* Studio: serve Swagger UI and ReDoc from this origin, not a CDN
FastAPI's built-in /docs and /redoc load ~2.3 MB of JavaScript from cdn.jsdelivr.net and
start Swagger with an inline script, so #8042 had to add 'unsafe-inline' and that CDN to
script-src for those paths. Those pages share an origin with the frontend, and localStorage
is origin-scoped rather than path-scoped, so anything executing there can read the access
and refresh tokens session.ts stores and call the API as that user.
Vendor the pinned bundles under backend/assets/docs_ui and re-register both pages on
FastAPI's own paths against them. Swagger's inline init runs off the per-response nonce
main.py already plumbs for the bootstrap script, so script-src stays 'self'. The docs CSP
branch now only relaxes style-src, font-src and worker-src, none of which execute script.
The pages look and behave exactly as before, and now work with no network.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Match the Swagger init tag by what follows it, not by surrounding whitespace
fastapi is unpinned, so a release that reflows the docs template or drops the comment
above the init script would miss an exact-string marker and 500 the page. Anchor on the
SwaggerUIBundle call instead.
* Docs pages: honor root_path, and ship Swagger UI's NOTICE
FastAPI's built-in docs routes prefix every URL they emit with the ASGI root_path;
the replacements did not, so behind a path-stripping proxy the schema, bundles and
OAuth redirect escaped the mapping. Apache-2.0 section 4(d) also requires the NOTICE
file to travel with a redistributed Swagger UI, along with the extracted third-party
banners its bundle names.
* Keep the vendored docs bundles out of git's CRLF conversion
The Windows cross-platform run failed the digest check on every text file in
assets/docs_ui (the PNG was fine), which is core.autocrlf=true rewriting them on
checkout. That both breaks the manifest and means a Windows install serves bytes
that are not the reviewed release.
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Replace standalone Studio wording with Unsloth
Replace the single word Studio with Unsloth wherever it is used as
shorthand for Unsloth Studio in docs, CLI output, UI strings, i18n
locales, workflow display names, comments and docstrings.
Kept unchanged: the full name Unsloth Studio, third party product
names (LM Studio, Visual Studio, Mac Studio), feature names
(Recipe Studio, Fine-tuning Studio and its translations), and all
identifiers such as env vars, commands, paths and filenames.
* Address review feedback on the Studio wording rename
Use "an" before Unsloth where the rename left the article as "a".
Restore the split brand where Unsloth and Studio render as two halves
of the full product name: the onboarding sidebar subtitle and the
IPv6 localhost warning. Scope two messages to the full name Unsloth
Studio where plain Unsloth was misleading: the AMD README bullet and
the CLI studio setup error.
* chore(studio/frontend): normalize line endings to LF
45 source files under studio/frontend/ were committed with CRLF or mixed
line endings while the rest of the repo and the JS/TS tooling assume LF.
Add a scoped `studio/frontend/** text=auto eol=lf` rule to .gitattributes
and run `git add --renormalize studio/frontend` so these files are stored
with LF in the index. The rule is scoped to the frontend tree (not a
repo-wide *.ts/*.tsx/... policy) so it cannot force LF on files elsewhere;
text=auto leaves binary assets (logos, fonts) untouched.
This commit is whitespace-only (CRLF -> LF) — no source content changed
(verified with `git diff --ignore-cr-at-eol`). It is intentionally
isolated so it can be listed in .git-blame-ignore-revs and skipped by
reviewers and `git blame`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: ignore the frontend LF-normalization commit in git blame
Add .git-blame-ignore-revs listing the whitespace-only line-ending
normalization commit so it doesn't pollute `git blame` output. GitHub
applies this file automatically; locally run
`git config blame.ignoreRevsFile .git-blame-ignore-revs`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Shell scripts are stored as LF in git, but without an eol rule a Windows
clone with core.autocrlf=true checks them out as CRLF. The trailing \r then
breaks them when run in WSL/Linux -- e.g. `set -e` becomes `set -e\r` and
dash/sh aborts with "set: Illegal option -". This bites developers who clone
on Windows and run the repo's *.sh directly in WSL, increasingly common with
the AMD Strix Halo ROCm-on-WSL support.
Add `*.sh text eol=lf` so every shell script always checks out with LF
regardless of the contributor's platform or core.autocrlf setting. All
tracked *.sh use Unix shebangs; none need CRLF. PowerShell/batch scripts are
left untouched -- they tolerate LF and are unaffected by this bug.
Verified with `git ls-files --eol`: every *.sh now resolves to
i/lf w/lf attr/text eol=lf.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
