{"record":{"id":"c31f8d55f374f659","repo":"unslothai/unsloth","slug":"base-repo-is-restricted-to-unsloth-repos-or-a-l","errorCode":null,"errorMessage":"base_repo is restricted to unsloth/* repos (or a local path); got '{base_repo}'.","messagePattern":"base_repo is restricted to unsloth/\\* repos \\(or a local path\\); got '(.+?)'\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"studio/backend/core/inference/diffusion.py","lineNumber":1663,"sourceCode":"                f\"'{fam.name}' checkpoints are whole-pipeline single files and have no GGUF \"\n                f\"transformer variant; load the .safetensors pipeline instead of a GGUF.\"\n            )\n        # A multi-denoiser family (Ideogram 4) has no transformer-only path; reject before eviction.\n        if kind in (\"gguf\", \"single_file\") and fam.pipeline_only:\n            raise ValueError(\n                f\"'{fam.name}' loads only as a full diffusers pipeline (it assembles \"\n                f\"multiple transformers), not from a single-file or GGUF checkpoint; \"\n                f\"select the pipeline repo.\"\n            )\n        # Non-GGUF loads fetch + deserialise weights, so gate to unsloth/ or a local path.\n        if kind != \"gguf\" and not _is_trusted_diffusion_repo(repo_id):\n            raise ValueError(\n                f\"Non-GGUF diffusion loads are restricted to unsloth/* repos (or a local \"\n                f\"path); got '{repo_id}'. Pass a gguf_filename to load a GGUF instead.\"\n            )\n        # The companion base repo also loads via from_pretrained, so it must clear the same trust bar.\n        if base_repo and base_repo.strip() and not _is_trusted_diffusion_repo(base_repo):\n            raise ValueError(\n                f\"base_repo is restricted to unsloth/* repos (or a local path); got '{base_repo}'.\"\n            )\n        # A local base_repo loads as a full pipeline; reject a non-pipeline one before eviction.\n        _assert_local_base_is_pipeline(base_repo)\n        # Reject a bad LOCAL pick before the route evicts chat: a path-shaped repo_id must be on disk.\n        local_root = Path(repo_id).expanduser()\n        # Path-shaped: \".\"/\"..\" prefix, a backslash (never in \"org/name\"), or an absolute path.\n        path_shaped = (\n            repo_id.startswith((\"/\", \"\\\\\", \"~\", \".\")) or \"\\\\\" in repo_id or local_root.is_absolute()\n        )\n        if kind in (\"gguf\", \"single_file\"):\n            if not gguf_filename:\n                raise ValueError(f\"a single-file checkpoint name is required for a '{kind}' load.\")\n            # Fail a kind/extension mismatch before the handoff: gguf needs .gguf, single_file must not.\n            is_gguf_name = gguf_filename.lower().endswith(\".gguf\")\n            if kind == \"gguf\" and not is_gguf_name:\n                raise ValueError(\"a 'gguf' load requires a .gguf checkpoint name.\")\n            if kind == \"single_file\" and is_gguf_name:","sourceCodeStart":1645,"sourceCodeEnd":1681,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/core/inference/diffusion.py#L1645-L1681","documentation":"The same trust bar as the main repo, applied to the companion base_repo: a base fed to from_pretrained(base) also fetches and deserialises third-party weights, so it must be unsloth/*, in the trusted allowlist, or an existing local path. Raised pre-eviction, alongside _assert_local_base_is_pipeline which then checks the local base actually is a pipeline directory.","triggerScenarios":"Passing base_repo='someorg/some-base' (not unsloth/*, not allowlisted, not an existing local path) together with a single-file/GGUF load that needs the companion pipeline base.","commonSituations":"User points base_repo at the original author's base repo instead of the unsloth mirror; base copied from an old config or tutorial predating the trust gate; typo in the base org name.","solutions":["Use the unsloth/* mirror id for the base repo.","Or download the base pipeline locally and pass its directory path as base_repo.","Verify the local base directory contains model_index.json, else the follow-up _assert_local_base_is_pipeline check will reject it.","Drop base_repo if the family's built-in default base (fam.base_repo) is sufficient."],"exampleFix":"# before\nmanager.validate_load_request(repo_id=\"org/model\", gguf_filename=\"m-Q4.gguf\",\n                              base_repo=\"black-forest-labs/FLUX.1-dev\")\n\n# after: trusted mirror or local pipeline dir\nmanager.validate_load_request(repo_id=\"org/model\", gguf_filename=\"m-Q4.gguf\",\n                              base_repo=\"unsloth/FLUX.1-dev\")","handlingStrategy":"validation","validationCode":"def base_repo_allowed(base_repo: str | None) -> bool:\n    if not base_repo or not base_repo.strip():\n        return True\n    # same trust bar as the primary repo: local path, unsloth/*, or allowlist\n    return non_gguf_load_allowed(base_repo.strip())","typeGuard":null,"tryCatchPattern":"try:\n    fam = manager.validate_load_request(repo_id=r, gguf_filename=f, base_repo=b)\nexcept ValueError as e:\n    if \"base_repo is restricted\" in str(e):\n        retry_with_unsloth_base(r, f)\n    else:\n        raise","preventionTips":["Apply the same id hygiene to base_repo as to repo_id - it deserializes weights too.","A local base_repo must be a real pipeline directory (model_index.json), so snapshot the base fully.","Omit base_repo when the family default base suffices; fewer moving parts, fewer trust failures."],"tags":["security","trust-gate","base-repo","unsloth","diffusion"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}