Integration/upstream main 2026 07 16

.github/actions/install-frontend-deps/action.yml

@@ -1,5 +1,10 @@
 name: install frontend dependencies
 description: Installs frontend dependencies with pnpm, with caching
+inputs:
+  working-directory:
+    description: Directory to install dependencies in
+    required: false
+    default: invokeai/frontend/web
 runs:
   using: 'composite'
   steps:
@@ -30,4 +35,4 @@ runs:
     - name: install frontend dependencies
       run: pnpm install --prefer-frozen-lockfile
       shell: bash
-      working-directory: invokeai/frontend/web
+      working-directory: ${{ inputs.working-directory }}

.github/workflows/frontend-checks.yml

@@ -30,14 +30,13 @@ on:
         type: boolean
         default: true
 
-defaults:
-  run:
-    working-directory: invokeai/frontend/web
-
 jobs:
   frontend-checks:
     runs-on: ubuntu-latest
     timeout-minutes: 10 # expected run time: <2 min
+    defaults:
+      run:
+        working-directory: invokeai/frontend/web
     steps:
       - uses: actions/checkout@v6
 
@@ -94,3 +93,37 @@ jobs:
         if: ${{ steps.changed-files.outputs.frontend_any_changed == 'true' || inputs.always_run == true }}
         run: 'pnpm lint:knip'
         shell: bash
+
+  frontend-webv2-checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10 # expected run time: <2 min
+    defaults:
+      run:
+        working-directory: invokeai/frontend/webv2
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: check for changed webv2 files
+        if: ${{ inputs.always_run != true }}
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96
+        with:
+          files_yaml: |
+            webv2:
+              - 'invokeai/frontend/webv2/**'
+
+      - name: install dependencies
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        uses: ./.github/actions/install-frontend-deps
+        with:
+          working-directory: invokeai/frontend/webv2
+
+      - name: lint
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        run: 'pnpm run lint'
+        shell: bash
+
+      - name: build
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        run: 'pnpm run build'
+        shell: bash

.github/workflows/frontend-tests.yml

@@ -30,14 +30,13 @@ on:
         type: boolean
         default: true
 
-defaults:
-  run:
-    working-directory: invokeai/frontend/web
-
 jobs:
   frontend-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 10 # expected run time: <2 min
+    defaults:
+      run:
+        working-directory: invokeai/frontend/web
     steps:
       - uses: actions/checkout@v6
 
@@ -63,3 +62,43 @@ jobs:
         if: ${{ steps.changed-files.outputs.frontend_any_changed == 'true' || inputs.always_run == true }}
         run: 'pnpm test:no-watch'
         shell: bash
+
+  frontend-webv2-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10 # expected run time: <2 min
+    defaults:
+      run:
+        working-directory: invokeai/frontend/webv2
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: check for changed webv2 files
+        if: ${{ inputs.always_run != true }}
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96
+        with:
+          files_yaml: |
+            webv2:
+              - '.github/workflows/frontend-tests.yml'
+              - 'invokeai/frontend/webv2/**'
+
+      - name: install dependencies
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        uses: ./.github/actions/install-frontend-deps
+        with:
+          working-directory: invokeai/frontend/webv2
+
+      - name: vitest
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        run: 'pnpm test'
+        shell: bash
+
+      - name: install Chromium
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        run: 'pnpm exec playwright install chromium'
+        shell: bash
+
+      - name: vitest browser
+        if: ${{ steps.changed-files.outputs.webv2_any_changed == 'true' || inputs.always_run == true }}
+        run: 'pnpm test:browser'
+        shell: bash

.gitignore

@@ -135,6 +135,16 @@ env/
 venv/
 ENV/
 
+# Generated stuff
+invokeai.yaml
+invokeai.example.yaml
+
+/models/
+/databases/
+/configs/
+/nodes/
+/outputs/
+
 # Spyder project settings
 .spyderproject
 .spyproject

docs/superpowers/specs/2026-07-15-canvas-context-menu-groups-design.md

@@ -0,0 +1,27 @@
+# Canvas Context Menu Groups Design
+
+## Goal
+
+Restore the legacy canvas context-menu organization with labeled layer and canvas groups while keeping Delete as the final action.
+
+## Design
+
+- Canvas-surface context menus use Chakra `Menu.ItemGroup` and `Menu.ItemGroupLabel` primitives with the established uppercase, subtle label styling.
+- A context menu opened over a layer labels the layer-scoped actions with the singular layer type: Raster Layer, Control Layer, Inpaint Mask, or Regional Guidance.
+- Canvas-wide actions are labeled Canvas. Save to Gallery remains in this canvas group and appears before the terminal Delete action.
+- Delete remains a separated standalone danger action at the bottom so no non-destructive action appears beneath it.
+- A context menu opened over empty canvas space shows only the Canvas group.
+- Layer-panel kebab and row context menus remain unchanged because the legacy panel menus were ungrouped.
+
+## Boundaries
+
+- Reuse existing translations for Canvas and singular layer types.
+- Preserve all existing handlers, disabled states, submenu behavior, and menu positioning.
+- Add no state, effects, dependencies, or action-registry coupling.
+
+## Verification
+
+- Add regression coverage for the surface-menu group model and render order.
+- Verify each layer type resolves to the matching legacy label.
+- Verify the optional Canvas group precedes the terminal danger section and panel menus remain ungrouped when labels are omitted.
+- Run the focused context-menu tests, frontend typecheck, formatting check, and full frontend test suite.

invokeai/app/api/dependencies.py

@@ -42,6 +42,7 @@
 from invokeai.app.services.names.names_default import SimpleNameService
 from invokeai.app.services.object_serializer.object_serializer_disk import ObjectSerializerDisk
 from invokeai.app.services.object_serializer.object_serializer_forward_cache import ObjectSerializerForwardCache
+from invokeai.app.services.project_records.project_records_sqlite import ProjectRecordsSqlite
 from invokeai.app.services.session_processor.session_processor_default import (
     DefaultSessionProcessor,
     DefaultSessionRunner,
@@ -189,6 +190,7 @@ def initialize(
         style_preset_image_files = StylePresetImageFileStorageDisk(style_presets_folder / "images")
         workflow_thumbnails = WorkflowThumbnailFileStorageDisk(workflow_thumbnails_folder)
         client_state_persistence = ClientStatePersistenceSqlite(db=db)
+        project_records = ProjectRecordsSqlite(db=db)
         users = UserService(db=db)
 
         services = InvocationServices(
@@ -223,6 +225,7 @@ def initialize(
             style_preset_image_files=style_preset_image_files,
             workflow_thumbnails=workflow_thumbnails,
             client_state_persistence=client_state_persistence,
+            project_records=project_records,
             users=users,
         )
 

invokeai/app/api/routers/_access.py

@@ -22,6 +22,8 @@ def assert_image_owner(image_name: str, current_user: CurrentUserOrDefault) -> N
     """
     if current_user.is_admin:
         return
+    if not ApiDependencies.invoker.services.image_records.exists(image_name):
+        raise HTTPException(status_code=404, detail="Image not found")
     owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)
     if owner is not None and owner == current_user.user_id:
         return
@@ -50,6 +52,8 @@ def assert_image_read_access(image_name: str, current_user: CurrentUserOrDefault
     """
     if current_user.is_admin:
         return
+    if not ApiDependencies.invoker.services.image_records.exists(image_name):
+        raise HTTPException(status_code=404, detail="Image not found")
 
     owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)
     if owner is not None and owner == current_user.user_id:

invokeai/app/api/routers/app_info.py

@@ -23,6 +23,7 @@
     load_external_api_keys,
 )
 from invokeai.app.services.external_generation.external_generation_common import ExternalProviderStatus
+from invokeai.app.services.external_generation.startup import sync_configured_external_starter_models
 from invokeai.app.services.invocation_cache.invocation_cache_common import InvocationCacheStatus
 from invokeai.app.services.model_records.model_records_base import UnknownModelException
 from invokeai.backend.image_util.infill_methods.patchmatch import PatchMatch
@@ -178,7 +179,7 @@ async def update_runtime_config(
     status_code=200,
     response_model=list[ExternalProviderStatusModel],
 )
-async def get_external_provider_statuses() -> list[ExternalProviderStatusModel]:
+async def get_external_provider_statuses(_: AdminUserOrDefault) -> list[ExternalProviderStatusModel]:
     statuses = ApiDependencies.invoker.services.external_generation.get_provider_statuses()
     return [status_to_model(status) for status in statuses.values()]
 
@@ -189,7 +190,7 @@ async def get_external_provider_statuses() -> list[ExternalProviderStatusModel]:
     status_code=200,
     response_model=list[ExternalProviderConfigModel],
 )
-async def get_external_provider_configs() -> list[ExternalProviderConfigModel]:
+async def get_external_provider_configs(_: AdminUserOrDefault) -> list[ExternalProviderConfigModel]:
     config = get_config()
     return [_build_external_provider_config(provider_id, config) for provider_id in EXTERNAL_PROVIDER_FIELDS]
 
@@ -219,9 +220,14 @@ async def set_external_provider_config(
         raise HTTPException(status_code=400, detail="No external provider config fields provided")
 
     api_key_removed = update.api_key is not None and updates.get(api_key_field) is None
+    api_key_set = update.api_key is not None and updates.get(api_key_field) is not None
     _apply_external_provider_update(updates)
     if api_key_removed:
         _remove_external_models_for_provider(provider_id)
+    elif api_key_set:
+        # Configuring a key should make the provider's models usable without a
+        # restart; queue its external starter models the same way startup does.
+        _sync_external_starter_models_for_provider(provider_id)
     return _build_external_provider_config(provider_id, get_config())
 
 
@@ -316,6 +322,19 @@ def _build_external_provider_config(provider_id: str, config: InvokeAIAppConfig)
     )
 
 
+def _sync_external_starter_models_for_provider(provider_id: str) -> None:
+    invoker = ApiDependencies.invoker
+    try:
+        sync_configured_external_starter_models(
+            configured_provider_ids={provider_id},
+            model_manager=invoker.services.model_manager,
+            logger=invoker.services.logger,
+        )
+    except Exception as error:
+        # Queuing installs must never fail the config save; surface and move on.
+        invoker.services.logger.warning(f"Failed queueing external starter models for '{provider_id}': {error}")
+
+
 def _remove_external_models_for_provider(provider_id: str) -> None:
     model_manager = ApiDependencies.invoker.services.model_manager
     external_models = model_manager.store.search_by_attr(

invokeai/app/api/routers/custom_nodes.py

@@ -1,8 +1,8 @@
 """FastAPI routes for custom node management."""
 
+import asyncio
 import json
 import shutil
-import subprocess
 import sys
 import traceback
 from importlib.util import module_from_spec, spec_from_file_location
@@ -28,6 +28,7 @@
 # were imported by that pack. Used on uninstall to delete only pack-imported workflows
 # — deleting by tag alone is unsafe because users can edit tags on their own workflows.
 PACK_MANIFEST_FILENAME = ".invokeai_pack_manifest.json"
+GIT_CLONE_TIMEOUT_SECONDS = 120
 
 
 class NodePackInfo(BaseModel):
@@ -126,6 +127,26 @@ def _get_installed_packs() -> list[NodePackInfo]:
     return packs
 
 
+async def _clone_node_pack(source: str, target_dir: Path) -> tuple[int, str]:
+    process = await asyncio.create_subprocess_exec(
+        "git",
+        "clone",
+        source,
+        str(target_dir),
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+    )
+
+    try:
+        _stdout, stderr = await asyncio.wait_for(process.communicate(), timeout=GIT_CLONE_TIMEOUT_SECONDS)
+    except asyncio.TimeoutError:
+        process.kill()
+        await process.communicate()
+        raise
+
+    return process.returncode or 0, stderr.decode(errors="replace").strip()
+
+
 @custom_nodes_router.get(
     "/",
     operation_id="list_custom_node_packs",
@@ -172,21 +193,16 @@ async def install_custom_node_pack(
 
     try:
         # Clone the repository
-        result = subprocess.run(
-            ["git", "clone", source, str(target_dir)],
-            capture_output=True,
-            text=True,
-            timeout=120,
-        )
+        returncode, stderr = await _clone_node_pack(source, target_dir)
 
-        if result.returncode != 0:
+        if returncode != 0:
             # Clean up on failure
             if target_dir.exists():
                 shutil.rmtree(target_dir)
             return InstallNodePackResponse(
                 name=pack_name,
                 success=False,
-                message=f"Git clone failed: {result.stderr.strip()}",
+                message=f"Git clone failed: {stderr}",
             )
 
         # Detect dependency manifests but do NOT install them automatically.
@@ -232,7 +248,7 @@ async def install_custom_node_pack(
             dependency_file=dependency_file,
         )
 
-    except subprocess.TimeoutExpired:
+    except asyncio.TimeoutError:
         if target_dir.exists():
             shutil.rmtree(target_dir)
         return InstallNodePackResponse(