hf-cli skill auto-installs; endpoint engine flags without custom image

🤖 The hf-cli skill installs itself and stays in sync

The hf-cli skill teaches AI agents how to use the hf CLI, but until now you had to know it existed and install it by hand. The standalone installers (bash and PowerShell) now install it globally by default, pass --exclude-skill / -ExcludeSkill to skip — and hf update refreshes it afterwards, without ever bringing it back if you opted out or removed it. Any hf command also hints, at most once a day, when the skill is missing or was generated by another hf version. The hint is purely local, never installs anything on its own, and is silenced by HF_HUB_DISABLE_UPDATE_CHECK=1.

# The installer sets up the skill for you...
>>> curl -LsSf https://hf.co/cli/install.sh | bash -s
[INFO] Installing the hf-cli skill for AI agents...
Installed 'hf-cli' to central location: ~/.agents/skills/hf-cli
[INFO] Pass --exclude-skill to skip it.

# ...or skip it entirely
>>> curl -LsSf https://hf.co/cli/install.sh | bash -s -- --exclude-skill
[INFO] Skipping the hf-cli skill (--exclude-skill)

• [CLI] Install & refresh the hf-cli skill (installer, update, hints) by @Wauplin in #4608

⚙️ Engine flags for Inference Endpoints, at deploy time and after

--container-command / --container-args no longer require --custom-image. That gate was conservative CLI scoping, not an API constraint: model.command and model.args are top-level fields of the endpoint payload and apply to managed engine images too, which is how the vLLM engine docs recommend passing engine flags. They can now also be changed after deploy — hf endpoints update gained both flags, and HfApi.update_inference_endpoint / InferenceEndpoint.update the matching container_command / container_args parameters. Values replace rather than append: pass an empty string to reset to the image default, or omit the flag to leave it untouched. --health-route and --port still require --custom-image, since they only exist on the custom image payload.

# Engine flags at deploy time, no custom image required anymore
>>> hf endpoints deploy my-endpoint --repo gpt2 --framework pytorch \
      --accelerator cpu --instance-size x2 --instance-type intel-icl \
      --region us-east-1 --vendor aws \
      --container-args "--max-model-len 8192"

# Change engine flags on an existing endpoint (previously UI / raw API only)
>>> hf endpoints update my-endpoint --container-args "--enable-auto-tool-choice --tool-call-parser lfm2"

# Reset to the image defaults
>>> hf endpoints update my-endpoint --container-args ""

• [Inference Endpoints] Allow container command/args without custom image + support them in update by @gary149 in #4628

🚀 Baseten joins the inference providers

Baseten is now supported for the conversational task. It serves an OpenAI-compatible chat completions API, so there are no provider-specific quirks: target it with provider="baseten" and your own key, or let auto-routing pick it for any model already mapped on the Hub.

>>> from huggingface_hub import InferenceClient

>>> client = InferenceClient(provider="baseten", api_key="<BASETEN_API_KEY>")
>>> out = client.chat_completion(
...     model="zai-org/GLM-5.2",
...     messages=[{"role": "user", "content": "Hello!"}],
... )
>>> print(out.choices[0].message.content)

• [Inference] Add Baseten as inference provider by @AlexKer in #3414

🔧 Other QoL Improvements

• [HfApi] Add region to ExpandSpaceProperty_T by @hanouticelina in #4641 — the Hub added region as an expandable property for Spaces; it is now accepted by space_info / list_spaces and typed on SpaceInfo as Literal["us", "eu"] | None — docs
• [Xet] Bump minimum hf-xet to 1.5.2 by @hanouticelina in #4640 — 1.5.2 fixes possible hangs on poor networks, but the floor was still 1.5.1, so fresh installs could land on the buggy version
• Serialize model first in conversational payloads by @moon-bot-app[bot] in #4618 — routers can now resolve the provider from a small prefix instead of buffering a whole payload of base64 images. The resulting dicts are equal, only the key order changes

🐛 Bug and typo fixes

• [HfFileSystem] Fix bucket prefix collisions by @lewtun in #4630 — the Buckets API applies prefix lexically, so in a bucket holding logs_existing/ but no logs/, exists(".../logs/new.txt") raised KeyError and ls(".../logs") could return the unrelated sibling. Listings are now filtered on path-component boundaries
• [Cache] Stop deleting snapshot files twice when deleting a revision by @hanouticelina in #4639 — snapshot files that aren't symlinks into blobs/ (Windows copies, or files created by the user inside a snapshot dir) were deleted a second time as blobs, logging a FileNotFoundError traceback each. Reported freed size is unchanged, and per-path delete lines moved to debug
• [Download] Don't retain caller frames when falling back to cache after a failed HEAD call by @Wauplin in #4614 — the swallowed HEAD exception kept its traceback, and with it the whole caller stack, alive until the next gc.collect(); vLLM had to monkey-patch this. Also fixes a v1.0 regression where http_backoff retried on an httpx client already closed by a previous ConnectError

🏗️ Internal

• [Tests] Fix two Windows-only CI failures + flaky-CI findings by @Wauplin in #4615
• Bump pinned doc-builder workflow SHA to 23dc84b by @mishig25 in #4617
• Bump the actions group with 10 updates by @dependabot[bot] in #4636
• Post-release: bump version to 1.27.0.dev0 by @huggingface-hub-bot[bot] in #4616