civitai-hub v0.3.2

Small fix: civitai config now shows the active host (so you can confirm a civitai.red mirror is in effect) and surfaces a clean error instead of a traceback on an invalid CIVITAI_HOST.

Install: pipx install civitai-hub · ghcr.io/mr8bit/civit-ai-cli:0.3.2

civitai-hub v0.3.1

civitai.red mirror support. civitai.red is a transparent reverse-proxy of civitai.com (same paths/ids), commonly used where civitai.com is blocked.

• Paste a civitai.red/… URL → the metadata API and downloads route through it automatically.
• For bare ids / search, set CIVITAI_HOST=civitai.red (or pass host= to the library).
• Only civitai.com and civitai.red are trusted, so the token can't be redirected to an arbitrary host.

Install: pipx install civitai-hub · ghcr.io/mr8bit/civit-ai-cli:0.3.1

civitai-hub v0.3.0

"Discover, identify, manage" milestone.

New commands

• civitai search — search models (--type/--base-model/--sort/--limit/--json), with cursor pagination.
• civitai by-hash <hash|file> — identify a model from a hash or a local file (reverse of download).
• civitai login / logout / config — store the API token (0600 file; flag > env > stored), show config.
• civitai cache ls / verify / rm / prune — inspect and manage the local cache.

Polish

• download --json and download --offline; info surfaces early-access; ship py.typed (PEP 561).
• Library: civitai_hub.search(), civitai_hub.find_by_hash().

Install: pipx install civitai-hub · ghcr.io/mr8bit/civit-ai-cli:0.3.0

civitai-hub v0.2.1

Patch release — closes the architecture + test-quality findings from the 0.2.0 review.

• Resource leak fixed: CivitaiClient is now a context manager; model_info/download/find_base_models close the httpx connection pool they open.
• Test coverage for the previously-unverified dangerous paths: real 416 range-restart, transport-error-keeps-partial-for-resume, 5xx retry, missing-SHA skip, expired early-access.

No API changes. pipx install civitai-hub · ghcr.io/mr8bit/civit-ai-cli:0.2.1

civitai-hub v0.2.0

Security-hardening + review-fixes release.

Security

• Reject path-traversal / absolute API filenames before building any path.
• Validate the download host (civitai.com only) — closes SSRF + token exfiltration.
• Send the token via the Authorization header, never a ?token= URL.

Robustness

• Transport failures wrap to a catchable NetworkError (exit 10) with retry.
• --force restarts instead of resuming a stale partial.

Packaging / docs

• Single-source version + version↔tag publish guard, slim sdist, Dependabot.
• Fixed phantom library-API params, documented find_base_models, scoped config table.

Breaking (minor): removed the dead no-op params download(progress=), model_info(cache_dir=), find_base_models(cache_dir=).

Install: pipx install civitai-hub · docker run --rm ghcr.io/mr8bit/civit-ai-cli:0.2.0 info <url>

civitai-hub v0.1.0

huggingface_hub, but for CivitAI — inspect a model and download its checkpoint/LoRA into a deduplicated managed cache, as a CLI and an importable library.

Highlights

• civitai info <url|id> — model type, base/parent model, versions, and a file table (--json too).
• civitai download <url|id> — smart version/file selection (--fp16/--fp32, --pruned/--full, --format, --file, --all), content-addressed dedup cache, range-resume, SHA256 verify, progress bar, --local-dir, --dry-run.
• civitai base <url|id> — find the base checkpoints a LoRA runs on (its baseModel family), with --download N.
• Library API: model_info, download, find_base_models.

Install

• pipx install civitai-hub (PyPI)
• docker run --rm ghcr.io/mr8bit/civit-ai-cli info 580857

See the README and docs/usage.md for the full reference.