Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@examples/speculative_decoding/launch_train.sh`:
- Around line 49-79: The accelerate launch invocation currently interpolates
unquoted variables into sh -c and omits --num_processes on single-node runs; to
fix, build the command as a bash array (e.g., CMD=()) instead of a single sh -c
string, append required flags using the existing
MULTI_NODE_ARGS/MODEL_ARG/TOTAL_GPU symbols (ensure MULTI_NODE_ARGS always
includes "--num_processes $TOTAL_GPU" even for single-node), and then run the
launch with "${CMD[@]}" so that $CONFIG_FILE, $MODEL, $HEAD_NODE_IP and other
variables are safely quoted and preserved without word-splitting or accidental
expansion.

In `@examples/speculative_decoding/main.py`:
- Line 111: The metadata help string for the dataclass field ar_validate_steps
is incomplete; update the metadata["help"] for ar_validate_steps to a full,
descriptive sentence (e.g., "Number of autoregressive validation steps to run
during evaluation" or similar) so users understand its purpose; locate the
ar_validate_steps field definition and replace the truncated help text with the
completed description.

In `@examples/speculative_decoding/train_eagle3_and_export.sh`:
- Around line 43-48: train_config.yaml is missing the base model identifier so
the generated YAML is not replayable; update the code that writes YAML_FILE
(train_config.yaml) to include the model_name_or_path value (the model used via
the --model override) under model: (e.g., model_name_or_path: "<value>") so the
config fully captures the runtime model selection; ensure the string comes from
the same variable/arg used to parse the --model override and is written when
creating YAML_FILE (preserving YAML_FILE, OUTPUT_DIR, and model_name_or_path
references).

In `@modelopt_recipes/speculative_decoding/kimi_k25_eagle_offline.yaml`:
- Around line 3-6: The recipe currently enables trust_remote_code by default in
the model block (fields model_name_or_path: moonshotai/Kimi-K2.5 and
trust_remote_code: true); change that default to false and instead
document/require an explicit opt-in (e.g., a commented flag or
environment-driven toggle) so users must consciously enable trust_remote_code
for the Kimi recipe; update any README or inline comment near the model
configuration and/or the use_fake_base_for_offline handling so it explains how
to opt in (enable trust_remote_code) when the user intentionally trusts the
model's custom HF code.

In `@modelopt_recipes/speculative_decoding/llama3_eagle_offline.yaml`:
- Around line 4-6: Replace the unsafe default by changing the YAML key
trust_remote_code from true to false in the model block of the Llama offline
recipe (the block containing model_name_or_path: meta-llama/Llama-3.2-1B);
update the value so the recipe does not silently enable remote code execution
and leave a brief comment if you want to document that users must opt-in to
enable remote code loading manually.

In `@modelopt_recipes/speculative_decoding/llama3_eagle_online.yaml`:
- Around line 4-6: The YAML enables trust_remote_code for a stock Llama model;
remove or set trust_remote_code to false to avoid executing arbitrary repo code.
Edit the model block that contains model_name_or_path: meta-llama/Llama-3.2-1B
and either delete the trust_remote_code line or change it to trust_remote_code:
false so the pipeline uses the standard transformers implementation rather than
allowing remote code execution.

In `@tests/examples/speculative_decoding/test_eagle.py`:
- Around line 138-149: The test currently writes both mix_hidden_states variants
into the same output directory causing runs to clobber each other; modify the
training output_dir construction (where eagle_output_dir /
f"eagle-tinyllama-cp{cp_size}" is used) to include the mix_hidden_states flag
(e.g., append `_mix{mix_hidden_states}` or similar) so each (cp_size,
mix_hidden_states) combination gets a unique checkpoint directory; update any
references that assume the old path (e.g., test_resume_training) to use the new
per-variant output_dir variable.
- Around line 269-273: Parametrize the trust_remote_code flag instead of
hardcoding True: add a test parameter (default False) named trust_remote_code to
the relevant test cases and use it when writing the model YAML dictionary
(replace the hardcoded "trust_remote_code": True with "trust_remote_code":
trust_remote_code) and when calling AutoConfig.from_pretrained (replace the
hardcoded trust_remote_code=True with trust_remote_code=trust_remote_code);
update only the specific test invocations that require remote code execution to
pass trust_remote_code=True. Ensure the new parameter is included in the pytest
parametrization for the test function(s) that build the YAML/model config so
local models keep trust_remote_code=False while remote-model cases explicitly
set it to True.

---

Outside diff comments:
In `@examples/speculative_decoding/main.py`:
- Around line 258-259: The torch.load call that assigns model.eagle_module.d2t
from data_args.draft_vocab_cache should pass weights_only=True to avoid
executing pickled code; update the load call in the code that sets
model.eagle_module.d2t to use torch.load(data_args.draft_vocab_cache,
weights_only=True) so only tensor data is deserialized.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@examples/speculative_decoding/main.py`:
- Around line 256-260: The code currently calls
os.path.isfile(data_args.draft_vocab_cache) which raises a TypeError when
data_args.draft_vocab_cache is None; add a guard to check for a truthy/non-None
draft_vocab_cache before performing os.path.isfile. Specifically, in the block
that assigns model.eagle_module.d2t via torch.load, first assert or raise a
clear error if data_args.draft_vocab_cache is falsy (e.g., None or empty string)
with a descriptive message, then proceed to call
os.path.isfile(data_args.draft_vocab_cache) and
torch.load(data_args.draft_vocab_cache, weights_only=True) only when the path
exists.

---

Duplicate comments:
In `@tests/examples/speculative_decoding/test_eagle.py`:
- Around line 246-273: Replace hardcoded trust_remote_code=True usages by adding
a test-level parameter (default False) and passing that variable to
transformers.AutoConfig.from_pretrained and into the generated
training_cfg["model"]["trust_remote_code"]; specifically, introduce a local
variable (e.g., trust_remote_code=False) at the top of the test and use it when
calling AutoConfig.from_pretrained(...) and when building training_cfg["model"]
instead of the literal True, and update any related test variants (e.g.,
test_offline_resume_training_kimi) to set trust_remote_code=True only when
explicitly required.
- Line 139: Tests still reference the old checkpoint path name; update
downstream consumers to use the new output_dir format that includes the mix
suffix (constructed via eagle_output_dir /
f"eagle-tinyllama-cp{cp_size}-mix{mix_hidden_states}"). Locate usages in tests
that read the checkpoint (notably the test functions test_ar_validate and
test_export_hf_checkpoint) and replace hardcoded "eagle-tinyllama-cp1" (or
similar) with the same formatted path logic or a derived variable from
eagle_output_dir and cp_size/mix_hidden_states so both creation and consumption
use the identical "-cp{cp_size}-mix{mix_hidden_states}" filename.

---

Nitpick comments:
In `@examples/speculative_decoding/main.py`:
- Around line 131-134: The CLI currently uses p.parse_known_args() which
swallows typos/legacy flags; change to p.parse_args() or explicitly fail when
unknown is non-empty: after calling parse_known_args(), if unknown is truthy
call parser.error(...) or raise SystemExit with a clear message so the script
fails fast instead of printing via print_rank_0 and proceeding; update the
handling around parse_known_args()/parse_args() and remove the print_rank_0
fallback so callers relying on args.config and args.model get validated input.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@examples/speculative_decoding/launch_train.sh`:
- Around line 30-39: Add parsing for the documented --model override so it
doesn't fall into EXTRA_ARGS: add a case branch for --model* (similar to
--config* etc.) that consumes either --model=... or the next arg and stores it
in a variable (e.g., MODEL_PATH) instead of EXTRA_ARGS; then ensure the launcher
uses MODEL_PATH to set model.model_name_or_path before launch. Update the case
block (near CONFIG_FILE, NUM_NODES, HEAD_NODE_IP, EXTRA_ARGS) to handle --model*
and ensure the code path that configures the model reads MODEL_PATH and assigns
it to model.model_name_or_path.

In `@examples/speculative_decoding/main.py`:
- Around line 136-149: The function _load_config currently only loads the target
file into merged and then flattens it, which drops any inherited defaults
referenced via a __base__ recipe; fix this by resolving __base__ entries before
converting to a plain dict: recursively detect __base__ in merged (string or
list), load each base YAML with OmegaConf.load (resolving relative paths against
the target config path), merge bases into a combined base_conf using
OmegaConf.merge, then merge the child merged onto that base_conf, repeating
until no __base__ remains; only after fully resolving inheritance apply the
dotlist overrides with OmegaConf.from_dotlist and finally call
OmegaConf.to_container to produce cfg and return the eagle_cfg as before (update
references in the code around merged, OmegaConf.load, OmegaConf.merge,
OmegaConf.from_dotlist, and cfg).

In `@examples/speculative_decoding/README.md`:
- Line 261: The README uses the wrong top-level key for the draft vocab size;
update the YAML example to the correct nested key
eagle.eagle_architecture_config.draft_vocab_size (keep data.draft_vocab_cache as
shown) and search/update any other documentation or examples that reference
eagle_architecture_config.draft_vocab_size so they use
eagle.eagle_architecture_config.draft_vocab_size to match the runtime schema.

---

Duplicate comments:
In `@examples/speculative_decoding/launch_train.sh`:
- Around line 59-74: The accelerate launch command should be built as a shell
array and executed directly instead of using sh -c with a single interpolated
string to avoid word-splitting/injection; update the script to construct CMD as
an array including "accelerate", "launch", "--mixed_precision", "bf16", plus the
expanded MULTI_NODE_ARGS elements (only when NUM_NODES != 1), then append
"${SCRIPT_DIR}/main.py", "--config", "$CONFIG_FILE", and each element from
EXTRA_ARGS, and finally run it with exec "${CMD[@]}"; also remove or use the
computed TOTAL_GPU (now unused) so you don’t compute --num_processes only in
MULTI_NODE_ARGS without applying it in the single-node case.

In `@examples/speculative_decoding/main.py`:
- Around line 246-252: The filesystem check for draft_vocab_cache calls
os.path.isfile(data_args.draft_vocab_cache) without ensuring
data_args.draft_vocab_cache is set, causing a TypeError; update the block that
handles compressed vocab (references: model.eagle_config.draft_vocab_size,
model.eagle_config.vocab_size, model.eagle_module.d2t,
data_args.draft_vocab_cache) to first verify data_args.draft_vocab_cache is
truthy (not None/empty) and if not raise a clear config error (e.g., ValueError)
indicating the draft_vocab_cache must be provided; only then call
os.path.isfile(...) and load the tensor with torch.load when the file exists.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@examples/speculative_decoding/train_eagle3_and_export.sh`:
- Line 36: The assignment to BASE_CFG uses GNU-only readlink -f which breaks on
macOS; replace the readlink usage in the BASE_CFG assignment by computing the
script directory portably (e.g., use cd and pwd -P) so it works on BSD/macOS and
Linux: change the expression that currently uses readlink -f "$0" to a portable
form such as cd "$(dirname "$0")" && pwd -P (then append the relative path) so
the BASE_CFG variable is constructed reliably across platforms.

---

Outside diff comments:
In `@examples/speculative_decoding/train_eagle3_and_export.sh`:
- Around line 53-58: The script fails to quote variable expansions which breaks
on paths with spaces: wrap expansions in double quotes when assigning and
passing variables — set EXPORT_PATH="export/${MODEL_BASENAME}-$(date
+%Y%m%d_%H%M)" and pass "$OUTPUT_DIR" to scripts/ar_validate.py and
"$OUTPUT_DIR" and "$EXPORT_PATH" to scripts/export_hf_checkpoint.py (also quote
any echo or other uses of these vars) so that OUTPUT_DIR, EXPORT_PATH, and
MODEL_BASENAME are safely handled.