diffusers-workflow 0.4.0b4__tar.gz → 0.4.0b5__tar.gz

{diffusers_workflow-0.4.0b4/diffusers_workflow.egg-info → diffusers_workflow-0.4.0b5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffusers-workflow
-Version: 0.4.0b4
+Version: 0.4.0b5
 Summary: Declarative workflow engine and web UI for Hugging Face Diffusers
 Author: dkackman
 License: Apache-2.0
@@ -68,7 +68,7 @@ Requires-Dist: pytest-timeout>=2.4.0; extra == "dev"
 Requires-Dist: pytest-mock>=3.15.1; extra == "dev"
 Requires-Dist: pytest-asyncio>=1.4.0; extra == "dev"
 Requires-Dist: httpx>=0.28.1; extra == "dev"
-Requires-Dist: black>=26.5.1; extra == "dev"
+Requires-Dist: ruff>=0.15.0; extra == "dev"
 Requires-Dist: build; extra == "dev"
 Requires-Dist: mcp>=2.1.1; extra == "dev"
 Dynamic: license-file
@@ -295,3 +295,4 @@ frame interpolation and more.
 - [Security](docs/SECURITY.md) — Security model
 - [Testing](docs/TESTING.md) — Running the test suite
 - [Releasing](docs/RELEASING.md) — Cutting a release from a version tag
+- [Agent Loop](docs/AGENT_LOOP.md) — What the automated implementer/tester ticket labels mean, for anyone joining an Issue

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/README.md

@@ -220,3 +220,4 @@ frame interpolation and more.
 - [Security](docs/SECURITY.md) — Security model
 - [Testing](docs/TESTING.md) — Running the test suite
 - [Releasing](docs/RELEASING.md) — Cutting a release from a version tag
+- [Agent Loop](docs/AGENT_LOOP.md) — What the automated implementer/tester ticket labels mean, for anyone joining an Issue

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5/diffusers_workflow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffusers-workflow
-Version: 0.4.0b4
+Version: 0.4.0b5
 Summary: Declarative workflow engine and web UI for Hugging Face Diffusers
 Author: dkackman
 License: Apache-2.0
@@ -68,7 +68,7 @@ Requires-Dist: pytest-timeout>=2.4.0; extra == "dev"
 Requires-Dist: pytest-mock>=3.15.1; extra == "dev"
 Requires-Dist: pytest-asyncio>=1.4.0; extra == "dev"
 Requires-Dist: httpx>=0.28.1; extra == "dev"
-Requires-Dist: black>=26.5.1; extra == "dev"
+Requires-Dist: ruff>=0.15.0; extra == "dev"
 Requires-Dist: build; extra == "dev"
 Requires-Dist: mcp>=2.1.1; extra == "dev"
 Dynamic: license-file
@@ -295,3 +295,4 @@ frame interpolation and more.
 - [Security](docs/SECURITY.md) — Security model
 - [Testing](docs/TESTING.md) — Running the test suite
 - [Releasing](docs/RELEASING.md) — Cutting a release from a version tag
+- [Agent Loop](docs/AGENT_LOOP.md) — What the automated implementer/tester ticket labels mean, for anyone joining an Issue

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/diffusers_workflow.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ dw/for_each.py
 dw/host_memory.py
 dw/hub_cache.py
 dw/introspection.py
+dw/locations.py
 dw/log_setup.py
 dw/media_info.py
 dw/plan.py
@@ -26,6 +27,7 @@ dw/prompt_schema.json
 dw/prompt_weighting.py
 dw/prompts.py
 dw/realize.py
+dw/reference_limits.py
 dw/repl.py
 dw/repl_commands.py
 dw/repl_worker.py
@@ -39,6 +41,7 @@ dw/settings.py
 dw/step.py
 dw/step_cache.py
 dw/subfolders.py
+dw/task_domains.py
 dw/teacache.py
 dw/teacache_models.json
 dw/test.py
@@ -52,6 +55,7 @@ dw/workflow_sources.py
 dw/workspace.py
 dw/community_pipelines/pipeline_flux_rf_inversion.py
 dw/docs/ACCELERATION.md
+dw/docs/AGENT_LOOP.md
 dw/docs/DEPENDENCIES.md
 dw/docs/IP_ADAPTER.md
 dw/docs/LORAS.md
@@ -99,45 +103,45 @@ dw/server/ui/assets/csharp-BKxtCVv1.js
 dw/server/ui/assets/csp-bTuwJoIa.js
 dw/server/ui/assets/css-DIMkf-bt.js
 dw/server/ui/assets/css.worker-B3ciXF_0.js
-dw/server/ui/assets/cssMode-_LF3nQQz.js
+dw/server/ui/assets/cssMode-BQ03gENP.js
 dw/server/ui/assets/cypher-CVaqCwHa.js
 dw/server/ui/assets/dart-onAF5SnQ.js
 dw/server/ui/assets/dockerfile-DZFCIeNp.js
 dw/server/ui/assets/ecl-D05T4iGw.js
 dw/server/ui/assets/editor-jjEx9u7D.css
-dw/server/ui/assets/editor.api-Df8mF5HS.js
+dw/server/ui/assets/editor.api-CzvLX8mb.js
 dw/server/ui/assets/editor.worker-q-txB4vs.js
 dw/server/ui/assets/elixir-6RTg0lbw.js
 dw/server/ui/assets/flow9-C5_-GSwl.js
-dw/server/ui/assets/freemarker2-BFhhUaaI.js
+dw/server/ui/assets/freemarker2-C8c7lwsP.js
 dw/server/ui/assets/fsharp-C8Ef5oNN.js
 dw/server/ui/assets/go-C-y9NEjX.js
 dw/server/ui/assets/graphql-fmXr3nnJ.js
-dw/server/ui/assets/handlebars-uOyL83kB.js
+dw/server/ui/assets/handlebars-7APo_5hD.js
 dw/server/ui/assets/hcl-CpzslTdj.js
-dw/server/ui/assets/html-CNOcS1qq.js
+dw/server/ui/assets/html-JgrkBemQ.js
 dw/server/ui/assets/html.worker-C93Ht9o9.js
-dw/server/ui/assets/htmlMode-BrZs8ZFo.js
-dw/server/ui/assets/index-BkC2KOK-.js
-dw/server/ui/assets/index-Dvcgq7CV.css
+dw/server/ui/assets/htmlMode-BH9VsgGh.js
+dw/server/ui/assets/index-B1DfbIuu.js
+dw/server/ui/assets/index-CRVAbEJ9.css
 dw/server/ui/assets/ini-sBoK_t0W.js
 dw/server/ui/assets/java-BEtHBSE6.js
-dw/server/ui/assets/javascript-BjmXvHYV.js
+dw/server/ui/assets/javascript-BrFJ1H6j.js
 dw/server/ui/assets/json.worker-B2V3pomh.js
-dw/server/ui/assets/jsonMode-CUpeMAA9.js
+dw/server/ui/assets/jsonMode-C10gRe-2.js
 dw/server/ui/assets/julia-Bri6UV-V.js
 dw/server/ui/assets/kotlin-BOotOW0E.js
 dw/server/ui/assets/less-B9JPFI3C.js
 dw/server/ui/assets/lexon-CfSJPG6W.js
-dw/server/ui/assets/liquid-CDCYHjo5.js
-dw/server/ui/assets/lspLanguageFeatures-C3BQ9bHy.js
+dw/server/ui/assets/liquid-CjfGWTAZ.js
+dw/server/ui/assets/lspLanguageFeatures-O-lB5SDv.js
 dw/server/ui/assets/lua-CsQS60Ue.js
 dw/server/ui/assets/m3-D-oSqn_W.js
 dw/server/ui/assets/markdown-Cimd5fb3.js
-dw/server/ui/assets/mdx-Z0OBIKet.js
+dw/server/ui/assets/mdx-D7b-hMTY.js
 dw/server/ui/assets/mips-CIPQ_RoX.js
 dw/server/ui/assets/monaco--ixms01u.css
-dw/server/ui/assets/monaco-CXIxqF1g.js
+dw/server/ui/assets/monaco-DBnxML20.js
 dw/server/ui/assets/msdax-DauUninz.js
 dw/server/ui/assets/mysql-SOo6toE5.js
 dw/server/ui/assets/objective-c-FvmIjYaQ.js
@@ -152,10 +156,10 @@ dw/server/ui/assets/powerquery-D3hlyOfw.js
 dw/server/ui/assets/powershell-DmHpPYUd.js
 dw/server/ui/assets/protobuf-C531GsRP.js
 dw/server/ui/assets/pug-Z5eAx3Zn.js
-dw/server/ui/assets/python-zEGBkDvi.js
+dw/server/ui/assets/python-NfJjzkPL.js
 dw/server/ui/assets/qsharp-DkqhCAOL.js
 dw/server/ui/assets/r-BwWrilGY.js
-dw/server/ui/assets/razor-QEBcCsTz.js
+dw/server/ui/assets/razor-CgQtwMBj.js
 dw/server/ui/assets/redis-ClamHrr6.js
 dw/server/ui/assets/redshift-DT7zqm-g.js
 dw/server/ui/assets/restructuredtext-BYgofb2h.js
@@ -175,15 +179,15 @@ dw/server/ui/assets/swift-Bxkupp3x.js
 dw/server/ui/assets/systemverilog-Bz4Y3fRF.js
 dw/server/ui/assets/tcl-DISqw1ZD.js
 dw/server/ui/assets/ts.worker-D7T1-Ig5.js
-dw/server/ui/assets/tsMode-YMmO0OvA.js
+dw/server/ui/assets/tsMode-BuMW6Qar.js
 dw/server/ui/assets/twig-De2hgUGE.js
-dw/server/ui/assets/typescript-DmCSelwV.js
+dw/server/ui/assets/typescript-Bfmxt754.js
 dw/server/ui/assets/typespec-B8J7ngcE.js
 dw/server/ui/assets/vb-DV3o63ZY.js
 dw/server/ui/assets/wgsl-DpFanUEy.js
-dw/server/ui/assets/workers-DNhR6kh1.js
-dw/server/ui/assets/xml-B9wx0o_u.js
-dw/server/ui/assets/yaml-DRuGviYp.js
+dw/server/ui/assets/workers-BSu9lD5s.js
+dw/server/ui/assets/xml-BJ2IwGRC.js
+dw/server/ui/assets/yaml-Cq85tEmC.js
 dw/tasks/audio_utils.py
 dw/tasks/background_remover.py
 dw/tasks/borders.py
@@ -269,6 +273,7 @@ tests/test_jobs_listing.py
 tests/test_jobs_reused.py
 tests/test_library_sources.py
 tests/test_list_images.py
+tests/test_locations.py
 tests/test_ltx_prompt_library.py
 tests/test_mcp_assets.py
 tests/test_mcp_authoring.py
@@ -303,6 +308,7 @@ tests/test_prompt_weighting.py
 tests/test_prompts.py
 tests/test_realize.py
 tests/test_recenter_crop.py
+tests/test_reference_limits.py
 tests/test_repl_commands.py
 tests/test_repl_ergonomics.py
 tests/test_repl_hierarchical.py
@@ -334,6 +340,7 @@ tests/test_strip_exif_and_watermark.py
 tests/test_subfolders.py
 tests/test_task.py
 tests/test_task_discovery.py
+tests/test_task_domains.py
 tests/test_teacache.py
 tests/test_template_subfolders.py
 tests/test_tensor_image.py

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/diffusers_workflow.egg-info/requires.txt

@@ -47,7 +47,7 @@ pytest-timeout>=2.4.0
 pytest-mock>=3.15.1
 pytest-asyncio>=1.4.0
 httpx>=0.28.1
-black>=26.5.1
+ruff>=0.15.0
 build
 mcp>=2.1.1
 

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/dw/arguments.py

@@ -17,6 +17,7 @@ from .security import (
     ALLOWED_VIDEO_EXTENSIONS,
     ALLOWED_AUDIO_EXTENSIONS,
 )
+from .locations import validate_media_path, validate_media_url
 
 logger = logging.getLogger("dw")
 
@@ -905,7 +906,7 @@ def fetch_image(img_spec, base_dir=None):
 
     # If already a PIL Image, return as-is (allows multiple realize_args calls)
     if hasattr(img_spec, "mode") and hasattr(img_spec, "size"):
-        logger.debug(f"Image already loaded, returning as-is")
+        logger.debug("Image already loaded, returning as-is")
         return img_spec
 
     # Handle dict format: {"location": "url_or_path"}
@@ -931,12 +932,13 @@ def fetch_image(img_spec, base_dir=None):
         if isinstance(img_spec, str) and (
             img_spec.startswith("http://") or img_spec.startswith("https://")
         ):
-            validated_url = validate_url(img_spec)
+            validated_url = validate_media_url(img_spec, "an image argument")
             return load_image(validated_url)
         else:
-            # Treat as file path, relative to the workflow file
-            validated_path = validate_path(
-                resolve_relative_path(str(img_spec), base_dir), allow_create=False
+            # Treat as file path, relative to the workflow file, and confined
+            # to the directories this workflow may read (dw/locations.py)
+            validated_path = validate_media_path(
+                str(img_spec), base_dir, "an image argument"
             )
             # Validate file extension
             ext = os.path.splitext(validated_path)[1].lower()
@@ -995,12 +997,12 @@ def fetch_video(video_spec, base_dir=None):
             return [fetch_video(vid, base_dir) for vid in video_spec]
         # Otherwise assume it's already loaded video frames
         else:
-            logger.debug(f"Video frames already loaded, returning as-is")
+            logger.debug("Video frames already loaded, returning as-is")
             return video_spec
 
     # If already loaded video frames (tuple), return as-is
     if isinstance(video_spec, tuple):
-        logger.debug(f"Video frames already loaded, returning as-is")
+        logger.debug("Video frames already loaded, returning as-is")
         return video_spec
 
     # Handle dict format: {"location": "url_or_path"}
@@ -1028,12 +1030,13 @@ def fetch_video(video_spec, base_dir=None):
         if isinstance(video_spec, str) and (
             video_spec.startswith("http://") or video_spec.startswith("https://")
         ):
-            validated_url = validate_url(video_spec)
+            validated_url = validate_media_url(video_spec, "a video argument")
             return _with_frame_rate(load_video(validated_url), validated_url)
         else:
-            # Treat as file path, relative to the workflow file
-            validated_path = validate_path(
-                resolve_relative_path(str(video_spec), base_dir), allow_create=False
+            # Treat as file path, relative to the workflow file, and confined
+            # to the directories this workflow may read (dw/locations.py)
+            validated_path = validate_media_path(
+                str(video_spec), base_dir, "a video argument"
             )
             # Validate file extension
             ext = os.path.splitext(validated_path)[1].lower()

diffusers_workflow-0.4.0b5/dw/docs/AGENT_LOOP.md

@@ -0,0 +1,86 @@
+# Agent Loop
+
+Some of the Issues in this repo are worked by an automated implementer/tester
+agent loop, not a human. It lives in a separate repo
+([`dkackman/iterate`](https://github.com/dkackman/iterate) — private) that
+drives two Claude Code agents in strict alternation against this repo's
+Issues. Nothing about running the loop lives here; this page exists so that
+anyone who opens or comments on one of its Issues — a human, or another
+agent joining in — knows how to act on it correctly.
+
+## The two roles
+
+- **Implementer** — has this repo checked out and SSH access to the box
+  running the MCP server. Reproduces, fixes, deploys, and hands the ticket
+  back. Never verifies its own fix.
+- **Tester** — talks to the MCP server only as a protocol client (MCP tool
+  calls), no source checkout, no shell/SSH access to the server box. Its job
+  is independent verification: it re-runs the original repro over MCP and
+  either confirms the fix or bounces the ticket back.
+
+That asymmetry — the only role that can mark an issue verified is the one
+with no ability to patch around a bug — is the entire point of the loop. A
+human or third agent joining in should preserve it: don't fix and verify the
+same ticket yourself.
+
+A third, standalone **regression agent** periodically runs a growing suite
+of scripted MCP calls (`regression-suite-*.md` in the `iterate` repo) against
+the live server and files/comments on Issues for anything that regresses. It
+doesn't participate in the implementer/tester handoff.
+
+## Reading a ticket
+
+Tickets use the **MCP agent-loop ticket** issue template. Two label
+families carry all the state — check both before acting:
+
+- **`owner:*`** — exactly one of `owner:implementer` / `owner:tester` /
+  `owner:don` at a time: whoever is expected to act on it next. If you're
+  not that owner, leave the issue alone beyond reading it (or the specific
+  handoff comment/label a role prompt allows).
+- **`status:*`** — where the ticket is in its lifecycle:
+  - *(no status label)* — open, ready for the implementer to reproduce.
+  - `status:fixed-pending-verify` — implementer has fixed and deployed;
+    waiting on the tester to re-run the repro over MCP.
+  - `status:verified` — tester confirmed the fix over MCP; issue is closed
+    as `completed`.
+  - `status:needs-info` — a question bounce; whoever is asked needs to
+    answer before work continues.
+  - `status:needs-approval` (+ `owner:don`) — parked for the human. The
+    implementer uses this for anything beyond a rename-level change
+    (engine behavior, breaking syntax). Neither agent touches a parked
+    issue.
+
+Two built-in GitHub labels close a ticket without a fix:
+
+- **`wontfix`** — the implementer's call, with a reason in a comment; issue
+  closed as `not planned`. The tester may reopen once with new evidence; a
+  second `wontfix` is final.
+- **`duplicate`** — closed as `not planned`, with a comment naming the
+  issue it duplicates (`duplicate of #NN`). A closed issue is still
+  canonical for duplicate detection — the implementer checks
+  `gh issue list --state all` before starting work, not just open issues.
+
+`breaking-change` marks an Issue whose fix changed the MCP interface, so the
+tester adjusts its calls instead of filing the change as a new bug.
+
+## If you want to participate
+
+Whether you're a human or another agent:
+
+- Only touch an issue that's currently owned by you (or, for a human, one
+  parked with `owner:don`).
+- When you hand a ticket to the next owner, swap the `owner:*` label and
+  say what you did in a comment — the next actor has no memory of this
+  session, only the issue thread.
+- Keep implementer and tester roles separate. If you're fixing code, don't
+  also close the issue as verified — that requires an independent MCP call
+  from someone who didn't write the patch.
+- Reference the issue number in any commit that fixes it
+  (`fix(mcp): #42 - ...`), and work on a branch merged to `develop`, never
+  `master`.
+- Only the tester (or an equivalently independent verifier) closes an issue
+  as `completed`/`status:verified`, and only after a real MCP call
+  reproduces the fix — not by reading the diff.
+
+See the `iterate` repo's `CLAUDE.md` for the full protocol this is
+summarized from, including how the automated loop itself is run.

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/dw/docs/MCP.md

@@ -227,7 +227,7 @@ when no single workflow covers it.
 | `get_server_info()` | — | What this installation can do and where it keeps things: `device` (the accelerator a run will use), `version`, the `workspace` this session is working in and the workflow/asset/output/prompt `directories` of *that* workspace, the bind address and port, whether a token is required, and whether MCP is mounted. Check the device before authoring - a CUDA-only choice (bitsandbytes, `torch.compile`, flash attention) is not available on an `mps` or `cpu` server |
 | `list_jobs(limit=20, status=None, workspace=None)` | optional `limit` (newest N), `status` (one state or a comma-separated set of `queued`, `running`, `succeeded`, `failed`, `cancelled`), `workspace` | List queued, running and recent jobs, **newest first**. Bounded by default: the unbounded listing was over a client's tool-result limit on a server with a few months of history, which made it a tool that could not be called at all. `total` says how many matched and `truncated`/`next` say so when the answer was cut - raise `limit` or narrow with `status`. Without `workspace`, a named workspace lists its own jobs and the default one lists every job the server holds |
 | `list_gallery(limit=50, subfolder=None, workspace=None)` | `limit`, `subfolder`, `workspace` | List generated output files, newest first. A name is `<workflow>/<run id>/<file>`, where `<file>` may sit in the subfolder the step chose (`final/episode.mp4`); each entry carries `folder` (the workflow) and `subfolder` (by convention `final` or `intermediate`, `''` when the step chose none, any path the workflow wrote otherwise), and `subfolder="final"` lists only deliverables. Each entry also carries a ready-made `url`, already scoped to the workspace that made it - a hand-built `/outputs/<name>` URL 404s for anything but the default workspace. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
-| `get_gallery_metadata(name, envelope=False, workspace=None)` | `name`, `workspace` | Get the metadata embedded in a generated file: the exact workflow and arguments that produced it, and, for audio/video, a `media` block (duration, rate, channels, fps, size, peak/mean dBFS). `envelope=true` adds `media.envelope` — `rms_dbfs` and `peak_dbfs` one entry per second — which is what locates something in a track rather than measuring the whole of it. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
+| `get_gallery_metadata(name, envelope=False, workspace=None)` | `name`, `workspace` | Get the metadata embedded in a generated file — or, when `name` is an `asset:` reference, what an *input* asset holds (`source` says which; `job` is null for an asset). Reading an input's duration, frame count, fps and sample rate before a run is how a caller learns the `total_frames`, `fps` and `sample_rate` a workflow expects it to supply: the exact workflow and arguments that produced it, and, for audio/video, a `media` block (duration, rate, channels, fps, size, peak/mean dBFS). `envelope=true` adds `media.envelope` — `rms_dbfs` and `peak_dbfs` one entry per second — which is what locates something in a track rather than measuring the whole of it. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 
 ### Media
 
@@ -235,7 +235,7 @@ when no single workflow covers it.
 | --- | --- | --- |
 | `get_output_image(name, max_dimension=768, workspace=None)` | `name`, `max_dimension`, `workspace` | Look at a generated image, downscaled to `max_dimension` on its longest side. Returns the image plus a text part reporting `original_size`, `returned_size` and `bytes`, so a downscale is never silent. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 | `get_output_text(name, max_characters=20000, workspace=None)` | `name`, `max_characters`, `workspace` | Read a text output — a prompt enhancement, or any step whose result is `text/plain` or JSON. Reports the file's real length and whether it was truncated. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
-| `download_output(name, destination=None, overwrite=False, workspace=None)` | `name`, `destination`, `overwrite`, `workspace` | Save one output file to local disk, of any content type. `destination` may be a full path, a directory, or omitted to save under the output's own name in the current working directory; `~` expands and missing parent directories are created. `overwrite=True` is required to replace a file already at the resolved path. Returns nothing to the conversation but where the file landed — unlike the other media tools, the point is a file on disk, not a payload in context. Writes on the machine running the MCP server - over `dw.serve --mcp` that is the GPU box. A write that fails there (a path that exists only on the client, for instance) comes back as an error naming the server-side write and the client-side alternatives, not as an anonymous tool failure. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
+| `download_output(name, destination=None, overwrite=False, workspace=None)` | `name`, `destination`, `overwrite`, `workspace` | Save one output file to local disk, of any content type. `destination` may be a full path, a directory, or omitted to save under the output's own name in the current working directory; `~` expands and missing parent directories are created. `overwrite=True` is required to replace a file already at the resolved path. Over a `dw.serve --mcp` endpoint the file lands on the server, so the destination is confined to that workspace and a relative one is joined onto it. Returns nothing to the conversation but where the file landed — unlike the other media tools, the point is a file on disk, not a payload in context. Writes on the machine running the MCP server - over `dw.serve --mcp` that is the GPU box. A write that fails there (a path that exists only on the client, for instance) comes back as an error naming the server-side write and the client-side alternatives, not as an anonymous tool failure. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 | `delete_output(name, workspace=None)` | `name`, `workspace` | Permanently remove one generated file from the output directory. `workspace` names the workspace for this one call without switching the session to it - the same pin `run_workflow` takes, so a job run into another workspace stays reachable from the session that queued it |
 
 ### Authoring, assets and workspaces
@@ -249,7 +249,7 @@ The session starts in `default` and stays there unless it is told otherwise.
 
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
-| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required` and `estimate` (with `basis`) for the arguments given; quote from it |
+| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. A reference set the model would refuse - too many images, videos or audio clips, or, for MiniMax-H3, audio as the only reference - is an error here too, rather than a failure minutes into a run you acknowledged. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required` and `estimate` (with `basis`) for the arguments given; quote from it |
 | `list_workspaces()` | — | The server's workspaces and which one this session is using. Each has its own workflows, assets and outputs; the prompt library is shared by all of them |
 | `use_workspace(name)` | `name` | Work in that workspace for the rest of the session - every later call reads and writes there. This is how to keep your work out of another agent's namespace rather than sharing the default one. Checked against the server, so a typo fails here rather than scoping every later call to nothing |
 | `create_workspace(name, use=False)` | `name`, `use` | Create a workspace. Pass use=true to switch this session to it as well; otherwise the session stays where it was and the result says so |
@@ -412,13 +412,22 @@ localhost binding, no auth, `Origin` header checks, and path confinement in
 Nothing under `dw_mcp/` re-implements or loosens that confinement; it is
 purely a client of the same validated endpoints the web UI uses - except for
 `download_output`, the one tool that writes a local file for the MCP client
-rather than only reading through the API. It may write anywhere the
-client's own filesystem lets it (a full path, a directory, or the current
-working directory by default, `~` expanded), the way a shell redirect
-would for the same user; a `..` path segment in `destination` is refused,
-and an existing file is left alone unless the caller passes
+rather than only reading through the API. Over a stdio `dw-mcp` it may write
+anywhere the client's own filesystem lets it (a full path, a directory, or
+the current working directory by default, `~` expanded), the way a shell
+redirect would for the same user; a `..` path segment in `destination` is
+refused, and an existing file is left alone unless the caller passes
 `overwrite=True`.
 
+Over `dw.serve --mcp` the write happens **on the server**, and there the
+destination is confined to that workspace: an absolute or `~` path outside
+it is refused, and a relative one is joined onto the workspace rather than
+onto whatever the server process's working directory happens to be. The
+transport is what distinguishes the two - on stdio "local disk" is genuinely
+the caller's own machine, over HTTP it is the operator's. Confinement is on
+the resolved real path, not a substring test, because an absolute path needs
+no `..` to reach anywhere the server can write.
+
 `dw-mcp` may be pointed at a `dw.serve` on another machine only when that
 server was started with a token, and the same token is passed here
 (`--token` / `DW_API_TOKEN`); it refuses to start otherwise. The token is
@@ -450,8 +459,13 @@ default) for any server an MCP client can reach.
   runs on. Over `dw.serve --mcp` that is the GPU box, so a file sitting on
   the client's laptop is not reachable that way - put it on the server, or
   give the workflow a URL (the arguments that take a path take a URL too).
+  On a `--mcp` endpoint `file_path` is also *confined* to the directories the
+  server works in (its workspace, workflows, assets, outputs and prompts), and
+  the refusal comes before the file is looked for, so the tool cannot be used
+  to probe which paths exist on the box (#138).
   `download_output` has the same asymmetry in the other direction: on a
-  `--mcp` endpoint it writes on the GPU box, not the client's machine.
+  `--mcp` endpoint it writes on the GPU box, not the client's machine, and is
+  confined to the workspace there.
 - **Prompts are not per-workspace.** Switching workspaces changes which
   workflows, assets and outputs the session sees; the prompt library is one
   library shared by all of them, because `prompt:` is shared by reference.

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/dw/docs/SECURITY.md

@@ -91,6 +91,52 @@ diffusers' remote-code paths open. No bundled catalog entry sets either
 (`tests/test_catalog_structure.py` refuses one that does); a workflow that
 needs them needs `--trust-workflows`.
 
+### Where a workflow may read and reach (`dw/locations.py`)
+
+Code execution is not the only thing a workflow file chooses. Its arguments
+choose *locations* - which image to open, which URL to fetch, which
+directory a glob expands over - and until 2026-09-13 each loader trusted the
+one it was handed. A workflow could name `/usr/share/pixmaps/debian-logo.png`
+as its `image` and get it decoded, glob `/usr/share/pixmaps/*.png` and get
+every match republished verbatim as an output, or point an `image` at
+`http://127.0.0.1:8765` and have the server fetch its own loopback.
+`remote_text_encoder.url` was the worst of them: the request carries this
+machine's HuggingFace token.
+
+One policy now answers all of it, untrusted:
+
+- **A path** must resolve inside a root this installation already works in -
+  the workflow file's own directory, the asset libraries on the search path,
+  the output root. `validate_path` already refuses `..`, so in practice this
+  closes the absolute path that pointed somewhere else entirely; a relative
+  one that climbs out is refused on its `..` segments, at validation time as
+  well as at the loader, so both spellings are answered at the same moment
+  rather than one of them three seconds into a queued job (#124). The remedy
+  for a file outside is to put it in the asset library and use an `asset:`
+  reference. Containment is checked **before** existence, so the refusal
+  cannot be used as a file-existence oracle.
+- **A glob** is contained the same way, on the fixed directory its pattern
+  starts from, and every match is re-checked on its real path so a symlink
+  cannot carry the expansion out.
+- **An `http(s)` URL** must not resolve to an address inside the deployment -
+  loopback, link-local (`169.254.0.0/16`, the cloud metadata address),
+  private ranges. Checked after DNS resolution, not on the literal string.
+- **`remote_text_encoder.url`** is https-only, and the HuggingFace token is
+  attached only for `huggingface.co`, `huggingface.cloud` and `hf.space`. An
+  endpoint elsewhere is still reachable; it just does not get the credential.
+- **`model_name`** must be a Hub repo id or a path inside a root - the same
+  shape check `download_model` has always applied to `repo_id`. A URL is
+  neither, and is refused as such rather than resolving into the workflow's
+  own directory as a path-shaped name (#117).
+
+Enforced twice: `location_errors` runs inside `validation_errors`, so
+`validate_workflow` refuses before a model load is spent on the run, and the
+loaders call the same functions for a location that arrives through a
+variable or a previous result. All of it yields to `--trust-workflows`.
+
+`GET /api/server` reports `trust_workflows`, so a client can read the posture
+it is running against rather than infer it.
+
 `--trust-workflows` is a blanket, process-wide choice - it is not scoped
 per-workflow or per-request. A `dw-serve` instance that accepts jobs from
 anything other than yourself (including an MCP client - see below) should
@@ -131,14 +177,21 @@ validated there, exactly as it would be for a browser request from the web
 UI. A remote `dw.serve` is allowed only with a token — see
 [MCP Server](MCP.md#security) and [REMOTE.md](REMOTE.md).
 
-The one exception is `download_output`, which writes a local file for the
-MCP client rather than only reading through the API. It may write anywhere
-the client's own filesystem permissions allow (the machine running the MCP
-server — the GPU box when served by `dw.serve --mcp`) — a full path, a
-directory, or the current working directory by default, `~` expanded — since
-it acts for the local user the same way a shell redirect would; a `..` path segment in
-`destination` is refused regardless, and an existing file at the resolved
-path is left alone unless the caller passes `overwrite=True`.
+The two exceptions are `download_output`, which writes a local file for the
+MCP client, and `upload_asset(file_path=...)`, which reads one — neither goes
+through the API for that half of its work. Both turn on whose machine "local"
+is. Over a **stdio `dw-mcp`** it is the user's own, so both act for the local
+user the way a shell redirect would: `download_output` writes anywhere the
+process may (a full path, a directory, or the working directory by default,
+`~` expanded) and `upload_asset` reads anything it may. Over **`dw.serve
+--mcp`** it is the operator's box, which the caller never chose, so both are
+confined there: `download_output`'s `destination` to the workspace (#113) and
+`upload_asset`'s `file_path` to the directories the server works in — its
+workspace, workflows, assets, outputs and prompts (#138). `upload_asset`'s
+refusal is ordered ahead of the existence and extension checks so it cannot
+be used as a path-existence oracle. A `..` path segment in `destination` is
+refused regardless, and an existing file at the resolved path is left alone
+unless the caller passes `overwrite=True`.
 
 ## Exception Hierarchy
 
@@ -160,10 +213,13 @@ SecurityError
 - **Path traversal** — Cannot access files outside allowed directories
 - **Command injection** — No shell interpretation is used anywhere in `dw/`; `sanitize_command_args()` is available as a guard should a subprocess call be added
 - **Resource exhaustion** — File size limits prevent memory exhaustion
-- **Malicious URLs** — Only http/https schemes allowed
+- **Malicious URLs** — Only http/https schemes allowed, and an untrusted
+  workflow may not name a host inside the deployment (SSRF)
+- **Arbitrary file read through a media argument** — a location a workflow
+  supplies is confined to the roots it may read (`dw/locations.py`)
 
 ## Testing
 
 ```bash
-pytest tests/test_security.py -v
+pytest tests/test_security.py tests/test_locations.py tests/test_workflow_trust.py -v
 ```

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/dw/docs/SECURITY_QUICKREF.md

@@ -13,12 +13,39 @@ and [REMOTE.md](REMOTE.md).
 
 ```python
 from dw.security import (
-    validate_path, validate_workflow_path, validate_output_path,
-    validate_url, validate_variable_name, validate_string_input,
-    sanitize_command_args, SecurityError, PathTraversalError, InvalidInputError
+    validate_path,
+    validate_workflow_path,
+    validate_output_path,
+    validate_url,
+    validate_variable_name,
+    validate_string_input,
+    sanitize_command_args,
+    SecurityError,
+    PathTraversalError,
+    InvalidInputError,
 )
 ```
 
+## Locations a workflow supplies
+
+A media path, glob or URL that comes out of a workflow's arguments is not
+just a path - it is untrusted input choosing where the server reads. Use
+`dw/locations.py`, never `validate_path`/`validate_url` directly, for
+anything a workflow names:
+
+```python
+from dw.locations import (
+    validate_media_path,  # confined to the workflow dir / assets / outputs
+    validate_media_glob,  # the same, on a pattern's fixed prefix
+    contained_matches,  # each match re-checked on its real path
+    validate_media_url,  # no loopback / link-local / private host
+    validate_model_name,  # a Hub repo id, or a contained path
+)
+```
+
+Containment is checked before existence, so a refusal never discloses
+whether the file is there. All of it yields to `--trust-workflows`.
+
 ## Common Patterns
 
 ```python
@@ -29,13 +56,14 @@ workflow_path = validate_workflow_path("workflow.json")
 output_path = validate_output_path(user_path, base_output_dir)
 
 # User input
-var_name = validate_variable_name("prompt")          # OK
-var_name = validate_variable_name("bad;name")        # raises InvalidInputError
+var_name = validate_variable_name("prompt")  # OK
+var_name = validate_variable_name("bad;name")  # raises InvalidInputError
 value = validate_string_input(user_input, max_length=1000)
-url = validate_url(user_url)                         # http/https only
+url = validate_url(user_url)  # http/https only
 
 # Subprocess (dw/ doesn't currently shell out anywhere - pattern for if/when it does)
 import subprocess
+
 cmd = sanitize_command_args(["python", "-m", "dw.run", validated_path])
 subprocess.Popen(cmd, shell=False)
 ```

{diffusers_workflow-0.4.0b4 → diffusers_workflow-0.4.0b5}/dw/docs/SERVER.md

@@ -277,7 +277,12 @@ The editor's forms come from these; they are just as usable from scripts:
   makes the same check and answers 400 rather than queuing a job that would
   fail on its first step; `checked_arguments` on a valid answer names what
   was covered, since without arguments the verdict is about the stored
-  defaults only.
+  defaults only. A reference set a pipeline would refuse is an error here
+  too - too many images, videos or audio clips for the family, or, for
+  MiniMax-H3, audio as the only reference - because the pipeline enforces
+  those only once its checkpoint is loaded, minutes into an acknowledged
+  run (`dw/reference_limits.py`, which reads each limit off the diffusers
+  block that enforces it rather than restating it).
 
   A valid answer also carries `plan`, what the run will execute for those
   arguments: `fingerprint` (`sha256:…` over the realized, expanded