feat(wd): accept a variant subdirectory for the model cache

Profiles may declare `hf_subdir` for repos that ship several builds under one
name. The sidecar resolved the model directory from the model id alone, so
yu-server had to forward those profiles to Python — the last reason a
supported ONNX profile could not run here.

`model_subdir` is optional and validated before it is joined: up to four
segments of `[A-Za-z0-9._-]`, `.` and `..` refused, empty treated as absent.
That mirrors `validate_hf_subdir` on the Python side. The value arrives over
the wire and becomes a filesystem path, so it is refused rather than
sanitised.

`is_profile_model_downloaded` becomes `is_profile_model_ready` and takes the
resolved directory, and the engine cache key follows the resolved directory
too — two variants of one repo are two engines.

Verified: 56 core tests (2 new, covering both the accepted and the refused
subdirectory shapes), workspace 65 tests serially, clippy clean, and the camie
cross-implementation check still matches Python exactly (16 / 23 / 20 tags,
worst confidence delta 0.00005).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: eauesque

yu-hailo-infer-core/src/lib.rs

@@ -18,22 +18,51 @@ pub fn is_model_downloaded(cache_dir: &std::path::Path, model_id: &str) -> bool
     base.join("model.onnx").exists() && base.join("selected_tags.csv").exists()
 }
 
-/// Whether the files a profile actually names are present.
+/// Whether the files a profile actually names are present in `model_dir`.
 ///
 /// The WD-shaped check above would reject camie, whose weights are
 /// `camie-tagger-v2.onnx` and whose vocabulary is a JSON — and would accept a
 /// directory holding WD's files while the request asks for something else.
-pub fn is_profile_model_downloaded(
-    cache_dir: &std::path::Path,
-    model_id: &str,
-    spec: &WdProfileSpec,
-) -> bool {
-    let base = cache_dir.join(model_id);
+pub fn is_profile_model_ready(model_dir: &std::path::Path, spec: &WdProfileSpec) -> bool {
     let tag_file = match &spec.tag_source {
         profile::TagSourceSpec::Csv { file, .. }
         | profile::TagSourceSpec::JsonDict { file, .. } => file,
     };
-    base.join(&spec.model_file).exists() && base.join(tag_file).exists()
+    model_dir.join(&spec.model_file).exists() && model_dir.join(tag_file).exists()
+}
+
+/// Resolve a model directory, honouring an optional variant subdirectory.
+///
+/// Mirrors `validate_hf_subdir` on the Python side: up to four segments of
+/// `[A-Za-z0-9._-]`, with `.` and `..` rejected. Returns `None` for anything
+/// else rather than joining it, because the result is a filesystem path built
+/// from a value that arrived over the wire.
+pub fn resolve_model_dir(
+    cache_dir: &std::path::Path,
+    model_id: &str,
+    subdir: Option<&str>,
+) -> Option<std::path::PathBuf> {
+    let mut dir = cache_dir.join(model_id);
+    let Some(subdir) = subdir.filter(|s| !s.is_empty()) else {
+        return Some(dir);
+    };
+    let segments: Vec<&str> = subdir.split('/').collect();
+    if segments.len() > 4 {
+        return None;
+    }
+    for segment in segments {
+        if segment.is_empty()
+            || segment == "."
+            || segment == ".."
+            || !segment
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '_' || c == '-')
+        {
+            return None;
+        }
+        dir = dir.join(segment);
+    }
+    Some(dir)
 }
 
 #[cfg(test)]
@@ -83,26 +112,61 @@ mod tests {
         fs::create_dir(&model_dir).unwrap();
         let spec = camie_spec();
 
-        assert!(!is_profile_model_downloaded(dir.path(), "camie", &spec));
+        assert!(!is_profile_model_ready(&model_dir, &spec));
         fs::write(model_dir.join("camie-tagger-v2.onnx"), b"dummy").unwrap();
-        assert!(!is_profile_model_downloaded(dir.path(), "camie", &spec));
+        assert!(!is_profile_model_ready(&model_dir, &spec));
         fs::write(model_dir.join("camie-tagger-v2-metadata.json"), b"{}").unwrap();
-        assert!(is_profile_model_downloaded(dir.path(), "camie", &spec));
+        assert!(is_profile_model_ready(&model_dir, &spec));
     }
 
     #[test]
     fn the_wd_shaped_check_would_have_rejected_a_ready_camie_directory() {
-        // Guards the reason is_profile_model_downloaded exists at all.
+        // Guards the reason is_profile_model_ready exists at all.
         let dir = TempDir::new().unwrap();
         let model_dir = dir.path().join("camie");
         fs::create_dir(&model_dir).unwrap();
         fs::write(model_dir.join("camie-tagger-v2.onnx"), b"dummy").unwrap();
         fs::write(model_dir.join("camie-tagger-v2-metadata.json"), b"{}").unwrap();
-        assert!(is_profile_model_downloaded(
-            dir.path(),
-            "camie",
-            &camie_spec()
-        ));
+        assert!(is_profile_model_ready(&model_dir, &camie_spec()));
         assert!(!is_model_downloaded(dir.path(), "camie"));
     }
+
+    #[test]
+    fn a_variant_subdirectory_is_joined_when_it_is_a_plain_relative_path() {
+        let root = std::path::Path::new("/cache");
+        assert_eq!(
+            resolve_model_dir(root, "repo", None),
+            Some(root.join("repo"))
+        );
+        assert_eq!(
+            resolve_model_dir(root, "repo", Some("")),
+            Some(root.join("repo")),
+            "an empty subdir means no subdir, as on the Python side"
+        );
+        assert_eq!(
+            resolve_model_dir(root, "repo", Some("v1.1/fp16")),
+            Some(root.join("repo").join("v1.1").join("fp16"))
+        );
+    }
+
+    #[test]
+    fn a_subdirectory_that_escapes_the_cache_is_refused() {
+        let root = std::path::Path::new("/cache");
+        for bad in [
+            "..",
+            "../other",
+            "v1/../../etc",
+            "/abs",
+            "a/b/c/d/e",
+            "a b",
+            "a\\b",
+            ".",
+        ] {
+            assert_eq!(
+                resolve_model_dir(root, "repo", Some(bad)),
+                None,
+                "subdir {bad:?} must be refused, not joined"
+            );
+        }
+    }
 }

yu-hailo-infer/src/router.rs

@@ -193,6 +193,11 @@ pub struct InferWdRequest {
     /// adapter family and belongs with the registry, not here.
     #[serde(default)]
     pub profile: Option<infer_core::WdProfileSpec>,
+    /// Variant subdirectory under the model's cache directory, for repos that
+    /// ship several builds (the Python side calls this `hf_subdir`). Validated
+    /// as a plain relative path before being joined.
+    #[serde(default)]
+    pub model_subdir: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -1672,8 +1677,18 @@ async fn infer_wd(
             .into_response();
     }
 
-    let model_dir = state.wd_cache_dir.join(&body.model_id);
-    if !infer_core::is_profile_model_downloaded(&state.wd_cache_dir, &body.model_id, &spec) {
+    let Some(model_dir) = infer_core::resolve_model_dir(
+        &state.wd_cache_dir,
+        &body.model_id,
+        body.model_subdir.as_deref(),
+    ) else {
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(json!({"error": "invalid model_subdir"})),
+        )
+            .into_response();
+    };
+    if !infer_core::is_profile_model_ready(&model_dir, &spec) {
         return (
             StatusCode::SERVICE_UNAVAILABLE,
             Json(json!({"error": "model not downloaded"})),
@@ -1685,7 +1700,7 @@ async fn infer_wd(
     // recipe, so the model id alone does not identify it: two requests for the
     // same directory with different profiles must not share one engine.
     let cache_key = match serde_json::to_string(&spec) {
-        Ok(fingerprint) => format!("{}\x00{}", body.model_id, fingerprint),
+        Ok(fingerprint) => format!("{}\x00{}", model_dir.display(), fingerprint),
         Err(error) => {
             tracing::error!("yu-infer wd profile fingerprint failed: {error}");
             return (