gflow-cli 0.34.0__tar.gz → 0.36.0__tar.gz

gflow_cli-0.36.0/.claude/commands/gflow/changelog.md

@@ -0,0 +1,9 @@
+---
+description: Show unreleased changes and last tagged version — insight into recent work.
+---
+
+# `/gflow:changelog` — Recent changes
+
+**Read `skills/changelog/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="changelog")` — read the file directly.

gflow_cli-0.36.0/.claude/commands/gflow/check.md

@@ -0,0 +1,9 @@
+---
+description: Auto-fix lint and formatting, then report types and tests. Run before every commit.
+---
+
+# `/gflow:check` — Quality gates
+
+**Read `skills/check/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="check")` — read the file directly.

gflow_cli-0.36.0/.claude/commands/gflow/doc-review.md

@@ -0,0 +1,9 @@
+---
+description: Use before cutting any gflow-cli release or after a major documentation change — systematic council-driven audit that combines a mechanical 7-section checklist with a 3-agent parallel review (completeness / cross-reference / drift). Produces a consensus verdict and a concrete fix list.
+---
+
+# `/gflow:doc-review` — Documentation Review Gate
+
+**Read `skills/doc-review/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="doc-review")` — read the file directly.

gflow_cli-0.36.0/.claude/commands/gflow/known-issues.md

@@ -0,0 +1,9 @@
+---
+description: Surface open known issues. Call before touching auth, reCAPTCHA, or anything previously flagged.
+---
+
+# `/gflow:known-issues` — Open issues
+
+**Read `skills/known-issues/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="known-issues")` — read the file directly.

gflow_cli-0.36.0/.claude/commands/gflow/llm-council.md

@@ -0,0 +1,13 @@
+---
+description: Run pr-council-review (PR or branch mode) plus an external-tools corroboration layer (codex, gemini, opt-in agy) for high-stakes reviews where a same-model-family blind spot is a real risk. Tiers: small (internal only, default) / medium (+codex) / high (+codex+gemini). Wrapper around skills/llm-council/SKILL.md.
+---
+
+# `/gflow:llm-council [PR# | --base <ref>] [--tier small|medium|high] [--include-agy]`
+
+**Read `skills/llm-council/SKILL.md` and follow its protocol now**, treating `$ARGUMENTS` as: the PR number or `--base <ref>` (branch mode, same as `/gflow:pr-council-review` / `/gflow:branch-review`), plus `--tier <small|medium|high>` (default `small`) and the optional `--include-agy` flag.
+
+> Do **not** call `Skill(skill="llm-council")` or `Skill(skill="pr-council-review")` — the repo's `skills/*/SKILL.md` files are plain Markdown, not registered as Skill-tool-invocable (only `.claude/commands/gflow/*` are). Invoking either errors with `Unknown skill: ...`. Read the files directly instead.
+
+`skills/llm-council/SKILL.md` is the canonical body: tier resolution, the tool registry (fixed invocation recipes per external tool — read this before running any external tool, `codex review` in particular is a known trap), the availability-probe step, dispatch flow, and synthesis. It wraps `skills/pr-council-review/SKILL.md` unchanged for the internal dimension council.
+
+Siblings: `/gflow:pr-council-review <N>` (internal-only, PR mode), `/gflow:branch-review` (internal-only, branch mode) — use either directly when external corroboration isn't warranted.

gflow_cli-0.36.0/.claude/commands/gflow/release.md

@@ -0,0 +1,9 @@
+---
+description: Cut a new gflow-cli release — bump version, update CHANGELOG, tag, push, and back-merge.
+---
+
+# `/gflow:release` — Cut a new release
+
+**Read `skills/release/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="release")` — read the file directly.

gflow_cli-0.36.0/.claude/commands/gflow/sonar.md

@@ -0,0 +1,9 @@
+---
+description: Check the SonarCloud quality gate for a PR (or the current branch) and drive it to zero. Reports GREEN, or the exact PR-scoped new issues/hotspots/coverage gaps to fix.
+---
+
+# `/gflow:sonar [PR#]` — SonarCloud quality gate
+
+**Read `skills/sonar/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="sonar")` — read the file directly.

{gflow_cli-0.34.0 → gflow_cli-0.36.0}/.env.template

@@ -155,6 +155,20 @@
 # derivation (tab title / page hints) fails.
 # GFLOW_CLI_PROJECT_NAME=
 
+# -----------------------------------------------------------------------------
+# Debugging (opt-in only — both can expose secrets, see docs/CONFIGURATION.md)
+# -----------------------------------------------------------------------------
+
+# Captures full Playwright network traffic (requests, responses, headers,
+# cookies) to this HAR file for the session. SECURITY: a HAR file contains
+# live auth cookies and bearer tokens -- never share one publicly.
+# GFLOW_CLI_HAR_PATH=
+
+# Prints the real exception message + traceback for unhandled errors, to the
+# console and (under --json) into the payload, instead of the generic
+# placeholder. SECURITY: may leak tokens/cookies present in exception text.
+# GFLOW_CLI_DEBUG_TRACEBACK=
+
 # -----------------------------------------------------------------------------
 # Headless Daemon (gflow serve)
 # -----------------------------------------------------------------------------

gflow_cli-0.36.0/.github/workflows/pages.yml

@@ -0,0 +1,55 @@
+name: Deploy site to GitHub Pages
+
+# Publishes the marketing landing (index.html) at the site root and the
+# Material for MkDocs docs portal (website/) at /docs. One site, two parts.
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      - "index.html"
+      - "website/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Never cancel an in-progress deploy; queue instead.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install MkDocs Material
+        run: pip install "mkdocs-material>=9,<10"
+      - name: Build docs portal
+        working-directory: website
+        run: mkdocs build
+      - name: Assemble site (landing at /, docs at /docs)
+        run: |
+          mkdir -p _site
+          cp index.html _site/
+          cp -r website/site _site/docs
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: _site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

{gflow_cli-0.34.0 → gflow_cli-0.36.0}/.gitignore

@@ -99,3 +99,6 @@ worktrees/
 
 # Subagent-driven-development scratch (ledger + task reports)
 .superpowers/
+
+# MkDocs build output
+website/site/

{gflow_cli-0.34.0 → gflow_cli-0.36.0}/AGENTS.md

@@ -91,6 +91,20 @@ The `skills/` directory ships installable agent skill docs in plain Markdown wit
 | `plan` | [`skills/plan/SKILL.md`](skills/plan/SKILL.md) | Create a structured task-by-task implementation plan for a feature |
 | `status` | [`skills/status/SKILL.md`](skills/status/SKILL.md) | Show current plan state, progress, and next unchecked task |
 | `pr-council-review` | [`skills/pr-council-review/SKILL.md`](skills/pr-council-review/SKILL.md) | Multi-dimensional PR council review |
+| `llm-council` | [`skills/llm-council/SKILL.md`](skills/llm-council/SKILL.md) | Wraps `pr-council-review` with external CLI reviewers (`codex`/`gemini`, opt-in `agy`) for high-stakes reviews |
+| `issue-assessment` | [`skills/issue-assessment/SKILL.md`](skills/issue-assessment/SKILL.md) | Triage a GitHub issue (read-only) before any fix work |
+| `issue-resolve` | [`skills/issue-resolve/SKILL.md`](skills/issue-resolve/SKILL.md) | Drive an assessed issue to a test-first fix + draft PR |
+| `check` | [`skills/check/SKILL.md`](skills/check/SKILL.md) | Quality gates (lint/format/types/tests) before every commit |
+| `changelog` | [`skills/changelog/SKILL.md`](skills/changelog/SKILL.md) | Unreleased changes + last tagged version |
+| `known-issues` | [`skills/known-issues/SKILL.md`](skills/known-issues/SKILL.md) | Open/mitigated known issues — before auth/reCAPTCHA work |
+| `sonar` | [`skills/sonar/SKILL.md`](skills/sonar/SKILL.md) | Drive the SonarCloud quality gate to zero for a PR/branch |
+| `doc-review` | [`skills/doc-review/SKILL.md`](skills/doc-review/SKILL.md) | Council-driven documentation audit before a release |
+| `release` | [`skills/release/SKILL.md`](skills/release/SKILL.md) | Cut a release — bump, CHANGELOG, tag, push, back-merge |
+
+**RULE — agent-agnostic by construction.** Core skills live in `skills/<name>/SKILL.md`
+and must be resolvable by ANY agent via this file. Vendor directories hold thin wrappers
+only (`.claude/commands/gflow/*.md` are pointers into `skills/`); never put protocol
+content in a vendor directory.
 
 **Cursor / Aider / Codex / Gemini CLI (`agy`):** paste or include the relevant `SKILL.md` in your system context. Note: in the `agy` TUI prompt, custom slash commands (e.g. `/gflow:pr-council-review`) are blocked by the TUI's command parser. Type them as plain text without the leading slash (e.g. `gflow:pr-council-review`, `gflow:branch-review`, or `gflow:check`) to trigger the corresponding agent skill workflow.
 **Claude Code:** the `/gflow:` slash commands in `.claude/commands/gflow/` are auto-discovered when the project is open — no extra setup needed. To register a skill globally, copy the command file to `~/.claude/commands/`.

{gflow_cli-0.34.0 → gflow_cli-0.36.0}/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.36.0] — 2026-07-16
+
+### Added
+
+- **`GFLOW_CLI_HAR_PATH`:** captures full Playwright network traffic (requests, responses, headers, cookies) to a HAR file for the session — useful for diagnosing wire-format surprises or WAF rejections. Opt-in, env-var only; the file is hardened to `0600` on POSIX after Playwright writes it (#316).
+- **`GFLOW_CLI_DEBUG_TRACEBACK`:** prints the real exception message + traceback for unhandled errors — to the console and, under `--json`, into the payload's `error.detail`/`error.traceback` fields — instead of the generic placeholder. The structured telemetry event stays SHA-256-hashed unconditionally either way; this only changes what the operator/caller sees (#316).
+- **`llm-council` skill:** `/gflow:llm-council` composes with `pr-council-review`, adding `codex`/`gemini` (opt-in `agy`) as independent external reviewers alongside the internal Claude-subagent council for high-stakes reviews (#320).
+
+### Fixed
+
+- **Reference entity smuggling:** a poisoned character entity (from a `gflow character create` that failed mid-workflow, e.g. the body-triptych step) could leak its `referenceEntities` into unrelated `gflow image i2i` calls in the same project workspace, even when the caller never passed `--reference-entity`. The UI-automation interceptor now strips unrequested `referenceEntities` before submit (#312).
+
+## [0.35.0] — 2026-07-14
+
+### Added
+
+- **Multimodal Reverse-Engineering:** Integrated `gflow reverse-engineer` with `claude-video`'s `watch.py` script. When a video file or URL is passed, gflow now automatically extracts frames and uses the multimodal capabilities of Gemini to reconstruct a detailed, structured prompt.
+- **Storyboard Creator:** Added a new built-in tool `storyboard` designed to scaffold a cohesive multi-panel storyboard from a narrative concept or scene description, ensuring visual and stylistic continuity across all panels.
+- **GitHub Pages Site:** Created a static site structure for GitHub Pages, including a landing page and material-based documentation layout, with a polished theme aligned with project aesthetics (#308, #309).
+
+### Changed
+
+- **Dynamic Token Budget:** The `maxOutputTokens` parameter for Gemini prompt expansion now dynamically scales as a fraction of `max_output_chars` (approx. 1 token per 4 characters), clamped to a minimum floor of 512 tokens.
+- **Agent-Agnostic Skills:** Refactored six command protocols and relocated them to the `skills/` directory to ensure they are accessible by any developer or AI coding agent regardless of the tool being used (#305).
+- **Security Updates:** Bumped the `pillow` dependency to `>=12.3.0` to address 5 CVEs (PYSEC-2026-2253..2257) (#306).
+- **Ruff Dependency:** Updated the dev-dependency `ruff` from `0.15.20` to `0.15.21` (#304).
+
+### Fixed
+
+- **Type Safety:** Added explicit `dict[str, object]` type annotations to the payload building in `PromptExpander` to satisfy strict Pyright invariance checks on dictionary values.
+
 ## [0.34.0] — 2026-07-12
 
 ### Added
@@ -1961,7 +1992,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.34.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.36.0...HEAD
+[0.36.0]: https://github.com/ffroliva/gflow-cli/compare/v0.35.0...v0.36.0
+[0.35.0]: https://github.com/ffroliva/gflow-cli/compare/v0.34.0...v0.35.0
 [0.34.0]: https://github.com/ffroliva/gflow-cli/compare/v0.33.0...v0.34.0
 [0.33.0]: https://github.com/ffroliva/gflow-cli/compare/v0.32.1...v0.33.0
 [0.32.1]: https://github.com/ffroliva/gflow-cli/compare/v0.32.0...v0.32.1

{gflow_cli-0.34.0 → gflow_cli-0.36.0}/KNOWN_ISSUES.md

@@ -291,10 +291,38 @@ gflow video batch ./batch-a.tsv --profile work
 gflow video batch ./batch-b.tsv --profile personal
 ```
 
-**Roadmap:** Phase 4 (v0.4.0a2) added concurrency *inside* one `gflow video batch` process via `GFLOW_CLI_CONCURRENCY=N` (per-worker Page pool on one shared BrowserContext). Cross-process same-profile serialization is a Chromium constraint we cannot work around without rewriting the auth model — multiple shells against the same profile remains a "use different profiles" workaround.
+**Roadmap:** Phase 4 (v0.4.0a2) added concurrency *inside* one `gflow-cli` process via `GFLOW_CLI_CONCURRENCY=N` (per-worker Page pool on one shared BrowserContext). Cross-process same-profile serialization is a Chromium constraint we cannot work around without rewriting the auth model — multiple shells against the same profile remains a "use different profiles" workaround.
 
 ---
 
+### Chromium cookie database locks block yt-dlp integrations (Instagram/restricted download paths)
+
+- **Status:** Mitigated · **Severity:** Low-Medium · **Affects:** any downstream helper calling `yt-dlp` (including `claude-video`, `cg-decode`/`refanalyzer`, or `experience-vault`)
+
+When executing `yt-dlp` from automated shell calls or Python wrappers while a Chromium-based browser (Chrome or Edge) is active, you may see:
+```text
+ERROR: Could not copy Chrome cookie database.
+```
+This is because Chromium holds an exclusive lock on its SQLite cookie database while active, causing `yt-dlp` to crash when attempting to extract cookies from the browser.
+
+**Mitigation & Workaround:**
+1. **Cookie Export:** Export Netscape-formatted cookies from your logged-in browser session to a static file (e.g. `ig_cookies.txt` or `.auth/ig_cookies.txt`).
+2. **Configuration Isolation:** Prevent `yt-dlp` from reading global user configurations that might force browser-cookie loading (e.g. `%APPDATA%\yt-dlp\config.txt` containing `--cookies-from-browser chrome`).
+   - In CLI calls, pass `--no-config` (or `--ignore-config`):
+     ```bash
+     yt-dlp --no-config --cookies path/to/cookies.txt [URL]
+     ```
+   - In Python `YoutubeDL` constructors, pass `"ignoreconfig": True` in the options dictionary:
+     ```python
+     opts = {
+         "cookiefile": "path/to/cookies.txt",
+         "ignoreconfig": True,
+     }
+     ```
+
+---
+
+
 ### Flow's first-upload terms-of-use dialog ("Aviso") blocks the worker (worker-only)
 
 - **Status:** Open · **Severity:** Low · **Affects:** the legacy in-tree Compiled Growth worker, NOT `gflow-cli` itself

{gflow_cli-0.34.0 → gflow_cli-0.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.34.0
+Version: 0.36.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.15.20; extra == 'dev'
+Requires-Dist: ruff==0.15.21; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'