remote_connector_active answers for the cloudflare tunnel and, since unslothai#8951, for
the LAN listener too. access_exposure read that single predicate and called both
public_url, so turning keyless access on behind LAN access told the operator
anyone with their public URL was being let in when the reach was the local
network, and there may be no public URL at all.

host_policy grows tunnel_connector_active and lan_connector_active beside the
combined reader, which keeps its meaning for the stdio MCP gate. access_exposure
asks the tunnel for public_url and the LAN listener for network, so a tunnel
still wins when both are up.

* serve the api without a key when the user opts in

Studio can only be used from another app after minting an API key in Settings.
LM Studio and Ollama serve their endpoints with no credential, so pointing an
existing OpenAI-compatible tool at Unsloth means a detour to create and paste a
key first.

Add a Keyless API access card to Settings > API with two switches, both off by
default: one serves the OpenAI-compatible endpoints, the other serves every
route. Splitting them means opening up chat does not also hand over training and
files. Turning either on opens a confirmation naming who it lets in, worded from
how far the server currently reaches; the bind address never blocks the choice.

With a scope on, a request that sends no usable credential authenticates as the
local admin: no Authorization header, a dummy bearer (the OpenAI SDKs always
send one), a malformed header, or a stale key. A key that still works keeps
authenticating as itself, so per-key attribution survives.

Sign-in is untouched: a session token this install knows stays authoritative, so
an expired one still fails and the app re-authenticates. Keyless callers count
as API callers, so every guard that already refuses an sk-unsloth key refuses
them too, including the saved-provider-credential rules in routes/inference.py.

The inference scope names its endpoints one by one because main.py aliases the
whole inference router under /v1, where a prefix match would also have opened
model loading, media generation and the sandbox routes.

* keep tools, key minting and the ui switch behind their own gates

Server-side tools stay off for a keyless caller until the admin ticks "Allow
tools", with its own confirmation. /v1/chat/completions drives the python and
terminal tool loop on this machine and `unsloth studio run` turns tools on by
default, so serving that route without a key would otherwise hand the loop to
anyone who can reach it. KeylessToolPolicyMiddleware applies the same
tools_force_disabled() the public /p surface already uses.

Only a signed-in UI session may change the setting: an sk-unsloth key must not
be able to switch authentication off for the whole install, and a keyless caller
must not be able to widen its own scope.

_request_used_api_key now counts a keyless caller, so the API monitor opens on
that traffic instead of filing it as the owner's own chat.

The usage-examples snippets take the scope rather than a boolean; the coding
agent reaches past /v1, so its command only drops the real key under full.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* let a working api key keep its tools, and refuse keyless key minting

KeylessToolPolicyMiddleware read every bearer that is not a Studio session as
keyless, so a valid sk-unsloth key hit tools_force_disabled() whenever keyless
inference was on with the tool grant off. That took tools away from API clients
that already had them. asgi_request_is_keyless now also asks whether the bearer
validates as a key, matching what _get_current_credential does with it a moment
later. A revoked or expired key still falls through to the keyless admin, so it
keeps losing tools.

Under the full scope an anonymous POST /api/auth/api-keys resolved to the admin
credential and minted an sk-unsloth key that went on working after keyless
access was switched off. admitted_without_credential is the narrower form of
is_keyless: true only when the setting itself is what admitted the caller. A
signed-in session and a working key still mint keys as before.

* drop the formatter churn from the two touched settings files

usage-examples.tsx and api-keys-tab.tsx came back through biome at its default
80 columns, and the repo is not formatted to that width. The rewrap split the
fromCatalog expression that test_usage_examples_model_source_contract.py reads
verbatim, failing test_examples_name_a_model_the_server_can_serve and
test_standalone_idle_unload_still_names_the_stored_checkpoint. Both files now
carry only the keylessScope wiring.

* give the tool snippets a key that actually gets tools

The tools and advanced variants ask for the built-in python, terminal and web
search tools, and KeylessToolPolicyMiddleware refuses them to a keyless caller
until the admin ticks the tool grant on. Building all nine snippets from one key
meant that with keyless access on and the grant off, a copied tools example ran
as plain chat with no sign anything had been dropped.

buildSnippets now takes a second key for the six tool-requesting variants, and
the panel only puts the dummy key there once the grant is on. KeylessApiAccessSection
reports the tool state alongside the scope so the panel can see it.

* do not let a stale refresh reopen the scope a write just closed

_settings() published whatever _read_settings() returned. A sqlite read blocks,
so a request could be holding the open scope when a concurrent PUT wrote "off"
and cached it, then overwrite that with its stale answer. Every request for the
rest of the 1s TTL still authenticated as the admin with no key, after the call
that closed access had already returned. The two settings also come back through
separate connections, so the same interleaving tears the scope from the tool
grant.

Writes now bump a generation under a lock, and a refresh only publishes when the
generation it read under is still current, otherwise it returns the value the
write published. test_a_refresh_that_raced_the_closing_write_cannot_republish_the_open_scope
drives the interleaving with an event pair and fails on the old code.

* keep keyless off credential management, and let it reach the sandbox files

Revoking a key outlives the setting exactly as minting one does: switching keyless
access off does not restore a key it destroyed, so an anonymous caller under the
full scope could permanently break every authenticated API client. The guard the
mint route carried is now a shared dependency on all three /api-keys routes, with
listing included because it is the step that names the key to revoke.

The three /api/inference/sandbox routes resolve the bearer themselves, out of the
Authorization header or the ?token= query param an <img src> has to use, so
`security` never sees them and they answered 401 under a scope that covers them.
credentials_for_token builds what the dependency would have, so those routes now
follow the full scope, stay outside the inference scope, and keep treating a
session token this install knows as authoritative on the query path too.

* stop the middleware key check stamping a use and taking the write lock

bearer_is_valid_api_key went through validate_api_key, which updates last_used_at
inside a BEGIN IMMEDIATE. _get_current_credential then validates the same bearer
again a moment later, so every API-key request on a keyless-scoped path counted as
two uses and took sqlite's global write lock twice. The stamp belongs to the real
validation, not to the advisory check the tool-policy middleware makes on the way
past.

validate_api_key_with_credential takes touch=False for that caller: same lookup,
same expiry and active checks, no write and no write transaction. Every existing
caller keeps the default, so the generation a route binds a write to still comes
from the transaction that read it.

* hold keyless callers back from downloads and sign-outs, and say what full grants

Three effects a keyless caller should not reach.

With auto-download already on, an unauthenticated request could name any public Hub
repo and make the server fetch it, which the inference dialog does not offer: it
says the caller gets the loaded model. _maybe_auto_download_model now stops there,
past the cheap disqualifiers so the bearer check only runs where a download would
otherwise start, and the request falls through to the resident model as it does
with auto-download off. A key still starts one, since that is a credential the
owner issued.

POST /api/auth/logout revokes every refresh token for the subject, and those do
not come back when keyless access is switched off, so any reachable caller could
sign the UI out again and again. It takes the guard the API-key routes already
have, now a small factory so each route names itself in the 403.

The full-scope confirmation said callers could read the files and settings. That
scope serves every route, delete endpoints included, so the dialog now says read,
change and delete at the point the operator consents to it.

* report a lan listener as network reach, not a public url

remote_connector_active answers for the cloudflare tunnel and, since #8951, for
the LAN listener too. access_exposure read that single predicate and called both
public_url, so turning keyless access on behind LAN access told the operator
anyone with their public URL was being let in when the reach was the local
network, and there may be no public URL at all.

host_policy grows tunnel_connector_active and lan_connector_active beside the
combined reader, which keeps its meaning for the stdio MCP gate. access_exposure
asks the tunnel for public_url and the LAN listener for network, so a tunnel
still wins when both are up.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* stop a keyless caller switching the loaded model, not just downloading one

The guard added in 50ed867 sat in _maybe_auto_download_model, which
_maybe_auto_switch_model only reaches once local resolution misses. With Switch
model by request on and several GGUFs already downloaded, a keyless caller could
still name any indexed one and evict the operator's active model, over and over.
Downloads were blocked, local swaps were not.

It moves up to _maybe_auto_switch_model, where clearing auto_switch_on gives the
caller exactly the behaviour of the switch being off: the named model must be the
one already serving or the request is refused by _reject_unservable_model, never
answered by a different model, and no download follows either. The reload stash
still runs, so an idle-unloaded model comes back for keyless chat.

Placed after the _loaded_identity_satisfies check so the ordinary request that
names the serving model returns before anything validates a bearer.

* answer /api/health in full for a caller the scope admits

health_check reads its own bearer, so _BearerOrKeyless never saw it: no header
returned the unauthenticated payload outright, and a dummy key was wrapped in a
plain Bearer credential that get_current_subject then refused. Under the full
scope a keyless caller was left without version, device_type, cloudflare_url and
server_url on a route that scope covers.

It now resolves through credentials_for_token, the same helper the sandbox
handlers use. The authed fields stay behind a credential everywhere else: with
keyless off there is nothing to stand in for one, and /api/health is not part of
the inference scope.

* refuse external provider routing to a caller admitted without a credential

/v1/chat/completions is in the inference scope, and its external-provider branch
runs before anything touches the local model. provider_type with a caller-supplied
provider_base_url needs no key, since llama.cpp, vLLM and Ollama commonly run
without one, and validate_provider_base_url deliberately allows loopback and LAN
so those work. Together that let an unauthenticated caller make this host issue
requests to whatever it can reach, which is nothing like the loaded model the
inference dialog offers.

The branch now refuses a caller the setting alone admitted. A key or a signed-in
session still routes as before, and the check costs nothing on a request that
names no provider. Saved credentials were already withheld separately, so this
closes the egress rather than the credential.

* Studio: harden keyless LAN API access

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Studio: stabilize keyless auth test collection

* Studio: compact keyless access regression tests

* Studio: keep keyless auth lookup off event loop

* Studio: linearize keyless settings reads

* Studio: recheck tools after keyless admission

* Studio: publish refreshed keyless settings

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Studio: close remaining keyless review gaps

* Studio: preserve compact keyless test matrix

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Studio: finish keyless review convergence

* Studio: harden keyless model restore and token lookup

* Tests: keep PR coverage at the line budget

* fix keyless credential and listener boundaries

* fix keyless usage examples

* serialize keyless settings writes

* close keyless hosted access gaps

* tighten keyless credential boundaries

* Tests: align keyless MCP CI scaffolding

* Studio: show keyless access under Remote and LAN

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Etherll <61019402+Etherll@users.noreply.github.com>

* serve the api without a key when the user opts in

Studio can only be used from another app after minting an API key in Settings.
LM Studio and Ollama serve their endpoints with no credential, so pointing an
existing OpenAI-compatible tool at Unsloth means a detour to create and paste a
key first.

Add a Keyless API access card to Settings > API with two switches, both off by
default: one serves the OpenAI-compatible endpoints, the other serves every
route. Splitting them means opening up chat does not also hand over training and
files. Turning either on opens a confirmation naming who it lets in, worded from
how far the server currently reaches; the bind address never blocks the choice.

With a scope on, a request that sends no usable credential authenticates as the
local admin: no Authorization header, a dummy bearer (the OpenAI SDKs always
send one), a malformed header, or a stale key. A key that still works keeps
authenticating as itself, so per-key attribution survives.

Sign-in is untouched: a session token this install knows stays authoritative, so
an expired one still fails and the app re-authenticates. Keyless callers count
as API callers, so every guard that already refuses an sk-unsloth key refuses
them too, including the saved-provider-credential rules in routes/inference.py.

The inference scope names its endpoints one by one because main.py aliases the
whole inference router under /v1, where a prefix match would also have opened
model loading, media generation and the sandbox routes.

* keep tools, key minting and the ui switch behind their own gates

Server-side tools stay off for a keyless caller until the admin ticks "Allow
tools", with its own confirmation. /v1/chat/completions drives the python and
terminal tool loop on this machine and `unsloth studio run` turns tools on by
default, so serving that route without a key would otherwise hand the loop to
anyone who can reach it. KeylessToolPolicyMiddleware applies the same
tools_force_disabled() the public /p surface already uses.

Only a signed-in UI session may change the setting: an sk-unsloth key must not
be able to switch authentication off for the whole install, and a keyless caller
must not be able to widen its own scope.

_request_used_api_key now counts a keyless caller, so the API monitor opens on
that traffic instead of filing it as the owner's own chat.

The usage-examples snippets take the scope rather than a boolean; the coding
agent reaches past /v1, so its command only drops the real key under full.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* let a working api key keep its tools, and refuse keyless key minting

KeylessToolPolicyMiddleware read every bearer that is not a Studio session as
keyless, so a valid sk-unsloth key hit tools_force_disabled() whenever keyless
inference was on with the tool grant off. That took tools away from API clients
that already had them. asgi_request_is_keyless now also asks whether the bearer
validates as a key, matching what _get_current_credential does with it a moment
later. A revoked or expired key still falls through to the keyless admin, so it
keeps losing tools.

Under the full scope an anonymous POST /api/auth/api-keys resolved to the admin
credential and minted an sk-unsloth key that went on working after keyless
access was switched off. admitted_without_credential is the narrower form of
is_keyless: true only when the setting itself is what admitted the caller. A
signed-in session and a working key still mint keys as before.

* drop the formatter churn from the two touched settings files

usage-examples.tsx and api-keys-tab.tsx came back through biome at its default
80 columns, and the repo is not formatted to that width. The rewrap split the
fromCatalog expression that test_usage_examples_model_source_contract.py reads
verbatim, failing test_examples_name_a_model_the_server_can_serve and
test_standalone_idle_unload_still_names_the_stored_checkpoint. Both files now
carry only the keylessScope wiring.

* give the tool snippets a key that actually gets tools

The tools and advanced variants ask for the built-in python, terminal and web
search tools, and KeylessToolPolicyMiddleware refuses them to a keyless caller
until the admin ticks the tool grant on. Building all nine snippets from one key
meant that with keyless access on and the grant off, a copied tools example ran
as plain chat with no sign anything had been dropped.

buildSnippets now takes a second key for the six tool-requesting variants, and
the panel only puts the dummy key there once the grant is on. KeylessApiAccessSection
reports the tool state alongside the scope so the panel can see it.

* do not let a stale refresh reopen the scope a write just closed

_settings() published whatever _read_settings() returned. A sqlite read blocks,
so a request could be holding the open scope when a concurrent PUT wrote "off"
and cached it, then overwrite that with its stale answer. Every request for the
rest of the 1s TTL still authenticated as the admin with no key, after the call
that closed access had already returned. The two settings also come back through
separate connections, so the same interleaving tears the scope from the tool
grant.

Writes now bump a generation under a lock, and a refresh only publishes when the
generation it read under is still current, otherwise it returns the value the
write published. test_a_refresh_that_raced_the_closing_write_cannot_republish_the_open_scope
drives the interleaving with an event pair and fails on the old code.

* keep keyless off credential management, and let it reach the sandbox files

Revoking a key outlives the setting exactly as minting one does: switching keyless
access off does not restore a key it destroyed, so an anonymous caller under the
full scope could permanently break every authenticated API client. The guard the
mint route carried is now a shared dependency on all three /api-keys routes, with
listing included because it is the step that names the key to revoke.

The three /api/inference/sandbox routes resolve the bearer themselves, out of the
Authorization header or the ?token= query param an <img src> has to use, so
`security` never sees them and they answered 401 under a scope that covers them.
credentials_for_token builds what the dependency would have, so those routes now
follow the full scope, stay outside the inference scope, and keep treating a
session token this install knows as authoritative on the query path too.

* stop the middleware key check stamping a use and taking the write lock

bearer_is_valid_api_key went through validate_api_key, which updates last_used_at
inside a BEGIN IMMEDIATE. _get_current_credential then validates the same bearer
again a moment later, so every API-key request on a keyless-scoped path counted as
two uses and took sqlite's global write lock twice. The stamp belongs to the real
validation, not to the advisory check the tool-policy middleware makes on the way
past.

validate_api_key_with_credential takes touch=False for that caller: same lookup,
same expiry and active checks, no write and no write transaction. Every existing
caller keeps the default, so the generation a route binds a write to still comes
from the transaction that read it.

* hold keyless callers back from downloads and sign-outs, and say what full grants

Three effects a keyless caller should not reach.

With auto-download already on, an unauthenticated request could name any public Hub
repo and make the server fetch it, which the inference dialog does not offer: it
says the caller gets the loaded model. _maybe_auto_download_model now stops there,
past the cheap disqualifiers so the bearer check only runs where a download would
otherwise start, and the request falls through to the resident model as it does
with auto-download off. A key still starts one, since that is a credential the
owner issued.

POST /api/auth/logout revokes every refresh token for the subject, and those do
not come back when keyless access is switched off, so any reachable caller could
sign the UI out again and again. It takes the guard the API-key routes already
have, now a small factory so each route names itself in the 403.

The full-scope confirmation said callers could read the files and settings. That
scope serves every route, delete endpoints included, so the dialog now says read,
change and delete at the point the operator consents to it.

* report a lan listener as network reach, not a public url

remote_connector_active answers for the cloudflare tunnel and, since #8951, for
the LAN listener too. access_exposure read that single predicate and called both
public_url, so turning keyless access on behind LAN access told the operator
anyone with their public URL was being let in when the reach was the local
network, and there may be no public URL at all.

host_policy grows tunnel_connector_active and lan_connector_active beside the
combined reader, which keeps its meaning for the stdio MCP gate. access_exposure
asks the tunnel for public_url and the LAN listener for network, so a tunnel
still wins when both are up.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* stop a keyless caller switching the loaded model, not just downloading one

The guard added in 50ed867 sat in _maybe_auto_download_model, which
_maybe_auto_switch_model only reaches once local resolution misses. With Switch
model by request on and several GGUFs already downloaded, a keyless caller could
still name any indexed one and evict the operator's active model, over and over.
Downloads were blocked, local swaps were not.

It moves up to _maybe_auto_switch_model, where clearing auto_switch_on gives the
caller exactly the behaviour of the switch being off: the named model must be the
one already serving or the request is refused by _reject_unservable_model, never
answered by a different model, and no download follows either. The reload stash
still runs, so an idle-unloaded model comes back for keyless chat.

Placed after the _loaded_identity_satisfies check so the ordinary request that
names the serving model returns before anything validates a bearer.

* answer /api/health in full for a caller the scope admits

health_check reads its own bearer, so _BearerOrKeyless never saw it: no header
returned the unauthenticated payload outright, and a dummy key was wrapped in a
plain Bearer credential that get_current_subject then refused. Under the full
scope a keyless caller was left without version, device_type, cloudflare_url and
server_url on a route that scope covers.

It now resolves through credentials_for_token, the same helper the sandbox
handlers use. The authed fields stay behind a credential everywhere else: with
keyless off there is nothing to stand in for one, and /api/health is not part of
the inference scope.

* refuse external provider routing to a caller admitted without a credential

/v1/chat/completions is in the inference scope, and its external-provider branch
runs before anything touches the local model. provider_type with a caller-supplied
provider_base_url needs no key, since llama.cpp, vLLM and Ollama commonly run
without one, and validate_provider_base_url deliberately allows loopback and LAN
so those work. Together that let an unauthenticated caller make this host issue
requests to whatever it can reach, which is nothing like the loaded model the
inference dialog offers.

The branch now refuses a caller the setting alone admitted. A key or a signed-in
session still routes as before, and the check costs nothing on a request that
names no provider. Saved credentials were already withheld separately, so this
closes the egress rather than the credential.

* Studio: harden keyless LAN API access

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Studio: stabilize keyless auth test collection

* Studio: compact keyless access regression tests

* Studio: keep keyless auth lookup off event loop

* Studio: linearize keyless settings reads

* Studio: recheck tools after keyless admission

* Studio: publish refreshed keyless settings

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Studio: close remaining keyless review gaps

* Studio: preserve compact keyless test matrix

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Studio: finish keyless review convergence

* Studio: harden keyless model restore and token lookup

* Tests: keep PR coverage at the line budget

* fix keyless credential and listener boundaries

* fix keyless usage examples

* serialize keyless settings writes

* close keyless hosted access gaps

* tighten keyless credential boundaries

* Tests: align keyless MCP CI scaffolding

* Studio: show keyless access under Remote and LAN

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Etherll <61019402+Etherll@users.noreply.github.com>