fix(colab): verify model access before loading the pipeline

notebooks/abliterate.ipynb

@@ -33,8 +33,9 @@
     "**How to use:**\n",
     "1. Make sure GPU runtime is enabled: `Runtime > Change runtime type > T4 GPU`\n",
     "2. Set your model and method in the config cell below\n",
-    "3. Run All (`Runtime > Run all` or `Ctrl+F9`)\n",
-    "4. Download the abliterated model from the output"
+    "3. For gated models, complete the Hugging Face access setup in section 2 before running.\n",
+    "4. Run All (`Runtime > Run all` or `Ctrl+F9`)\n",
+    "5. Download the abliterated model from the output"
    ]
   },
   {
@@ -61,9 +62,15 @@
     "id": "config-header"
    },
    "source": [
-    "## 2. Configure\n",
+    "## 2. Configure and prepare model access\n",
     "\n",
-    "Edit the cell below to set your target model and abliteration method."
+    "Edit the cell below to set your target model and abliteration method.\n",
+    "\n",
+    "**The default Llama model is gated.** Open its [model page](https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct), accept the license/request access, and wait for approval on your Hugging Face account. A token alone does not grant access.\n",
+    "\n",
+    "Create a **read** token for that account (or a fine-grained token permitted to read the selected model). In Colab, open **Secrets** (the key icon), add a secret named `HF_TOKEN`, and enable **Notebook access**. Never paste a token into a code cell or saved output. Outside Colab, an existing `hf auth login` session or an `HF_TOKEN` environment variable also works.\n",
+    "\n",
+    "Ungated public models such as `Qwen/Qwen2.5-7B-Instruct` or `openai-community/gpt2` need no login. Step 3 checks access to the selected model's small `config.json` before constructing the pipeline or downloading weights; if access cannot be confirmed, it stops with setup instructions. After fixing access or changing the model, rerun the configuration and step 3. The check runs again even when step 3 is executed directly.\n"
    ]
   },
   {
@@ -115,6 +122,38 @@
    },
    "outputs": [],
    "source": [
+    "import os\n",
+    "from huggingface_hub import get_token, hf_hub_download\n",
+    "from obliteratus.credential_sources import resolve_secret\n",
+    "\n",
+    "\n",
+    "def check_model_access(model_name):\n",
+    "    # Resolve the same configured sources as the loader, then Hub/Colab login.\n",
+    "    # Only the small config is fetched; force a live check even if it is cached.\n",
+    "    try:\n",
+    "        token = resolve_secret(\"HF_TOKEN\") or get_token()\n",
+    "        hf_hub_download(\n",
+    "            repo_id=model_name, filename=\"config.json\",\n",
+    "            token=token or False, force_download=True,\n",
+    "        )\n",
+    "    except Exception:\n",
+    "        # Hub/credential exceptions may contain sensitive request details.\n",
+    "        raise RuntimeError(\n",
+    "            \"Model access could not be confirmed. Check the model ID and your \"\n",
+    "            \"connection. For gated/private models, accept the license/request \"\n",
+    "            \"access on the model page and wait for approval; use a read token \"\n",
+    "            \"from that account. In Colab, add HF_TOKEN in Secrets and enable \"\n",
+    "            \"Notebook access (outside Colab use hf auth login or HF_TOKEN). \"\n",
+    "            \"Then rerun this cell, or choose an ungated public model. \"\n",
+    "            \"No model weights have been loaded.\"\n",
+    "        ) from None\n",
+    "    if token:\n",
+    "        # Runtime only: keep the loader on the credential that passed the check.\n",
+    "        os.environ[\"HF_TOKEN\"] = token\n",
+    "\n",
+    "\n",
+    "check_model_access(MODEL)\n",
+    "\n",
     "from obliteratus.abliterate import AbliterationPipeline\n",
     "\n",
     "# Build kwargs, only pass overrides if non-zero\n",
@@ -217,25 +256,30 @@
    },
    "outputs": [],
    "source": [
-    "#@title Option B: Push to HuggingFace Hub\n",
-    "#@markdown Set your HF repo name. You'll need to be logged in (`huggingface-cli login`).\n",
+    "#@title Option B: Push to HuggingFace Hub (opt-in)\n",
+    "#@markdown Enable only when ready to upload. Publishing requires a write token with permission for the destination repo; read access to the source model is separate.\n",
+    "UPLOAD_TO_HUB = False #@param {type: \"boolean\"}\n",
     "HF_REPO = \"your-username/model-name-abliterated\" #@param {type: \"string\"}\n",
     "\n",
-    "from huggingface_hub import HfApi\n",
-    "api = HfApi()\n",
+    "if UPLOAD_TO_HUB:\n",
+    "    from huggingface_hub import HfApi, get_token\n",
+    "    from obliteratus.credential_sources import resolve_secret\n",
     "\n",
-    "# Login if needed\n",
-    "from huggingface_hub import notebook_login\n",
-    "notebook_login()\n",
-    "\n",
-    "# Upload\n",
-    "api.create_repo(HF_REPO, exist_ok=True)\n",
-    "api.upload_folder(\n",
-    "    folder_path=str(model_dir),\n",
-    "    repo_id=HF_REPO,\n",
-    "    repo_type=\"model\",\n",
-    ")\n",
-    "print(f\"\\nUploaded to: https://huggingface.co/{HF_REPO}\")"
+    "    if HF_REPO == \"your-username/model-name-abliterated\":\n",
+    "        raise ValueError(\"Set HF_REPO to your destination repository before uploading.\")\n",
+    "    upload_token = resolve_secret(\"HF_TOKEN\") or get_token()\n",
+    "    if not upload_token:\n",
+    "        raise RuntimeError(\"Set a write token in HF_TOKEN Secrets before uploading.\")\n",
+    "    api = HfApi(token=upload_token)\n",
+    "    api.create_repo(HF_REPO, exist_ok=True)\n",
+    "    api.upload_folder(\n",
+    "        folder_path=str(model_dir),\n",
+    "        repo_id=HF_REPO,\n",
+    "        repo_type=\"model\",\n",
+    "    )\n",
+    "    print(f\"\\nUploaded to: https://huggingface.co/{HF_REPO}\")\n",
+    "else:\n",
+    "    print(\"Hub upload skipped. Enable UPLOAD_TO_HUB to publish explicitly.\")\n"
    ]
   },
   {