gflow-cli 0.4.0a2__tar.gz → 0.6.0a1__tar.gz

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/.claude/commands/release.md

@@ -9,8 +9,8 @@ You are about to release a new version of `gflow-cli`. Follow this sequence verb
 ## Inputs
 
 Ask the user (if not already provided):
-1. **Version** — the new SemVer (e.g. `0.2.0`, `0.2.0a1`, `1.0.0-rc1`). If they don't know, look at the latest entry in `CHANGELOG.md` `[Unreleased]` and propose the next bump (PATCH for fixes only, MINOR for new features, MAJOR for breaks).
-2. **Pre-release?** — `0.x.y` is alpha by definition. Only the user can say if a `0.x.y-rc1` should ship.
+1. **Version** — the new version (e.g. `0.4.0`, `0.4.0a3`, `1.0.0rc1`). Use PEP 440 prerelease suffixes (`aN`, `bN`, `rcN`) for Python package releases. If they don't know, look at the latest entry in `CHANGELOG.md` `[Unreleased]` and propose the next bump (PATCH for fixes only, MINOR for new features, MAJOR for breaks).
+2. **Pre-release?** — prerelease versions such as `0.4.0a3` should stay marked as GitHub prereleases. Only the user can say when a release line is ready for the stable tag, such as `0.4.0`.
 
 ## Sequence
 
@@ -41,7 +41,17 @@ Ask the user (if not already provided):
    version = "<NEW_VERSION>"
    ```
 
-5. **Update `CHANGELOG.md`:**
+5. **Bump package version** in `src/gflow_cli/__init__.py`:
+   ```python
+   __version__ = "<NEW_VERSION>"
+   ```
+
+6. **Update version assertion tests** if present:
+   ```bash
+   rg -n "__version__|<OLD_VERSION>|version assertion" tests src pyproject.toml
+   ```
+
+7. **Update `CHANGELOG.md`:**
    - Move all entries under `## [Unreleased]` to a new `## [<NEW_VERSION>] — YYYY-MM-DD` section.
    - Leave `## [Unreleased]` empty.
    - Update the link footer:
@@ -50,24 +60,24 @@ Ask the user (if not already provided):
      [<NEW_VERSION>]: https://github.com/ffroliva/gflow-cli/releases/tag/v<NEW_VERSION>
      ```
 
-6. **Commit the release prep.**
+8. **Commit the release prep.**
    ```bash
-   git add pyproject.toml CHANGELOG.md
-   git commit -m "release: v<NEW_VERSION>"
+   git add pyproject.toml src/gflow_cli/__init__.py CHANGELOG.md tests
+   git commit -m "chore(release): v<NEW_VERSION>"
    ```
 
-7. **Tag.** Pre-release tags include `-rc*` / `-alpha*` / `-beta*`:
+9. **Tag.** PEP 440 prerelease tags include `aN` / `bN` / `rcN`:
    ```bash
    git tag -a v<NEW_VERSION> -m "v<NEW_VERSION>"
    ```
 
-8. **Push commit + tag.**
+10. **Push commit + tag.**
    ```bash
    git push origin main
    git push origin v<NEW_VERSION>
    ```
 
-9. **Report.** Tell the user:
+11. **Report.** Tell the user:
    - The pushed tag triggers `.github/workflows/release.yml`.
    - Watch <https://github.com/ffroliva/gflow-cli/actions> for the release workflow.
    - On success: PyPI publish + GitHub Release with auto-generated notes.
@@ -82,5 +92,6 @@ Ask the user (if not already provided):
 
 ## See also
 
-- [README § Releases](../../README.md#releases) — full release policy & cadence
+- [RELEASE.md](../../RELEASE.md) — full release protocol, prerelease policy, and checklist
+- [README § Releases](../../README.md#releases) — short release policy & cadence
 - [PLAN § Phase 5](../../PLAN.md#phase-5--public-alpha-release-on-pypi) — first-release exit criteria

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/.gitattributes

@@ -28,8 +28,10 @@ LICENSE     text eol=lf
 *.sh        text eol=lf
 *.bash      text eol=lf
 
-# Windows scripts MUST stay CRLF or they break under PowerShell / cmd.exe
-*.ps1       text eol=crlf
+# PowerShell handles LF fine on both PS 5.1 and Core, so keep .ps1 as LF.
+# cmd.exe has historical edge cases with multi-line batch files, so .bat/.cmd
+# stay CRLF.
+*.ps1       text eol=lf
 *.bat       text eol=crlf
 *.cmd       text eol=crlf
 

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/.github/workflows/ci.yml

@@ -32,4 +32,11 @@ jobs:
         run: uv run pyright src
 
       - name: Test (smoke only)
-        run: uv run pytest -q
+        # e2e tests (tests/e2e/) require a logged-in `denon82` Chromium profile
+        # and live Flow auth — never runnable in CI. They self-mark with
+        # `pytestmark = pytest.mark.e2e` (file-level) and are opt-in via
+        # `-m e2e` per their module docstring. `live` marker is reserved for
+        # `GFLOW_LIVE=1` tests that hit the real Flow API. Both are excluded
+        # from the default smoke run; `tests/smoke/test_real_flow.py` already
+        # self-skips via `pytest.mark.skipif(GFLOW_E2E != "1")`.
+        run: uv run pytest -q -m "not e2e and not live"

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/.github/workflows/release.yml

@@ -50,4 +50,8 @@ jobs:
         with:
           generate_release_notes: true
           files: dist/*
-          prerelease: ${{ contains(github.ref_name, '-') }}
+          # Pre-release detection covers both conventions:
+          #   - semver suffixes:  v1.2.3-alpha1, v1.2.3-rc1, v1.2.3-beta1   (any '-' qualifies)
+          #   - PEP 440 suffixes: v1.2.3a1, v1.2.3b1, v1.2.3rc1             (any 'a' / 'b' / 'rc')
+          # Stable tags like v1.2.3 contain none of these substrings.
+          prerelease: ${{ contains(github.ref_name, '-') || contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc') }}

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/.gitignore

@@ -48,6 +48,13 @@ tmp/
 !tests/fixtures/**/*.png
 samples/*.captured.json # sandbox-recorded API exchanges may contain PII
 
+# Live Flow traffic captures — NEVER commit (contain real Bearer tokens / API keys).
+# Diagnostic scripts MUST default-write here, NOT to samples/captured/.
+# Sanitised reference samples (no secrets) can still live under samples/captured/.
+tmp/captured/
+samples/captured/flow_outgoing_*.jsonl
+samples/captured/flow_outgoing_*.json
+
 # Claude Code worktrees and lock files
 .claude/worktrees/
 .claude/scheduled_tasks.lock

gflow_cli-0.6.0a1/.planning/todos/pending/2026-05-11-add-project-logo-and-docs-site-promotion-plan.md

@@ -0,0 +1,38 @@
+---
+created: 2026-05-11T11:34:56.295Z
+title: Add project logo and docs site promotion plan
+area: docs
+files:
+  - README.md:18
+  - README.md:365
+  - RELEASE.md:1
+  - docs/INDEX.md:10
+---
+
+## Problem
+
+The project is now public on GitHub and PyPI and has enough release/process
+surface to benefit from a more polished presentation. The README was cleaned up
+with working badges and a public `RELEASE.md`, but the next promotion step is
+still undecided: whether to add a logo/social preview, whether to create a
+GitHub Pages documentation site, and which static-docs stack to use.
+
+Jekyll is available on GitHub Pages, but for this Python CLI project the better
+default is likely MkDocs Material: it fits Markdown-heavy CLI docs, has search
+and navigation, and can publish to GitHub Pages cleanly. This should wait until
+after the current prerelease E2E validation, because the real launch gate is
+runtime confidence, not site polish.
+
+## Solution
+
+After E2E validation, decide a small promotion package:
+
+1. Add a simple project logo and GitHub social preview image.
+2. Keep README as the landing page and make the first screen clear for users.
+3. If docs navigation grows cramped, add a MkDocs Material site published to
+   GitHub Pages.
+4. Avoid Jekyll unless the goal shifts toward a blog-style marketing site.
+5. Add the star-history chart only after the repo has enough activity for the
+   graph to render as useful signal rather than empty axes.
+6. Keep `RELEASE.md`, README release policy, and `.claude/commands/release.md`
+   in sync when the release process changes.

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/CHANGELOG.md

@@ -7,6 +7,136 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0a1] — 2026-05-14
+
+> **Shell-friendly multi-prompt `t2i` + performance hardening.** This release 
+> promotes `gflow image t2i` to a variadic command that can consume multiple 
+> prompts from positional arguments, a line-delimited text file, or standard 
+> input. Core generation logic has been consolidated into a shared 
+> `image_batch` module, ensuring architectural consistency between shell runs 
+> and JSON-described batches. This version also ships critical resource 
+> cleanup fixes for SQLite connections and OOM protection for stdin streams.
+
+### Added
+
+- **Variadic `gflow image t2i`** — now accepts multiple positional prompts. 
+  Example: `gflow image t2i "prompt 1" "prompt 2"`.
+- **`--prompts-file <PATH>` and `--stdin`** — read batches of prompts from 
+  text files or pipes. All prompts in a batch share a single Flow session 
+  and project, significantly reducing reCAPTCHA and project-init overhead.
+- **Shared `image_batch` logic** (`src/gflow_cli/image_batch.py`) — unified 
+  orchestration, validation, and rendering for all multi-prompt generation 
+  surfaces.
+- **Memory safety for stdin** — bounded read on standard input prevents 
+  memory exhaustion when piping large or infinite streams.
+- **`examples/multi_prompt_t2i.py` + `examples/sample_prompts.txt`** — 
+  runnable template for the new shell-multi-prompt surface.
+
+### Fixed
+
+- **Resource leaks in SQLite** — ensured all `sqlite3` connections are 
+  properly closed via `try...finally` blocks, resolving resource exhaust 
+  warnings and potential hangs in long-running processes.
+- **Output directory partitioning** — `t2i` batches now correctly land in 
+  date-partitioned folders (`images/YYYY-MM-DD/`) by default, aligning 
+  with the core design spec.
+
+### Changed
+
+- **CLI validation alignment** — `t2i` and `i2i` subcommands now use 
+  authoritative domain constants for model, aspect, and count validation, 
+  ensuring UI help text and defaults stay in perfect sync with the engine.
+
+## [0.5.0a1] — 2026-05-12
+
+> **Pluggable image transport + JSON-described batch runs.** The image
+> generation surface now ships a new default `ui_automation` transport —
+> a Playwright-driven UI mimicry strategy validated end-to-end against
+> real Flow on a Google AI Pro/Ultra profile. Three earlier HTTP
+> transport strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) move
+> into a new `experimental/` subpackage; they remain importable for
+> research but are hidden from the CLI by default. New top-level
+> `gflow run --config <file>` command drives JSON-described sequential
+> batches through one shared session.
+
+### Added
+
+- **`UiAutomationTransport`** (`gflow_cli.api.transports.ui_automation`)
+  — new default transport. Drives the Flow editor on a logged-in
+  profile through a Playwright-managed persistent context (internal CDP
+  port; no externally-exposed debug port). Mirrors the validated
+  reference flow in `scripts/smoke_worker_style.py`.
+- **`gflow run --config <file>`** — sequential JSON-described batch
+  command. Schema covers `profile`, `transport`, `output_dir`, and a
+  `prompts` list (1–50 entries) with per-prompt `text`,
+  `aspect_ratio`, `model`, `count`, and `output_filename`. Supports
+  `--continue-on-error` (default) and `--fail-fast` semantics; final
+  exit code is the max per-prompt exit code. ONE `FlowApiClient`
+  session wraps the whole loop so the browser/project persist across
+  prompts.
+- **`examples/` directory** — three runnable scripts (`single_image_t2i.py`,
+  `batch_from_config.py`) + a copy-and-edit `sample_config.json` + an
+  index `examples/README.md`. All sanitised: no hardcoded profile
+  names, generic placeholder prompts, parameterised via `--profile` /
+  `$GFLOW_EXAMPLE_PROFILE`.
+- **Opt-in real-Flow smoke test** at `tests/smoke/test_real_flow.py`,
+  gated by `GFLOW_E2E=1` + `GFLOW_E2E_PROFILE`. Runs the full
+  `UiAutomationTransport` flow against real Flow and asserts a
+  non-trivial PNG was written.
+- **`EXPERIMENTAL_TRANSPORTS` constant** + **`transport_choices()`
+  helper** in `gflow_cli.api.transports`. The factory continues to
+  accept every registered key; the CLI `--transport` Choice list is
+  the gated surface (default = `ui_automation` only;
+  `GFLOW_CLI_EXPERIMENTAL_TRANSPORTS=1` expands to all four).
+- **Download host allow-list** in `UiAutomationTransport._download`
+  (`googleusercontent.com`, `googleapis.com`, `google.com` suffix
+  match). `follow_redirects=False`. Prevents session cookies from
+  reaching a non-Google host through a malformed or compromised
+  `fifeUrl`.
+
+### Changed
+
+- **Default `--transport` flag** flipped from `evaluate_fetch` to
+  `ui_automation` across `gflow image t2i`, `gflow image i2i`, and
+  `gflow image upload`. The change is transparent to existing scripts
+  unless they pinned `--transport evaluate_fetch` explicitly.
+- **`evaluate_fetch` / `bearer` / `sapisidhash` strategies moved** to
+  `gflow_cli.api.transports.experimental.*`. Public registry keys
+  (the strings used by `make_transport()` and the
+  `GFLOW_CLI_TRANSPORT` env var) are unchanged. Import paths within
+  the package are the only user-visible delta.
+- **Debug screenshots** captured by the strategy on `_enter_editor` /
+  `_send_prompt` failures are now **viewport-only**
+  (`full_page=False`) and emit a `WARNING` log line noting the file
+  may contain identifying information from the authenticated session.
+
+### Fixed
+
+- Listener-attach race in `generate_images`. The earlier
+  `asyncio.create_task(_capture_batch_response(page))` scheduled the
+  listener registration AFTER the next event-loop tick; on a busy
+  loop the prompt click could fire before the listener attached,
+  causing the capture to time out. Refactored into a synchronous
+  `_attach_batch_response_listener(page)` + an `async
+  _await_captured(captured, ...)`. No more orphaned task on partial
+  failure.
+
+### Removed
+
+- Dead `_extract_image_urls(response)` helper on
+  `UiAutomationTransport` and its five tests.
+  `generate_images` parses `body.media[]` directly through
+  `GeneratedImage.from_response_item`; the parallel helper was
+  unreachable.
+
+### Documentation
+
+- `BrowserManager` module docstring updated to make explicit that the
+  module is retained for research / non-Flow use, not on the
+  v0.5.0a1 image-generation critical path. No behavior change.
+- README "Project status" table updated with v0.5.0a1 row.
+- `docs/USAGE.md` gains a `gflow run` section.
+
 ## [0.4.0a2] — 2026-05-11
 
 > **Documentation polish.** Same release surface as v0.4.0a1; this tag fixes
@@ -307,9 +437,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.4.0a2...HEAD
-[0.4.0a2]: https://github.com/ffroliva/gflow-cli/compare/v0.4.0a1...v0.4.0a2
-[0.4.0a1]: https://github.com/ffroliva/gflow-cli/compare/v0.3.0a1...v0.4.0a1
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.6.0a1...HEAD
+[0.6.0a1]: https://github.com/ffroliva/gflow-cli/compare/v0.5.0a1...v0.6.0a1
+[0.5.0a1]: https://github.com/ffroliva/gflow-cli/compare/v0.4.0a2...v0.5.0a1
 [0.3.0a1]: https://github.com/ffroliva/gflow-cli/releases/tag/v0.3.0a1
 [0.2.0a1]: https://github.com/ffroliva/gflow-cli/releases/tag/v0.2.0a1
 [0.1.0]: https://github.com/ffroliva/gflow-cli/releases/tag/v0.1.0

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/CLAUDE.md

@@ -142,3 +142,66 @@ uv run gflow auth login --profile experiments  # named profile
 - [docs/INDEX.md](docs/INDEX.md) — full doc routing
 - [PLAN.md](PLAN.md) — implementation roadmap with phases & ADRs
 - [.claude/README.md](.claude/README.md) — what's in `.claude/` and how to extend it
+
+# context-mode — MANDATORY routing rules
+
+You have context-mode MCP tools available. These rules are NOT optional — they protect your context window from flooding. A single unrouted command can dump 56 KB into context and waste the entire session.
+
+## BLOCKED commands — do NOT attempt these
+
+### curl / wget — BLOCKED
+Any Bash command containing `curl` or `wget` is intercepted and replaced with an error message. Do NOT retry.
+Instead use:
+- `ctx_fetch_and_index(url, source)` to fetch and index web pages
+- `ctx_execute(language: "javascript", code: "const r = await fetch(...)")` to run HTTP calls in sandbox
+
+### Inline HTTP — BLOCKED
+Any Bash command containing `fetch('http`, `requests.get(`, `requests.post(`, `http.get(`, or `http.request(` is intercepted and replaced with an error message. Do NOT retry with Bash.
+Instead use:
+- `ctx_execute(language, code)` to run HTTP calls in sandbox — only stdout enters context
+
+### WebFetch — BLOCKED
+WebFetch calls are denied entirely. The URL is extracted and you are told to use `ctx_fetch_and_index` instead.
+Instead use:
+- `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` to query the indexed content
+
+## REDIRECTED tools — use sandbox equivalents
+
+### Bash (>20 lines output)
+Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `npm install`, `pip install`, and other short-output commands.
+For everything else, use:
+- `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
+- `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context
+
+### Read (for analysis)
+If you are reading a file to **Edit** it → Read is correct (Edit needs content in context).
+If you are reading to **analyze, explore, or summarize** → use `ctx_execute_file(path, language, code)` instead. Only your printed summary enters context. The raw file content stays in the sandbox.
+
+### Grep (large results)
+Grep results can flood context. Use `ctx_execute(language: "shell", code: "grep ...")` to run searches in sandbox. Only your printed summary enters context.
+
+## Tool selection hierarchy
+
+1. **GATHER**: `ctx_batch_execute(commands, queries)` — Primary tool. Runs all commands, auto-indexes output, returns search results. ONE call replaces 30+ individual calls.
+2. **FOLLOW-UP**: `ctx_search(queries: ["q1", "q2", ...])` — Query indexed content. Pass ALL questions as array in ONE call.
+3. **PROCESSING**: `ctx_execute(language, code)` | `ctx_execute_file(path, language, code)` — Sandbox execution. Only stdout enters context.
+4. **WEB**: `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` — Fetch, chunk, index, query. Raw HTML never enters context.
+5. **INDEX**: `ctx_index(content, source)` — Store content in FTS5 knowledge base for later search.
+
+## Subagent routing
+
+When spawning subagents (Agent/Task tool), the routing block is automatically injected into their prompt. Bash-type subagents are upgraded to general-purpose so they have access to MCP tools. You do NOT need to manually instruct subagents about context-mode.
+
+## Output constraints
+
+- Keep responses under 500 words.
+- Write artifacts (code, configs, PRDs) to FILES — never return them as inline text. Return only: file path + 1-line description.
+- When indexing content, use descriptive source labels so others can `ctx_search(source: "label")` later.
+
+## ctx commands
+
+| Command | Action |
+|---------|--------|
+| `ctx stats` | Call the `ctx_stats` MCP tool and display the full output verbatim |
+| `ctx doctor` | Call the `ctx_doctor` MCP tool, run the returned shell command, display as checklist |
+| `ctx upgrade` | Call the `ctx_upgrade` MCP tool, run the returned shell command, display as checklist |

gflow_cli-0.6.0a1/CONFIGURATION.md

@@ -0,0 +1,68 @@
+# gflow-cli Configuration Reference
+
+## Environment variables
+
+| Env var | Default | Description |
+|---|---|---|
+| `GFLOW_CLI_HOME` | Platform data dir | Root directory for profiles and config. |
+| `GFLOW_CLI_OUTPUT_DIR` | `~/Downloads/gflow-cli` | Where generated images and videos are saved. |
+| `GFLOW_CLI_BROWSER` | `auto` | Browser mode. See **Browser mode** section below. |
+| `CHROME_BINARY` | (autodetect) | Override Chrome binary path. Falls back to platform-standard locations. |
+| `GFLOW_CLI_CONCURRENCY` | `4` | Maximum parallel API requests per batch. |
+| `GFLOW_LIVE` | _(unset)_ | Set to `1` to enable live-API test markers (`@pytest.mark.live`). |
+
+---
+
+## Browser mode (D.2.3+)
+
+| Env var | Default | Description |
+|---|---|---|
+| `GFLOW_CLI_BROWSER` | `auto` | `auto` attaches to running Chrome via CDP or spawns detached; `fresh` launches new Playwright Chromium per call (legacy); `cdp:<port>` attaches to explicit CDP endpoint. |
+| `CHROME_BINARY` | (autodetect) | Override Chrome binary path. Falls back to platform-standard locations. |
+
+### When to use which
+
+- **`auto`** (recommended): real Chrome fingerprint = highest reCAPTCHA risk score; persistent
+  across CLI invocations. First call spawns Chrome detached; subsequent calls attach via CDP.
+- **`fresh`**: legacy single-shot Playwright Chromium. Use when you need a clean profile per call.
+- **`cdp:<port>`**: connect to an already-running Chrome you spawned yourself
+  (e.g. with `--remote-debugging-port=9222`).
+
+### Chrome binary autodetection order
+
+1. `CHROME_BINARY` env var (checked first — always wins)
+2. `shutil.which("chrome")` / `shutil.which("google-chrome")` / `shutil.which("chromium")`
+3. Platform-standard paths:
+   - **Windows**: `C:\Program Files\Google\Chrome\Application\chrome.exe`,
+     `C:\Program Files (x86)\Google\Chrome\Application\chrome.exe`,
+     `%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe`
+   - **macOS**: `/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`
+   - **Linux**: `/usr/bin/google-chrome`, `/usr/bin/chromium`, `/usr/bin/chromium-browser`
+
+If Chrome is not found, gflow-cli raises a `ConfigurationError` with an install hint.
+
+### CDP port range
+
+By default gflow-cli uses CDP port `9222`. If that port is occupied by a non-gflow Chrome,
+it probes `9222–9229` until a free port is found. The chosen port is persisted in
+`<profile_dir>/.gflow-cdp.lock` so subsequent calls reuse the same port.
+
+If all 8 ports are occupied, a `ConfigurationError` is raised.
+
+### Lockfile
+
+`<profile_dir>/.gflow-cdp.lock` — JSON file containing `{pid, port, profile_name}`.
+Written atomically (tmp + `os.link`, `O_CREAT|O_EXCL|O_NOFOLLOW`, mode `0o600`)
+when Chrome is first spawned. Stale locks (PID no longer alive) are cleaned up
+automatically on the next CLI invocation.
+
+### Security note — localhost CDP trust model
+
+The Chrome DevTools Protocol endpoint (`http://localhost:<port>/json/version`)
+is **not authenticated**. Any process on the same machine that can reach
+`localhost:9222` can drive the browser. gflow-cli treats a port owner that
+matches our lockfile as trusted; an unmanaged Chrome on the same port is
+attached with a `attached_to_unmanaged_chrome=true` warning logged.
+
+**Do not run gflow-cli on a shared multi-user machine** where untrusted users
+have shell access. Use a dedicated user account or a VM per worker.

{gflow_cli-0.4.0a2 → gflow_cli-0.6.0a1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.4.0a2
+Version: 0.6.0a1
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -69,7 +69,7 @@ Description-Content-Type: text/markdown
 
 > ⚠️ **Not affiliated with Google.** Reverse-engineered from public Flow web traffic. Endpoints can change at any time. See full [DISCLAIMER](DISCLAIMER.md) before use.
 
-📚 **Docs:** [INDEX](docs/INDEX.md) · [User Guide](docs/USER_GUIDE.md) · [Architecture](docs/ARCHITECTURE.md) · [Authentication](docs/AUTHENTICATION.md) · [Configuration](docs/CONFIGURATION.md) · [Usage](docs/USAGE.md) · [Security](docs/SECURITY.md) · [Known issues](KNOWN_ISSUES.md) · [Plan](PLAN.md) · [Changelog](CHANGELOG.md)
+📚 **Docs:** [INDEX](docs/INDEX.md) · [User Guide](docs/USER_GUIDE.md) · [Architecture](docs/ARCHITECTURE.md) · [Authentication](docs/AUTHENTICATION.md) · [Configuration](docs/CONFIGURATION.md) · [Usage](docs/USAGE.md) · [Security](docs/SECURITY.md) · [Known issues](KNOWN_ISSUES.md) · [Release protocol](RELEASE.md) · [Plan](PLAN.md) · [Changelog](CHANGELOG.md)
 🤖 **For AI agents:** [CLAUDE.md](CLAUDE.md) · [`.claude/`](.claude/README.md)
 
 ---
@@ -108,7 +108,7 @@ Read the full [DISCLAIMER](DISCLAIMER.md) before deploying this in any productio
 
 ## Project status
 
-**v0.4.0a2 — alpha.** Video (T2V/I2V/batch), image (T2I/I2I/upload), and **batch concurrency, typed errors, retry/backoff, and structured logging** are functional end-to-end against a live Google AI Ultra/Pro Flow account.
+**v0.5.0a1 — alpha.** Video (T2V/I2V/batch), image (T2I/I2I/upload), the new **`gflow run` JSON-batch command**, and the **`ui_automation` default transport** are functional end-to-end against a live Google AI Pro/Ultra Flow account. Three earlier HTTP transport strategies (`evaluate_fetch` / `bearer` / `sapisidhash`) move to an `experimental/` subpackage in this release; the production path is `ui_automation`.
 
 | Milestone | Status |
 |---|---|
@@ -122,7 +122,36 @@ Read the full [DISCLAIMER](DISCLAIMER.md) before deploying this in any productio
 | Typed errors (RFC 9457 Problem Details) + per-class exit codes 3–7 | ✅ done (v0.4.0a2) |
 | Retry / backoff + reCAPTCHA re-mint inside the retry loop | ✅ done (v0.4.0a2) |
 | Structured logs (`structlog`, JSON on pipe) | ✅ done (v0.4.0a2) |
-| Provider abstraction for official Veo 3.1 API | ⏳ planned (v0.5+) |
+| Pluggable image transport + `ui_automation` default strategy | ✅ done (v0.5.0a1) |
+| `gflow run --config <file>` sequential JSON batches | ✅ done (v0.5.0a1) |
+| `examples/` directory with runnable single-image + batch scripts | ✅ done (v0.5.0a1) |
+| Shell multi-prompt `gflow image t2i` (`PROMPT...`, `--prompts-file`, `--stdin`) | ✅ done (v0.6.0a1) |
+| Provider abstraction for official Veo 3.1 API | ⏳ planned (v0.6+) |
+
+### What's new in v0.5.0a1
+
+- `UiAutomationTransport` is now the default image-generation strategy — Playwright-driven UI mimicry against the Flow editor on a logged-in Pro/Ultra profile (no externally-exposed CDP debug port).
+- New top-level `gflow run --config <file>` command for JSON-described sequential batches (1–50 prompts per file, `--continue-on-error` / `--fail-fast` modes). See [`docs/USAGE.md`](docs/USAGE.md#gflow-run) for the schema.
+- Three runnable example scripts shipped under [`examples/`](examples/README.md) — copy and edit for your own pipelines.
+- See the full [CHANGELOG](CHANGELOG.md#0501) for the security follow-ups (download host allow-list, viewport-only debug screenshots) and the listener-attach race fix.
+
+---
+
+## Demo
+
+![gflow image t2i — single 9:16 prompt, streaming structlog output, PNG on disk](docs/assets/example-run.gif)
+
+*A single `gflow image t2i "..." --aspect 9:16 --model nano2 --out ...` call against a logged-in Pro/Ultra profile. The terminal shows the streaming `structlog` JSON for the run, the final `ls` of the written PNG, and nothing else — Chromium drives the Flow editor silently in the background because the persistent Playwright session is already warm, so this take is intentionally terminal-only.*
+
+**Try it yourself** — this is the exact command the GIF runs:
+
+```bash
+gflow image t2i "a quiet mountain lake at dawn, cinematic photography" --aspect 9:16 --model nano2 --out ./gflow-output/example-single
+```
+
+One prompt, default model (`nano2` = Nano Banana 2), 9:16 portrait, written as `./gflow-output/example-single/<media_name>_0.png`. Wall time is typically 30–90s on a warm profile; the first call after a fresh `gflow auth login` is slower because Playwright spins up Chromium and navigates to the Flow editor. See [`docs/USAGE.md`](docs/USAGE.md) for the full `gflow image t2i` flag reference (`--model`, `--aspect`, `-n`, `--seed`, `--profile`, `--transport`).
+
+To reproduce the recording yourself, see [`scripts/record_demo.ps1`](scripts/record_demo.ps1) (Windows, requires OBS + ffmpeg + gifski).
 
 ---
 
@@ -233,7 +262,9 @@ gflow auth login                                         # one-time browser sign
 gflow auth status                                        # show current session
 
 gflow image upload <path>                                # upload PNG/JPEG → asset UUID
-gflow image t2i "<prompt>" [--model] [--aspect] [-n]     # text-to-image (1–4 per call)
+gflow image t2i "<prompt>" [...] [--model] [--aspect]    # text-to-image; repeat prompts for a warm batch
+gflow image t2i --prompts-file prompts.txt               # text-file multi-prompt batch
+gflow image t2i --stdin                                  # stdin multi-prompt batch
 gflow image i2i "<prompt>" --ref PATH_OR_UUID [...]      # image-to-image (1–4 per call)
 
 gflow video t2v "<prompt>" -o out.mp4                    # text-to-video (Veo 3.1)
@@ -376,17 +407,20 @@ Each `Provider` method has a corresponding test file under `tests/`. New routes
 
 1. Update [`CHANGELOG.md`](CHANGELOG.md) with the version's changes (Keep-a-Changelog format).
 2. Bump `version` in `pyproject.toml`.
-3. Tag the commit:
+3. Bump `__version__` in `src/gflow_cli/__init__.py`.
+4. Tag the commit:
    ```bash
-   git tag vX.Y.Z          # or vX.Y.ZaN for an alpha
-   git push origin vX.Y.Z
+   git tag v<version>          # for example, v0.4.0 or v0.4.0a3
+   git push origin v<version>
    ```
-4. The [`release.yml`](.github/workflows/release.yml) GitHub Action runs:
+5. The [`release.yml`](.github/workflows/release.yml) GitHub Action runs:
    - Builds the wheel + sdist with `uv build`
    - Publishes to PyPI via [Trusted Publishing](https://docs.pypi.org/trusted-publishers/) — no API tokens stored
    - Creates a GitHub Release with the changelog excerpt + built artifacts attached
 
-Pre-release tags (`v*.*.*-rc*`, `v*.*.*-alpha*`, `v*.*.*-beta*`) auto-flag as pre-releases on GitHub. Install with `pip install --pre gflow-cli` or `uvx --from "gflow-cli==0.4.0a2" gflow`.
+PEP 440 prerelease tags (`vX.Y.ZaN`, `vX.Y.ZbN`, `vX.Y.ZrcN`) and hyphenated prerelease tags (`vX.Y.Z-alphaN`, `vX.Y.Z-betaN`, `vX.Y.Z-rcN`) auto-flag as prereleases on GitHub. Stable tags such as `v0.4.0` become full GitHub Releases. See [RELEASE.md](RELEASE.md) for the checklist and the prerelease/full-release policy.
+
+Install prereleases explicitly with `pip install --pre gflow-cli` or `uvx --from "gflow-cli==0.4.0a2" gflow`.
 
 ---
 
@@ -422,6 +456,5 @@ Note that the **Google service** this tool talks to has its own terms (Google La
 [![GitHub last commit](https://img.shields.io/github/last-commit/ffroliva/gflow-cli)](https://github.com/ffroliva/gflow-cli/commits/main)
 [![GitHub repo size](https://img.shields.io/github/repo-size/ffroliva/gflow-cli)](https://github.com/ffroliva/gflow-cli)
 [![PyPI downloads](https://img.shields.io/pypi/dm/gflow-cli.svg)](https://pypi.org/project/gflow-cli/)
-[![PyPI total downloads](https://img.shields.io/pypi/dt/gflow-cli.svg)](https://pypi.org/project/gflow-cli/)
 
 If `gflow-cli` saves you time, please ⭐ the repo — it's the cheapest way to support the project.