Get the file

Download TheTensorTune 1.0

One zip: a Python file, its requirements, and the docs. Four commands from download to workbench — and one of them is cd.

TheTensorTune_v1.0.zip

python TheTensorTune.py

The zip contains TheTensorTune.py, INSTALL.md, LICENSE and requirements.txt. That is all — and it never connects to any other server.

Before you start

What your machine needs

Need	Minimum	Recommended
Python	3.10	3.12
Disk	~2 GB for a first run (libraries + a small model)	More, if you will train bigger models
OS	Linux / macOS / Windows	Linux

Install

Unzip the download and step into the folder. A virtual environment keeps your global Python clean.

unzip TheTensorTune_v1.0.zip -d thetensortune && cd thetensortune
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate

2
2 · Install the six dependencies
Flask serves the workbench; torch, transformers, peft and accelerate handle the training; safetensors handles the weights. That is the whole list.
```
pip install flask==3.1.3 torch transformers==5.17.0 peft==0.21.0 \
  accelerate==1.15.0 safetensors==0.8.0 "huggingface_hub>=0.30"
```
3
3 · Run it
That is the entire build step. The workbench opens on a free local port, and datasets/, runs/ and a small SQLite history appear next to the file.
```
python TheTensorTune.py
```
4
4 · First steps inside
Set TT_TOKEN if the machine is shared, flip FA/EN to your language, then open Learn — the twelve-lesson course takes it from there.

Configuration

TT_TOKEN: Service token. When set, every /api/* route requires it (X-TT-Token header). Set it on shared networks — always.
TT_PORT: HTTP port. Defaults to a free port picked automatically.
TT_HOST: Bind address, default 127.0.0.1. For LAN: 0.0.0.0 — plus a token, no exceptions.
TT_HEADLESS: 1 = do not open the browser. For servers and containers.
TT_DEBUG: 1 = more verbose logging.
TT_LLAMA_CPP: Path to llama-quantize, needed for K-quants like q4_k_m. f16 and q8_0 do not need it.
TT_WEBHOOK_ALLOW_PRIVATE: 1 = allow webhooks to private/loopback targets, for purely local automation.
HF_TOKEN: Hugging Face token for gated models. Can also be pasted in the Model block; never written to disk.

Security notes

01Dataset IDs are locked to the datasets/ folder — no path traversal.
02All HTML is escaped client-side; no stored XSS.
03Webhooks: SSRF filtering, CRLF stripping and HMAC-SHA256 signatures on every notification.
04Tokens are compared in constant time and never appear in query strings or logs.
05Browser POSTs are Origin-checked against CSRF.
06Your HF token lives in memory for the session only — run configs on disk never contain it.