diffusers-workflow 0.4.0a10__tar.gz → 0.4.0b1__tar.gz

{diffusers_workflow-0.4.0a10/diffusers_workflow.egg-info → diffusers_workflow-0.4.0b1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffusers-workflow
-Version: 0.4.0a10
+Version: 0.4.0b1
 Summary: Declarative workflow engine and web UI for Hugging Face Diffusers
 Author: dkackman
 License: Apache-2.0
@@ -79,6 +79,8 @@ Dynamic: license-file
 
 A declarative workflow engine and web UI for the [Hugging Face Diffusers library](https://github.com/huggingface/diffusers). Define image/video generation pipelines in JSON — with full access to the configuration diffusers exposes — and run them from the command line, an interactive REPL, or a browser.
 
+A workflow JSON file is portable and easy to hand off — but that same flexibility means loading one can execute arbitrary Python (dynamic imports are how it reaches any diffusers pipeline or quantization backend without a bespoke adapter for each). Treat a workflow file from someone else the way you'd treat a `.py` script: see [Trust model](docs/SECURITY.md#trust-model) before running one you didn't write.
+
 **Python 3.10-3.14 | CUDA (NVIDIA) | MPS (Apple Silicon) | CPU**
 
 <picture>
@@ -89,10 +91,11 @@ A declarative workflow engine and web UI for the [Hugging Face Diffusers library
 ## Features
 
 - **Web UI** — browse and run workflows, edit them in introspection-driven forms, watch jobs stream live progress, manage generated output and the models on disk. `python -m dw.serve` and open a browser. See [Server & Web UI](docs/SERVER.md).
-- **MCP server** — a stdio server that lets an MCP client (Claude Code first) author, validate, save, run and diagnose workflows against a running `dw.serve`. `dw-mcp`. See [MCP Server](docs/MCP.md).
+- **MCP server** — a tool surface that lets an MCP client (Claude Code first) author, validate, save, run and diagnose workflows against a running `dw.serve`: `dw-mcp` over stdio, or mounted at `/mcp` by `dw.serve --mcp` for a client on another machine. See [MCP Server](docs/MCP.md) and [Remote GPU server](docs/REMOTE.md).
+- **Step-output caching** — a step whose resolved arguments and seed are unchanged since the last run in the same process reuses its cached result instead of re-executing. This applies to any `Workflow.run` — REPL iteration and a re-run of a server-submitted job alike, so re-running a fixed-seed workflow from the UI finishes instantly and writes no new output files. The cache holds the most recent 50 steps and is dropped by `memory clear`
 - **Declarative JSON workflows** with variable substitution and cross-step data flow
 - **Multi-step pipelines** — chain text-to-image, image-to-video, inpainting, ControlNet
-- **Reproducible by construction** — outputs embed their full workflow definition and seed; any image in the gallery reopens as the exact workflow that made it
+- **Reproducible by construction** — outputs embed their full workflow definition and seed; any image in the gallery reopens as the exact workflow that made it (see [Trust model](docs/SECURITY.md#trust-model) before reopening one someone else sent you). A rerun never overwrites a prior output — a name collision gets an incrementing suffix instead
 - **Long-video chaining** — run a video pipeline once per segment and stitch the segments into one clip, with audio-driven length and frame-to-frame continuity
 - **Quantization** — BitsAndBytes, TorchAO, GGUF, SDNQ, optimum-quanto
 - **Inference acceleration** — TeaCache, FirstBlockCache, FasterCache, MagCache, TaylorSeerCache
@@ -153,15 +156,26 @@ Jobs queue, stream progress live (per denoising step), cancel cooperatively, and
 
 ### Run a Workflow
 
+`workflows/sd15.json` is the smallest, fastest starting point — a small, ungated model and a literal prompt, so the first run needs no Hugging Face login and downloads only a few GB:
+
 ```bash
+python -m dw.run workflows/sd15.json
+python -m dw.run workflows/sd15.json prompt="a cat" num_images_per_prompt=4
+```
+
+Most of the workflows under `workflows/` (Flux, LTX-2, MiniMax...) use **gated** Hugging Face models — the repo owner has to approve your account before you can download them. Before running one of those, request access on the model's Hugging Face page (e.g. [black-forest-labs/FLUX.1-dev](https://huggingface.co/black-forest-labs/FLUX.1-dev)) and log in locally:
+
+```bash
+huggingface-cli login
 python -m dw.run workflows/flux/FluxDev.json
-python -m dw.run workflows/flux/FluxDev.json prompt="a cat" num_images_per_prompt=4
 ```
 
+Without this, the run fails partway through with an HTTP 401/403 from the Hub.
+
 ### Validate a Workflow
 
 ```bash
-python -m dw.validate workflows/flux/FluxDev.json
+python -m dw.validate workflows/sd15.json
 ```
 
 ### Interactive REPL
@@ -329,6 +343,7 @@ See [workflows/](workflows/) for more workflow files.
 
 - [Server & Web UI](docs/SERVER.md) — The web UI, jobs API, and introspection service
 - [MCP Server](docs/MCP.md) — Tool surface for MCP clients (Claude Code, Claude Desktop)
+- [Remote GPU server](docs/REMOTE.md) — Using the server, UI and MCP from another machine
 - [Workflow Guide](docs/WORKFLOW_GUIDE.md) — JSON structure, variables, steps, data flow
 - [Quantization](docs/QUANTIZATION.md) — BitsAndBytes, TorchAO, GGUF, SDNQ
 - [Inference Acceleration](docs/ACCELERATION.md) — torch.compile, FirstBlockCache, MagCache, TaylorSeer, TeaCache

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/README.md

@@ -4,6 +4,8 @@
 
 A declarative workflow engine and web UI for the [Hugging Face Diffusers library](https://github.com/huggingface/diffusers). Define image/video generation pipelines in JSON — with full access to the configuration diffusers exposes — and run them from the command line, an interactive REPL, or a browser.
 
+A workflow JSON file is portable and easy to hand off — but that same flexibility means loading one can execute arbitrary Python (dynamic imports are how it reaches any diffusers pipeline or quantization backend without a bespoke adapter for each). Treat a workflow file from someone else the way you'd treat a `.py` script: see [Trust model](docs/SECURITY.md#trust-model) before running one you didn't write.
+
 **Python 3.10-3.14 | CUDA (NVIDIA) | MPS (Apple Silicon) | CPU**
 
 <picture>
@@ -14,10 +16,11 @@ A declarative workflow engine and web UI for the [Hugging Face Diffusers library
 ## Features
 
 - **Web UI** — browse and run workflows, edit them in introspection-driven forms, watch jobs stream live progress, manage generated output and the models on disk. `python -m dw.serve` and open a browser. See [Server & Web UI](docs/SERVER.md).
-- **MCP server** — a stdio server that lets an MCP client (Claude Code first) author, validate, save, run and diagnose workflows against a running `dw.serve`. `dw-mcp`. See [MCP Server](docs/MCP.md).
+- **MCP server** — a tool surface that lets an MCP client (Claude Code first) author, validate, save, run and diagnose workflows against a running `dw.serve`: `dw-mcp` over stdio, or mounted at `/mcp` by `dw.serve --mcp` for a client on another machine. See [MCP Server](docs/MCP.md) and [Remote GPU server](docs/REMOTE.md).
+- **Step-output caching** — a step whose resolved arguments and seed are unchanged since the last run in the same process reuses its cached result instead of re-executing. This applies to any `Workflow.run` — REPL iteration and a re-run of a server-submitted job alike, so re-running a fixed-seed workflow from the UI finishes instantly and writes no new output files. The cache holds the most recent 50 steps and is dropped by `memory clear`
 - **Declarative JSON workflows** with variable substitution and cross-step data flow
 - **Multi-step pipelines** — chain text-to-image, image-to-video, inpainting, ControlNet
-- **Reproducible by construction** — outputs embed their full workflow definition and seed; any image in the gallery reopens as the exact workflow that made it
+- **Reproducible by construction** — outputs embed their full workflow definition and seed; any image in the gallery reopens as the exact workflow that made it (see [Trust model](docs/SECURITY.md#trust-model) before reopening one someone else sent you). A rerun never overwrites a prior output — a name collision gets an incrementing suffix instead
 - **Long-video chaining** — run a video pipeline once per segment and stitch the segments into one clip, with audio-driven length and frame-to-frame continuity
 - **Quantization** — BitsAndBytes, TorchAO, GGUF, SDNQ, optimum-quanto
 - **Inference acceleration** — TeaCache, FirstBlockCache, FasterCache, MagCache, TaylorSeerCache
@@ -78,15 +81,26 @@ Jobs queue, stream progress live (per denoising step), cancel cooperatively, and
 
 ### Run a Workflow
 
+`workflows/sd15.json` is the smallest, fastest starting point — a small, ungated model and a literal prompt, so the first run needs no Hugging Face login and downloads only a few GB:
+
 ```bash
+python -m dw.run workflows/sd15.json
+python -m dw.run workflows/sd15.json prompt="a cat" num_images_per_prompt=4
+```
+
+Most of the workflows under `workflows/` (Flux, LTX-2, MiniMax...) use **gated** Hugging Face models — the repo owner has to approve your account before you can download them. Before running one of those, request access on the model's Hugging Face page (e.g. [black-forest-labs/FLUX.1-dev](https://huggingface.co/black-forest-labs/FLUX.1-dev)) and log in locally:
+
+```bash
+huggingface-cli login
 python -m dw.run workflows/flux/FluxDev.json
-python -m dw.run workflows/flux/FluxDev.json prompt="a cat" num_images_per_prompt=4
 ```
 
+Without this, the run fails partway through with an HTTP 401/403 from the Hub.
+
 ### Validate a Workflow
 
 ```bash
-python -m dw.validate workflows/flux/FluxDev.json
+python -m dw.validate workflows/sd15.json
 ```
 
 ### Interactive REPL
@@ -254,6 +268,7 @@ See [workflows/](workflows/) for more workflow files.
 
 - [Server & Web UI](docs/SERVER.md) — The web UI, jobs API, and introspection service
 - [MCP Server](docs/MCP.md) — Tool surface for MCP clients (Claude Code, Claude Desktop)
+- [Remote GPU server](docs/REMOTE.md) — Using the server, UI and MCP from another machine
 - [Workflow Guide](docs/WORKFLOW_GUIDE.md) — JSON structure, variables, steps, data flow
 - [Quantization](docs/QUANTIZATION.md) — BitsAndBytes, TorchAO, GGUF, SDNQ
 - [Inference Acceleration](docs/ACCELERATION.md) — torch.compile, FirstBlockCache, MagCache, TaylorSeer, TeaCache

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1/diffusers_workflow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffusers-workflow
-Version: 0.4.0a10
+Version: 0.4.0b1
 Summary: Declarative workflow engine and web UI for Hugging Face Diffusers
 Author: dkackman
 License: Apache-2.0
@@ -79,6 +79,8 @@ Dynamic: license-file
 
 A declarative workflow engine and web UI for the [Hugging Face Diffusers library](https://github.com/huggingface/diffusers). Define image/video generation pipelines in JSON — with full access to the configuration diffusers exposes — and run them from the command line, an interactive REPL, or a browser.
 
+A workflow JSON file is portable and easy to hand off — but that same flexibility means loading one can execute arbitrary Python (dynamic imports are how it reaches any diffusers pipeline or quantization backend without a bespoke adapter for each). Treat a workflow file from someone else the way you'd treat a `.py` script: see [Trust model](docs/SECURITY.md#trust-model) before running one you didn't write.
+
 **Python 3.10-3.14 | CUDA (NVIDIA) | MPS (Apple Silicon) | CPU**
 
 <picture>
@@ -89,10 +91,11 @@ A declarative workflow engine and web UI for the [Hugging Face Diffusers library
 ## Features
 
 - **Web UI** — browse and run workflows, edit them in introspection-driven forms, watch jobs stream live progress, manage generated output and the models on disk. `python -m dw.serve` and open a browser. See [Server & Web UI](docs/SERVER.md).
-- **MCP server** — a stdio server that lets an MCP client (Claude Code first) author, validate, save, run and diagnose workflows against a running `dw.serve`. `dw-mcp`. See [MCP Server](docs/MCP.md).
+- **MCP server** — a tool surface that lets an MCP client (Claude Code first) author, validate, save, run and diagnose workflows against a running `dw.serve`: `dw-mcp` over stdio, or mounted at `/mcp` by `dw.serve --mcp` for a client on another machine. See [MCP Server](docs/MCP.md) and [Remote GPU server](docs/REMOTE.md).
+- **Step-output caching** — a step whose resolved arguments and seed are unchanged since the last run in the same process reuses its cached result instead of re-executing. This applies to any `Workflow.run` — REPL iteration and a re-run of a server-submitted job alike, so re-running a fixed-seed workflow from the UI finishes instantly and writes no new output files. The cache holds the most recent 50 steps and is dropped by `memory clear`
 - **Declarative JSON workflows** with variable substitution and cross-step data flow
 - **Multi-step pipelines** — chain text-to-image, image-to-video, inpainting, ControlNet
-- **Reproducible by construction** — outputs embed their full workflow definition and seed; any image in the gallery reopens as the exact workflow that made it
+- **Reproducible by construction** — outputs embed their full workflow definition and seed; any image in the gallery reopens as the exact workflow that made it (see [Trust model](docs/SECURITY.md#trust-model) before reopening one someone else sent you). A rerun never overwrites a prior output — a name collision gets an incrementing suffix instead
 - **Long-video chaining** — run a video pipeline once per segment and stitch the segments into one clip, with audio-driven length and frame-to-frame continuity
 - **Quantization** — BitsAndBytes, TorchAO, GGUF, SDNQ, optimum-quanto
 - **Inference acceleration** — TeaCache, FirstBlockCache, FasterCache, MagCache, TaylorSeerCache
@@ -153,15 +156,26 @@ Jobs queue, stream progress live (per denoising step), cancel cooperatively, and
 
 ### Run a Workflow
 
+`workflows/sd15.json` is the smallest, fastest starting point — a small, ungated model and a literal prompt, so the first run needs no Hugging Face login and downloads only a few GB:
+
 ```bash
+python -m dw.run workflows/sd15.json
+python -m dw.run workflows/sd15.json prompt="a cat" num_images_per_prompt=4
+```
+
+Most of the workflows under `workflows/` (Flux, LTX-2, MiniMax...) use **gated** Hugging Face models — the repo owner has to approve your account before you can download them. Before running one of those, request access on the model's Hugging Face page (e.g. [black-forest-labs/FLUX.1-dev](https://huggingface.co/black-forest-labs/FLUX.1-dev)) and log in locally:
+
+```bash
+huggingface-cli login
 python -m dw.run workflows/flux/FluxDev.json
-python -m dw.run workflows/flux/FluxDev.json prompt="a cat" num_images_per_prompt=4
 ```
 
+Without this, the run fails partway through with an HTTP 401/403 from the Hub.
+
 ### Validate a Workflow
 
 ```bash
-python -m dw.validate workflows/flux/FluxDev.json
+python -m dw.validate workflows/sd15.json
 ```
 
 ### Interactive REPL
@@ -329,6 +343,7 @@ See [workflows/](workflows/) for more workflow files.
 
 - [Server & Web UI](docs/SERVER.md) — The web UI, jobs API, and introspection service
 - [MCP Server](docs/MCP.md) — Tool surface for MCP clients (Claude Code, Claude Desktop)
+- [Remote GPU server](docs/REMOTE.md) — Using the server, UI and MCP from another machine
 - [Workflow Guide](docs/WORKFLOW_GUIDE.md) — JSON structure, variables, steps, data flow
 - [Quantization](docs/QUANTIZATION.md) — BitsAndBytes, TorchAO, GGUF, SDNQ
 - [Inference Acceleration](docs/ACCELERATION.md) — torch.compile, FirstBlockCache, MagCache, TaylorSeer, TeaCache

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/diffusers_workflow.egg-info/SOURCES.txt

@@ -30,6 +30,7 @@ dw/security.py
 dw/serve.py
 dw/settings.py
 dw/step.py
+dw/step_cache.py
 dw/teacache.py
 dw/teacache_models.json
 dw/test.py
@@ -48,6 +49,8 @@ dw/server/__init__.py
 dw/server/app.py
 dw/server/enhancers.py
 dw/server/jobs.py
+dw/server/mcp_mount.py
+dw/server/netinfo.py
 dw/server/updater.py
 dw/server/ui/index.html
 dw/server/ui/assets/abap-08VXUWAP.js
@@ -64,45 +67,45 @@ dw/server/ui/assets/csharp-BKxtCVv1.js
 dw/server/ui/assets/csp-bTuwJoIa.js
 dw/server/ui/assets/css-DIMkf-bt.js
 dw/server/ui/assets/css.worker-B3ciXF_0.js
-dw/server/ui/assets/cssMode-DBf-T_da.js
+dw/server/ui/assets/cssMode-DIA5LESv.js
 dw/server/ui/assets/cypher-CVaqCwHa.js
 dw/server/ui/assets/dart-onAF5SnQ.js
 dw/server/ui/assets/dockerfile-DZFCIeNp.js
 dw/server/ui/assets/ecl-D05T4iGw.js
 dw/server/ui/assets/editor-jjEx9u7D.css
-dw/server/ui/assets/editor.api-B0D5Ygq7.js
+dw/server/ui/assets/editor.api-CuOF-U_A.js
 dw/server/ui/assets/editor.worker-q-txB4vs.js
 dw/server/ui/assets/elixir-6RTg0lbw.js
 dw/server/ui/assets/flow9-C5_-GSwl.js
-dw/server/ui/assets/freemarker2-Br8g4G1T.js
+dw/server/ui/assets/freemarker2-xMcLxHzc.js
 dw/server/ui/assets/fsharp-C8Ef5oNN.js
 dw/server/ui/assets/go-C-y9NEjX.js
 dw/server/ui/assets/graphql-fmXr3nnJ.js
-dw/server/ui/assets/handlebars-BKo1TaOF.js
+dw/server/ui/assets/handlebars-Dbt47IUh.js
 dw/server/ui/assets/hcl-CpzslTdj.js
-dw/server/ui/assets/html-Bis1seyM.js
+dw/server/ui/assets/html-C4QoqgED.js
 dw/server/ui/assets/html.worker-C93Ht9o9.js
-dw/server/ui/assets/htmlMode-D2SOD2MF.js
-dw/server/ui/assets/index-D7eWnTCB.css
-dw/server/ui/assets/index-JyFxgIR9.js
+dw/server/ui/assets/htmlMode-BQ_x-rQl.js
+dw/server/ui/assets/index-BCNGRglb.css
+dw/server/ui/assets/index-C14JKFhY.js
 dw/server/ui/assets/ini-sBoK_t0W.js
 dw/server/ui/assets/java-BEtHBSE6.js
-dw/server/ui/assets/javascript-CkEbVb78.js
+dw/server/ui/assets/javascript-yDlADdyl.js
 dw/server/ui/assets/json.worker-B2V3pomh.js
-dw/server/ui/assets/jsonMode-dVJbYwxg.js
+dw/server/ui/assets/jsonMode-X4znCY4b.js
 dw/server/ui/assets/julia-Bri6UV-V.js
 dw/server/ui/assets/kotlin-BOotOW0E.js
 dw/server/ui/assets/less-B9JPFI3C.js
 dw/server/ui/assets/lexon-CfSJPG6W.js
-dw/server/ui/assets/liquid-Btak-6uF.js
-dw/server/ui/assets/lspLanguageFeatures-BfeZZQbb.js
+dw/server/ui/assets/liquid-CAaCQzwu.js
+dw/server/ui/assets/lspLanguageFeatures-CTJIGm94.js
 dw/server/ui/assets/lua-CsQS60Ue.js
 dw/server/ui/assets/m3-D-oSqn_W.js
 dw/server/ui/assets/markdown-Cimd5fb3.js
-dw/server/ui/assets/mdx-D9KXK7-s.js
+dw/server/ui/assets/mdx-ByHLng1y.js
 dw/server/ui/assets/mips-CIPQ_RoX.js
 dw/server/ui/assets/monaco--ixms01u.css
-dw/server/ui/assets/monaco-ZMCk_MWf.js
+dw/server/ui/assets/monaco-LJZc6TiS.js
 dw/server/ui/assets/msdax-DauUninz.js
 dw/server/ui/assets/mysql-SOo6toE5.js
 dw/server/ui/assets/objective-c-FvmIjYaQ.js
@@ -117,10 +120,10 @@ dw/server/ui/assets/powerquery-D3hlyOfw.js
 dw/server/ui/assets/powershell-DmHpPYUd.js
 dw/server/ui/assets/protobuf-C531GsRP.js
 dw/server/ui/assets/pug-Z5eAx3Zn.js
-dw/server/ui/assets/python-0FnO4xGM.js
+dw/server/ui/assets/python-BCT_lvfW.js
 dw/server/ui/assets/qsharp-DkqhCAOL.js
 dw/server/ui/assets/r-BwWrilGY.js
-dw/server/ui/assets/razor-B6PMzeY4.js
+dw/server/ui/assets/razor-Bw9oTolL.js
 dw/server/ui/assets/redis-ClamHrr6.js
 dw/server/ui/assets/redshift-DT7zqm-g.js
 dw/server/ui/assets/restructuredtext-BYgofb2h.js
@@ -140,21 +143,22 @@ dw/server/ui/assets/swift-Bxkupp3x.js
 dw/server/ui/assets/systemverilog-Bz4Y3fRF.js
 dw/server/ui/assets/tcl-DISqw1ZD.js
 dw/server/ui/assets/ts.worker-D7T1-Ig5.js
-dw/server/ui/assets/tsMode-nxyvZH1t.js
+dw/server/ui/assets/tsMode-BGvHTpYz.js
 dw/server/ui/assets/twig-De2hgUGE.js
-dw/server/ui/assets/typescript-BhBe8aGf.js
+dw/server/ui/assets/typescript-mwKKpQXP.js
 dw/server/ui/assets/typespec-B8J7ngcE.js
 dw/server/ui/assets/vb-DV3o63ZY.js
 dw/server/ui/assets/wgsl-DpFanUEy.js
-dw/server/ui/assets/workers-ChAf-t8A.js
-dw/server/ui/assets/xml-z2r9dHSO.js
-dw/server/ui/assets/yaml-DrcHrz7f.js
+dw/server/ui/assets/workers-BOhWN9wu.js
+dw/server/ui/assets/xml-DuQ6E6P7.js
+dw/server/ui/assets/yaml-D7o22x0f.js
 dw/tasks/audio_utils.py
 dw/tasks/background_remover.py
 dw/tasks/borders.py
 dw/tasks/concat_videos.py
 dw/tasks/depth_estimator.py
 dw/tasks/diffusion_upscale.py
+dw/tasks/dissolve_videos.py
 dw/tasks/format_messages.py
 dw/tasks/gather.py
 dw/tasks/image_to_text.py
@@ -166,6 +170,7 @@ dw/tasks/qr_code.py
 dw/tasks/restore_faces.py
 dw/tasks/rife_model.py
 dw/tasks/segment.py
+dw/tasks/stabilize.py
 dw/tasks/task.py
 dw/tasks/tensor_image.py
 dw/tasks/text_generation.py
@@ -203,6 +208,7 @@ tests/test_device.py
 tests/test_device_helpers.py
 tests/test_device_portability.py
 tests/test_diffusion_upscale.py
+tests/test_dissolve_videos.py
 tests/test_docs_links.py
 tests/test_events.py
 tests/test_examples.py
@@ -213,15 +219,18 @@ tests/test_image_utils.py
 tests/test_integration.py
 tests/test_interpolate_frames.py
 tests/test_introspection.py
+tests/test_jobs_reused.py
 tests/test_list_images.py
 tests/test_mcp_authoring.py
 tests/test_mcp_catalog.py
 tests/test_mcp_client.py
 tests/test_mcp_diagnose.py
+tests/test_mcp_main.py
 tests/test_mcp_media.py
 tests/test_mcp_models.py
 tests/test_mcp_prompts.py
 tests/test_mcp_server.py
+tests/test_mix_audio.py
 tests/test_model_cache.py
 tests/test_modular_pipeline.py
 tests/test_offload_placement.py
@@ -233,6 +242,7 @@ tests/test_previous_results.py
 tests/test_prompt_parser.py
 tests/test_prompt_weighting.py
 tests/test_prompts.py
+tests/test_recenter_crop.py
 tests/test_repl_commands.py
 tests/test_repl_ergonomics.py
 tests/test_repl_hierarchical.py
@@ -240,12 +250,19 @@ tests/test_repl_reorganization.py
 tests/test_repl_worker.py
 tests/test_resize_bucket.py
 tests/test_result.py
+tests/test_result_output_naming.py
 tests/test_scheduler_config.py
 tests/test_schema.py
 tests/test_security.py
 tests/test_segment.py
+tests/test_serve_main.py
 tests/test_server.py
+tests/test_server_downloads.py
+tests/test_server_info.py
+tests/test_server_mcp.py
+tests/test_stabilize.py
 tests/test_step.py
+tests/test_step_cache.py
 tests/test_strip_exif_and_watermark.py
 tests/test_task.py
 tests/test_task_discovery.py
@@ -254,8 +271,11 @@ tests/test_tensor_image.py
 tests/test_text_generation.py
 tests/test_text_sections.py
 tests/test_type_helpers.py
+tests/test_updater.py
 tests/test_variables.py
 tests/test_video_utils.py
 tests/test_worker.py
 tests/test_worker_execute.py
-tests/test_workflow.py
+tests/test_workflow.py
+tests/test_workflow_step_cache.py
+tests/test_workflow_trust.py

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/dw/__init__.py

@@ -29,8 +29,20 @@ warnings.filterwarnings("ignore", category=FutureWarning)
 warnings.filterwarnings("ignore", category=UserWarning)
 warnings.filterwarnings("ignore", category=DeprecationWarning)
 
-# Lazy import torch to avoid import errors when torch isn't available
-# (e.g., when using system Python instead of venv)
+# Eager (but guarded) import of torch. This module's own top-level code needs
+# torch's exceptions/types unconditionally to detect its absence gracefully
+# (see _TORCH_AVAILABLE below) rather than deferring the try/except to first
+# use everywhere torch is touched. It would be nice for a torch-free path like
+# `python -m dw.validate` (pure JSON schema validation) to skip this multi-
+# second import, but that isn't achievable by changing dw/__init__.py alone:
+# dw/validate.py imports dw/workflow.py, which does its own unconditional
+# `import torch` at module scope (Workflow.run() uses torch.Generator() for
+# seeding) - so torch loads regardless of what this module does. Making the
+# import here lazy without also restructuring dw/workflow.py's random-seed
+# handling would just move the cost around, not remove it, and touching
+# dw/workflow.py's import structure is a larger, riskier change than this
+# fix pass is meant to make. Left eager on purpose; see the audit notes for
+# why a real fix needs to start in dw/workflow.py, not here.
 try:
     import torch
     import diffusers

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/dw/events.py

@@ -27,6 +27,10 @@ class RunContext:
     def __init__(self, on_event=None):
         self._on_event = on_event
         self._cancel = threading.Event()
+        # The most recent phase this run reported (see emit_phase/PHASES) -
+        # cancel() reads it to tell a client whether the cancel takes effect
+        # right away or has to wait out an in-flight, non-interruptible phase
+        self._current_phase = None
         # Pipeline cache keys this run resolved - the worker evicts entries a
         # run no longer touches, so an edited workflow drops stale models
         self.touched_pipelines = set()
@@ -40,8 +44,18 @@ class RunContext:
             # A broken sink must not kill a run that is otherwise fine
             logger.warning(f"Progress event sink failed on '{event_type}': {e}")
 
+    def note_phase(self, phase):
+        """Record the run's latest phase - called by emit_phase, read by
+        cancel() to judge whether the current phase can be interrupted."""
+        self._current_phase = phase
+
     def cancel(self):
         self._cancel.set()
+        if self._current_phase in NON_INTERRUPTIBLE_PHASES:
+            # A model load or a task step has no checkpoint to catch this
+            # flag until it finishes - say so, or the client sees the cancel
+            # request go silent for however long that takes
+            self.emit("cancel_pending", phase=self._current_phase)
 
     @property
     def cancelled(self):
@@ -82,6 +96,11 @@ def deactivate_context(token):
 # the run is waiting on, not what any one library is doing internally
 PHASES = ("loading", "cached", "generating", "decoding", "saving", "task")
 
+# Phases with no checkpoint of their own: nothing inside a from_pretrained()
+# call or a task handler consults the cancel flag, so a cancel requested
+# during one of these can only take effect once the phase finishes on its own
+NON_INTERRUPTIBLE_PHASES = ("loading", "task")
+
 
 def emit_phase(phase, detail=None):
     """Report a coarse phase change on the active run.
@@ -92,4 +111,6 @@ def emit_phase(phase, detail=None):
     enough (a handful per step) to carry a free-text detail alongside, which
     is what makes 'loading' readable as 'which model'.
     """
-    get_context().emit("phase", phase=phase, detail=detail)
+    context = get_context()
+    context.note_phase(phase)
+    context.emit("phase", phase=phase, detail=detail)

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/dw/pipeline_processors/chain.py

@@ -35,8 +35,7 @@ import torch
 from diffusers.utils import encode_video, is_av_available
 
 from .. import empty_device_cache
-from ..result import AudioVideo, get_artifact_list
-from ..security import validate_output_path
+from ..result import AudioVideo, get_artifact_list, output_file_path
 from ..tasks.audio_utils import (
     as_channels_samples,
     equal_power_crossfade_join,
@@ -165,6 +164,11 @@ class SegmentedFrames:
         self.paths = list(paths)
         self.total_frames = total_frames
         self.keep_files = keep_files
+        # True once cleanup() has actually removed the files (not when
+        # keep_files skipped that) - a cached Result pointing at a cleaned-up
+        # SegmentedFrames must not be served to a later miss, since the files
+        # a replay would open are gone. See Result.retainable.
+        self.cleaned = False
 
     def __len__(self):
         """Chunk count - one per segment file."""
@@ -191,6 +195,7 @@ class SegmentedFrames:
                 os.remove(path)
             except FileNotFoundError:
                 pass
+        self.cleaned = True
 
 
 class SegmentSpill:
@@ -240,12 +245,14 @@ class SegmentSpill:
                 chain leaves fully playable segments
             sample_rate: Sample rate of that audio
         """
-        path = validate_output_path(
-            os.path.join(
-                self.output_dir,
-                f"{self.base_name}.segment-{len(self.paths):03d}.mp4",
-            ),
+        # A crashed or completed chain leaves segment files behind on disk,
+        # ready to salvage - and the per-wrapper iteration counter (base_name)
+        # restarts at 0 in a fresh process, so a rerun must dedupe through the
+        # same '-N' convention every other output goes through rather than
+        # silently overwriting them.
+        path = output_file_path(
             self.output_dir,
+            f"{self.base_name}.segment-{len(self.paths):03d}.mp4",
         )
 
         audio_track = None

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/dw/pipeline_processors/pipeline.py

@@ -16,6 +16,10 @@ from .remote import remote_text_encoder
 from ..cache_blocks import register_cache_blocks
 from ..teacache import teacache_context
 from ..type_helpers import has_method
+from ..security import (
+    require_trusted_from_pretrained_arguments,
+    require_trusted_pre_load_modules,
+)
 from .. import empty_device_cache, get_device_type, resolve_device
 from diffusers import attention_backend
 
@@ -23,6 +27,7 @@ from diffusers import attention_backend
 # imported where they are used - at module scope they add seconds to every startup
 
 from ..events import WorkflowCancelled, emit_phase, get_context
+from huggingface_hub.errors import HfHubHTTPError
 
 logger = logging.getLogger("dw")
 
@@ -224,8 +229,12 @@ class Pipeline:
         logger.debug(f"Loading pipeline: {self.name}")
 
         # Import modules that need to register with diffusers/transformers before loading
-        # (e.g., sdnq registers its quantization method on import)
-        for module_name in self.configuration.get("pre_load_modules", []):
+        # (e.g., sdnq registers its quantization method on import). This runs
+        # arbitrary python at import time, so an untrusted workflow is refused
+        # here unless --trust-workflows was passed - see docs/SECURITY.md
+        pre_load_modules = self.configuration.get("pre_load_modules", [])
+        require_trusted_pre_load_modules(pre_load_modules)
+        for module_name in pre_load_modules:
             logger.info(f"Pre-loading module: {module_name}")
             importlib.import_module(module_name)
 
@@ -1509,6 +1518,10 @@ def load_component(
     component_type = configuration["component_type"]
     component = None
 
+    # Refused before anything reaches the Hub: an untrusted workflow must not
+    # be able to have diffusers fetch and run code on its behalf
+    require_trusted_from_pretrained_arguments(from_pretrained_arguments, component_name)
+
     # A standard pipeline takes a component as a constructor argument. A modular one
     # cannot: it is built from the component specs in its own index and given the
     # objects afterwards, which is also what keeps load_components() from pulling a
@@ -1537,6 +1550,7 @@ def load_component(
             f"Consider changing torch_dtype from float16 to float32 for {component_name} "
         )
 
+    model_name = None
     try:
         with loading_device(configuration):
             # Load from model name
@@ -1600,12 +1614,44 @@ def load_component(
         )
 
     except Exception as e:
-        # One log line with the full traceback - every error class was logged
-        # and re-raised identically
+        # 401/403 from the Hub means the account behind whatever token (or
+        # lack of one) HfApi is using cannot read this repo - almost always
+        # a gated model the user has not requested access to, or has not
+        # logged in for. A whole-pipeline load raises the HfHubHTTPError
+        # itself; a per-component load gets it wrapped in an EnvironmentError
+        # by diffusers' _get_model_file / transformers' cached_file, so the
+        # cause chain is searched. Every other error (a real outage, a bad
+        # repo id) is logged once with its traceback and re-raised unchanged
+        if _hub_auth_status(e) is not None:
+            repo = model_name or component_name
+            logger.error(
+                f"Hugging Face authentication required loading {component_name} "
+                f"({repo}): {e}",
+                exc_info=True,
+            )
+            raise RuntimeError(
+                f"Model '{repo}' requires Hugging Face authentication - run "
+                f"'huggingface-cli login', or request access at "
+                f"https://huggingface.co/{repo}"
+            ) from e
         logger.error(f"{type(e).__name__} loading {component_name}: {e}", exc_info=True)
         raise
 
 
+def _hub_auth_status(error):
+    """The 401/403 status an exception (or anything in its cause/context
+    chain) carries from the Hub, else None."""
+    seen = set()
+    while error is not None and id(error) not in seen:
+        seen.add(id(error))
+        if isinstance(error, HfHubHTTPError):
+            status = getattr(getattr(error, "response", None), "status_code", None)
+            if status in (401, 403):
+                return status
+        error = error.__cause__ or error.__context__
+    return None
+
+
 def apply_sdnq_optimizations(pipeline, component_names):
     """Apply SDNQ quantized matmul optimization to pipeline components.
 

{diffusers_workflow-0.4.0a10 → diffusers_workflow-0.4.0b1}/dw/previous_results.py

@@ -6,6 +6,7 @@ from .arguments import (
     PREVIOUS_RESULT_PREFIX,
     build_objects,
 )
+from .step_cache import reference_resolves_to
 
 logger = logging.getLogger("dw")
 
@@ -126,13 +127,14 @@ def get_previous_results(previous_results, previous_result_name):
             f"Previous result '{previous_result_name}' not found. Available results: {list(previous_results.keys())}"
         )
 
-    # Find the longest known step name that is a prefix of the reference
-    # followed by ".", and treat the remainder as the property name.
+    # Find the longest known step name the reference resolves to, and treat
+    # the remainder as the property name. The exact-match case returned
+    # above, so every name reaching here is a strict '<name>.' prefix.
     result_name = max(
         (
             name
             for name in previous_results
-            if previous_result_name.startswith(name + ".")
+            if reference_resolves_to(previous_result_name, name)
         ),
         key=len,
         default=None,