{"record":{"id":"9bac93ab8068b70c","repo":"unslothai/unsloth","slug":"secure-requires-the-cloudflare-tunnel-do-not-co","errorCode":null,"errorMessage":"--secure requires the Cloudflare tunnel; do not combine it with --no-cloudflare.","messagePattern":"--secure requires the Cloudflare tunnel; do not combine it with --no-cloudflare\\.","errorType":"console","errorClass":"SystemExit","httpStatus":null,"severity":"critical","filePath":"studio/backend/run.py","lineNumber":2251,"sourceCode":"\n    initialize_parent_lifetime()\n    # macOS has neither PR_SET_PDEATHSIG nor job objects, so a Studio that\n    # crashed left its sidecars running. Sweep before spawning anything: a\n    # leftover holds VRAM, a port, and the files an update has to replace.\n    try:\n        reaped = reap_recorded_children()\n        if reaped:\n            logger.warning(\"Reaped %d orphan(s) from a previous Studio: %s\", len(reaped), reaped)\n    except Exception as e:\n        logger.warning(\"Could not sweep orphans from a previous run: %s\", e)\n\n    # --secure exposes ONLY the Cloudflare link: reject --secure --no-cloudflare,\n    # then force a loopback bind so the raw port is never public (even -H 0.0.0.0).\n    # Otherwise keep the tri-state so the banner distinguishes \"off by default\"\n    # from an explicit --no-cloudflare.\n    if secure:\n        if cloudflare is False:\n            raise SystemExit(\n                \"--secure requires the Cloudflare tunnel; do not combine it with --no-cloudflare.\"\n            )\n        cloudflare = True\n        host = \"127.0.0.1\"\n\n    # `unsloth studio run` installs its own resolved policy and passes None here.\n    _apply_cli_tool_policy(enable_tools)\n\n    # Windows cp1252 can't encode emoji; reconfigure stdout to UTF-8.\n    if sys.platform == \"win32\" and hasattr(sys.stdout, \"reconfigure\"):\n        try:\n            sys.stdout.reconfigure(encoding = \"utf-8\", errors = \"replace\")\n        except Exception:\n            pass\n\n    # Persist a session log + native-crash stacks BEFORE importing main, so\n    # even import-time failures leave evidence on disk. Field report: Unsloth\n    # \"terminates without a warning\" -- a native crash in the GPU runtime","sourceCodeStart":2233,"sourceCodeEnd":2269,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/run.py#L2233-L2269","documentation":"Fatal CLI validation error (SystemExit): --secure was combined with --no-cloudflare. --secure's contract is to expose the server ONLY through the Cloudflare tunnel (it forces a loopback bind so the raw port is never public), so disabling the tunnel makes the security promise meaningless — the launcher refuses rather than silently running insecure.","triggerScenarios":"unsloth studio with both --secure and --no-cloudflare on the command line (or the equivalent config file/env pair); scripts evolved from a --no-cloudflare setup gaining --secure later without removing the old flag.","commonSituations":"Hardening an existing local-only launch config by appending --secure; CI scripts carrying stale flags.","solutions":["Remove --no-cloudflare when using --secure.","If you truly want no tunnel, drop --secure and bind explicitly to the interface you intend (understanding the raw port is exposed).","Audit launch scripts/env files for the conflicting flag pair."],"exampleFix":"# before\n$ unsloth studio --secure --no-cloudflare\n\n# after\n$ unsloth studio --secure","handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\nif [[ \"$1\" == *--secure* && \"$@\" == *--no-cloudflare* ]]; then\n  echo \"--secure and --no-cloudflare are mutually exclusive\" >&2; exit 2;\nfi\nexec unsloth studio \"$@\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When hardening a launch config, review existing flags instead of appending","--secure implies the tunnel AND a loopback bind — plan exposure accordingly","Keep flag pairs validated in wrapper scripts/CI"],"tags":["cli","flag-conflict","security","cloudflare-tunnel","startup"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}