Allow any Hugging Face model in API with trust_remote_code=False for unlisted models

CLAUDE.md

@@ -40,8 +40,9 @@ The application consists of a single `app.py` file with:
 
 - **Queue**: Hugging Face Spaces enforces queuing at infrastructure level, even without `.queue()` in code
 - **CPU Mode**: Explicitly set to CPU to avoid GPU requirements
-- **Trust Remote Code**: Model uses `trust_remote_code=True` for custom Nomic model code
-- **API Access**: Direct HTTP requires queue protocol; use Gradio client libraries instead
+- **Trust Remote Code**: Only predefined models in MODELS dict allow `trust_remote_code=True`
+- **Any HF Model**: API accepts any Hugging Face model name but uses `trust_remote_code=False` for unlisted models
+- **API Access**: Direct HTTP available via FastAPI endpoints
 
 ## API Usage
 

app.py

@@ -34,12 +34,16 @@ current_model_name = "nomic-ai/nomic-embed-text-v1.5"
 def load_model(model_name: str):
     global loaded_models
     if model_name not in loaded_models:
-        config = MODELS.get(model_name, {})
-        loaded_models[model_name] = SentenceTransformer(
-            model_name, 
-            trust_remote_code=config.get("trust_remote_code", False),
-            device='cpu'
-        )
+        # Only allow trust_remote_code=True for predefined models
+        trust_remote_code = MODELS.get(model_name, {}).get("trust_remote_code", False)
+        try:
+            loaded_models[model_name] = SentenceTransformer(
+                model_name, 
+                trust_remote_code=trust_remote_code,
+                device='cpu'
+            )
+        except Exception as e:
+            raise ValueError(f"Failed to load model '{model_name}': {str(e)}")
     return loaded_models[model_name]
 
 # Load default model
@@ -50,9 +54,12 @@ fastapi_app = FastAPI()
 
 
 def embed(document: str, model_name: str = None):
-    if model_name and model_name in MODELS:
-        selected_model = load_model(model_name)
-        return selected_model.encode(document)
+    if model_name:
+        try:
+            selected_model = load_model(model_name)
+            return selected_model.encode(document)
+        except Exception as e:
+            raise ValueError(f"Error with model '{model_name}': {str(e)}")
     return model.encode(document)
 
 
@@ -70,11 +77,11 @@ async def embed_text(data: Dict[str, Any]):
                 content={"error": "No text provided"}
             )
         
+        # Allow any model but warn about trust_remote_code
         if model_name not in MODELS:
-            return JSONResponse(
-                status_code=400,
-                content={"error": f"Model '{model_name}' not supported. Available models: {list(MODELS.keys())}"}
-            )
+            trust_remote_code = False
+        else:
+            trust_remote_code = MODELS[model_name].get("trust_remote_code", False)
         
         # Generate embedding
         embedding = embed(text, model_name)
@@ -83,7 +90,9 @@ async def embed_text(data: Dict[str, Any]):
             content={
                 "embedding": embedding.tolist(),
                 "dim": len(embedding),
-                "model": model_name
+                "model": model_name,
+                "trust_remote_code": trust_remote_code,
+                "predefined": model_name in MODELS
             }
         )
     except Exception as e:
@@ -117,12 +126,13 @@ with gr.Blocks(title="Multi-Model Text Embeddings", css="""
     gr.Markdown("# Multi-Model Text Embeddings")
     gr.Markdown("Generate embeddings for your text using 16+ state-of-the-art embedding models from Nomic, BGE, Snowflake, IBM Granite, and more.")
     
-    # Model selector dropdown
+    # Model selector dropdown (allows custom input)
     model_dropdown = gr.Dropdown(
         choices=list(MODELS.keys()),
         value=current_model_name,
         label="Select Embedding Model",
-        info="Choose the embedding model to use"
+        info="Choose from predefined models or enter any Hugging Face model name",
+        allow_custom_value=True
     )
     
     # Create an input text box
@@ -143,6 +153,8 @@ with gr.Blocks(title="Multi-Model Text Embeddings", css="""
     gr.Markdown("""
     You can use this API in two ways: via the direct FastAPI endpoint or through Gradio clients.
     
+    **Security Note**: Only predefined models allow `trust_remote_code=True`. Any other Hugging Face model will use `trust_remote_code=False` for security.
+    
     ### List Available Models
     ```bash
     curl https://ipepe-nomic-embeddings.hf.space/models
@@ -155,10 +167,15 @@ with gr.Blocks(title="Multi-Model Text Embeddings", css="""
       -H "Content-Type: application/json" \
       -d '{"text": "Your text to embed goes here"}'
     
-    # With specific model
+    # With predefined model (trust_remote_code allowed)
     curl -X POST https://ipepe-nomic-embeddings.hf.space/embed \
       -H "Content-Type: application/json" \
       -d '{"text": "Your text to embed goes here", "model": "sentence-transformers/all-MiniLM-L6-v2"}'
+    
+    # With any Hugging Face model (trust_remote_code=False for security)
+    curl -X POST https://ipepe-nomic-embeddings.hf.space/embed \
+      -H "Content-Type: application/json" \
+      -d '{"text": "Your text to embed goes here", "model": "intfloat/e5-base-v2"}'
     ```
     
     Response format:
@@ -166,7 +183,9 @@ with gr.Blocks(title="Multi-Model Text Embeddings", css="""
     {
       "embedding": [0.123, -0.456, ...],
       "dim": 384,
-      "model": "sentence-transformers/all-MiniLM-L6-v2"
+      "model": "sentence-transformers/all-MiniLM-L6-v2",
+      "trust_remote_code": false,
+      "predefined": true
     }
     ```