diffusers-workflow 0.8.0__py3-none-any.whl → 0.9.0__py3-none-any.whl

{diffusers_workflow-0.8.0.dist-info → diffusers_workflow-0.9.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffusers-workflow
-Version: 0.8.0
+Version: 0.9.0
 Summary: Declarative workflow engine and web UI for Hugging Face Diffusers
 Author: dkackman
 License: Apache-2.0

{diffusers_workflow-0.8.0.dist-info → diffusers_workflow-0.9.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-diffusers_workflow-0.8.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+diffusers_workflow-0.9.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
 dw/__init__.py,sha256=fWaCvN4c5PtD97ZufrMz0okq33fxTWHmJp9UCuluouw,19183
 dw/adapter_compatibility.py,sha256=OAJdCDsiU29DX-vW5DIGN3kUcapbq3Bz6vU6GCgV_6w,11316
 dw/argument_media.py,sha256=yeXBDAoFnLhMKb-YFxtqmqgXhwqmj3Eh-sJblSxsa_4,12816
@@ -33,7 +33,7 @@ dw/media_types.py,sha256=to2bGLpfF__EJnXxis-t0SHlzgx_WzlK6t0roqLf24g,8045
 dw/output_extraction.py,sha256=Q4OB2Lnz8yF9sK6H2svBDNuf4G8shEuQRExEaVieUXU,9610
 dw/path_redaction.py,sha256=Zv8sGmZQ0meQYinMhqo10IJKt5egqkjekbiTSPoBVJg,2949
 dw/pipeline_ownership.py,sha256=sY90vQVLBXzAeyR6jVygGm4i_FqfSeGp7up_0SvNSYE,12944
-dw/plan.py,sha256=xIFilQAcNwqFQh6Dmgq6l5qns1dcBGtA8ruHErSNP5M,38998
+dw/plan.py,sha256=7yif6_PKWYOHROLWSPtswoSnnN_-mwgoduZ4hB9_gXg,41470
 dw/previous_results.py,sha256=Ano0nl0714eEgJd76e4Xu-1EC3vvaE4MsdvHVTIBMoU,16313
 dw/probe_paths.py,sha256=iJgy4G256zELyzi4Aol4_qifejjZsUtdeEEDWryAB0o,2683
 dw/prompt_schema.json,sha256=5e7NWgce28cf-YWEWwyDjQQ90ki0BcI4tczTyr_d8lQ,1934
@@ -86,12 +86,12 @@ dw/docs/ARCHITECTURE.md,sha256=RFIW1eSQ6l25uA5QKJWDns1i8iJgGoqXxwq-PrHZzuw,35102
 dw/docs/DEPENDENCIES.md,sha256=avxinFm52qDToYi2_C0M39OTXNo1ERqxZj6t_0HIUjE,4142
 dw/docs/IP_ADAPTER.md,sha256=AAHaUIfbnOojHfT0noIeypbhdYPluR7sbZeVn5FpbjU,3730
 dw/docs/LORAS.md,sha256=lwug-7yQp7O1AHJfzv5jzvH8Vta4KMAt5G8m6khyMH8,6895
-dw/docs/MCP.md,sha256=7xnNsSBCK3ge6ceOVN6pgWyQHcdwSF2ei3A7V5XzTtQ,56009
+dw/docs/MCP.md,sha256=L7vXp9j8VmzupKJlMkmUi7ZMlXR1QRHij9xJxil-URE,56114
 dw/docs/PROMPT_WEIGHTING.md,sha256=Pvr25d3yvS8SlnYwX9qc61VvTa8yFMxK_1zMLvrEigI,3031
 dw/docs/QUANTIZATION.md,sha256=NZCL-09bDM-JhzV1WqK2JGkL1la8VoH9fie1X39arsE,7678
 dw/docs/RECIPES_24GB.md,sha256=j7CCtMCNg830o6xD7C1DPz7dXRHvBQkbJaViRnH8AR4,16035
-dw/docs/RELEASING.md,sha256=Ft0BH0ZGpsyqBYd7Ev_jCK61fiWtvCfpZUokF1Y0tXY,38520
-dw/docs/REMOTE.md,sha256=1TVGxTbLjIg5RpkoxpASSncZW_E7_llDu6zPLarkDbg,6389
+dw/docs/RELEASING.md,sha256=LUISTzZYjxcy1ND0MXE-1rYnGaEJ6Jei0DaSZf4-5DY,41460
+dw/docs/REMOTE.md,sha256=quum2Y54g2bp2rgXg9WkSPY3zhVGHEpMkEAiL6oAQDU,6650
 dw/docs/SECURITY.md,sha256=HYkBnAGlX83moyCryHylYdyWFodyZzzF7J38elebYGA,17900
 dw/docs/SECURITY_QUICKREF.md,sha256=-xZNIV6j1oWcoy5B-oHKqh3ko2zJgB2fuNMiDV4f1zY,3537
 dw/docs/SERVER.md,sha256=XAMoVdlCAjTR0AMtupWv5nuDUGClEz31YBfaOObSBlc,52418
@@ -134,7 +134,7 @@ dw/server/routes/__init__.py,sha256=Z6hnzGs1jdXuY_1C74t09_e1QDYWOxWbCnyjo6_qKB0,
 dw/server/routes/assets.py,sha256=D3VSCSo_xKJeBZ-5ZMWWRtMlr1db7iiDPDFIUAPg8_I,17517
 dw/server/routes/files.py,sha256=6c7ySIPe7o8HSc8Z7M2b1fKWonQdkC8S_TPAVppCxOo,7125
 dw/server/routes/gallery.py,sha256=pwE1qsizXpqL-kMieM6UbXAgAHOpdQ1V3MR53510PsU,15107
-dw/server/routes/jobs.py,sha256=gb1bUHepdDxMzJaFYnI7a5dUy0ZFR0WLhzaQuUcUtps,34308
+dw/server/routes/jobs.py,sha256=lrtGkk7_CzgVsmO0MhXWQAleOm0--LwKqahG5WBHNo4,34451
 dw/server/routes/library.py,sha256=GiUFqYuin8nHx1pU28gJsr8m6YvgBNAWoUZjUbT9PYM,29738
 dw/server/routes/loras.py,sha256=OVxlXutJs1ThSsTC3R31pg44sUaV9iH8PhY0Xy9UyVQ,9289
 dw/server/routes/media.py,sha256=vRhH52iZ8BwmPeNtN0wS_zM6A3qj92p2V8E2DwIifN8,26005
@@ -259,7 +259,7 @@ dw/tasks/image_to_text.py,sha256=iNza67G5h24y6GIs22mCyLOFgqsAOfz9hf88jBn16iY,161
 dw/tasks/image_utils.py,sha256=4mAHIob7Yh8JEdekI5X5yI_dJSKia1PTrRDGjljAOfc,25397
 dw/tasks/interpolate_frames.py,sha256=Jxp0GcETheu1SBwAP6QrCCRKRs9XfoF5SHzwfUkIwCk,9272
 dw/tasks/join_into_song.py,sha256=54nr2-Q5MOUV4rTtBeWyJV-oK1misJ86LV2eRRV_BTo,17825
-dw/tasks/joins.py,sha256=5Mc6DFItML_asJQexSmcGalL66bPb4qIvcqtVIivFSw,25386
+dw/tasks/joins.py,sha256=BbzoTOfc6WJDXHWxdm0dVjA-awa634U3SpQT83RoNDc,25861
 dw/tasks/judge.py,sha256=fdT6a20x66tCCP37d2NnVFrZAPiuhduuBvg_bsAdtSg,2312
 dw/tasks/loop_bed.py,sha256=JQ-Zx8qpNiobBtdmRPU4nwYiLJyrje6hAsT8QauXkz0,35563
 dw/tasks/model_cache.py,sha256=Bh97x5mFFFzT8M8_LiHo0a1izsaIqvsQyIURPkjKxTk,1879
@@ -289,7 +289,7 @@ dw_mcp/catalog.py,sha256=RMPqJ_Vtgoc3wFlRp0xd4GedbQVICaI0rkXwiqbvzus,15219
 dw_mcp/client.py,sha256=YhIJY6Nlf2B1MbBfdcMZySsQ5PFvdEVF41dFL8MRhm4,22166
 dw_mcp/confine.py,sha256=bAitZXmyoNMFkmzNa7WwzYNgKhVLT5nUsMOAGe5t-bI,2766
 dw_mcp/diagnose.py,sha256=V9-8gNf1eMVjzRDilj9FiD8dcnHu5AZ9nRVm9AcXIYk,17392
-dw_mcp/exports.py,sha256=Txly4-pD_GCcKR0CxvfWAWmhbRrcbUsOcvAdO7dMTps,4137
+dw_mcp/exports.py,sha256=U37jOe40K1HVM4ic_CpYFvkZiupDVWPCzWiOJYqvc8g,4388
 dw_mcp/guides.py,sha256=QDvofzCO5FOXTNO5DW82UKqDn2IdvwNEr7rB91fHmxE,1762
 dw_mcp/loras.py,sha256=dp0fUZ9YfECYnDemJNvq62ZbvXjJJaEAEPdkRKIDVGM,875
 dw_mcp/media.py,sha256=1MzdoyO9p2B1PKAm8Neu9gCSHYmECEQ_X4boMBHuTvo,20937
@@ -298,11 +298,11 @@ dw_mcp/prompts.py,sha256=ZgbcATJbWUxHlebt8ssH2PlUc3nBD6rrVLdFLJSo8TM,3944
 dw_mcp/server.py,sha256=dEVWxyyN5yh-lIkc4Yub3S9TwcFOV5TSYNikqyiVXXg,7738
 dw_mcp/tools_authoring.py,sha256=FBelAhWf1OWRQX290rF2Eoy2fY1fpMoG5lZXytBFgpY,12313
 dw_mcp/tools_catalog.py,sha256=cZf32oDGgc-VOeKT4Z8guFDSFzQwPR5HG1oTCW0TR7M,22086
-dw_mcp/tools_jobs.py,sha256=IhzItLsok4QbwztgeQw5qr3z2KcELIhb954vEOVWAj4,12112
+dw_mcp/tools_jobs.py,sha256=e4DY1f6xqlHtK_M4K2gg7OyjjVu5_iw4mn-2laNuB78,11988
 dw_mcp/tools_media.py,sha256=HsMQ5ihUmkUcZ1NELtJMNbxfpSjdfFLQA6-Q9jOhe0w,16848
 dw_mcp/workspaces.py,sha256=OF6oVMQx_pkTuRMLvbOYkpVWwcA6GQwaEf5k0oxqBnI,8449
-diffusers_workflow-0.8.0.dist-info/METADATA,sha256=b4SVA0uisJE416y0YSXwqIn3E2pfA8qqs1SDNTGwOr4,14938
-diffusers_workflow-0.8.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-diffusers_workflow-0.8.0.dist-info/entry_points.txt,sha256=Dem_AOzV-Kcpr9AASlSvJ-S5sn3f6TQu6ABb6BbApho,148
-diffusers_workflow-0.8.0.dist-info/top_level.txt,sha256=o-uFAN_oUOrhXfMKO39HsMs2r19L9LykxoVKj2S9q7U,10
-diffusers_workflow-0.8.0.dist-info/RECORD,,
+diffusers_workflow-0.9.0.dist-info/METADATA,sha256=lZa1AWCNfxpdjcpmfEXQ-GqVnIoMyU4bGLukSVnct80,14938
+diffusers_workflow-0.9.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+diffusers_workflow-0.9.0.dist-info/entry_points.txt,sha256=Dem_AOzV-Kcpr9AASlSvJ-S5sn3f6TQu6ABb6BbApho,148
+diffusers_workflow-0.9.0.dist-info/top_level.txt,sha256=o-uFAN_oUOrhXfMKO39HsMs2r19L9LykxoVKj2S9q7U,10
+diffusers_workflow-0.9.0.dist-info/RECORD,,

dw/docs/MCP.md

@@ -308,7 +308,7 @@ references written in the same session.
 | `run_workflow(workflow_path=None, inline_workflow=None, arguments=None, acknowledged_cost=False, workspace=None, wait_seconds=0)` | exactly one of `workflow_path` (a catalog name from `list_workflows`, with or without `.json`, or a path to a workflow file on the server) or `inline_workflow`, optional `arguments`, `acknowledged_cost`, `workspace`, `wait_seconds` | Queue a workflow for generation. Returns as soon as the job is queued - unless `wait_seconds` is above 0, in which case the call then waits on the queued job exactly as `wait_for_job(job_id, timeout_seconds=wait_seconds)` would (same per-call cap, clamped not honoured) and the result carries the queued-job fields plus that wait's (`status`, `still_running`, `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds`, `timeout_capped`, the slim `job`); when the cap covers the job's runtime one call is the run and the wait, and a `still_running: true` result is followed with `wait_for_job` as before. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate, and nothing is waited on |
 | `get_job(job_id)` | `job_id` | Get a job's status, warnings, output manifest, error and traceback; each manifest entry's `subfolder` is the in-run subfolder the step declared - by convention `final` for the deliverable, `intermediate` for scratch, `''` for none. A running job also carries `progress` (below) |
 | `get_job_workflow(job_id)` | `job_id` | The REST equivalent is `GET /api/jobs/{id}/workflow` (see [SERVER.md](SERVER.md#jobs-api)). The workflow the job actually ran. `realized: true` means every mutable input is pinned (arguments, seed, prompts, `output:latest`); `false` means the job predates run tracking and this is the definition as submitted. Pass it to `save_workflow` to keep it under a name |
-| `export_job(job_id, overwrite=False)` | `job_id`, `overwrite` | Gather one finished job into `<workspace>/exports/<job id>/` on the server: the realized workflow, the run's manifest, the job row, a README, and copies of the assets, earlier-run inputs and outputs. Returns the directory, a zip URL, the file list with sizes and the total. The three JSON files are in the zip, not repeated here - get_job_workflow and get_job serve them individually. **The directory is on the machine running the server**, like `download_output`'s destination. `auth_required` says whether opening the zip needs this server's bearer token, which this agent cannot attach to someone else's fetch (#353): when false, fetch `open_url` yourself and unpack it into `exports/` under the session's working directory (a deliverable, not a temp file) - the archive already unpacks into one folder named after the job id, so do not create that folder first; when true, hand `open_url` to the person instead of fetching it |
+| `export_job(job_id, overwrite=False)` | `job_id`, `overwrite` | Gather one finished job into `<workspace>/exports/<job id>/` on the server: the realized workflow, the run's manifest, the job row, a README, and copies of the assets, earlier-run inputs and outputs. Returns the directory, a zip URL, the file list with sizes and the total. The three JSON files are in the zip, not repeated here - get_job_workflow and get_job serve them individually. **The directory is on the machine running the server**, like `download_output`'s destination. The zip needs no token (`/exports/*.zip` is ungated like `/outputs`, #592), so `auth_required` is false and the agent fetches `open_url` itself (prefixing a relative one with the server address) and unpacks it into `exports/` under the session's working directory (a deliverable, not a temp file) - the archive already unpacks into one folder named after the job id, so do not create that folder first; only an agent without HTTP gives the user `open_url`. `true` is kept as a forward guard for a gated zip, when `open_url` is handed to the person instead |
 | `get_job_events(job_id, after=-1, limit=200)` | `job_id`, `after`, `limit` | Get a page of a job's progress events |
 | `wait_for_job(job_id, timeout_seconds=20)` | `job_id`, `timeout_seconds` | Block until a job reaches a terminal status, or `timeout_seconds` elapses. **One call blocks for at most the server's cap** — 55 seconds unless the deployment sets `DW_MCP_MAX_WAIT_SECONDS` higher, and the tool's description states the live value; a larger `timeout_seconds` is clamped, not honoured. Ask for the job's `plan.estimate` plus a margin: under the cap that is one call for the whole job, over it one call per cap. A deployment raises the cap only as far as its clients (and anything between them and the server) hold one silent HTTP request open - Claude Code's limit is `MCP_TOOL_TIMEOUT`. Every reply carries `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds` and `timeout_capped`, so a capped return is distinguishable from an elapsed one. Use instead of hand-polling `get_job`/`get_job_events` in a loop; if it returns `still_running: true`, call it again. Returns a slim job - status, warnings, error, `run_id` and `run_version` (the run's `v5`, as the gallery labels it), and the manifest once finished - without the arguments; `get_job` has those. A running job also carries `progress` (below) |
 | `cancel_job(job_id)` | `job_id` | Ask a queued or running job to stop |

dw/docs/RELEASING.md

@@ -7,6 +7,63 @@ notes from commits at tag time (see below). This section is a scratch pad
 for items a branch's author wants the next release note to name; clear it
 when a release ships.
 
+### 0.9.0
+
+<!-- Drafted from v0.8.0..dd74e17b (develop). Paste into the GitHub release body once the tag has published: gh release edit v0.9.0 --notes-file ... -->
+
+A smaller range than 0.8.0: the LoRA catalog grows to cover three more
+bases, the cost planner is corrected for list-driven and `for_each` steps,
+and `export_job` reports its zip's real auth gating. No upgrade-order
+changes.
+
+**LoRA catalog** (docs/LORAS.md)
+
+- 11 LTX-2.5 entries added: IC-LoRAs for alpha generation, clean plate,
+  colorization, day-to-night, layout-to-render, detail refinement,
+  restoration, SDR-to-HDR and water simulation, plus cinemagraph and
+  slow-motion control.
+- MiniMax-H3 goes to 13 trial and 3 rejected entries beyond the 0.8.0 set:
+  styles, speech, orbits, action and motion, and a diffusers-native 4-step
+  turbo. FastVideo FastH3 (`.diff` keys), RAVEN (unrecognised prefix, loads
+  nothing silently) and TaoMate (lowercase `lora_a`/`lora_b`) are rejected.
+- New bases: Qwen-Image-2.1 (10 trial, including three few-step distills
+  that need their scheduler and sigma overrides, plus edit LoRAs; Fun-Acc
+  rejected) and Z-Image-Turbo (13 trial). The Z-Image entries match
+  `Tongyi-MAI/Z-Image-Turbo` only; whether they apply to the SDNQ
+  checkpoint is untested.
+- Every new entry pins the repo's current sha, and its header was read
+  against the installed diffusers converter.
+
+**Cost planning**
+
+- `other_device` figures are re-priced for `for_each` counts and shifted
+  list drivers (#589, #590).
+- A shifted per-entry field in a list driver resets to unknown, and a
+  summed child figure takes the children's basis (#593). A numeric string
+  in a list-driver entry compares as its number (#593).
+- Measured MPS cost entries for `templates/ltx2/text-to-video` and Music 3
+  (#590).
+
+**Fixes**
+
+- `assemble-and-score` threads `sample_rate` into its edit join, and mixed-rate
+  shots resampled to a pinned `sample_rate` no longer draw a warning advising
+  you to pass it (#594).
+- `export_job` reports the zip's real gating: `/exports/*.zip` is ungated
+  like `/outputs`, so `auth_required` is false whether or not the server has
+  a token. The MCP `next` text and the skills now say to fetch `open_url` and
+  unpack into `exports/` to bring a project home (#595, #592).
+
+**Plugin**
+
+- The `ltx-2.5`, `minimax-h3` and `minimax-music3` skills moved
+  request-specific detail (the LTX caption spec, H3 checkpoint and LoRA
+  combinations and cuts recipes, Music 3 loudness) into `references/`
+  beside each `SKILL.md`, which are read when the skill points there. The
+  12 KiB cap applies to `SKILL.md` alone; a new test fails on an unlinked
+  reference or a dead link.
+- The H3 and LTX skills point at `list_loras`.
+
 ### 0.8.0
 
 <!-- Drafted from v0.7.0..a9e1e72b (develop). Paste into the GitHub release body once the tag has published: gh release edit v0.8.0 --notes-file ... -->
@@ -38,6 +95,9 @@ upscaler and two security fixes.
 - GHSA-crqf-hw9p-r739: `create_workspace`'s MCP result is `name`,
   `default`, `current` and `next` only; `list_workspaces(detail=true)` is
   the opt-in for folder paths. `POST /api/workspaces` is unchanged.
+- `GET /api/loras/recommend` and `recommend_loras`: `hub_error` names the
+  exception type, or the HTTP status, never the exception's text, which
+  could name the server's HF cache directory. The log keeps the full error.
 - UI lockfile bumps for open Dependabot alerts (devalue, dompurify,
   brace-expansion, undici).
 

dw/docs/REMOTE.md

@@ -48,6 +48,11 @@ responses add an `absolute_url` / `absolute_zip_url` built from it; nothing
 guesses this from request headers, so an unconfigured server omits the
 field rather than composing a wrong origin.
 
+The export zip, like `/outputs` and `/inputs` files, needs no token (#592), so
+an agent with HTTP fetches `export_job`'s `open_url` itself, prefixing a
+relative one with the address it reaches the server at; `DW_PUBLIC_URL` is for
+the URLs handed to a person.
+
 ## Browser
 
 Open `http://<box>:8765`. Click the key icon next to the theme toggle,

dw/plan.py

@@ -17,6 +17,7 @@ import copy
 import hashlib
 import json
 import logging
+import math
 import os
 
 from huggingface_hub import model_info
@@ -340,6 +341,36 @@ def _driver_comparable(value):
     return json.dumps(value, sort_keys=True, default=str)
 
 
+def _numeric_fields(entries):
+    """{field: {values}} over the numeric fields of a list's dict entries. A
+    numeric string ("243") counts as its number, as `_driver_comparable` does
+    for a scalar driver."""
+    fields = {}
+    if not isinstance(entries, list):
+        return fields
+    for entry in entries:
+        if not isinstance(entry, dict):
+            continue
+        for key, value in entry.items():
+            number = _driver_comparable(value)
+            if isinstance(number, float) and math.isfinite(number):
+                fields.setdefault(key, set()).add(number)
+    return fields
+
+
+def _list_entry_field_shifted(default_entries, effective_entries):
+    """Whether a list driver's entries carry a numeric field (a per-shot
+    `num_frames`, say) with a value none of the default entries had. The
+    curated figure was measured over the default entries' values, so a value
+    outside them has no matching bucket - the #267 rule applied inside a
+    list driver (#593)."""
+    measured = _numeric_fields(default_entries)
+    for field, values in _numeric_fields(effective_entries).items():
+        if field in measured and not values <= measured[field]:
+            return True
+    return False
+
+
 def _scalar_driver_shifted(definition, expanded, list_entries):
     """Whether a declared, non-list `cost_driver` was overridden away from
     the default value the curated `cost` was measured against (#267).
@@ -352,10 +383,12 @@ def _scalar_driver_shifted(definition, expanded, list_entries):
     defaults = definition.get("variables") or {}
     effective = expanded.get("variables") or {}
     for name in _declared_drivers(definition):
-        if name in list_entries:
-            continue
         default_value = defaults.get(name)
         if isinstance(default_value, list):
+            if _list_entry_field_shifted(default_value, effective.get(name)):
+                return True
+            continue
+        if name in list_entries:
             continue
         if _driver_comparable(effective.get(name)) != _driver_comparable(default_value):
             return True
@@ -365,7 +398,7 @@ def _scalar_driver_shifted(definition, expanded, list_entries):
 def _own_price(definition, expanded, list_entries, device, measured_entries):
     """The workflow's own price, reset to unknown when a scalar driver moved."""
     own = _price(definition.get("cost"), device, list_entries, measured_entries or {})
-    if own["basis"] == CATALOG and _scalar_driver_shifted(
+    if own["basis"] in (CATALOG, OTHER_DEVICE) and _scalar_driver_shifted(
         definition, expanded, list_entries
     ):
         # A scalar cost_driver (H3's num_frames, say) moved away from the
@@ -434,7 +467,7 @@ def _child_catalog_price(child_definition, child_cost, step_arguments, device):
         child_list_entries = _list_entries(child_definition, child_expanded)
     child = _price(child_cost, device, child_list_entries, child_measured_entries)
     if (
-        child["basis"] == CATALOG
+        child["basis"] in (CATALOG, OTHER_DEVICE)
         and child_definition is not None
         and _scalar_driver_shifted(child_definition, child_expanded, child_list_entries)
     ):
@@ -458,6 +491,7 @@ class _ChildTotals:
         self.all_observed = True
         self.runs = []
         self.measured_on = set()
+        self.bases = []
 
     def add(self, path, child, observed):
         self.had_child = True
@@ -469,7 +503,9 @@ class _ChildTotals:
         if child["minutes"] is None:
             self.partial = True
             self.unpriced.append(path)
-        elif self.minutes is not None:
+            return
+        self.bases.append((child["basis"], child.get("measured_on")))
+        if self.minutes is not None:
             self.minutes += child["minutes"]
         else:
             self.minutes = child["minutes"]
@@ -509,6 +545,20 @@ def _rolled_up_estimate(own, totals, device, cached_steps, total_steps):
         top_measured_on = (
             next(iter(totals.measured_on)) if len(totals.measured_on) == 1 else None
         )
+    if top_basis == UNKNOWN and minutes is not None and totals.bases:
+        # A number must not carry the basis a caller reads as "no number":
+        # the parent has no cost of its own, but its priced children do, so
+        # the sum takes their basis (#593)
+        kinds = {basis for basis, _ in totals.bases}
+        if OTHER_DEVICE in kinds:
+            top_basis = OTHER_DEVICE
+        elif kinds == {CATALOG}:
+            top_basis = CATALOG
+        else:
+            top_basis = DERIVED
+        devices = {on for _, on in totals.bases}
+        if len(devices) == 1:
+            top_measured_on = next(iter(devices))
     rounded = round(minutes, 1) if minutes is not None else None
     result = {
         "minutes": rounded,
@@ -696,18 +746,22 @@ def _price(cost, device, list_entries, measured_entries):
         basis = OTHER_DEVICE
     minutes = float(chosen.get("minutes", 0))
     per = chosen.get("per_entry")
-    if (
-        basis == CATALOG
-        and isinstance(per, dict)
-        and per.get("variable") in list_entries
-    ):
+    # Another device's figure is re-priced for the list length too (#589): it
+    # stays `other_device` (still not a measurement here), but a 32-entry
+    # for_each must not be quoted at the one-clip figure
+    if isinstance(per, dict) and per.get("variable") in list_entries:
         count = list_entries[per["variable"]]
         each = float(per.get("minutes", 0))
         measured_with = int(per.get("entries", 0))
         minutes = max(0.0, (minutes - each * measured_with) + each * count)
-        basis = PER_ENTRY
-    elif basis == CATALOG:
-        minutes, basis = _repriced(minutes, list_entries, measured_entries)
+        if basis == CATALOG:
+            basis = PER_ENTRY
+    else:
+        minutes, repriced_basis = _repriced(minutes, list_entries, measured_entries)
+        if repriced_basis == UNKNOWN:
+            return {"minutes": None, "basis": UNKNOWN, "measured_on": None}
+        if basis == CATALOG:
+            basis = repriced_basis
     return {"minutes": minutes, "basis": basis, "measured_on": chosen.get("name")}
 
 

dw/server/routes/jobs.py

@@ -455,11 +455,13 @@ def export_job_route(
     absolute_zip_url = absolute_served_url(zip_path, ws)
     if absolute_zip_url is not None:
         body["absolute_zip_url"] = absolute_zip_url
-    # Same rule get_server_info's field states (#353): whether the zip
-    # URL above needs a bearer token an MCP-only agent has no way to
-    # attach itself, which is what tells the caller whether to fetch it
-    # or hand it to the person.
-    body["auth_required"] = bool(state.api_token)
+    # Whether the zip URL above needs a bearer token (#353, #592) - a
+    # property of the route, not of whether this server has a token. The
+    # auth middleware covers /api/ and /mcp only, and /exports/*.zip sits
+    # with /outputs and /inputs on dw/server/routes/files.py's ungated
+    # list, so it is false. export_job's `next` keeps its hand-it-over
+    # branch for the day /exports is gated.
+    body["auth_required"] = False
     for key, name in (
         ("workflow", "workflow.json"),
         ("manifest", "manifest.json"),

dw/tasks/joins.py

@@ -94,6 +94,7 @@ def reconcile_sample_rates(command, videos, names, waveforms, sample_rate=None):
         for video, waveform in zip(videos, waveforms)
         if waveform is not None
     ]
+    pinned = bool(sample_rate)
     sample_rate = sample_rate or (max(set(rates)) if rates else None)
     if rates and len(set(rates)) == 1 and rates[0] != sample_rate:
         # The inputs agree and the caller pinned another rate: converting
@@ -104,6 +105,15 @@ def reconcile_sample_rates(command, videos, names, waveforms, sample_rate=None):
             command=command,
             sample_rate=sample_rate,
         )
+    elif rates and pinned and any(rate != sample_rate for rate in rates):
+        # Mixed inputs converted to the rate the caller (or the template)
+        # pinned: expected, and 'pass sample_rate' advice would be wrong (#594)
+        emit_log(
+            f"{command}: resampling tracks at {sorted(set(rates))} Hz to the "
+            f"requested {sample_rate} Hz",
+            command=command,
+            sample_rate=sample_rate,
+        )
     elif rates and any(rate != sample_rate for rate in rates):
         # emit_warning rather than logger.warning: resampling every track is
         # an audio decision made on the caller's behalf, and a caller reading

dw_mcp/exports.py

@@ -3,9 +3,9 @@
 The one thing this module has to keep saying: the directory it makes is on
 the machine running dw.serve, which over a `dw.serve --mcp` endpoint is the
 GPU box and not where the agent is. The zip URL is the way to it from
-anywhere else - but when the server requires a bearer token (#353), that URL
-is for the person to open, not for this agent to fetch on their behalf; see
-`export_job`'s `auth_required` / `open_url`.
+anywhere else, and it needs no token: /exports/*.zip is ungated like
+/outputs (#592), so `auth_required` is false and the agent fetches it itself.
+The hand-it-to-the-person branch (#353) stays for the day it is gated.
 """
 
 from dw_mcp.client import api_path
@@ -22,10 +22,10 @@ def export_job(client, job_id, overwrite=False):
     here. The directory is on the server machine, not this one.
 
     `auth_required` says whether the zip needs this server's bearer token
-    to open - a token this agent has no way to attach to a browser or hand
-    to someone else's tooling. When it is true, `open_url` is for the
-    *person* to open, not for this agent to fetch: hand it to them (see
-    `next`). When it is false, `open_url` may be fetched directly. It is
+    to open. The server reports false - the zip route is ungated, token or
+    not (#592) - and `next` says to fetch `open_url` and unpack it. True
+    is a forward guard: a gated zip is for the *person* to open, since
+    this agent cannot attach the token to their browser. `open_url` is
     `absolute_zip_url` when the server has one configured (`DW_PUBLIC_URL`
     / the `public_url` setting), else the relative `zip_url`."""
     body = client.post_json(
@@ -58,11 +58,14 @@ def export_job(client, job_id, overwrite=False):
         open_url = absolute_zip_url or zip_url
         next_text = (
             "The directory is on the server. To give the user the files, "
-            "fetch open_url and unpack it into exports/ under the session's "
-            "working directory - it is the user's deliverable, not a "
-            "temporary file, so not a scratch or temp directory. The archive "
-            "already unpacks into one folder named after the job id; do not "
-            "create that folder first or the id is doubled in the path. "
+            "fetch open_url with whatever HTTP you have - it needs no token; "
+            "prefix a relative one with the address you reach this server at "
+            "- and unpack it into exports/ under the session's working "
+            "directory - it is the user's deliverable, not a temporary file, "
+            "so not a scratch or temp directory. The archive already unpacks "
+            "into one folder named after the job id; do not create that "
+            "folder first or the id is doubled in the path. Only if you "
+            "cannot make HTTP requests, give the user open_url to open. "
             "workflow.json, manifest.json and job.json are inside it - they "
             "are not repeated here; get_job_workflow and get_job serve them "
             "individually."

dw_mcp/tools_jobs.py

@@ -216,16 +216,15 @@ class JobTools:
         repeated here - get_job_workflow and get_job serve them individually.
         THE DIRECTORY IS ON THE MACHINE RUNNING THE SERVER, not on yours.
 
-        `auth_required` says whether opening the zip needs this server's
-        bearer token, a token you cannot attach to someone else's browser
-        or tooling. When it is false, fetch open_url yourself and unpack
-        it into exports/ under the session's working directory - it is
-        the user's deliverable, not a temp file; the archive already
-        unpacks into one folder named after the job id, so do not create that folder first.
-        When it is true, do NOT fetch it: hand open_url to the person and let them open it
-        (`next` says whether it is already absolute or needs the server's
-        address told to them). Individual results stay reachable inline
-        via get_output_image/get_output_audio/get_output_frames either
-        way. Refuses a job that is still running; refuses an existing
+        open_url is the zip and needs no token: fetch it with any HTTP
+        you have (prefix a relative one with the server's address) and
+        unpack it into exports/ under the session's working directory -
+        the user's deliverable, not a temp file; it already unpacks into
+        one folder named after the job id, so do not create that folder first.
+        Only without HTTP, give the user open_url to open. If `auth_required`
+        is ever true, the zip is gated: hand it over (see `next`).
+        Individual results stay reachable inline via
+        get_output_image/get_output_audio/get_output_frames
+        without the zip. Refuses a job that is still running; refuses an existing
         export unless overwrite=true."""
         return exports.export_job(self.client, job_id, overwrite=overwrite)