[skritosss]

Pull Request

Thanks for sending a pull request! Please make sure you read the contributing guidelines.

Issue

Fixes #1791

Description

The aLoRA upload commands now use huggingface_hub.get_token(), available throughout the supported Hub range, instead of the removed HfFolder. Both upload modules import successfully with Hub 1.x, and add-readme reaches its intended authentication flow rather than reporting a missing extra that is already installed.

The intrinsic uploader also guards cleanup until its staging directory has been created. Otherwise a missing token raises the intended OSError but the finally block replaces it with an UnboundLocalError, hiding the authentication error once the import is fixed.

Seven offline regressions exercise module imports and authenticated/missing-token paths for plain uploads, intrinsic uploads, and README upload orchestration. Hub writes are mocked; README generation is isolated from the LLM. No real credentials, model downloads, or uploads are required. Existing staging and upload payload behavior is retained.

Testing

• Tests added to the respective file if code was changed
• New code has 100% coverage if code was added
• Ensure existing tests and github automation passes (a maintainer will kick off the github automation when the rest of the PR is populated)

Local checks on Python 3.12, based on main at cf484f7:

• uv run --no-sync pytest test/cli -m 'not e2e and not qualitative' --no-cov -q: 496 passed, 2 skipped. This is the selected CLI suite, not a full all-extras/backend/e2e run.
• The seven new regressions pass separately with the lower supported huggingface-hub==0.33.4 and the locked huggingface-hub==1.16.1. Before the fix, all seven fail against Hub 1.16.1 on the removed import.
• Focused coverage reaches all eight changed executable production lines. This is changed-line coverage, not 100% coverage of the entire existing modules.
• Ruff check and format check pass for all four changed files. Focused mypy passes with --follow-imports=skip.
• Repository-wide mypy is not green in this partial dependency environment. To check for regressions, I ran the same analyzer with --no-install-types --interactive -O json --no-incremental --no-error-summary . against both this branch and an unmodified archive of the current main, using the same environment. Both report the same 148 errors across 50 files, with no added or removed errors. This does not claim a passing full pre-commit gate or the complete optional-dependency CI environment.

Attribution

• AI coding assistants used

Assisted by OpenAI Codex. Changes and verification were reviewed before submission.

---

Adding a new component, requirement, sampling strategy, or tool?

If your PR adds or modifies one of the types below, check the matching box. A checklist of type-specific review items will be posted as a comment.

• Component
• Requirement
• Sampling Strategy
• Tool

This is a CLI compatibility fix; none of these types changes.

[planetf1]

Thanks for picking this up, the fix looks spot on.

One small thing I spotted while trying it out. Now that people can actually reach this error on newer versions of huggingface_hub, it tells them to run huggingface-cli login, and that command has been retired. Running it just prints a note saying to use hf instead, which isn't much help to someone who's already stuck.

We still support older versions that don't have hf, so it's probably best to mention both. Something like "set HF_TOKEN or run hf auth login" would cover everyone. The same message also appears in intrinsic_uploader.py and commands.py.

Feel free to change those three here if you're happy to. If not, no worries, I'll raise a separate issue, since a few docs have the same wording and need tidying anyway.

[skritosss]

Updated in 6c579a7. All three missing-token errors now recommend setting HF_TOKEN or running hf auth login; the three missing-token regressions assert the exact guidance.

Offline checks: 496 CLI tests passed, two optional training modules skipped. All seven upload regressions also pass with Hub 0.33.4, in addition to the locked 1.16.1. Ruff and focused mypy pass. The full local mypy gate is not green in this partial optional-dependency environment: it reports the same 148 errors in 50 files on both this update and the unmodified previous PR head, with no new errors.

This follow-up was assisted by Codex. No real tokens, uploads or model calls were used in these tests.