fix(wandb): working endpoints — dead install gate removed, resume can't smuggle wandb on, key checked before side effects (MT40)

Fixes main's wandb surface per the MT40 audit, re-derived for main's
code (not a port of rig's restore — rig's panel/lineage interactions
arrive with the later carve train):

- Install gate deleted: /system/wandb-extra*, the wandb InstallManager,
  and WandbInstallDialog. It was dead code — wandb is a hard transitive
  dep of the pinned lerobot training extra, so the probe could never
  fail — and its fetch-error fallthrough silently enabled wandb.
  Replaced by GET /system/wandb-credentials on the existing
  resolve_wandb_api_key (env -> ~/.netrc; boolean only, never the key).
- Resume emits an explicit --wandb.enable, so a resumed checkpoint's
  train_config.json can never silently re-enable wandb (the MT40 core);
  enable/project/entity inherit server-side from the parent record (the
  wandb run identity rides the checkpoint; verified against lerobot
  v0.6.0's resume path).
- Credential preflight: a wandb-enabled run with no resolvable key is
  refused 400 BEFORE any side effect — before the dataset Hub push and
  before the deferred resume-upload thread — instead of dying inside a
  billed GPU container 20 minutes in.
- Defaults and copy: wandb defaults on when a key exists (form-level,
  once, never clobbering a user's choice); artifact upload defaults
  off; Entity/Project labeled in W&B's own vocabulary with the
  blank-value semantics spelled out.
- URL scrape: comment corrected (lerobot's 'Track this run -->' line;
  wandb's own banner is WANDB_SILENT-suppressed) and run-id class
  widened.

Known divergence kept deliberately: wandb_run_id stays on main's
TrainingRequest (inert; rig removed it — reconciled by the carve
train).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Mokuroh54

frontend/src/components/training/TrainingConfigurator.tsx

@@ -239,9 +239,14 @@ const TrainingConfigurator: React.FC<TrainingConfiguratorProps> = ({
     resume_from_step: resumeSeed?.step ?? undefined,
     finetune_from_job_id: finetuneSeed?.jobId,
     finetune_from_step: finetuneSeed?.step ?? undefined,
+    // Off here, and switched on by the credentials probe below once a key is
+    // confirmed — an initial value can't wait on an async answer. A RESUME is
+    // never defaulted: its W&B state is inherited server-side.
     wandb_enable: false,
     wandb_mode: "online",
-    wandb_disable_artifact: false,
+    // TRUE = artifacts off. Per-checkpoint model uploads to W&B are opt-in,
+    // not a side effect of turning logging on.
+    wandb_disable_artifact: true,
     policy_device: resumeSeed?.policyDevice ?? "auto",
     policy_use_amp: resumeSeed?.policyUseAmp ?? false,
     optimizer_type: resumeSeed?.optimizerType ?? "adam",
@@ -260,6 +265,12 @@ const TrainingConfigurator: React.FC<TrainingConfiguratorProps> = ({
     hf_job_timeout: resumeSeed?.hfJobTimeout,
   });
 
+  // Whether the user has touched the W&B toggle, and whether the credentials
+  // probe has already had its one say. Refs, not state: nothing renders from
+  // them, and the default-on effect below must not re-run when they change.
+  const wandbEnableTouched = useRef(false);
+  const wandbDefaultApplied = useRef(false);
+
   // The config the form actually reads: internal state overlaid with the
   // controlled policy type + dataset. Keeps EssentialsCard's frozen dataset
   // display and policy dropdown bound to the caller's selection.
@@ -332,6 +343,46 @@ const TrainingConfigurator: React.FC<TrainingConfiguratorProps> = ({
       .finally(() => setHardwareLoading(false));
   }, [baseUrl, fetchWithHeaders, auth.status]);
 
+  // Default W&B logging ON once the backend confirms it can resolve an API key.
+  // A UI-level default only: the backend's `TrainingRequest.wandb_enable` still
+  // defaults false, so non-UI callers keep opt-in semantics and the submit-time
+  // preflight still protects them.
+  //
+  // Three guards, each earning its place:
+  //   * `resumeSeed` — a continuation's W&B state is inherited from its parent
+  //     server-side, never defaulted; enabling it here could only contradict
+  //     what JobRegistry.start is about to write.
+  //   * `wandbDefaultApplied` — fires at most once per mounted form, so a
+  //     re-render or a re-answered probe can't re-assert the default after the
+  //     user has moved on.
+  //   * `wandbEnableTouched` — an explicit decision always wins, including one
+  //     made while the probe was still in flight. The probe answers
+  //     asynchronously, so without this a late "yes, there's a key" would flip
+  //     the toggle back on under someone who had just switched it off.
+  //
+  // A failed probe leaves `available` false and changes nothing: not evidence a
+  // key exists, so it must not turn logging on.
+  useEffect(() => {
+    if (resumeSeed || wandbDefaultApplied.current) return;
+    let cancelled = false;
+    fetchWithHeaders(`${baseUrl}/system/wandb-credentials`)
+      .then((r) => r.json())
+      .then((data: { available: boolean }) => {
+        if (cancelled || !data.available) return;
+        wandbDefaultApplied.current = true;
+        if (wandbEnableTouched.current) return;
+        setTrainingConfig((prev) =>
+          prev.wandb_enable ? prev : { ...prev, wandb_enable: true },
+        );
+      })
+      .catch(() => {
+        /* older backend / transport blip — leave the default off */
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, fetchWithHeaders, resumeSeed]);
+
   const updateConfig = <T extends keyof TrainingConfig>(
     key: T,
     value: TrainingConfig[T],
@@ -344,6 +395,7 @@ const TrainingConfigurator: React.FC<TrainingConfiguratorProps> = ({
       return;
     }
     if (key === "dataset_repo_id") return;
+    if (key === "wandb_enable") wandbEnableTouched.current = true;
     setTrainingConfig((prev) => ({ ...prev, [key]: value }));
   };
 

frontend/src/components/training/WandbInstallDialog.tsx

@@ -1,4 +1,4 @@
-import React, { useState } from "react";
+import React from "react";
 import { Input } from "@/components/ui/input";
 import { NumberInput } from "@/components/ui/number-input";
 import { Label } from "@/components/ui/label";
@@ -16,8 +16,6 @@ import {
   RESUME_INHERITED_NOTE,
   RESUME_INHERITED_SHORT,
 } from "../types";
-import WandbInstallDialog from "../WandbInstallDialog";
-import { useApi } from "@/contexts/ApiContext";
 
 /** The run's headline settings — steps, batch size, name, and W&B logging.
  * Flat: each control carries its own <Label> and the section has no eyebrow
@@ -27,46 +25,20 @@ import { useApi } from "@/contexts/ApiContext";
  * On a resume, `steps` stays editable (the resume branch passes --steps, and
  * raising it is the whole point of a continuation) while `batch_size` does not
  * — lerobot takes it from the checkpoint's train_config.json. The whole W&B
- * group is locked for the same reason: the resume branch emits no --wandb.*, so
- * lerobot logs (or doesn't) exactly as the parent run's config said. The one
- * live effect the toggle keeps is a bad one — HfCloudJobRunner reads
- * `wandb_enable` when assembling job secrets and 400s on a missing
- * WANDB_API_KEY, so leaving it enabled could only ever block a launch without
- * turning any logging on. */
+ * group is locked for a stronger reason: lerobot re-opens the PARENT's W&B run
+ * (`wandb.init(resume="must")` with the run id stored in the checkpoint), so a
+ * continuation cannot log anywhere else. JobRegistry.start inherits
+ * enable/project/entity from the parent record and ignores what the form sends;
+ * the values shown are the parent's, which is what the run really uses.
+ *
+ * On a FRESH run the toggle defaults ON once the backend reports a resolvable
+ * W&B API key (see TrainingConfigurator); with no key it stays off, and a run
+ * that enables it anyway is refused at submit time with the reason. */
 const EssentialsCard: React.FC<ConfigComponentProps> = ({
   config,
   updateConfig,
   resumeLocked,
 }) => {
-  const { baseUrl, fetchWithHeaders } = useApi();
-  const [wandbDialogOpen, setWandbDialogOpen] = useState(false);
-  const [wandbInstallHint, setWandbInstallHint] = useState("pip install wandb");
-
-  const handleWandbToggle = async (checked: boolean) => {
-    if (!checked) {
-      updateConfig("wandb_enable", false);
-      return;
-    }
-    // Check availability before flipping the switch on. If wandb isn't
-    // importable in this MakerMods Lab process, surface the same install flow used
-    // for the training extra (accelerate) instead of letting the user start
-    // a run that will fail.
-    try {
-      const r = await fetchWithHeaders(`${baseUrl}/system/wandb-extra`);
-      const data: { available: boolean; install_hint: string } = await r.json();
-      if (data.available) {
-        updateConfig("wandb_enable", true);
-      } else {
-        setWandbInstallHint(data.install_hint);
-        setWandbDialogOpen(true);
-      }
-    } catch {
-      // Backend unreachable — let the user proceed; training start will
-      // surface the real error if wandb is genuinely missing.
-      updateConfig("wandb_enable", true);
-    }
-  };
-
   return (
     <section className="space-y-4">
       <div className="grid grid-cols-2 gap-4">
@@ -131,44 +103,47 @@ const EssentialsCard: React.FC<ConfigComponentProps> = ({
           <Switch
             id="wandb_enable"
             checked={config.wandb_enable}
-            onCheckedChange={handleWandbToggle}
+            onCheckedChange={(checked) => updateConfig("wandb_enable", checked)}
             disabled={resumeLocked}
             className="data-[state=checked]:bg-primary"
           />
           <Label htmlFor="wandb_enable">Log to Weights &amp; Biases</Label>
         </div>
 
-        <WandbInstallDialog
-          open={wandbDialogOpen}
-          onOpenChange={setWandbDialogOpen}
-          installHint={wandbInstallHint}
-        />
-
         {config.wandb_enable && (
           <div className="space-y-4 border-l-2 border-border pl-4">
             <div className="space-y-2">
-              <Label htmlFor="wandb_project">W&amp;B project name</Label>
+              <Label htmlFor="wandb_project">Project</Label>
               <Input
                 id="wandb_project"
                 value={config.wandb_project || ""}
                 onChange={(e) =>
                   updateConfig("wandb_project", e.target.value || undefined)
                 }
-                placeholder="my-robotics-project"
+                placeholder="lerobot (default)"
                 disabled={resumeLocked}
               />
             </div>
             <div className="space-y-2">
-              <Label htmlFor="wandb_entity">W&amp;B entity (optional)</Label>
+              <Label htmlFor="wandb_entity">Entity</Label>
               <Input
                 id="wandb_entity"
                 value={config.wandb_entity || ""}
                 onChange={(e) =>
                   updateConfig("wandb_entity", e.target.value || undefined)
                 }
-                placeholder="your-username"
+                placeholder="your-username or team"
                 disabled={resumeLocked}
               />
+              {/* The 403 trap, stated as what the field IS rather than as a
+                  warning: W&B rejects a run aimed at an entity you aren't a
+                  member of, and it rejects it at run start, long after Start
+                  was clicked. Naming "a team you belong to" is what stops
+                  someone typing a placeholder word into it. */}
+              <p className="text-xs text-muted-foreground">
+                Your W&amp;B username or a team you belong to. Blank = your
+                personal account.
+              </p>
             </div>
             <div className="space-y-2">
               <Label htmlFor="wandb_notes">W&amp;B notes (optional)</Label>
@@ -209,7 +184,9 @@ const EssentialsCard: React.FC<ConfigComponentProps> = ({
                 disabled={resumeLocked}
                 className="data-[state=checked]:bg-primary"
               />
-              <Label htmlFor="wandb_disable_artifact">Disable artifacts</Label>
+              <Label htmlFor="wandb_disable_artifact">
+                Don't upload checkpoints to W&amp;B
+              </Label>
             </div>
           </div>
         )}

frontend/src/components/training/config/EssentialsCard.tsx

@@ -26,7 +26,7 @@ export interface UseInstallExtraResult {
 }
 
 /**
- * Drives the backend extra-install flow (`accelerate`, `wandb`, …). Seeds state
+ * Drives the backend extra-install flow (`accelerate`, policy extras, …). Seeds state
  * from `${endpointPrefix}/install-status`, polls while installing, and exposes
  * install/retry handlers. Pass `enabled=false` to gate seeding on dialog open.
  */