[bug]: Diffusers repo-id installs never apply the model_index.json component filter #9901

Is there an existing issue for this problem?

• I have searched the existing issues

Install method

Any (code path in the model install service)

Operating system

Any

GPU vendor

Any

What happened

When a Diffusers repo is installed by repo id, HuggingFaceMetadata.download_urls() (invokeai/backend/model_manager/metadata/metadata_base.py) is meant to read model_index.json and keep only the files in the folders of the pipeline's components. That branch never runs for real installs.

HuggingFaceMetadataFetch.from_id() (metadata/fetch/huggingface.py) builds every file path as Path(name, rfilename), so all paths carry the repository name as their first part, and filter_files() keeps that prefix. The check is

if Path(f"{prefix}model_index.json") in paths:

with prefix either "" or "<subfolder>/". It looks for model_index.json (or <subfolder>/model_index.json) without the repository name, which is never in paths. The comparison inside the branch (Path(x).parent.as_posix() in submodels) is unprefixed in the same way.

Result: the component filter is skipped. Only filter_files()' extension, variant and model.* name filtering applies. A repo-id install can therefore download weights that are not part of the pipeline: root-level files and files in folders not listed in model_index.json, whenever their names match model.*\.(safetensors|bin|...).

What you expected to happen

Only the folders listed in model_index.json (plus the index itself) are downloaded, as the code intends.

How to reproduce the problem

Build HuggingFaceMetadata the way from_id() does, with Path("<repo-name>", rfilename) paths that include model_index.json and an extra root or non-component model.safetensors, and call download_urls() with a mocked session. The index is never fetched (session.get is not called), and the extra weight file is returned.

Additional context

The same issue was found and fixed for the sibling modular_model_index.json branch in #9883 (commit 045e7e3). There the index check and the component-folder comparison now work relative to the repository root, while the returned files keep their prefixed paths. Its test uses production-shaped prefixed paths: tests/backend/model_manager/test_modular_repo_download_urls.py. The classic branch needs the same normalization, plus a test with prefixed paths. The existing tests for this branch use unprefixed paths, which is why they pass.

Note: once fixed, the branch actually starts filtering classic Diffusers installs. Starter models and repos whose files rely on the current unfiltered behaviour should be checked so that nothing they need is dropped.

Discord username

No response