fix(cli): escape metadata in generated scripts - #147
Open
hannibal-lee wants to merge 1 commit into
Open
Conversation
Andyyyy64
approved these changes
Jul 28, 2026
Andyyyy64
left a comment
Andyyyy64
left a comment
Owner
There was a problem hiding this comment.
Hey, really sorry this took me so long to get to. Thanks for waiting!
I finally went through this locally. With a safe AST-only payload, main produced an extra top-level assignment from the model ID, while this branch kept the same payload as the model_id string literal.
I also checked both the GGUF and Transformers paths with quotes and newlines. all 468 tests pass, along with Ruff 0.15.22 check and format, and compileall.
nothing blocking on my side. Thanks again for fixing this!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Python literals before embedding them in generated scripts
whichllm runandwhichllm snippetWhy
whichllm rungenerates a temporary Python script from Hugging Face metadataand executes it. Direct string interpolation could produce invalid Python or
allow specially crafted metadata to alter the generated code structure.
Using
repr()through the!rconversion preserves the original value whileemitting a correctly escaped Python string literal. Normal model IDs and
filenames keep the same runtime behavior.
Testing
uv run --no-dev --with pytest pytest -q(468 passed)uvx ruff check .uvx ruff format --check .