improve handling of hf auth

Signed-off-by: Vladimir Mandic <mandic00@live.com>

CHANGELOG.md

@@ -22,6 +22,7 @@
   - init hf env variables before gradio load
   - lora skip init and rebuild offload state
   - lora keep network multiplier on change
+  - improve handling of hf auth
 
 ## Update for 2026-08-07
 

modules/detailer/dino.py

@@ -3,7 +3,7 @@ import re
 import torch
 import transformers
 from PIL import Image
-from modules import shared, devices, sd_offload_aux, model_quant
+from modules import shared, devices, sd_offload_aux, sd_models, model_quant
 from modules.detailer import DetailerResult, detailer_opt, get_mask
 from modules.logger import log
 
@@ -24,6 +24,7 @@ def load(self, model_name: str | None = None) -> tuple[str, transformers.AutoMod
     if cached is not None:
         return model_name, cached
     repo_id = 'IDEA-Research/' + model_name.lower() if '/' not in model_name else model_name
+    sd_models.hf_auth_check(repo_id)
     load_kwargs = {
         'pretrained_model_name_or_path': repo_id,
         'cache_dir': shared.opts.hfcache_dir,

modules/detailer/florence.py

@@ -2,7 +2,7 @@ import time
 import json
 import transformers
 from PIL import Image
-from modules import shared, devices, sd_offload_aux, model_quant
+from modules import shared, devices, sd_offload_aux, sd_models, model_quant
 from modules.detailer import DetailerResult, detailer_opt, get_mask
 from modules.logger import log
 
@@ -35,6 +35,7 @@ def load(self, model_name: str | None = None) -> tuple[str, transformers.AutoMod
     if cached is not None:
         return model_name, cached
     repo_id = 'florence-community/' + model_name if '/' not in model_name else model_name
+    sd_models.hf_auth_check(repo_id)
 
     orig_get_imports = transformers.dynamic_module_utils.get_imports
 

modules/detailer/qwen.py

@@ -3,7 +3,7 @@ import json
 import transformers
 from pydantic import BaseModel, Field
 from PIL import Image
-from modules import shared, devices, sd_offload_aux, model_quant
+from modules import shared, devices, sd_offload_aux, sd_models, model_quant
 from modules.detailer import DetailerResult, detailer_opt, get_mask
 from modules.logger import log
 
@@ -61,6 +61,7 @@ def load(self, model_name: str | None = None) -> tuple[str, transformers.Qwen3VL
     if cached is not None:
         return model_name, cached
     repo_id = 'Qwen/' + model_name if not model_name.startswith('Qwen/') else model_name
+    sd_models.hf_auth_check(repo_id)
     load_kwargs = {
         'pretrained_model_name_or_path': repo_id,
         'cache_dir': shared.opts.hfcache_dir,

modules/detailer/rexomni.py

@@ -3,7 +3,7 @@ import re
 import torch
 import transformers
 from PIL import Image
-from modules import shared, devices, sd_offload_aux, model_quant
+from modules import shared, devices, sd_offload_aux, sd_models,model_quant
 from modules.detailer import DetailerResult, detailer_opt, get_mask
 from modules.logger import log
 
@@ -23,6 +23,7 @@ def load(self, model_name: str | None = None) -> tuple[str, transformers.AutoMod
         return model_name, cached
 
     repo_id = 'IDEA-Research/' + model_name if '/' not in model_name else model_name
+    sd_models.hf_auth_check(repo_id)
     load_kwargs = {
         'pretrained_model_name_or_path': repo_id,
         'cache_dir': shared.opts.hfcache_dir,

modules/detailer/sam.py

@@ -1,7 +1,7 @@
 import time
 import transformers
 from PIL import Image
-from modules import shared, devices, sd_offload_aux
+from modules import shared, devices, sd_models, sd_offload_aux
 from modules.detailer import DetailerResult, detailer_opt, get_mask
 from modules.logger import log
 
@@ -11,6 +11,7 @@ def load(self, model_name: str | None = None) -> tuple[str, transformers.Sam3Mod
     if cached is not None:
         return model_name, cached
     repo_id = model_name.lower().replace('-', '/')
+    sd_models.hf_auth_check(repo_id, force=True)
     load_kwargs = {
         'pretrained_model_name_or_path': repo_id,
         'cache_dir': shared.opts.hfcache_dir,

modules/modelloader.py

@@ -18,6 +18,7 @@ loggedin = None
 diffuser_repos = []
 debug = log.trace if os.environ.get('SD_DOWNLOAD_DEBUG', None) is not None else lambda *args, **kwargs: None
 pbar = None
+_orig_build_hf_headers = hf.utils._headers.build_hf_headers
 
 
 def hf_login(token=None):
@@ -25,34 +26,53 @@ def hf_login(token=None):
         return False
     global loggedin # pylint: disable=global-statement
     token = token or shared.opts.huggingface_token
+    if token is None:
+        token = os.environ.get('HF_TOKEN', None)
     token = token.replace("\n", "").replace("\r", "").strip() if token is not None else None
     install('hf_xet', quiet=True)
     if token is None or len(token) <= 4:
         log.debug('HF login: no token provided')
         return False
-    if len(shared.opts.huggingface_mirror.strip()) > 0 and os.environ.get('HF_ENDPOINT', None) is None:
-        os.environ['HF_ENDPOINT'] = shared.opts.huggingface_mirror.strip()
-    if os.environ.get('HUGGING_FACE_HUB_TOKEN', None) is not None:
+    if loggedin != token:
+        if len(shared.opts.huggingface_mirror.strip()) > 0 and os.environ.get('HF_ENDPOINT', None) is None:
+            os.environ['HF_ENDPOINT'] = shared.opts.huggingface_mirror.strip()
+
         os.environ.pop('HUGGING_FACE_HUB_TOKEN', None)
         os.unsetenv('HUGGING_FACE_HUB_TOKEN')
-    if os.environ.get('HF_TOKEN', None) is not None:
-        os.environ.pop('HF_TOKEN', None)
-        os.unsetenv('HF_TOKEN')
-    if loggedin != token:
+        os.environ['HF_TOKEN'] = token
         stdout = io.StringIO()
+        stderr = io.StringIO()
+        text = ''
         try:
-            with contextlib.redirect_stdout(stdout):
+            with contextlib.redirect_stdout(stdout), contextlib.redirect_stderr(stderr):
                 hf.logout()
         except Exception:
             pass
-        with contextlib.redirect_stdout(stdout):
-            hf.login(token=token, add_to_git_credential=False)
-        os.environ['HF_TOKEN'] = token
-        text = stdout.getvalue() or ''
-        obfuscated_token = 'hf_...' + token[-4:]
+        try:
+            # with contextlib.nullcontext():
+            with contextlib.redirect_stdout(stdout), contextlib.redirect_stderr(stderr):
+                hf.login(token=token, add_to_git_credential=False)
+        except Exception as e:
+            text += str(e)
+        text = (stdout.getvalue() or '') + (stderr.getvalue() or '')
+        try:
+            new_token = hf.get_token()
+        except Exception:
+            pass
+        obfuscated_token = 'hf_...' + new_token[-4:]
         line = [l for l in text.split('\n') if 'Token' in l]
-        log.info(f'HF login: token="{obfuscated_token}" fn="{hf.constants.HF_TOKEN_PATH}" {line[0] if len(line) > 0 else text}')
-        loggedin = token
+        token_name = None
+        user_name = None
+        try:
+            user = hf.whoami()
+            if user is not None:
+                user_name = user.get('name', None)
+                token_name = user.get('auth', {}).get('accessToken', {}).get('displayName', None)
+        except Exception:
+            pass
+        log.info(f'HF login: user={user_name} key="{token_name}" token="{obfuscated_token}" fn="{hf.constants.HF_TOKEN_PATH}" {line[0] if len(line) > 0 else text}')
+        loggedin = new_token
+        return user_name is not None
     return True
 
 

modules/sd_hijack_hfhub.py

@@ -61,6 +61,11 @@ def xet_get_hijack(*args, **kwargs):
 
 
 def build_hf_headers_hijack(*args, **kwargs):
+    from huggingface_hub import get_token
+    token = kwargs.get('token', None)
+    if token is None or token is True:
+        token = os.environ.get("HF_TOKEN") or get_token()
+        kwargs['token'] = token
     headers = orig_build_hf_headers(*args, **kwargs)
     headers = clean_user_agent(headers)
     return headers

modules/sd_models.py

@@ -1603,12 +1603,14 @@ def hf_auth_check(checkpoint_info: CheckpointInfo, force:bool=False):
     if repo_id is None or '/' not in repo_id:
         # log.warning(f'Auth: repo="{repo_id}" invalid repo id')
         return False
+    auth_ok = False
     try:
         login = modelloader.hf_login()
-        return hf.auth_check(repo_id)
+        hf.auth_check(repo_id, write=False)
+        auth_ok = True
     except Exception as e:
-        log.error(f'Auth: repo="{repo_id}" login={login} {e}')
-        return False
+        log.error(f'Auth: repo="{repo_id}" login={login} auth={auth_ok} {e}')
+    return auth_ok
 
 
 def save_model(name: str, path: str | None = None, shard: str = "5GB", overwrite = False):

ui/dist/sdnext.mjs

@@ -11122,7 +11122,7 @@ function requestProgress(id_task = "undefined", progressEl = null, galleryEl = n
       parentGallery.style.overflow = "hidden";
     };
   };
-  const removeLivePreview = (ok2 = false) => {
+  const removeLivePreview = (useImage = false) => {
     debug("taskEnd:", id_task);
     localStorage.removeItem("task");
     setProgress();
@@ -11132,12 +11132,14 @@ function requestProgress(id_task = "undefined", progressEl = null, galleryEl = n
     for (const gallery of galleries) gallery.style.display = "flex";
     try {
       if (parentGallery && livePreview) {
-        if (ok2) {
+        if (useImage) {
           const previewImg = gradioApp().querySelector("#livePreviewImage");
-          const galleryImg = gradioApp().querySelector("#control_gallery img");
+          const galleryImg = parentGallery.querySelector("img");
           if (previewImg?.src && galleryImg) galleryImg.src = previewImg.src;
         }
         parentGallery.removeChild(livePreview);
+      }
+      if (parentGallery) {
         parentGallery.style.minHeight = "unset";
         parentGallery.style.maxHeight = "unset";
         parentGallery.style.overflow = "unset";

ui/progressBar.ts

@@ -148,7 +148,7 @@ export function requestProgress(id_task = 'undefined', progressEl = null, galler
     };
   };
 
-  const removeLivePreview = (ok = false) => {
+  const removeLivePreview = (useImage = false) => {
     debug('taskEnd:', id_task);
     localStorage.removeItem('task');
     setProgress();
@@ -158,12 +158,14 @@ export function requestProgress(id_task = 'undefined', progressEl = null, galler
     for (const gallery of galleries) gallery.style.display = 'flex'; // remove all galleries
     try {
       if (parentGallery && livePreview) {
-        if (ok) {
+        if (useImage) {
           const previewImg = gradioApp().querySelector('#livePreviewImage');
-          const galleryImg = gradioApp().querySelector('#control_gallery img');
+          const galleryImg = parentGallery.querySelector('img');
           if (previewImg?.src && galleryImg) galleryImg.src = previewImg.src; // copy preview to gallery if everything is ok
         }
         parentGallery.removeChild(livePreview);
+      }
+      if (parentGallery) {
         parentGallery.style.minHeight = 'unset';
         parentGallery.style.maxHeight = 'unset';
         parentGallery.style.overflow = 'unset';