Support both Comfy-Org and Kijai author indexes as known HuggingFace fallbacks, aggregate their status in the backend, refresh the cached author index, and update the frontend UI and tests.
Backend:
- Keep CivArchive source page URL distinct from HuggingFace download mirrors in download metadata
- Handle CivitAI hash lookup HTTP errors and unexpected JSON shapes without caching failures
- Allow network JSON requests to return arrays as well as objects
Frontend:
- Escape each item individually when interpolating arrays into HTML templates
- Prefer the selected provider's page URL over cross-provider mirrors in context menus and download targets
- Reuse source link resolution for model info display
Tests:
- Add coverage for CivArchive metadata URL isolation, HTML array escaping, provider array responses, and CivitAI hash lookup caching behavior
Consolidate provider-specific category mapping into resolve_model_category(),
shared JSON request handling into execute_provider_json_request(), sidecar
path resolution into get_or_build_model_sidecar_info(), and progress
reporting into ProgressTracker. Update civitai/civarchive/common sources to
use the unified helpers. Add tests for the new utilities. Remove redundant
frontend wrapper methods from render_format_methods.js.
- Add run_in_background_thread() in __init__.py to unify success/cancel/error
handling for hash calculation and local metadata build progress
- Extract match_model_by_title_generic() in core/matcher.py and use it from
both CivitAI and CivArchive providers to remove duplicated version/file
selection logic
- Enable safetensors header SHA256 extraction by default and report hash source
through progress updates
- Update options_methods.js to match backend progress behavior
- Add tests/test_title_matching_hashing.py covering title matching and hashing
- Minor metadata updates
- Replace remaining direct requests.get calls with request_public_url,
request_source_response, and request_source_json in downloader,
civarchive, civitai, and popular sources
- Use normalize_model_file_info in CivitAI source instead of inline logic
- Update huggingface-author-index.json metadata
- Add tests for civarchive page/search requests and popular base model updates
- Adjust downloader redirect test for new request_public_url behavior
- Add core/network_utils.py with URL validation, public-IP enforcement,
redirect validation, and safe request_public_url/validate_public_http_url helpers
- Replace direct requests calls in downloader/type_utils/sources with
request_public_url so redirects are validated before follow-up
- Replace netloc string checks with host_matches_domain for CivitAI,
CivArchive, and HuggingFace host matching
- Add HuggingFace Xet download backend with progress reporting and
cancellation support via hf_xet/huggingface_hub
- Harden aria2 installer: reject symlinks/special files in archives,
restrict custom aria2c paths to the managed install, and update UI copy
- Normalize paths with realpath and enforce configured model roots in
local hash/metadata routes, plus remove caller-selected metadata_path
injection in sidecar writing
- Sanitize download/network errors to strip signed query strings before
logging or showing them to the user
The URL parser previously required the hostname to contain "civitai.com",
so CivitAI download links using the "civitai.red" domain were treated as
non-CivitAI URLs and rejected.
This extracts the host check into _is_civitai_host() and accepts both
"civitai.com" and "civitai.red" base domains, so resolve/parse flows
handle all CivitAI download links correctly.
- Merge GET and POST aria2 status handlers into one route
- Remove redundant calculate_file_sha256 wrapper and use path_utils directly
- Remove redundant _normalize_archive_image, _normalize_filename, and _similarity wrappers
- Replace urllib with requests for remote JSON fetching in model_list
- Update metadata timestamps
Add an early guard in core/sources/civitai.py to return None for non-string or empty URL inputs before calling urlparse. This prevents exceptions and unexpected behavior when callers pass None or empty values, making the parser more robust.
Dariusz L