Enable matching files in the HuggingFace author index by SHA-256 in
addition to filename. Enrich the author index with hashes from repo
tree responses, store them in the index metadata, and use them as a
primary lookup path during search_huggingface_for_file before falling
back to filename-based search. Also update the author index cache
version to 2 and add tests for the new behavior.
- Skip name fallback in search provider runner when request already has sha256
- Add direct SQLite hash lookup in lora_manager_archive with result caching
- Add timing and logging for archive search
- Refresh HuggingFace author index metadata
- Add tests for hash search and provider fallback behavior
Support both Comfy-Org and Kijai author indexes as known HuggingFace fallbacks, aggregate their status in the backend, refresh the cached author index, and update the frontend UI and tests.
Backend:
- Keep CivArchive source page URL distinct from HuggingFace download mirrors in download metadata
- Handle CivitAI hash lookup HTTP errors and unexpected JSON shapes without caching failures
- Allow network JSON requests to return arrays as well as objects
Frontend:
- Escape each item individually when interpolating arrays into HTML templates
- Prefer the selected provider's page URL over cross-provider mirrors in context menus and download targets
- Reuse source link resolution for model info display
Tests:
- Add coverage for CivArchive metadata URL isolation, HTML array escaping, provider array responses, and CivitAI hash lookup caching behavior
Consolidate provider-specific category mapping into resolve_model_category(),
shared JSON request handling into execute_provider_json_request(), sidecar
path resolution into get_or_build_model_sidecar_info(), and progress
reporting into ProgressTracker. Update civitai/civarchive/common sources to
use the unified helpers. Add tests for the new utilities. Remove redundant
frontend wrapper methods from render_format_methods.js.
- Add run_in_background_thread() in __init__.py to unify success/cancel/error
handling for hash calculation and local metadata build progress
- Extract match_model_by_title_generic() in core/matcher.py and use it from
both CivitAI and CivArchive providers to remove duplicated version/file
selection logic
- Enable safetensors header SHA256 extraction by default and report hash source
through progress updates
- Update options_methods.js to match backend progress behavior
- Add tests/test_title_matching_hashing.py covering title matching and hashing
- Minor metadata updates
- Replace remaining direct requests.get calls with request_public_url,
request_source_response, and request_source_json in downloader,
civarchive, civitai, and popular sources
- Use normalize_model_file_info in CivitAI source instead of inline logic
- Update huggingface-author-index.json metadata
- Add tests for civarchive page/search requests and popular base model updates
- Adjust downloader redirect test for new request_public_url behavior
- Add core/network_utils.py with URL validation, public-IP enforcement,
redirect validation, and safe request_public_url/validate_public_http_url helpers
- Replace direct requests calls in downloader/type_utils/sources with
request_public_url so redirects are validated before follow-up
- Replace netloc string checks with host_matches_domain for CivitAI,
CivArchive, and HuggingFace host matching
- Add HuggingFace Xet download backend with progress reporting and
cancellation support via hf_xet/huggingface_hub
- Harden aria2 installer: reject symlinks/special files in archives,
restrict custom aria2c paths to the managed install, and update UI copy
- Normalize paths with realpath and enforce configured model roots in
local hash/metadata routes, plus remove caller-selected metadata_path
injection in sidecar writing
- Sanitize download/network errors to strip signed query strings before
logging or showing them to the user
Dariusz L