comfygit-core 0.6.0__tar.gz → 0.7.0__tar.gz

comfygit_core-0.6.0/README.md → comfygit_core-0.7.0/PKG-INFO

@@ -1,3 +1,25 @@
+Metadata-Version: 2.5
+Name: comfygit-core
+Version: 0.7.0
+Summary: ComfyGit Core - Git-based ComfyUI environment manager
+Project-URL: Documentation, https://docs.comfygit.org/
+Project-URL: Repository, https://github.com/comfygit-ai/comfygit
+Project-URL: Issues, https://github.com/comfygit-ai/comfygit/issues
+License-File: LICENSE.txt
+Requires-Python: >=3.10
+Requires-Dist: blake3>=0.3.3
+Requires-Dist: huggingface-hub>=0.15.1
+Requires-Dist: packaging>=16.2
+Requires-Dist: requests>=2.32.4
+Requires-Dist: requirements-parser>=0.11.0
+Requires-Dist: tomli>=2.0.1; python_version < '3.11'
+Requires-Dist: tomlkit>=0.11.0
+Requires-Dist: uv>=0.11.15
+Requires-Dist: xxhash>=2.0.0
+Provides-Extra: keyring
+Requires-Dist: keyring>=25.7.0; extra == 'keyring'
+Description-Content-Type: text/markdown
+
 # ComfyGit Core
 
 Core library for programmatic ComfyUI environment and package management. Build custom tools, GUIs, web interfaces, or CI/CD integrations on top of ComfyGit's architecture.
@@ -466,3 +488,34 @@ dependencies = [
     "comfygit-core>=0.3.14,<0.4.0"  # Pin to minor version
 ]
 ```
+
+## Credentials in headless applications
+
+The base `comfygit-core` installation does not require `keyring`. Install
+`comfygit-core[keyring]` when OS-backed credential persistence is wanted; the
+normal `comfygit` CLI includes this extra. An unavailable package or OS backend
+produces a structured error when saving credentials, never plaintext fallback.
+
+`Workspace.open`, `create`, `from_path`, and `open_or_create` accept an optional
+`credential_overrides` mapping keyed by `CredentialProvider`. A nonempty token
+is process-local and takes priority over environment variables, workspace secure
+storage and provider-native login. An explicit `None` requests anonymous
+provider access; omitted providers follow the normal resolution chain. For
+Hugging Face downloads and lookup, anonymous access disables the SDK's saved
+login discovery too. External git helpers/SSH and URL-embedded authentication
+remain the embedding application's responsibility.
+
+```python
+from comfygit_core import Workspace
+from comfygit_core.models import CredentialProvider
+
+workspace = Workspace.open(
+    workspace_path,
+    credential_overrides={CredentialProvider.HUGGINGFACE: None},
+)
+```
+
+No login is required for local operations or public resources that allow
+anonymous access. For authenticated access without keyring, set the appropriate
+provider environment variable or use an existing Hugging Face login. Tokens
+are never exported in environment manifests.

comfygit_core-0.6.0/PKG-INFO → comfygit_core-0.7.0/README.md

@@ -1,22 +1,3 @@
-Metadata-Version: 2.4
-Name: comfygit-core
-Version: 0.6.0
-Summary: ComfyGit Core - Git-based ComfyUI environment manager
-Project-URL: Documentation, https://docs.comfygit.org/
-Project-URL: Repository, https://github.com/comfygit-ai/comfygit
-Project-URL: Issues, https://github.com/comfygit-ai/comfygit/issues
-License-File: LICENSE.txt
-Requires-Python: >=3.10
-Requires-Dist: blake3>=0.3.3
-Requires-Dist: huggingface-hub>=0.11.0
-Requires-Dist: packaging>=16.2
-Requires-Dist: requests>=2.32.4
-Requires-Dist: requirements-parser>=0.11.0
-Requires-Dist: tomlkit>=0.11.0
-Requires-Dist: uv>=0.11.8
-Requires-Dist: xxhash>=2.0.0
-Description-Content-Type: text/markdown
-
 # ComfyGit Core
 
 Core library for programmatic ComfyUI environment and package management. Build custom tools, GUIs, web interfaces, or CI/CD integrations on top of ComfyGit's architecture.
@@ -485,3 +466,34 @@ dependencies = [
     "comfygit-core>=0.3.14,<0.4.0"  # Pin to minor version
 ]
 ```
+
+## Credentials in headless applications
+
+The base `comfygit-core` installation does not require `keyring`. Install
+`comfygit-core[keyring]` when OS-backed credential persistence is wanted; the
+normal `comfygit` CLI includes this extra. An unavailable package or OS backend
+produces a structured error when saving credentials, never plaintext fallback.
+
+`Workspace.open`, `create`, `from_path`, and `open_or_create` accept an optional
+`credential_overrides` mapping keyed by `CredentialProvider`. A nonempty token
+is process-local and takes priority over environment variables, workspace secure
+storage and provider-native login. An explicit `None` requests anonymous
+provider access; omitted providers follow the normal resolution chain. For
+Hugging Face downloads and lookup, anonymous access disables the SDK's saved
+login discovery too. External git helpers/SSH and URL-embedded authentication
+remain the embedding application's responsibility.
+
+```python
+from comfygit_core import Workspace
+from comfygit_core.models import CredentialProvider
+
+workspace = Workspace.open(
+    workspace_path,
+    credential_overrides={CredentialProvider.HUGGINGFACE: None},
+)
+```
+
+No login is required for local operations or public resources that allow
+anonymous access. For authenticated access without keyring, set the appropriate
+provider environment variable or use an existing Hugging Face login. Tokens
+are never exported in environment manifests.

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/docs/architecture.md

@@ -41,7 +41,7 @@ ComfyGit Core is a **library-first Python package** providing environment manage
 |--------|---------|--------------|
 | **core/** | Public API | Workspace (multi-env), Environment (single env) |
 | **models/** | Public typed contracts | Exported data classes, protocols, exceptions with context |
-| **readiness.py**, **workflow.py**, **runtime.py**, **assets.py**, **git.py** | Public facades | Reusable domain helpers promoted for adapters |
+| **readiness.py**, **workflow.py**, **runtime.py**, **assets.py**, **git.py**, **security.py** | Public facades | Reusable domain helpers promoted for adapters |
 | **managers/** | Orchestration | Environment orchestrators (Git, Model), Resource managers (Node, Workflow, Model symlinks), Config managers (PyProject, UV, PyTorch backend) |
 | **manifest/** | Internal manifest abstraction | Pyproject-backed store, section handlers, edit helpers, overlay materialization, migration cleanup |
 | **analyzers/** | Analysis | Parse workflows/git/status; classify nodes |
@@ -79,6 +79,10 @@ ComfyGit Core is a **library-first Python package** providing environment manage
 - `Workspace.create()` - Create new workspace with validation
 - `Workspace.open_or_create()` - Setup-friendly load-or-create entry point
 - `Workspace.list_environments()` / `get_environment()` - List/get environments
+- `Workspace.get_resource_inventory()` / `get_model_inventory()` - Typed model,
+  environment, source, and storage inventory for adapters
+- `Workspace.plan_model_deletion()` / `apply_model_deletion_plan()` - Dry-run-first,
+  location-specific model reclaim with conservative blockers
 - `Workspace.get_schema_version()` / `is_legacy_schema()` - Check workspace version
 - `Workspace.upgrade_schema_if_needed()` - Migrate to current schema
 

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/pyproject.toml

@@ -1,20 +1,24 @@
 [project]
 name = "comfygit-core"
-version = "0.6.0"
+version = "0.7.0"
 description = "ComfyGit Core - Git-based ComfyUI environment manager"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "blake3>=0.3.3",
-    "huggingface_hub>=0.11.0",
+    "huggingface-hub>=0.15.1",
     "packaging>=16.2",
     "requests>=2.32.4",
     "requirements-parser>=0.11.0",
     "tomlkit>=0.11.0",
-    "uv>=0.11.8",
+    "tomli>=2.0.1; python_version < '3.11'",
+    "uv>=0.11.15",
     "xxhash>=2.0.0",
 ]
 
+[project.optional-dependencies]
+keyring = ["keyring>=25.7.0"]
+
 [project.urls]
 Documentation = "https://docs.comfygit.org/"
 Repository = "https://github.com/comfygit-ai/comfygit"

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/analyzers/model_scanner.py

@@ -208,7 +208,13 @@ class ModelScanner:
                 continue
 
             try:
-                if not file_path.is_file() or file_path.is_symlink():
+                # Model libraries commonly use file symlinks to share large
+                # weights between ComfyUI installations or expose a loader's
+                # expected filename as an alias. ``Path.stat()`` and the hash
+                # reader intentionally follow a valid file symlink, while the
+                # indexed location remains the alias path under ``models/``.
+                # Broken links and links to directories still fail is_file().
+                if not file_path.is_file():
                     skipped_not_file += 1
                     continue
 

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/analyzers/unmanaged_comfyui_analyzer.py

@@ -77,6 +77,11 @@ def scan_unmanaged_comfyui(
         ignored_custom_node_names=ignored_custom_node_names,
     )
     version, commit = _detect_comfyui_version(comfyui_path)
+    repository = (
+        _git_output(comfyui_path, "remote", "get-url", "origin")
+        if _is_git_checkout(comfyui_path)
+        else None
+    )
 
     if not workflows:
         warnings.append("No saved workflow JSON files were found.")
@@ -88,6 +93,7 @@ def scan_unmanaged_comfyui(
         python_version=f"{sys.version_info.major}.{sys.version_info.minor}",
         comfyui_version=version,
         comfyui_commit=commit,
+        comfyui_repository=repository,
         workflows=workflows,
         model_references=model_references,
         models_scanned=models_scanned,

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/caching/comfyui_cache.py

@@ -4,9 +4,15 @@ Caches ComfyUI installations by version to avoid re-downloading and re-cloning.
 Supports releases, commits, and branches.
 """
 
+import hashlib
 from dataclasses import dataclass
 from pathlib import Path
 
+from ..constants import DEFAULT_COMFYUI_REPOSITORY
+from ..utils.comfyui_ops import (
+    comfyui_repository_identity,
+    normalize_comfyui_repository,
+)
 from .base import ContentCacheBase
 
 
@@ -16,6 +22,7 @@ class ComfyUISpec:
     version: str              # "v0.3.20", "abc123", "main"
     version_type: str         # "release", "commit", "branch"
     commit_sha: str | None = None  # Actual commit SHA (for branches)
+    repository: str = DEFAULT_COMFYUI_REPOSITORY
 
 
 class ComfyUICacheManager(ContentCacheBase):
@@ -60,12 +67,20 @@ class ComfyUICacheManager(ContentCacheBase):
             # Simple string version
             return f"version_{spec}"
 
-        # Use commit SHA for branches (they can change)
-        if spec.version_type == "branch" and spec.commit_sha:
-            return f"commit_{spec.commit_sha}"
+        repository = normalize_comfyui_repository(spec.repository)
+        repository_identity = comfyui_repository_identity(repository)
+        repository_key = hashlib.sha256(
+            repository_identity.encode("utf-8")
+        ).hexdigest()[:12]
 
-        # For releases and commits, use the version
-        return f"{spec.version_type}_{spec.version}"
+        # Any captured commit is the immutable cache authority, including
+        # snapshots originally described by a branch or release.
+        if spec.commit_sha:
+            revision_key = f"commit_{spec.commit_sha}"
+        else:
+            revision_key = f"{spec.version_type}_{spec.version}"
+
+        return f"source_{repository_key}_{revision_key}"
 
     def cache_comfyui(self, spec: ComfyUISpec, source_path: Path) -> Path:
         """Cache a ComfyUI installation.
@@ -82,7 +97,8 @@ class ComfyUICacheManager(ContentCacheBase):
         metadata = {
             "version": spec.version,
             "version_type": spec.version_type,
-            "commit_sha": spec.commit_sha
+            "commit_sha": spec.commit_sha,
+            "repository": normalize_comfyui_repository(spec.repository),
         }
 
         return self.cache_content(cache_key, source_path, metadata)
@@ -96,5 +112,11 @@ class ComfyUICacheManager(ContentCacheBase):
         Returns:
             Path to cached ComfyUI content, or None if not cached
         """
+        if (
+            isinstance(spec, ComfyUISpec)
+            and spec.version_type == "branch"
+            and not spec.commit_sha
+        ):
+            return None
         cache_key = self.generate_cache_key(spec)
         return self.get_cached_path(cache_key)

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/caching/custom_node_cache.py

@@ -127,9 +127,20 @@ class CustomNodeCacheManager(ContentCacheBase):
         cache_dir = self.store_dir / cache_key
         content_dir = cache_dir / "content"
 
+        if node_info.source == "git" and (content_dir / ".gitmodules").is_file():
+            from ..utils.git import _git
+
+            if not (content_dir / ".git").exists():
+                return False
+            try:
+                status = _git(["submodule", "status", "--recursive"], content_dir)
+                if any(line.startswith(("-", "+", "U")) for line in status.stdout.splitlines()):
+                    return False
+            except (OSError, ValueError):
+                return False
         return content_dir.exists() and any(content_dir.iterdir())
 
-    def get_cached_path(self, node_info: NodeInfo) -> Path | None:
+    def get_cached_node_path(self, node_info: NodeInfo) -> Path | None:
         """Get the path to cached node content if it exists.
 
         Returns:
@@ -225,7 +236,7 @@ class CustomNodeCacheManager(ContentCacheBase):
         Returns:
             True if successfully copied, False otherwise
         """
-        cached_path = self.get_cached_path(node_info)
+        cached_path = self.get_cached_node_path(node_info)
         if not cached_path:
             return False
 

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/clients/civitai_client.py

@@ -82,12 +82,13 @@ class CivitAIClient:
         self.cache_manager = cache_manager
         self.workspace_config = workspace_config
 
-        # Resolve API key: direct > environment > config
-        self._api_key = api_key
-        if not self._api_key:
-            self._api_key = os.environ.get("CIVITAI_API_TOKEN")
-        if not self._api_key and workspace_config:
+        # Workspace resolution owns overrides, environment and secure-store order.
+        if api_key is not None:
+            self._api_key = api_key
+        elif workspace_config is not None:
             self._api_key = workspace_config.get_civitai_token()
+        else:
+            self._api_key = os.environ.get("CIVITAI_API_TOKEN") or os.environ.get("CIVITAI_API_KEY")
 
         self.rate_limiter = RateLimitManager(min_interval=0.1)
         self.retry_config = RetryConfig(

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/constants.py

@@ -93,6 +93,7 @@ PYPROJECT_SCHEMA_VERSION = 2
 DEFAULT_REGISTRY_URL = "https://api.comfy.org"
 DEFAULT_GITHUB_URL = "https://github.com"
 GITHUB_API_BASE = "https://api.github.com"
+DEFAULT_COMFYUI_REPOSITORY = "https://github.com/Comfy-Org/ComfyUI.git"
 
 GITHUB_NODE_MAPPINGS_URL = "https://raw.githubusercontent.com/comfygit-ai/comfygit-registry-data/main/data/node_mappings.json"
 GITHUB_COMFYUI_BUILTINS_BY_VERSION_URL = "https://raw.githubusercontent.com/comfygit-ai/comfygit-registry-data/main/data/comfyui_builtins_by_version.json"

{comfygit_core-0.6.0 → comfygit_core-0.7.0}/src/comfygit_core/core/environment.py

@@ -636,6 +636,31 @@ class Environment:
             missing_models=missing_models
         )
 
+    def _missing_required_materialized_nodes(self) -> list[str]:
+        """Return required manifest nodes absent from the ComfyUI checkout."""
+        scanner = StatusScanner(
+            comfyui_path=self.comfyui_path,
+            venv_path=self.venv_path,
+            uv=self.uv_manager,
+            pyproject=self.pyproject,
+            pytorch_manager=self.pytorch_manager,
+        )
+        comparison = scanner.get_full_comparison(check_package_sync=False)
+        missing = {
+            str(name).casefold()
+            for name in (
+                *comparison.missing_nodes,
+                *comparison.dev_nodes_missing,
+            )
+        }
+        required = []
+        for node in self.pyproject.nodes.get_existing().values():
+            if node.criticality == "optional":
+                continue
+            if node.name.casefold() in missing:
+                required.append(node.name)
+        return sorted(required, key=str.casefold)
+
     def get_lifecycle_status(
         self,
         *,
@@ -992,6 +1017,7 @@ class Environment:
         overlay_names: list[str] | None = None,
         extras: list[str] | None = None,
         all_extras: bool = False,
+        mark_complete: bool = True,
     ) -> SyncResult:
         """Apply changes: sync packages, nodes, workflows, and models with environment.
 
@@ -1009,6 +1035,7 @@ class Environment:
             overlay_names: One-time overlay names for this sync call.
             extras: Optional list of extras to install
             all_extras: Install all optional extras
+            mark_complete: False when import still has acquisition steps to finish.
 
         Returns:
             SyncResult with details of what was synced
@@ -1035,6 +1062,7 @@ class Environment:
             overlay_names=overlay_names,
             extras=extras,
             all_extras=all_extras,
+            mark_complete=mark_complete,
         )
 
     # =====================================================
@@ -2992,8 +3020,12 @@ class Environment:
             ValueError: If ComfyUI already exists or .cec not properly initialized
         """
         from ..caching.comfyui_cache import ComfyUICacheManager, ComfyUISpec
-        from ..utils.comfyui_ops import clone_comfyui
-        from ..utils.git import git_rev_parse
+        from ..utils.comfyui_ops import (
+            clone_comfyui,
+            normalize_comfyui_commit_sha,
+            normalize_comfyui_repository,
+            verify_comfyui_checkout,
+        )
 
         logger.info(f"Finalizing import for environment: {self.name}")
 
@@ -3016,10 +3048,18 @@ class Environment:
             comfyui_manifest_version = self.pyproject.manifest.get_comfyui_version()
             comfyui_version = comfyui_manifest_version.version
             comfyui_version_type = comfyui_manifest_version.version_type
+            comfyui_repository = normalize_comfyui_repository(
+                comfyui_manifest_version.repository
+            )
+            comfyui_commit_sha = normalize_comfyui_commit_sha(
+                comfyui_manifest_version.commit_sha
+            )
         except Exception as e:
             logger.warning(f"Could not read comfyui_version from pyproject.toml: {e}")
             comfyui_version = None
             comfyui_version_type = None
+            comfyui_repository = normalize_comfyui_repository(None)
+            comfyui_commit_sha = None
 
         if comfyui_version:
             version_desc = f"{comfyui_version_type} {comfyui_version}" if comfyui_version_type else comfyui_version
@@ -3039,8 +3079,10 @@ class Environment:
         spec = ComfyUISpec(
             version=comfyui_version or "main",
             version_type=comfyui_version_type or "branch",
-            commit_sha=None
+            commit_sha=comfyui_commit_sha,
+            repository=comfyui_repository,
         )
+        clone_ref = comfyui_commit_sha or comfyui_version
 
         # Check cache first
         cached_path = comfyui_cache.get_cached_comfyui(spec)
@@ -3050,14 +3092,35 @@ class Environment:
                 callbacks.on_phase("restore_comfyui", f"Restoring ComfyUI {spec.version} from cache...")
             logger.info(f"Restoring ComfyUI {spec.version} from cache")
             shutil.copytree(cached_path, self.comfyui_path)
+            actual_commit = verify_comfyui_checkout(
+                self.comfyui_path,
+                repository=comfyui_repository,
+                commit_sha=comfyui_commit_sha,
+            )
+            logger.info(
+                "Verified cached ComfyUI origin and commit %s",
+                actual_commit[:12],
+            )
         else:
             if callbacks:
                 callbacks.on_phase("clone_comfyui", f"Cloning ComfyUI {spec.version}...")
-            logger.info(f"Cloning ComfyUI {spec.version}")
-            clone_comfyui(self.comfyui_path, comfyui_version)
+            logger.info(
+                "Cloning ComfyUI %s from %s",
+                clone_ref or "default branch",
+                comfyui_repository,
+            )
+            clone_comfyui(
+                self.comfyui_path,
+                clone_ref,
+                repository=comfyui_repository,
+            )
 
             # Cache the fresh clone
-            commit_sha = git_rev_parse(self.comfyui_path, "HEAD")
+            commit_sha = verify_comfyui_checkout(
+                self.comfyui_path,
+                repository=comfyui_repository,
+                commit_sha=comfyui_commit_sha,
+            )
             if commit_sha:
                 spec.commit_sha = commit_sha
                 comfyui_cache.cache_comfyui(spec, self.comfyui_path)
@@ -3238,7 +3301,7 @@ class Environment:
         try:
             # During import, don't remove ComfyUI builtins (fresh clone has example files)
             # Enable verbose to show real-time uv output during dependency installation
-            sync_result = self.sync(remove_extra_nodes=False, sync_callbacks=callbacks, verbose=True)
+            sync_result = self.sync(remove_extra_nodes=False, sync_callbacks=callbacks, verbose=True, mark_complete=False)
             if sync_result.success and sync_result.nodes_installed and callbacks:
                 for node_name in sync_result.nodes_installed:
                     callbacks.on_node_installed(node_name)
@@ -3248,6 +3311,13 @@ class Environment:
             if fail_on_sync_errors and not sync_result.success:
                 error_text = "; ".join(sync_result.errors) if sync_result.errors else "unknown sync error"
                 raise RuntimeError(f"Environment sync failed during materialization: {error_text}")
+            if fail_on_sync_errors:
+                missing_required_nodes = self._missing_required_materialized_nodes()
+                if missing_required_nodes:
+                    raise RuntimeError(
+                        "Environment materialization is missing required custom nodes: "
+                        + ", ".join(missing_required_nodes)
+                    )
         except Exception as e:
             if callbacks:
                 callbacks.on_error(f"Node sync failed: {e}")
@@ -3258,19 +3328,6 @@ class Environment:
         if callbacks:
             callbacks.on_phase("resolve_models", f"Resolving workflows ({model_strategy} strategy)...")
 
-        # Always prepare models to copy sources from global table, even for "skip"
-        # This ensures download intents are preserved for later resolution
-        workflows_with_intents = self.model_manager.prepare_import_with_model_strategy(model_strategy)
-
-        # Only auto-resolve if not "skip" strategy
-        workflows_to_resolve = [] if model_strategy == "skip" else workflows_with_intents
-
-        # prepare_import_with_model_strategy() may update pyproject model entries.
-        # Invalidate per-workflow cache entries so resolve_workflow() sees fresh
-        # download intents instead of stale session-cached resolutions.
-        for workflow_name in workflows_to_resolve:
-            self.workflow_cache.invalidate(self.name, workflow_name)
-
         # Resolve workflows with download intents
         from ..models.workflow import BatchDownloadCallbacks
         from ..strategies.auto import AutoModelStrategy, AutoNodeStrategy
@@ -3288,8 +3345,30 @@ class Environment:
                 on_batch_complete=callbacks.on_download_batch_complete
             )
 
+        for download in self.model_manager.download_environment_models(model_strategy, download_callbacks):
+            if not download.success:
+                download_failures.append(("environment", download.filename))
+
+        # Always prepare models to copy sources from global table, even for "skip"
+        # This ensures download intents are preserved for later resolution
+        workflows_with_intents = self.model_manager.prepare_import_with_model_strategy(model_strategy)
+
+        # Only auto-resolve if not "skip" strategy
+        workflows_to_resolve = [] if model_strategy == "skip" else workflows_with_intents
+
+        # prepare_import_with_model_strategy() may update pyproject model entries.
+        # Invalidate per-workflow cache entries so resolve_workflow() sees fresh
+        # download intents instead of stale session-cached resolutions.
+        for workflow_name in workflows_to_resolve:
+            self.workflow_cache.invalidate(self.name, workflow_name)
+
         for workflow_name in workflows_to_resolve:
             try:
+                manifest_downloads = self.workflow_manager.execute_manifest_downloads(
+                    workflow_name,
+                    self.pyproject.workflows.get_workflow_models(workflow_name),
+                    download_callbacks,
+                )
                 result = self.resolve_workflow(
                     name=workflow_name,
                     model_strategy=AutoModelStrategy(),
@@ -3298,10 +3377,11 @@ class Environment:
                 )
 
                 # Track successful vs failed downloads from actual download results
-                successful_downloads = sum(1 for dr in result.download_results if dr.success)
+                all_downloads = [*manifest_downloads, *result.download_results]
+                successful_downloads = sum(1 for dr in all_downloads if dr.success)
                 failed_downloads = [
                     (workflow_name, dr.filename)
-                    for dr in result.download_results
+                    for dr in all_downloads
                     if not dr.success
                 ]
 
@@ -3311,6 +3391,7 @@ class Environment:
                     callbacks.on_workflow_resolved(workflow_name, successful_downloads)
 
             except Exception as e:
+                download_failures.append((workflow_name, str(e)))
                 if callbacks:
                     callbacks.on_error(f"Failed to resolve {workflow_name}: {e}")
 
@@ -3318,6 +3399,18 @@ class Environment:
         if download_failures and callbacks:
             callbacks.on_download_failures(download_failures)
 
+        if download_failures and model_strategy != "skip":
+            from ..models.exceptions import CDModelDownloadError
+
+            formatted_failures = ", ".join(
+                f"{model_name} (from {workflow_name})"
+                for workflow_name, model_name in download_failures
+            )
+            raise CDModelDownloadError(
+                f"{len(download_failures)} model(s) failed to download: {formatted_failures}",
+                failures=download_failures
+            )
+
         if no_manager:
             self._set_headless_marker()
 
@@ -3331,18 +3424,6 @@ class Environment:
             self.git_manager.commit_with_identity("Imported environment", add_all=True)
             logger.info("Committed import changes")
 
-        if download_failures and model_strategy != "skip":
-            from ..models.exceptions import CDModelDownloadError
-
-            formatted_failures = ", ".join(
-                f"{model_name} (from {workflow_name})"
-                for workflow_name, model_name in download_failures
-            )
-            raise CDModelDownloadError(
-                f"{len(download_failures)} model(s) failed to download: {formatted_failures}",
-                failures=download_failures
-            )
-
         logger.info("Import finalization completed successfully")
 
     def _strip_local_path_sources(self) -> None: