gflow-cli 0.22.0__tar.gz → 0.23.0__tar.gz

gflow_cli-0.23.0/.claude/commands/gflow/issue-assessment.md

@@ -0,0 +1,28 @@
+---
+description: >
+  Triage a gflow-cli GitHub issue: verify the reporter's claim against code,
+  tests, docs, KNOWN_ISSUES, and memory; classify it (CONFIRMED / NEEDS-E2E /
+  NEEDS-INFO / DUPLICATE / INVALID / WONTFIX); judge whether it is verifiable
+  end-to-end in the current environment; and draft a reporter-facing reply.
+  Read-only — changes nothing and posts nothing on its own.
+---
+
+# `/gflow:issue-assessment [issue number or URL]`
+
+**Read `skills/issue-assessment/SKILL.md` and follow its protocol now**, passing `$ARGUMENTS` as the issue to assess.
+
+> Do **not** call `Skill(skill="issue-assessment")` — the repo's `skills/*/SKILL.md` files are plain Markdown, not Skill-tool-invocable (only `.claude/commands/gflow/*` are). Read the file directly instead.
+
+The skill at `skills/issue-assessment/SKILL.md` ingests the issue, verifies the
+claim (dispatching a search agent to keep context clean), assigns one verdict,
+applies the **e2e-gate** (never claim a fix is verified on an unverifiable
+surface), and emits a standard report artifact. On a `CONFIRMED` / `LIKELY-BUG`
+verdict with localized, verifiable scope it hands off to `issue-resolve`;
+otherwise it replies only.
+
+**Typical chain:**
+```
+/gflow:issue-assessment <N>   →  verdict + e2e-gate + reply artifact
+   ↓ (if scope clear & verifiable)
+issue-resolve <N>             →  worktree + TDD + draft PR for human review
+```

gflow_cli-0.23.0/.claude/commands/gflow/issue-resolve.md

@@ -0,0 +1,18 @@
+---
+description: >
+  Drive an assessed gflow-cli issue (verdict CONFIRMED-BUG or LIKELY-BUG, with
+  localized verifiable scope) to a fix: isolated worktree off develop, test-first
+  fix, /gflow:check, then a DRAFT PR for human review. Mutating and gated — runs
+  inside a strict action envelope (never merges, never spends credits, never
+  marks a PR ready, never claims an unverified fix verified).
+---
+
+# `/gflow:issue-resolve [issue number]`
+
+**Read `skills/issue-resolve/SKILL.md` and follow its protocol now**, passing `$ARGUMENTS` as the issue to resolve.
+
+> Do **not** call `Skill(skill="issue-resolve")` — the repo's `skills/*/SKILL.md` files are plain Markdown, not Skill-tool-invocable (only `.claude/commands/gflow/*` are). Read the file directly instead.
+
+Preconditions (from `/gflow:issue-assessment`): verdict ∈ {`CONFIRMED-BUG`, `LIKELY-BUG`}, scope single-surface, and the fix is verifiable in this environment (or the gap is carried into the PR as "needs human e2e"). The skill isolates a `bugfix/` worktree off `develop`, gates high-stakes changes through `/gflow:predict` + `/gflow:scenario`, fixes test-first (Opus plans → Sonnet codes → Opus reviews for non-trivial work), runs `/gflow:check`, opens a **draft** PR with a Verification-status section, runs `/gflow:pr-council-review`, and **stops** for a human to promote and merge.
+
+**Chain:** `/gflow:issue-assessment <N>` → (if scope clear) `/gflow:issue-resolve <N>` → human promotes draft → human runs any headed/e2e check → merge.

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/.github/workflows/ci.yml

@@ -93,10 +93,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: test   # wait for tests + coverage report
     # Forked pull_request runs do not receive repository secrets, so SONAR_TOKEN
-    # is empty there and the scanner fails before analysis. Keep SonarCloud on
-    # trusted pushes/internal PRs where the token is available.
+    # is empty there and the scanner fails before analysis. Dependabot-triggered
+    # runs are the same case: GitHub serves them the separate Dependabot secrets
+    # namespace, so SONAR_TOKEN is also empty even though the branch is in-repo.
+    # Keep SonarCloud on trusted pushes/internal PRs where the token is available.
     if: >
       always() &&
+      github.actor != 'dependabot[bot]' &&
       (
         github.event_name != 'pull_request' ||
         github.event.pull_request.head.repo.full_name == github.repository

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/AGENTS.md

@@ -69,6 +69,15 @@ Or invoke the wrapper: `/gflow:check`.
 - Run `/gflow:check` (or the Impeccable Routine) before every commit.
 - All releases require a signed annotated tag (`git tag -s vX.Y.Z`); CI rejects unsigned tags.
 
+## Working discipline — verify before you act
+
+These rules exist because docs alone don't bind under momentum: a "check open PRs first" rule was already written and still got skipped, and a PR was merged without seeing an entangled open one. Follow them on every task.
+
+- **Check what's already in flight before coding a fix, opening a PR, or merging.** Run `gh pr list` and `git ls-remote` first — another open PR may already touch the same issue or files. Reconcile against it; don't re-derive "the only thing left" from a stale handoff. (A `PreToolUse` hook also surfaces same-issue open PRs at `gh pr create`/`merge` time, but treat that as a backstop, not a substitute for looking.)
+- **Truth is the CLI and running the code — not IDE/LSP "reminder" diagnostics.** Editor / `pyright`-in-worktree warnings go stale for an entire session and throw false positives (especially across multiple worktrees). Confirm with `ruff` / `pyright` / `pytest` from the terminal — or trust the worktree's own venv — never an IDE squiggle.
+- **Verify third-party runtime behavior empirically before wiring it in.** Don't assume how an external library, API, or browser actually behaves — exercise it once and observe, then build on the observed contract.
+- **If a claim can't be verified in the current environment, it's LIKELY — not CONFIRMED.** Keep the issue open, reference it with `Refs #N` (not `Closes #N`), and ship diagnostics rather than a blind fix. When you can't reproduce it, hand the fix to whoever can.
+
 ## Skills reference (cross-tool)
 
 The `skills/` directory ships installable agent skill docs in plain Markdown with YAML frontmatter. Any agent can consume them directly:

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/CHANGELOG.md

@@ -7,6 +7,60 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.0] — 2026-07-01
+
+### Added
+
+- **MCP generation is now functional (#228)**: the `gflow_generate_image` and
+  `gflow_generate_video` MCP tools — previously non-functional stubs — now enqueue onto
+  the FlowWorker queue and run end-to-end, with the background worker owning download and
+  history recording. The `tools` parameter (e.g. `creative-director`) is now applied to
+  expand the prompt before generation (it was previously accepted but never applied), and
+  reference images are supported across the image (`i2i`) and video (`i2v` / `r2v`) tools.
+
+### Fixed
+
+- **macOS generation 401 — resolved (#222, #230)**: Flow cookies are now read from the
+  full cookie jar filtered by domain instead of a path-`/` URL filter that silently
+  dropped the `/fx`-scoped `__Secure-next-auth.session-token`; and on macOS — where the
+  headed generation context can intermittently fail to decrypt the on-disk cookie store —
+  the session is seeded into the context from a snapshot captured pre-launch via the
+  working `--password-store=basic` reader. Verified end-to-end on macOS (Apple Silicon) by
+  the reporter. Thanks @gunalak.
+- **MCP video task safety (#228)**: `i2v` now requires `initial_frame` and `r2v` requires
+  `reference_images`, validated at the tool boundary with a clear error; a post-success
+  recording failure no longer flips a credit-spent video to `failed`; and any
+  non-`completed` task status is reported as a failure rather than a false success.
+- **Chrome channel on Chromium-only hosts**: `channel_for_profile()` now gates
+  Playwright's `channel="chrome"` on a new `_is_playwright_chrome_channel_available()`
+  check that probes only the exact Google-Chrome paths Playwright hardcodes, instead
+  of `is_chrome_available()` (which also accepts Chromium). On a host with only
+  Chromium installed, the CLI no longer requests `channel="chrome"` and fails with
+  `Chromium distribution 'chrome' is not found at /opt/google/chrome/chrome`; it falls
+  back to bundled Chromium and logs an actionable warning (#219).
+- **Text-to-image extra-image billing**: the generation-settings trigger selector now
+  requires `button[aria-haspopup='menu']` (aliased to `MODE_SWITCH_TRIGGER_SELECTORS`),
+  preventing a mis-click on an icon-only aspect thumbnail that skipped the count panel
+  and left Flow's own default count (typically 2) in effect — billing extra generations
+  while the CLI saved only one (#219).
+- **Extra-image observability**: `generate_image()` now logs a
+  `client.generate_image_extra_returned` warning when the transport returns more images
+  than the requested `count=1`, so silent over-generation is surfaced to the user (#219).
+- **macOS generation 401 — fail loud (#222)**: a `chrome`-strategy profile that is
+  silently downgraded to bundled Chromium at generation launch now raises instead of
+  running logged-out, so the macOS auth failure surfaces at its cause rather than as an
+  opaque later `401`.
+
+### Diagnostics
+
+- **Persistent-context cookie state (#222)**: generation launch now logs the resolved
+  `cookies_db_path` (`client.persistent_context_launch`) and the launched context's own
+  cookie state (`client.context_cookie_state`: `flow_session_cookie_present` / count /
+  expiry — **never values**, safe to paste publicly). This splits a cookie-**load**
+  failure (the macOS persistent context cannot decrypt the profile's cookies) from a
+  server-side rejection — the observability that localized the macOS `401` root cause,
+  now resolved (see the #222/#230 entry above).
+
 ## [0.22.0] — 2026-06-28
 
 ### Added
@@ -1628,7 +1682,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.22.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.23.0...HEAD
+[0.23.0]: https://github.com/ffroliva/gflow-cli/compare/v0.22.0...v0.23.0
 [0.22.0]: https://github.com/ffroliva/gflow-cli/compare/v0.21.0...v0.22.0
 [0.21.0]: https://github.com/ffroliva/gflow-cli/compare/v0.20.1...v0.21.0
 [0.20.1]: https://github.com/ffroliva/gflow-cli/compare/v0.20.0...v0.20.1

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/GEMINI.md

@@ -25,7 +25,7 @@
 
 ## Active phase
 
-- **Decoupled Daemon/Worker Plan:** The blueprint for the headless SSE Daemon, SQLite generation queue, and Tauri/React editor is scheduled in [PLAN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-23-mcp-ui-worker-integration/PLAN.md) and [SCENARIO.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-23-mcp-ui-worker-integration/SCENARIO.md).
+- **Decoupled Daemon/Worker Plan:** The MCP→FlowWorker wiring shipped in v0.23.0 (PR #228). The remaining headless SSE Daemon + Tauri/React editor blueprint is scheduled in [gflow-studio-scaffold/PLAN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-24-gflow-studio-scaffold/PLAN.md) and [rest-api-layer/PLAN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-24-rest-api-layer/PLAN.md).
 - **Core Lesson (Retrospective):** Kept `gflow-cli` strictly headless (running Uvicorn and FastMCP over localhost HTTP/SSE). Bypassed browser context locks by serializing task writes in SQLite queue, allowing parallel client database reads via WAL mode.
 
 See [PLAN.md](PLAN.md) or type `gflow:status` for the current task. Type `gflow:plan <feature>` to create a new feature plan.

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/KNOWN_ISSUES.md

@@ -14,6 +14,28 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### macOS: generation runs logged-out → HTTP 401, even with `--browser chrome`
+
+- **Status:** **RESOLVED in v0.23.0** ([#222](https://github.com/ffroliva/gflow-cli/issues/222),
+  fixed by [#230](https://github.com/ffroliva/gflow-cli/pull/230), @gunalak)
+- **Severity:** High · **Affected:** all `gflow` generation on **macOS** with a
+  `chrome`-strategy profile; Windows was unaffected
+
+On macOS, generation calls failed with **HTTP 401** (`AuthExpiredError` at
+`project.createProject`) on a profile that `gflow auth login` and verification
+accepted. Two corrections fixed it (verified end-to-end on macOS Apple Silicon):
+
+1. **Cookie-read bug (unconditional).** The Flow cookie snapshot read the jar via
+   `ctx.cookies(["https://labs.google"])`, whose path-`/` filter silently dropped
+   the `/fx`-scoped `__Secure-next-auth.session-token`. Now the full jar is read
+   and filtered by domain, so the session token is captured.
+2. **macOS headed-context decrypt (intermittent).** When the headed generation
+   context can't decrypt the on-disk store, the session is seeded from a snapshot
+   captured **pre-launch** via the working `--password-store=basic` reader. No-op on
+   Windows and on runs where the context decrypts natively.
+
+Evidence: [LIVE_VERIFICATION_v0.23.0](docs/LIVE_VERIFICATION_v0.23.0.md).
+
 ### Flow's new full-page media-library UI breaks entity attach (A/B rollout)
 
 - **Status:** **Open** — Flow-side staged rollout; tracked in

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.22.0
+Version: 0.23.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.15.18; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/PLAN.md

@@ -366,7 +366,7 @@ The video-generation feature has its own sub-phase plan (spike → Phase A → P
   - **`expand_prompt` reconcile — DONE 2026-06-28 (PR #215).** The legacy `mcp/prompts.py` `expand_prompt` MCP prompt is **deprecated** in favor of the `creative-director` tool (client-visible `[DEPRECATED]` marker; kept functional; removal slated for a future major). See [PROMPT_EXPANSION § Relationship to expand_prompt](file:///C:/development/github/gflow-cli/docs/PROMPT_EXPANSION.md).
   - **My Tools — DONE 2026-06-28 (PR #216).** User-authored TOMLs in `<GFLOW_CLI_HOME>/tools/*.toml` are loaded into the registry (override-a-builtin-with-warning; malformed fails loud).
   - **Backlog — deferred by design:** the S3 `Tool.apply(ctx)→outcome` dispatch framework. The research doc gates it on a *second, non-prompt* tool (e.g. Mockup) — building it now with a single prompt-only implementer is the documented "premature uniformity (guessed contract)" anti-pattern.
-- [ ] **Integrated Filmmaking Studio, Flow Worker & MCP SSE Service.** (Backlog) Port google-flow-worker, construct a local FastAPI/React filmmaking studio dashboard, and support HTTP/SSE MCP. Planned in [DESIGN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-23-mcp-ui-worker-integration/DESIGN.md) / [PLAN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-23-mcp-ui-worker-integration/PLAN.md).
+- [ ] **Integrated Filmmaking Studio, Flow Worker & MCP SSE Service.** (Backlog) The MCP→FlowWorker wiring shipped in v0.23.0 (PR #228). Remaining: a local FastAPI/React filmmaking studio dashboard + HTTP/SSE MCP. Planned in [gflow-studio-scaffold/PLAN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-24-gflow-studio-scaffold/PLAN.md) and [rest-api-layer/PLAN.md](file:///C:/development/github/gflow-cli/docs/superpowers/plans/2026-06-24-rest-api-layer/PLAN.md).
 - [x] **Issue #92: Google account identity persistence shipped 2026-05-28 (PR #110).** After every `gflow auth login`, both auth strategies write the verified email to `$GFLOW_CLI_HOME/profile_<name>/.gflow_account`. `ProfileMeta.google_account` surfaces it; `gflow auth list` and `gflow auth list --json` display it. First-login auto-rename: when no `--profile` flag was given and the only profile is named `default`, it is renamed to the email local-part. `profile_store.rename_profile()` primitive added. Zero-credit smoke test (`tests/smoke/test_profile_account_smoke.py`) ships with backfill path for pre-existing profiles. LLM council (9-dim) run; all must-fix items applied before merge. See `KNOWN_ISSUES.md` § Resolved for full detail.
 - [x] **`/gflow:pr-council-review` slash command shipped 2026-05-26 (PR #97).** Multi-dimensional LLM council for open PRs (4 baseline + 8 adaptive dimensions, mandatory memory-slug binding, draft-PR guard, YELLOW escape valve, live-verify gate). Validated on PR #93; self-audited by 3-agent meta-council surfacing 13 must-fix items applied before merge. See memory `[[llm-council-code-review-pr93]]`.
   - **Phase A (Backlog — Portability):** extract command body into `skills/pr-council-review/SKILL.md` so Gemini CLI / Codex / Cursor / Aider can consume it. Keep `.claude/commands/gflow/pr-council-review.md` as a thin wrapper. Memory: `[[pr-council-review-portability-backlog]]`.

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/docs/INDEX.md

@@ -37,7 +37,6 @@ Welcome to the `gflow-cli` documentation. This index is the routing layer: it te
 | **[docs/TOOLS.md](TOOLS.md)** | Tools framework: the `gflow tools list/show/run` group, the `--tool/-t` option on generation commands, the TOML tool schema, how a tool is defined, "My Tools" user-authored tools, MCP exposure + §61 parity | Working on `gflow_cli.tools`, adding a built-in or user tool, or wiring `--tool` into a command |
 | **[docs/MCP.md](MCP.md)** | MCP server: `gflow mcp run` (stdio) + `gflow serve` (HTTP/SSE), the tools/prompts/resources surface, CLI↔MCP §61 parity, security model, client setup | Configuring an MCP client, working on `gflow_cli.mcp`, or debugging the stdio/SSE transports |
 | **[docs/PROMPT_EXPANSION.md](PROMPT_EXPANSION.md)** | The `creative-director` tool: 5-component formula, 15 domain styles, banned-keyword policy, Gemini endpoint + I/O, never-fatal contract, `expanded_prompt` + `metadata_json.tool` provenance/redaction, config | Using or debugging `--tool creative-director`, editing the tool TOML, or auditing recorded prompt provenance |
-| **[docs/superpowers/plans/2026-06-23-mcp-ui-worker-integration/DESIGN.md](superpowers/plans/2026-06-23-mcp-ui-worker-integration/DESIGN.md)** | Integrated local Filmmaking Studio Web UI, Flow Worker queue daemon, and MCP SSE server design spec (HLD/LLD) | Understanding the integrated HTTP/SSE daemon architecture |
 | **[docs/IMAGE_UPSCALE_RECON.md](IMAGE_UPSCALE_RECON.md)** | `gflow image upscale` wire protocol: `upsampleImage` endpoint, full clientContext (projectId/sessionId/tool/userPaygateTier), reCAPTCHA action `IMAGE_GENERATION`, inline base64 response, 4K Ultra-gating, REST-is-dead proof | Working on `gflow image upscale`, debugging the 403/reCAPTCHA path, or understanding Flow's image-upscale wire protocol (#171) |
 | **[docs/AGENT_UI_RECON.md](AGENT_UI_RECON.md)** | Agentic Flow UI cohort: classic-vs-agentic DOM signature, server-side + volatile (flapping) A/B gating (no client-readable flag), why `_exit_agent_mode` fails, runtime-DOM-detection recommendation | Touching `_exit_agent_mode` / composer mode-switch, diagnosing exit 23 selector drift, or understanding Flow's agentic-UI A/B (#183/#174) |
 | **[tasks/lessons.md](../tasks/lessons.md)** | Running notebook of patterns + reviewer findings, dated and traced to commits | Starting a new phase; debugging "why did the council flag this?" |
@@ -118,7 +117,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A gflow command hangs / fails — where do I start?"** → [DEBUGGING § Quick reference](DEBUGGING.md#quick-reference)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**"What was actually live-verified for the latest release?"** → latest: [LIVE_VERIFICATION_v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc). Prior: [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**"What was actually live-verified for the latest release?"** → latest: [LIVE_VERIFICATION_v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships.
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)
 **"What was live-verified for the video-download feature (#29)?"** → [LIVE_VERIFICATION_video_download](LIVE_VERIFICATION_video_download.md)

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/docs/LIVE_VERIFICATION_v0.22.0.md

@@ -82,5 +82,39 @@ Owner checklist (run after publish, then fill **Post-tag evidence**):
 
 ## Post-tag evidence
 
-_(fill after the owner live run: the 5-layer ledger — command, exit code, catalog row JSON,
-structlog events, and a user-confirmable artifact.)_
+### Tool / expander / My-Tools — ✅ live-verified 2026-06-28 (real Gemini API)
+
+Run with the owner's `GFLOW_CLI_GEMINI_API_KEY` (from `.env.local`), CLI v0.22.0:
+
+| # | Check | Command | Result |
+|---|---|---|---|
+| 1 | Tool registered | `gflow tools list` | `creative-director` listed (Title/Category/Description correct) ✅ |
+| 2 | Real expansion | `gflow tools run creative-director "a cat on a couch" --style cinema --json` | `was_expanded: true`; 16→1189 chars; vivid 5-component prose naming a real camera (Sony A7R IV / Cooke S7/i) + prestige anchor (Kinfolk); structlog `prompt_expanded` (model `gemini-2.5-flash`) ✅ |
+| 3 | Banned-keyword guarantee | `gflow tools run creative-director "a luxury watch" --style product` | output scanned against all 13 banned terms → **none present** ✅ |
+| 4 | Never-fatal (bad key) | `GFLOW_CLI_GEMINI_API_KEY=invalid-key-xyz gflow tools run creative-director "a dog" --json` | `was_expanded: false`, original returned, no error/exit ✅ |
+| 5 | Video category style | `gflow tools run creative-director "a city at night" --style cinematic` | rewrites with cinematic vocabulary (video-gated style resolves) ✅ |
+| 6 | "My Tools" loader | wrote `<HOME>/tools/haiku-bot.toml`; `GFLOW_CLI_HOME=<tmp> gflow tools list` | user tool `haiku-bot` listed **alongside** the builtin `creative-director` ✅ |
+
+These exercise the whole prompt-tool path (registry → `apply_tool` → `build_instruction` → live
+`PromptExpander.expand` → `strip_banned_keywords`), the never-fatal contract, category gating, and
+the user-dir loader — end to end against the real Gemini endpoint.
+
+### Generation recording (`expanded_prompt` + `metadata_json.tool` + redaction) — ✅ live-verified 2026-06-28
+
+Real credit-free `image t2i` generations on the authenticated `denon82` profile (agentic UI
+cohort, model NARWHAL), CLI v0.22.0:
+
+**Store mode** — `gflow image t2i "a fox in the snow" --tool creative-director:style=cinema --profile denon82`:
+- File: a real **729 KB JPEG** (magic bytes `ff d8 ff`) written to the `--out` dir ✅
+- `prompt` = `"a fox in the snow"` (the **original**) ✅
+- `expanded_prompt` = the 971-char rewrite (`"A sleek, mature red fox, …"`) ✅
+- `operations.metadata_json.tool` = `{name: "creative-director", version: "1", model: "gemini-2.5-flash", params: {style: "cinema"}, config_hash: "e8399085…"}` ✅
+
+**Redacted mode** — same command with `GFLOW_CLI_HISTORY_PROMPTS=redacted` (`"a red barn at dusk"`):
+- `prompt` = `None`, `prompt_redacted` = `1`, `expanded_prompt` = `None` (both withheld) ✅
+- `metadata_json.tool` = `{name, version, params_hash, config_hash}` only — no `model`, no raw
+  `params` (replaced by `params_hash`) ✅
+- `config_hash` identical to store mode (same resolved `ToolConfig`) — tamper-evidence confirmed ✅
+
+**All 5 ledger layers cleared** (file + magic bytes + real generation + DB rows in both prompt
+modes + structlog `prompt_expanded`/`ui_driver.bound`). v0.22.0 live verification is **complete**.

gflow_cli-0.23.0/docs/LIVE_VERIFICATION_v0.23.0.md

@@ -0,0 +1,76 @@
+# Live Verification — v0.23.0
+
+Release date: 2026-07-01. This document records what was exercised against **live
+Google Flow** (credit-free wherever possible) for the user-facing changes in v0.23.0,
+following the 5-layer verification ledger.
+
+## Scope
+
+| Change | Surface | Live-verified? |
+|---|---|---|
+| **#228** — MCP generation now functional (tool → FlowWorker → download → record; `tools` applied) | MCP `gflow_generate_image` / `gflow_generate_video` | 🟡 Wiring proven live (tool → worker → real Flow REST + structured-error translation); the final image-write layer was **not** run live (expired session — environmental) — see below |
+| **#230 / #222** — macOS generation 401 fixed (path=/ cookie read + headed-context seed) | `auth/cookies.py`, `api/client.py` (macOS headed Chrome) | ✅ Reporter-verified end-to-end on macOS (Apple Silicon) |
+| **#219** — Chromium-only-host chrome-channel gate + T2I extra-image guard | `browser_manager.py`, image path | ⚠️ Not reproducible on this maintainer box (Google Chrome is installed) — covered by automated tests |
+
+## #228 — MCP generation path (credit-free image)
+
+Exercised the **wired MCP tool path in-process** (`gflow_generate_image`, profile
+`denon82`, aspect 1:1, count 1) — the exact path this release fixes (tool → queue →
+`FlowWorker.process_task` → real `FlowApiClient` → real Flow REST).
+
+**Proven live (structlog evidence, 2026-07-01):**
+- `mcp.tool.profile_resolved requested=denon82 resolved=denon82` — profile resolution
+- `mcp.tool.task_enqueued task_type=t2i` → `Processing task` — enqueue + worker dispatch
+- `client.persistent_context_launch channel=chrome chrome_strategy_requested=True cookies_db_present=True password_store_basic=True` — real headed Chrome, chrome-strategy
+- `client.context_cookie_state context_cookie_count=57 flow_session_cookie_present=True google_sapisid_present=True` — cookies loaded
+- Reached a **real Flow REST call**: `POST project.createProject`
+- **Structured-error translation confirmed** (the core #228 wiring): the server returned
+  HTTP 401 → worker raised `AuthExpiredError` → the MCP tool returned a clean RFC-9457
+  failure envelope:
+  ```json
+  {"status":"failed","error":{"type":".../auth-expired","title":"Authentication expired",
+   "status":401,"detail":"HTTP 401","remediation_hint":"Run `gflow auth login ...`",
+   "exit_code":3}}
+  ```
+  This exercises exactly the tool→worker→status-translation path the release wires, plus
+  the "any non-`completed` status → failure" behavior added in this release.
+
+**Not completed live (environmental, not a code defect):** the actual image creation +
+download + `local_files` recording did not run because the `denon82` Flow session was
+**server-side expired** (HTTP 401 on a fully-loaded cookie jar — a stale session token,
+distinct from the #222 macOS decrypt bug). Completing the image-write layer requires an
+interactive `gflow auth login --profile denon82` (browser login). The generation +
+download + recording code beneath the MCP wiring is the **same shared FlowWorker /
+FlowApiClient path** exercised live in prior releases (CLI image path) and by the
+automated suite.
+
+## #230 / #222 — macOS generation 401
+
+Verified **end-to-end on macOS (Apple Silicon) by the issue reporter** (@gunalak), both
+branches of the fix (PR #230 body evidence):
+- **Seed fires** (headed decrypt loaded nothing): `context_cookie_count=0
+  flow_session_cookie_present=False` → `preread_count=8 preread_session=True` →
+  `context_cookies_seeded seeded_session=True` → `createProject` + `batchGenerateImages`
+  **200** → image written.
+- **Native decrypt** (seed is a no-op): `context_cookie_count=7
+  flow_session_cookie_present=True` → **200** → image written.
+
+Council review (`/gflow:pr-council-review` #230): correctness/security/auth/quality all
+GREEN; tests/memory YELLOW (coverage-gap follow-up tracked).
+
+## Automated coverage
+
+- Full suite (this release tree): **1918 passed / 7 skipped** (pre-#230), plus **70
+  passed** on the #230-affected suites (`tests/api/test_client_launch_kwargs.py`,
+  `tests/auth/`) after the merge.
+- `pyright src`: 0 errors. `ruff check` / `ruff format --check`: clean.
+- New MCP-wiring regression tests (`tests/mcp/test_tools_wired.py`,
+  `tests/worker/test_daemon.py`) assert the full enqueue → worker → status-translation
+  path and the `tool_specs` application.
+
+## Follow-ups
+
+- MCP → worker → download/record has no gated live e2e harness yet (tracked): a
+  `test_mcp_*_e2e.py` mirroring `test_daemon_e2e.py` (opt-in, credit-free image).
+- Two #230 regression tests (falsifiable `/fx` cookie-path test + `_preread` capture
+  test) tracked as a post-merge follow-up.

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/docs/MCP.md

@@ -45,10 +45,10 @@ Both Click CLI (`src/gflow_cli/cli.py`) and MCP Server (`src/gflow_cli/mcp/`) ar
 The server registers three protocol surfaces:
 
 ### Tools (Executable actions)
-* `gflow_generate_image(prompt, model, aspect, count, seed)`: Triggers text-to-image (Imagen 3.5 / Nano Banana).
-* `gflow_generate_video(prompt, initial_frame_path, aspect, seed)`: Triggers vertical or landscape video generation (Veo 3.1).
-* `gflow_list_projects(limit, offset)`: Queries SQLite catalog for recent generation folders.
-* `gflow_list_characters(project_id)`: Lists saved project-scoped characters.
+* `gflow_generate_image(prompt, model, aspect, count, seed, reference_images, tools, profile)`: Triggers text-to-image / image-to-image (Imagen / Nano Banana). `reference_images` switches to i2i.
+* `gflow_generate_video(prompt, mode, aspect, initial_frame, end_frame, reference_images, tools, profile)`: Triggers vertical or landscape video generation (Veo). `mode` is `t2v`/`i2v`/`r2v`; `i2v` requires `initial_frame`, `r2v` requires `reference_images`.
+* `gflow_list_projects(profile, limit)`: Queries SQLite catalog for recent generation folders.
+* `gflow_list_characters(profile)`: Lists Flow Character entities (requires an active browser session).
 
 ### Prompts (Orchestration templates)
 * `expand_prompt`: Helps the agent structure simple ideas into Google's official 5-component prompt formula (Subject + Action + Location + Composition + Style) before sending them to the generation tools.

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/docs/PROJECT_STATUS.md

@@ -4,9 +4,25 @@
 
 ## Current release
 
+**v0.23.0 — alpha.** **MCP generation goes live + macOS 401 fixed.** The MCP server's
+`gflow_generate_image` / `gflow_generate_video` tools — previously non-functional stubs —
+are now wired end-to-end to the FlowWorker queue (background worker owns download +
+history recording), the `tools` prompt-expansion parameter is actually applied, and i2v/r2v
+require their frame/reference inputs at the tool boundary. The long-standing macOS
+generation `401` (#222) is resolved (#230, @gunalak): Flow cookies are read from the full
+jar by domain instead of a path-`/` filter that dropped the `/fx`-scoped session token, and
+the headed context is seeded from a pre-launch snapshot when macOS can't decrypt the store.
+Carries forward v0.22.0 (Tools framework) + v0.21.0 (MCP server). Verification:
+[LIVE_VERIFICATION_v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP wiring proven live; #222
+reporter-verified e2e on macOS).
+
+**Develop (unreleased, post-v0.23.0):** *(empty — develop is the staging branch for the next release).*
+
+<details><summary>v0.22.0 — Tools framework ("Creative Director")</summary>
+
 **v0.22.0 — alpha.** **Tools framework ("Creative Director").** A TOML-defined prompt-tool system: `creative-director` rewrites a terse prompt into a vivid one via Google's five-component formula (public Gemini API, never-fatal), with 15 category-gated domain styles and deterministic banned-keyword stripping. Invoke it via the new `gflow tools list/show/run` group or the uniform `-t`/`--tool` option on every generation command (`image t2i`/`i2i`/`batch`, `video t2v`/`i2v`/`r2v`/`chain`), replacing the never-released `-e/--expand`. History records the original prompt, the submitted `expanded_prompt`, and `metadata_json.tool` provenance (redaction-honoring). **"My Tools"**: user-authored TOMLs in `<GFLOW_CLI_HOME>/tools/*.toml` load automatically. MCP parity via `gflow_list_tools` + a `tools` array param; the legacy `expand_prompt` MCP prompt is deprecated. The Gemini expander gained an overall wall-clock budget. Carries forward v0.21.0 (MCP server over stdio + HTTP/SSE). Verification: [LIVE_VERIFICATION_v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (CI/automated complete; live owner-run pending).
 
-**Develop (unreleased, post-v0.22.0):** *(empty — develop is the staging branch for the next release).*
+</details>
 
 ## Milestone history
 
@@ -68,6 +84,8 @@
 | Aspect-ratio overrides under Agentic & Classic cohorts + `GFLOW_CLI_PREFER_CLASSIC` (#193) | ✅ done (v0.20.0 / v0.20.1) |
 | MCP server (`gflow mcp run` stdio + `gflow serve` HTTP/SSE) + daemon/queue scaffolding | ✅ done (v0.21.0) |
 | Tools framework: `gflow tools` group + `--tool` + `creative-director` + "My Tools" + MCP parity | ✅ done (v0.22.0) |
+| MCP generation wired to FlowWorker (tool→queue→download→record) + `tools` applied + i2v/r2v boundary validation | ✅ done (v0.23.0) |
+| macOS generation 401 fixed — `/fx` cookie-path read + headed-context seed (#222/#230) | ✅ done (v0.23.0) |
 | `gflow video batch` (TSV manifest) on `ui_automation` | ⏳ Phase B |
 | Persistence layer (stay-mounted batch sessions across project boundaries) | ⏳ Phase B |
 | Provider abstraction for official Veo 3.1 API | ⏳ planned |

gflow_cli-0.23.0/docs/superpowers/specs/2026-06-29-issue-assessment-workflow-design.md

@@ -0,0 +1,143 @@
+# Issue-assessment workflow — design
+
+> Status: **approved design** (2026-06-29). Next step: `writing-plans` → author skills with `writing-skills`.
+> Scope: two new project skills that let an agent triage a GitHub issue, report to the reporter, and — when scope is clear — drive a guard-railed fix to a draft PR. Built to run both interactively and autonomously (hermes-ops on the VPS).
+
+## Problem
+
+Incoming GitHub issues (e.g. #222) need a **systematic, repeatable** assessment instead of ad-hoc investigation. We want a process that:
+
+1. Reads the reporter's claim and verifies it against code, tests, docs, `KNOWN_ISSUES.md`, and auto-memory.
+2. Produces a defensible verdict and a reply to the reporter.
+3. **Requires e2e evidence before claiming a fix works** — and is honest when e2e is impossible in the current environment.
+4. When scope is clear, performs the full development workflow in an isolated worktree and opens a PR **for human review** (never merges).
+5. Can run **autonomously** (hermes-ops VPS) without taking wrong outward-facing actions.
+6. Tells the agent **which project skill to use for what**, so it does not hallucinate skill names.
+
+## Key environmental constraint
+
+The hermes-ops VPS is **headless Linux**. Flow generation auth requires a **headed real-Chrome** session (`real-browser-auth-mandatory` in memory). Therefore, for any Flow-generation/selector/auth bug, the autonomous agent **cannot e2e-verify** — it can only get the problem review-ready and hand to a human. This is encoded as a **standing known limitation**, never hidden. The design goal is to make a wrong autonomous action *rare*, not to pretend the agent can verify everything.
+
+## Two-layer architecture (orchestration vs domain)
+
+Separation of concerns across two repos, with a one-way dependency:
+
+- **hermes-ops = orchestration layer (project-agnostic "HOW the agent operates").** Triggers (cron/webhook/label), the autonomy gate, the `skills/`→`blessed/` blessing procedure, secret access (SOPS `GH_TOKEN`), the Opus→Sonnet→Opus delegation loop, Telegram delivery, idempotency. Hosts an `autopilot-core` reused by `dependabot-autopilot` (deterministic), `issue-autopilot` (LLM), and `release-autopilot` (weekly patch-bump-if-safe).
+- **gflow-cli = domain layer (project-specific "WHAT the work means").** `issue-assessment` / `issue-resolve` + the existing `/gflow:*` pipeline. Encodes gflow-cli's e2e-gate (headed-browser truth), `KNOWN_ISSUES`, branch workflow.
+
+**Rule:** hermes orchestration *calls into* a target repo's domain skills; gflow-cli never imports hermes. A gflow-cli skill must run standalone (interactive) **and** be invokable by hermes. The safety boundary lands on the blessing gate — the autonomous machinery (hermes layer) is exactly what a human blesses; domain skills are ordinary repo content. The two skills below are the **domain layer**; the orchestration layer is a later phase in the hermes-ops repo.
+
+## Architecture — two skills (domain layer)
+
+The repo already ships the fix pipeline as skills (`/gflow:predict` → `/gflow:scenario` → `/gflow:plan` → `/gflow:check` → `/gflow:pr-council-review`) plus superpowers TDD/worktrees. The new work is a **conductor** on top, split for a clean safety boundary:
+
+- **`issue-assessment`** — READ-ONLY. Always safe to run, VPS-friendly. Ingest → verify → classify → e2e-gate → report. Decides (graded, not a hard stop) whether to chain into `issue-resolve`.
+- **`issue-resolve`** — MUTATING, gated, autonomous-with-guardrails. Worktree off `develop` → predict/scenario/plan → TDD with Opus-orchestrated review loop → check → browser-free verification → **draft** PR → council review → STOP.
+
+```
+GitHub issue ─► issue-assessment (read-only)
+                  1. Ingest    gh issue view → claim, env, repro
+                  2. Verify    Explore agent over code/tests/docs + KNOWN_ISSUES.md + memory
+                  3. Classify  verdict taxonomy
+                  4. e2e-gate  is verification possible here & now?
+                  5. Report    comment to reporter (verdict + next step)
+                       ├─ INVALID / DUP / WONTFIX / NEEDS-INFO ─► stop (comment only)
+                       └─ CONFIRMED/LIKELY-BUG & scope clear ──► issue-resolve (if autonomy gate allows)
+
+                issue-resolve (mutating, gated)
+                  worktree off develop → /gflow:predict → /gflow:scenario → /gflow:plan
+                  → TDD (Opus plans, Sonnet codes, Opus reviews, loop to consensus)
+                  → /gflow:check → browser-free verification only
+                  → DRAFT PR → /gflow:pr-council-review → STOP
+                  Human: promote draft → headed e2e → merge.
+```
+
+## `issue-assessment` detail
+
+### Verdict taxonomy (exactly one per assessment)
+
+- `CONFIRMED-BUG` — reproduced or root-caused in code with line-level evidence.
+- `LIKELY-BUG / NEEDS-E2E` — strong code hypothesis, unverifiable here (e.g. #222: macOS-only, no headed browser). **The common VPS outcome.**
+- `NEEDS-INFO` — reporter must supply a discriminating diagnostic first.
+- `DUPLICATE` / `KNOWN-ISSUE` — matches `KNOWN_ISSUES.md` or an open issue/PR.
+- `WORKING-AS-INTENDED` / `INVALID` — usage error or expected behavior.
+- `WONTFIX / OUT-OF-SCOPE` — real but deliberately not addressed.
+
+### e2e-gate (the honesty mechanism)
+
+Before claiming any verification, classify what verification *requires*:
+
+- **Browser-free** (Gemini tool-path, unit, lint, pyright, recording-verif) → runnable autonomously; run it.
+- **Headed-Flow-browser required** (generation, selector, auth) → NOT possible on VPS → mark `NEEDS-E2E`, never claim success, hand to human.
+
+### Report format
+
+A reporter-facing comment: restated claim, verdict + confidence, evidence (`file:line`), root-cause hypothesis, the discriminating diagnostic requested (if `NEEDS-INFO`/`NEEDS-E2E`), and the next step (draft PR link if `issue-resolve` ran, else what we need).
+
+## `issue-resolve` guardrails
+
+Autonomous allow-list:
+- ✅ Post issue comment (text reply to reporter).
+- ✅ Open a **draft** PR (push branch + open PR in draft state).
+- ✅ Browser-free / credit-free verification.
+- ❌ **Never** spend Veo credits (no credit-spending e2e).
+- ❌ Never mark a PR ready; ❌ never merge; ❌ never push to `main`/`develop` (always a `bugfix/`-prefixed branch off `develop`).
+
+Hard preconditions before opening even a draft PR:
+1. Verdict ∈ {`CONFIRMED-BUG`, `LIKELY-BUG`} **and** scope single-surface / localized.
+2. A failing test exists first (TDD) and passes after the fix.
+3. `/gflow:check` clean (ruff + pyright + tests).
+4. If verification needed a headed browser → PR body states **"NOT e2e-verified — requires human macOS/headed run"** explicitly.
+
+Trigger gate (autonomy safety): the agent acts **only on issues a human labels** (e.g. `triage`), never on every new issue.
+
+### Orchestration model
+
+Opus plans → delegates coding to Sonnet → Opus reviews → loop until consensus → `/gflow:pr-council-review`. Gemini (`agy`) as an optional extra reviewer **if available** — soft dependency, never blocks.
+
+## Anti-hallucination skill routing
+
+The skill ships a **literal routing table** mapping situation → skill → how to invoke. Critical trap (in memory `skill-wrapper-registration-trap`): this repo's `skills/*/SKILL.md` are plain markdown invoked by **reading** `.claude/commands/gflow/*`, NOT by `Skill()`. Superpowers skills ARE `Skill()`-invocable. The skill instructs the agent to **re-derive** the table from `ls skills/` + `ls .claude/commands/gflow/` rather than trust a possibly-stale list.
+
+| Situation | Use | How |
+|---|---|---|
+| High-stakes change (auth/transport/selector/schema) | `/gflow:predict` | Read `skills/predict/SKILL.md` |
+| Edge cases + BDD skeleton | `/gflow:scenario` | Read `skills/scenario/SKILL.md` |
+| Write task checklist | `/gflow:plan` | Read `skills/plan/SKILL.md` |
+| Before any commit | `/gflow:check` | `.claude/commands/gflow/check.md` |
+| Pre-PR / PR review | `/gflow:pr-council-review`, `branch-review` | Read `skills/pr-council-review/SKILL.md` |
+| Touching auth/reCAPTCHA | `/gflow:known-issues` | `.claude/commands/gflow/known-issues.md` |
+| Worktree, TDD, finishing a branch | superpowers | `Skill()` tool (these are invocable) |
+
+## File layout
+
+```
+skills/issue-assessment/SKILL.md     # read-only conductor
+skills/issue-resolve/SKILL.md        # mutating, gated
+.claude/commands/gflow/issue-assessment.md   # thin wrapper: "read skills/.../SKILL.md"
+.claude/commands/gflow/issue-resolve.md
+```
+
+## Worked example — issue #222 (validation case)
+
+macOS, v0.22.0: `image t2i` launches a logged-out browser → 401 on `createProject` despite `.gflow_browser_strategy=chrome`. Code investigation hypothesis: `channel_for_profile()` returns `None` because macOS `is_chrome_available()` (`src/gflow_cli/browser_manager.py:146`) only checks the hardcoded `/Applications/Google Chrome.app/...` path with no `shutil.which()` fallback (unlike Windows/Linux), so generation falls back to bundled Chromium, which can't decrypt Keychain-protected cookies. **Caveat:** if detection failed, a `browser_manager.chrome_marker_but_unavailable` warning should fire — the reporter didn't mention it, so the channel may instead never be resolved on the `setup_shared_page` path. This ambiguity is exactly why the verdict is `LIKELY-BUG / NEEDS-E2E` (macOS + headed browser, unverifiable on Windows or the VPS) rather than `CONFIRMED-BUG`. Expected workflow output: a reporter reply requesting the discriminating diagnostic (does the warning appear? actual Chrome path? DEBUG run with channel logging), plus optionally a draft PR adding the `shutil.which` fallback with a unit test, flagged NOT-e2e-verified.
+
+## hermes-ops orchestration layer (later phase, hermes-ops repo)
+
+Confirmed facts about the target runtime (`C:\development\github\hermes-ops`, deployed):
+
+- **VPS:** `89.167.1.15` (`cgserver01`), headless Hetzner Linux. SSH `deploy@89.167.1.15` (key-based). hermes-agent v0.16.0 as a systemd unit (`HERMES_HOME=/opt/hermes`); repo at `/opt/hermes-ops` (git-pull deploy: `git fetch && git reset --hard origin/main`).
+- **GitHub creds:** `GH_TOKEN` already provisioned in SOPS (`secrets/vps-prod.env.sops.yaml`), fine-grained PAT scoped to **gflow-cli `pull_requests:write + contents:write`**. Decrypted by `hermes.service` `ExecStartPre` to `/opt/hermes/.env` (600, owner `hermes`); `gh` reads it automatically.
+- **Knowledge (T1):** git-versioned markdown in `hermes-ops/knowledge/`; update = branch → human review → merge → VPS pulls.
+- **Triggers:** `hermes cron create "<expr>" "<prompt>" --skills … --deliver telegram` (v1); `hermes webhook subscribe --events … --skills … --deliver …` (v2, deferred).
+- **Blessing gate (NOT yet implemented):** `skills/` (unprivileged staging) → human signoff → `blessed/` (executable). Skill file format + promotion procedure are undefined on disk — `autopilot-core` defines them once.
+- **Headless confirmation:** no headed Chrome on the VPS → Flow-generation/selector/auth bugs are **never** e2e-verifiable autonomously. This is the standing known limitation that forces the `LIKELY-BUG / NEEDS-E2E` + draft-PR-for-human terminal behavior.
+
+Reconciliation: the same-day `hermes-ops/docs/specs/2026-06-29-dependabot-autopilot-design.md` becomes the first (deterministic) specialization of `autopilot-core`. Nothing runs on the remote until the user confirms; this section is reference for the orchestration-layer spec to be written in the hermes-ops repo.
+
+## Out of scope (this spec — domain layer only)
+
+- The hermes-ops orchestration layer (`autopilot-core`, `issue-autopilot`, `release-autopilot`) — designed separately in the hermes-ops repo.
+- Auto-merging or auto-promoting PRs (always draft, human promotes).
+- Acting on unlabeled issues.
+- Onboarding target repos other than gflow-cli.

{gflow_cli-0.22.0 → gflow_cli-0.23.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.22.0"
+version = "0.23.0"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -39,7 +39,7 @@ dependencies = [
 dev = [
     "pytest>=8.0.0",
     "pytest-asyncio>=0.23.0",
-    "ruff==0.15.18",
+    "ruff==0.15.20",
     "pyright>=1.1.0",
     # video-chain: the last-frame extractor (media.py) decodes with PyAV, and its
     # tests build synthetic mp4 fixtures with numpy. Declared here so the dev/CI
@@ -149,7 +149,7 @@ dev = [
     "pytest-asyncio>=1.3.0",
     "pytest-bdd>=8.1.0",
     "pytest-cov>=7.1.0",
-    "ruff==0.15.18",
+    "ruff==0.15.20",
 ]
 # Container-based integration tests — requires Docker daemon.
 # Install: uv sync --group containers