fix progress auth

Signed-off-by: vladmandic <mandic00@live.com>

.eslintrc.json

@@ -94,6 +94,7 @@
     "setFontSize": "readonly",
     "setTheme": "readonly",
     "registerDragDrop": "readonly",
+    "getToken": "readonly",
     "getENActiveTab": "readonly",
     "quickApplyStyle": "readonly",
     "quickSaveStyle": "readonly",

CHANGELOG.md

@@ -1,12 +1,12 @@
 # Change Log for SD.Next
 
-## Update for 2025-11-26
+## Update for 2025-12-02
 
 ### TBD
 
 Merge commit: `f903a36d9`
 
-### Highlights for 2025-11-26
+### Highlights for 2025-12-02
 
 New native [kanvas](https://vladmandic.github.io/sdnext-docs/Kanvas/) module for image manipulation that fully replaces img2img, inpaint and outpaint controls  
 New generation of **Flux.2** large image model and a first cloud model with **Google's Nano Banana** *2.5 Flash and 3.0 Pro* plus new **Photoroom PRX** model  
@@ -15,7 +15,7 @@ New generation of **Flux.2** large image model and a first cloud model with **Go
 
 [ReadMe](https://github.com/vladmandic/automatic/blob/master/README.md) | [ChangeLog](https://github.com/vladmandic/automatic/blob/master/CHANGELOG.md) | [Docs](https://vladmandic.github.io/sdnext-docs/) | [WiKi](https://github.com/vladmandic/automatic/wiki) | [Discord](https://discord.com/invite/sd-next-federal-batch-inspectors-1101998836328697867) | [Sponsor](https://github.com/sponsors/vladmandic)  
 
-### Details for 2025-11-26
+### Details for 2025-12-02
 
 - **Models**
   - [Black Forest Labs FLUX.2 Dev](https://bfl.ai/blog/flux-2) and prequantized variation [SDNQ-SVD-Uint4](https://huggingface.co/Disty0/FLUX.2-dev-SDNQ-uint4-svd-r32)  
@@ -42,6 +42,7 @@ New generation of **Flux.2** large image model and a first cloud model with **Go
   - **amdgpu**: prefer rocm-on-windows over zluda  
   - **amdgpu**: improve rocm-on-windows installer  
   - **sdnq**: improve dequant logic  
+  - **gallery**: significant performance improvements, thanks @awsr  
 - **API**
   - `/control` endpoint is now fully compatible with scripts
   - `/control` additional params to to control *xyz grid*  
@@ -63,6 +64,8 @@ New generation of **Flux.2** large image model and a first cloud model with **Go
   - nunchaku: update to `1.0.2`  
   - lint: add rules for run-on-windows  
   - gallery: purge old thumbnails, thanks @awsr  
+- **Docs**
+  - update supported models table with VAE information, thanks @alerikaisattera
 - **Fixes**
   - xyz-grid: improve parsing of axis lists, thanks @awsr  
   - hires: strength save/load in metadata, thanks @awsr  
@@ -82,7 +85,9 @@ New generation of **Flux.2** large image model and a first cloud model with **Go
   - control: safe load non-sparse controlnet  
   - control: fix marigold preprocessor with bfloat16  
   - auth: fix password being shown in clear text during login  
-  - firefox: remove obsolete checks, thanks @awsr
+  - firefox: remove obsolete checks, thanks @awsr  
+  - runai streamer: cleanup logging, thanks @CalamitousFelicitousness  
+  - fix gradio event handlers, thanks @awsr  
 
 ## Update for 2025-11-06
 

TODO.md

@@ -6,7 +6,7 @@
 
 ## Kanvas
 
-- implement different llama remover  
+- Reimplement llama remover  
 
 ## Internal
 
@@ -40,6 +40,8 @@
 
 TODO: *Prioritize*!
 
+- [HunyuanVideo-1.5](https://github.com/huggingface/diffusers/pull/12696)
+- [Sana-I2V](https://github.com/huggingface/diffusers/pull/12634#issuecomment-3540534268)
 - [Bria FIBO](https://huggingface.co/briaai/FIBO)
 - [Bytedance Lynx](https://github.com/bytedance/lynx)
 - [ByteDance OneReward](https://github.com/bytedance/OneReward)
@@ -74,10 +76,6 @@ TODO: *Prioritize*!
 - [Wan2.2-Animate-14B](https://huggingface.co/Wan-AI/Wan2.2-Animate-14B)
 - [WAN2GP](https://github.com/deepbeepmeep/Wan2GP)  
 
-## Futureproofing
-
-Anything marked with **(!!!)** means a change *will* eventually be required.
-
 ### General
 
 - Review/improve type-hinting and type checking
@@ -85,7 +83,7 @@ Anything marked with **(!!!)** means a change *will* eventually be required.
 
 ### Asyncio
 
-- **(!!!)** Policy system is deprecated and will be removed in **Python 3.16**
+- Policy system is deprecated and will be removed in **Python 3.16**
   - [Python 3.14 removals - asyncio](https://docs.python.org/3.14/whatsnew/3.14.html#id10)
   - https://docs.python.org/3.14/library/asyncio-policy.html
   - Affected files:

installer.py

@@ -620,7 +620,7 @@ def check_diffusers():
     t_start = time.time()
     if args.skip_all:
         return
-    sha = '6bf668c4d217ebc96065e673d8a257fd79950d34' # diffusers commit hash
+    sha = 'edf36f5128abf3e6ecf92b5145115514363c58e6' # diffusers commit hash
     # if args.use_rocm or args.use_zluda or args.use_directml:
     #     sha = '043ab2520f6a19fce78e6e060a68dbc947edb9f9' # lock diffusers versions for now
     pkg = pkg_resources.working_set.by_key.get('diffusers', None)

javascript/authWrap.js

@@ -1,8 +1,8 @@
 let user = null;
 let token = null;
 
-async function authFetch(url, options = {}) {
-  if (!token) {
+async function getToken() {
+  if (!token || !user) {
     const res = await fetch(`${window.subpath}/token`);
     if (res.ok) {
       const data = await res.json();
@@ -10,9 +10,14 @@ async function authFetch(url, options = {}) {
       token = data.token;
     }
   }
-  if (user && token) {
+  return { user, token };
+}
+
+async function authFetch(url, options = {}) {
+  const { localUser, localToken } = await getToken();
+  if (localUser && localToken) {
     if (!options.headers) options.headers = {};
-    const encoded = btoa(`${user}:${token}`);
+    const encoded = btoa(`${localUser}:${localToken}`);
     options.headers.Authorization = `Basic ${encoded}`;
   }
   const res = await fetch(url, options);

javascript/logger.js

@@ -35,7 +35,7 @@ const error = async (...msg) => {
   // if (!txt.includes('asctime') && !txt.includes('xhr.')) xhrPost('/sdapi/v1/log', { error: txt }); // eslint-disable-line no-use-before-define
 };
 
-const xhrInternal = (xhrObj, data, handler = undefined, errorHandler = undefined, ignore = false, serverTimeout = opts.ui_request_timeout || 30000) => {
+const xhrInternal = async (xhrObj, data, handler = undefined, errorHandler = undefined, ignore = false, serverTimeout = opts.ui_request_timeout || 30000) => {
   const err = (msg) => {
     if (!ignore) {
       error(`${msg}: state=${xhrObj.readyState} status=${xhrObj.status} response=${xhrObj.responseText}`);
@@ -43,6 +43,12 @@ const xhrInternal = (xhrObj, data, handler = undefined, errorHandler = undefined
     }
   };
 
+  const { localUser, localToken } = await getToken();
+  if (localUser && localToken) {
+    const encoded = btoa(`${localUser}:${localToken}`);
+    xhrObj.setRequestHeader('Authorization', `Basic ${encoded}`);
+  }
+
   xhrObj.setRequestHeader('Content-Type', 'application/json');
   xhrObj.timeout = opts.ui_request_timeout || 30000;
   xhrObj.ontimeout = () => err('xhr.ontimeout');