Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add redai-infra/Relax --skill sglang-upgradegit clone --depth 1 https://github.com/redai-infra/RelaxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/redai-infra/relax/sglang-upgrade)<a href="https://agentmods.dev/skills/redai-infra/relax/sglang-upgrade"><img src="https://agentmods.dev/badge/skills/redai-infra/relax/sglang-upgrade/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/redai-infra/relax/sglang-upgrade"><img src="https://agentmods.dev/badge/skills/redai-infra/relax/sglang-upgrade.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 28 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.02764 |
| Opus 5 | $0.00057 | $0.01382 |
| Sonnet 5 | $0.00023 | $0.00553 |
| Haiku 4.5 | $0.00012 | $0.00276 |
Grade A, and why
sglang-upgrade scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
升级 Relax 的 sglang 版本
把 Relax 训练镜像依赖的 sglang 升级到新版本。最大的工作量永远是 rebase docker/patch/latest/sglang.patch;核心方法是 以 THUDM/slime 已 rebase 好的同版本 patch 为骨架,只 port Relax 真正私有且未被上游吸收的改动。
升级时建议维护一份 docs/draft/sglang-<ver>-upgrade-plan.md 决策日志(见第 8 节),
记录本次保留/丢弃的私有改动与验证清单,可作为下次升级的模板。
0. 先搞清楚版本是怎么定的(关键前提)
sglang 版本 不在 requirements.txt / pyproject.toml 固定,完全由 Docker 构建决定:
docker/Dockerfile:4的ARG BASE_IMAGE=lmsysorg/sglang:<tag>—— 版本由此唯一确定。- 历史上可能有
git clone -b <branch> ... && rsync的源码 overlay(例如曾用update-transformers-v5给老镜像 backport transformers 5.x)。新镜像原生支持后应删除 overlay。 docker/patch/latest/sglang.patch(真实文件,非软链)通过git apply --3way打入。- 运行时
--sglang-*参数(relax/utils/arguments.py)。
注意:rsync overlay 只替换源码,不动镜像里 setuptools_scm 固化的 .dist-info,所以 pip show sglang 可能与实际源码版本不符。
1. 前置确认
# 目标镜像是否存在(注意 -cuXXX 后缀 = CUDA 版本,如 -cu129 = CUDA 12.9)
docker pull lmsysorg/sglang:<NEW_TAG> # 或查 hub.docker.com
# 目标版本对 transformers 等的要求(决定 overlay 能否删、requirements 怎么改)
git show <NEW_TAG>:python/pyproject.toml | grep -iE "transformers==|huggingface_hub"
2. 找到 slime 的对应升级作参考(省 90% 工作量)
Relax 的 docker/patch 派生自 THUDM/slime,slime 按版本维护 docker/patch/v<X>/sglang.patch 并已 rebase。本地仓库:/root/data/slime。
cd /root/data/slime
# 找哪个 slime tag 的 base sglang == 目标版本
for t in $(git tag | grep '^v0\.'); do
echo "$t: $(git show $t:docker/Dockerfile 2>/dev/null | grep SGLANG_IMAGE_TAG= | head -1)"
done
# 看那个 tag 的 Dockerfile diff(基线、torch_memory_saver、Megatron、PyJWT 等怎么改的)
git diff <slime_old> <slime_new> -- docker/Dockerfile
# 取出 slime 已 rebase 的目标版本 patch 作骨架
git show <slime_new>:docker/patch/<NEW_TAG>/sglang.patch > /tmp/slime_skeleton.patch
判断 Relax 当前 patch 最接近哪个 slime 版本(差异最小的即 fork 起点),用
scripts/classify_patch.sh 对比(见第 4 节)。
3. 准备目标源码树(让 patch 可验证,别盲改)
cd /root/data/sglang # 用户的 sglang 仓库
git fetch --depth 1 origin tag <NEW_TAG> # 需代理
git worktree add --detach /tmp/sgl_base <NEW_TAG>
# 验证 slime 骨架能干净应用(exit 0 即可;"lacks blob/Falling back" 是浅克隆正常现象)
cd /tmp/sgl_base && git apply --check /tmp/slime_skeleton.patch; echo "exit=$?"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 144 lines · 115 tokens per session scan A 259a87526603
sglang-upgrade is a skill published in the GitHub repository redai-infra/Relax (580 stars, last pushed 14d ago), licensed Apache-2.0. It adds 115 tokens to every session and 2,764 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verl-rl-training
Provides guidance for training LLMs with reinforcement learning using verl (Volcano Engine RL). Use when implementing RLHF, GRPO, PPO, or other RL algorithms for LLM post-training at scale with flexible infrastructure backends.
openrlhf-training
High-performance RLHF framework with Ray+vLLM acceleration. Use for PPO, GRPO, RLOO, DPO training of large models (7B-70B+). Built on Ray, vLLM, ZeRO-3. 2× faster than DeepSpeedChat with distributed architecture and GPU resource sharing.
verl-rl-training
Provides guidance for training LLMs with reinforcement learning using verl (Volcano Engine RL). Use when implementing RLHF, GRPO, PPO, or other RL algorithms for LLM post-training at scale with flexible infrastructure backends.
openrlhf-training
High-performance RLHF framework with Ray+vLLM acceleration. Use for PPO, GRPO, RLOO, DPO training of large models (7B-70B+). Built on Ray, vLLM, ZeRO-3. 2× faster than DeepSpeedChat with distributed architecture and GPU resource sharing.
verl-rl-training
Provides guidance for training LLMs with reinforcement learning using verl (Volcano Engine RL). Use when implementing RLHF, GRPO, PPO, or other RL algorithms for LLM post-training at scale with flexible infrastructure backends.
openrlhf-training
High-performance RLHF framework with Ray+vLLM acceleration. Use for PPO, GRPO, RLOO, DPO training of large models (7B-70B+). Built on Ray, vLLM, ZeRO-3. 2× faster than DeepSpeedChat with distributed architecture and GPU resource sharing.