Fall back to an anonymous conditioner call when the forwarded ZeroGPU token is refused

README.md

@@ -162,14 +162,18 @@ one-time `PIPE.to("cuda")` is inside the first row's 339 s and does not reappear
 
 Two cards are booked per request: this Space's denoise loop and the conditioner's forward. ZeroGPU attributes a
 booking to the `X-IP-Token` header of the request that triggered it, so this Space forwards the caller's token to the
-conditioner (`gradio_client.Client(..., headers={"X-IP-Token": ...})`, from the `gr.Request` gradio injects — the UI
-path and the `/generate` API path alike). One user's request then bills as one request across both halves, the way it
-would if this were a single Space, and no org token is ever spent on it.
-
-A caller the router cannot attribute — an unauthenticated API call — falls back to the conditioner's IP-based quota,
-whose ceiling is 120 credits. An `xlarge` booking costs **twice** its seconds there, so the conditioner keeps its
-reservation at 60 s (120 credits) for an encode; asking it to upsample a prompt books 120 s (240 credits) and needs a
-forwarded token.
+conditioner (`gradio_client.Client(..., headers={"X-IP-Token": ...})`, off the `gr.Request` gradio injects — the UI
+path and the `/generate` API path alike). When ZeroGPU honours it, one user's request bills as one request across both
+halves and no org token is spent on it.
+
+It is best effort, though: ZeroGPU answers `401` for a proxy token it will not honour, which `spaces` surfaces as
+`Expired ZeroGPU proxy token`, and a token minted for one Space arriving at another is exactly that case on the API
+path. So a refused token falls back to calling the conditioner with no token at all, on an IP-based quota.
+
+That fallback is a working path rather than a degraded one, because the conditioner is sized for it. An unattributed
+caller may book at most 120 credits at a time and an `xlarge` booking costs **twice** its seconds, i.e. 60 s — so the
+conditioner books the encode (45 s) and a prompt upsample (60 s) as **two separate calls**, each under the ceiling,
+where one combined booking would be refused outright.
 
 ## Secrets
 

app.py

@@ -210,6 +210,30 @@ def ip_token_of(request) -> str | None:
     return token
 
 
+LOG_TAG = "gen"
+
+
+def call_conditioner(ip_token, **arguments):
+    """One conditioner call, on the caller's ZeroGPU identity when that is accepted and anonymously when it is not.
+
+    Forwarding is best effort. ZeroGPU's `/schedule` answers `401` for a proxy token it will not honour — which is
+    what a token minted for *this* Space looks like when it arrives at the conditioner — and `spaces` surfaces that as
+    `Expired ZeroGPU proxy token`. So the forwarded call is tried first, and a rejected token falls back to no token
+    at all rather than failing the request. The conditioner's own bookings are sized to fit the unattributed ceiling,
+    so the fallback is a working path and not a degraded one.
+    """
+    api_name = arguments.pop("api_name")
+    if ip_token is not None:
+        try:
+            return conditioner(ip_token).predict(**arguments, api_name=api_name)
+        except Exception as error:
+            if "proxy token" not in str(error):
+                raise
+            print(f"[{LOG_TAG}] the forwarded ZeroGPU token was refused ({error}); retrying anonymously", flush=True)
+            CLIENTS.pop(ip_token, None)
+    return conditioner(None).predict(**arguments, api_name=api_name)
+
+
 def encode_remote(prompt, image_path, last_image_path, canvas, num_frames, rewrite_prompt=False, ip_token=None):
     """Ask the conditioner Space for `prompt_embeds` + `text_token_tags`. Off this Space's GPU time entirely.
 
@@ -221,7 +245,8 @@ def encode_remote(prompt, image_path, last_image_path, canvas, num_frames, rewri
     from gradio_client import handle_file
     from safetensors import safe_open
 
-    path, plan = conditioner(ip_token).predict(
+    path, plan = call_conditioner(
+        ip_token,
         prompt=prompt,
         image_path=handle_file(image_path) if image_path else None,
         last_image_path=handle_file(last_image_path) if last_image_path else None,