan_packages.py | 2709 | "def helper():\n" | CODE |
| LOW | scripts/lint_duplicate_definitions.py | 453 | "import types as t\n\n\ndef helper():\n import typing as t\n return t\n\n\n" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | install.sh | 1512 | # Step 1: Try installing without sudo (works when already root) | COMMENT |
| LOW⚡ | install.sh | 1516 | # Step 2: Check which packages are still missing | COMMENT |
| LOW | install.sh | 1540 | # Step 3: Escalate -- need elevated permissions for remaining packages | COMMENT |
| LOW | .github/workflows/docker-credential-probe.yml | 51 | # Step 1: does the token authenticate at all? | COMMENT |
| LOW | .github/workflows/docker-credential-probe.yml | 62 | # Step 2: authentication is not authorisation. Only a real push proves write | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | install.sh | 1512 | # Step 1: Try installing without sudo (works when already root) | COMMENT |
| LOW⚡ | install.sh | 1516 | # Step 2: Check which packages are still missing | COMMENT |
| LOW | install.sh | 1540 | # Step 3: Escalate -- need elevated permissions for remaining packages | COMMENT |
| LOW | .github/workflows/docker-credential-probe.yml | 51 | # Step 1: does the token authenticate at all? | COMMENT |
| LOW | .github/workflows/docker-credential-probe.yml | 62 | # Step 2: authentication is not authorisation. Only a real push proves write | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | studio/backend/tests/test_mlx_inference_backend.py | 6350 | # Nothing that runs to ask: priced as requested, as the load would try it. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | unsloth/chat_templates.py | 2820 | # Check if system part is the same! | COMMENT |
| LOW | unsloth/kernels/moe/grouped_gemm/kernels/forward.py | 105 | # Check if L2 cache reuse for this order is optimal | COMMENT |
| LOW | unsloth/models/loader_utils.py | 3485 | # Check if torchao has pytorch/ao#3158, released in 0.15.0. | COMMENT |
| LOW | unsloth/models/llama.py | 2838 | # Check if RoPE Scaling is even allowed | COMMENT |
| LOW | unsloth/models/loader.py | 2327 | # Set norms to float32 since they get upcasted anyway (gemma-3, gemma-3n); Granite-4 rms norms are stored as | COMMENT |