Skip to content

sglang fa4 - #10

Open
avnermay wants to merge 123 commits into
mainfrom
avner/sglang-fa4
Open

sglang fa4#10
avnermay wants to merge 123 commits into
mainfrom
avner/sglang-fa4

Conversation

@avnermay

Copy link
Copy Markdown
Collaborator

No description provided.

avnermay and others added 30 commits March 18, 2026 12:39
avnermay and others added 28 commits April 27, 2026 14:16
Sync with post-merge tgl pyproject pins so editable installs that depend on
both packages can resolve.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Strips Phoenix V1 support (PhoenixLlamaForCausalLM, use_phoenix config flag,
--phoenix CLI flags, PHOENIX_70B paths, use_eagle_or_phoenix abstraction,
phoenix-specific activation conditioning branches, mask_tensor loader skip).
Preserves all other improvements from avner/sglang-fa4-phnx.

The companion branch avner/sglang-fa4-phnx differs from this branch solely by
the phoenix code removed here.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@broly-code-security-scanner

Copy link
Copy Markdown

Broly Security Scan

Note

Baseline snapshot is missing for this repo. Broly is running in PR-only fallback mode until the first scheduled baseline completes. This does not block the PR.

Note

Summary

4 actionable finding(s) in this PR

  • 🟡 1 medium
  • 🔵 3 low

1 highest-priority actionable rows in the table below (critical/high first, then top medium).

Severity Scanner Issue Location Dismiss Verdict
🟡 MEDIUM SAST Path traversal via glob pattern in model loading
function
tests/hf/eagle3_hf.py:138 d1 🔺 TRUE_POSITIVE · Confidence: HIGH

Dismiss false positives

Each dismissable row has a Dismiss key (d1, d2, …) in the table above. Reply to this comment (or post on the PR) with /broly dismiss d2: your reason to mark a false positive, or /broly undismiss d2 to reverse it. Broly records every dismissal in the section below this comment (updated in place) and suppresses the finding on the next scan.

Key Finding
d1 🟡 MEDIUM · Path traversal via glob pattern in model loading function · tests/hf/eagle3_hf.py:138
d2 🔵 LOW · Arbitrary file write via environment-controlled file path · ssd/engine/draft_runner.py:1205
d3 🔵 LOW · Unvalidated tensor metadata received over NCCL can cause denial of service vi... · ssd/engine/helpers/runner_helpers.py:135
d4 🔵 LOW · Path traversal via environment-controlled trace output path · ssd/utils/profile.py:104

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · GH Actions (zizmor) · Containers · SBOM · Powered by Together AI

Comment thread tests/hf/eagle3_hf.py
Comment on lines +138 to +140
hits = glob.glob(os.path.join(path, "snapshots", "*", "config.json"))
assert hits, f"no config.json under {path}"
path = os.path.dirname(hits[0])
print(f"[{_ts()}] [metrics] All acceptance lengths: {self._acceptance_lengths}", flush=True)
print(f"[{_ts()}] [metrics] All cache hits: {self._cache_hits}", flush=True)
print(f"[{_ts()}] [metrics] Logging acceptance lengths and cache hits to: {self._acceptance_rate_log_path}", flush=True)
with open(self._acceptance_rate_log_path, "w") as f:
Comment on lines +135 to +136
fused_total = total_new_tokens + batch_size + batch_size * max_blocks
fused = torch.empty(fused_total, dtype=torch.int64, device=device)
Comment thread ssd/utils/profile.py
PROFILE = os.environ.get("SSD_PROFILE", "0") == "1"
TRACE = os.environ.get("SSD_PROFILE_TRACE", "0") == "1"
_TRACE_NAME = os.environ.get("SSD_PROFILE_TRACE_NAME", f"proc_{os.getpid()}")
_TRACE_OUT = os.environ.get(
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants