gflow-cli 0.55.0__tar.gz → 0.57.0__tar.gz

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.55.0",
+  "version": "0.57.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.env.template

@@ -133,6 +133,21 @@
 # changes; don't exceed 8 without measuring. Shipped in v0.4.0a2.
 # GFLOW_CLI_CONCURRENCY=1
 
+# Seconds to wait for another gflow process to release the profile lease
+# before giving up with ProfileLockedError (0 = fail fast, the default).
+# Holders always run to completion; the waiter takes over on release (#478).
+# GFLOW_CLI_LEASE_WAIT_SECONDS=0
+
+# Once-a-day best-effort PyPI check printing a one-line notice when a newer
+# gflow-cli exists (#479). Never blocks; skipped in CI and for
+# editable/source installs. Set to 0 to disable.
+# GFLOW_CLI_UPDATE_CHECK=1
+
+# MCP no-spend mode (#496): when set to 1, the MCP server (gflow mcp run AND
+# gflow serve) never registers the credit-spending generate tools — agents
+# cannot see them in tools/list. Equivalent to the --no-spend flag.
+# GFLOW_MCP_NO_SPEND=0
+
 # Run Playwright in headless mode for non-`auth login` commands (true|false).
 # Default: false — headed real Chrome is the PRODUCTION default, not a
 # fallback. The ui_automation transport (the only production transport)

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/dependabot.yml

@@ -110,3 +110,47 @@ updates:
       github-actions:
         applies-to: version-updates
         patterns: ["*"]
+
+  # npm — the PR-triage sandbox's pinned Claude Code CLI
+  # (scripts/autopilot/package-lock.json, installed via `npm ci` in
+  # Dockerfile.triage).
+  - package-ecosystem: "npm"
+    directory: "/scripts/autopilot"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+
+  # Docker — the digest-pinned node:20-slim base of Dockerfile.triage.
+  - package-ecosystem: "docker"
+    directory: "/scripts/autopilot"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+
+  # uv — the hash-pinned MkDocs set for the Pages build
+  # (website/requirements.txt, compiled from website/requirements.in).
+  # "uv", NOT "pip", for the same reason as the root entry: the pip ecosystem
+  # would regenerate the file with pip-compile, clobbering the uv-authored
+  # header/format; dependabot's uv ecosystem recompiles .in → .txt via
+  # `uv pip compile` and keeps the hashes.
+  - package-ecosystem: "uv"
+    directory: "/website"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+      - "python"

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/ci.yml

@@ -5,6 +5,11 @@ on:
     branches: [develop, main]
   pull_request:
 
+# Least-privilege default token for every job (OpenSSF Scorecard:
+# Token-Permissions). Jobs that need more elevate per-job below.
+permissions:
+  contents: read
+
 env:
   # Suppress Node.js deprecation warnings and align with user request to use Node 22/remove noise.
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
@@ -15,13 +20,16 @@ jobs:
   secrets-scan:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # gitleaks-action PR feedback comments
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0  # full history so gitleaks can diff against base
 
       - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v3
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -30,9 +38,9 @@ jobs:
     name: Dependency audit (pip-audit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       - name: Audit locked dependencies for known CVEs
         # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
         #
@@ -45,7 +53,9 @@ jobs:
         # alerts flagged them against uv.lock; this gate could not see them.
         run: |
           uv export --frozen --all-extras --format requirements-txt --no-emit-project > requirements-audit.txt
-          uvx pip-audit -r requirements-audit.txt
+          # pip-audit version pinned for a reproducible gate (uvx has no
+          # dependabot ecosystem — bump by hand when it drifts).
+          uvx pip-audit==2.10.1 -r requirements-audit.txt
 
   # ── Supply-chain gate: resolve WITHOUT the lockfile ───────────────────────
   # Every other job installs via `uv sync`, which honours uv.lock. That means CI
@@ -62,10 +72,10 @@ jobs:
     name: Dependency resolution drift (no lockfile)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -116,10 +126,10 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}
@@ -152,12 +162,17 @@ jobs:
         # e2e/live tests require a logged-in Chromium profile and may spend
         # Flow credits. pyproject.toml excludes both markers by default; CI
         # intentionally relies on that default smoke set.
-        run: uv run python -m pytest -q --cov=gflow_cli --cov-report=xml
+        run: uv run python -m pytest -q --cov=gflow_cli --cov-report=xml --junitxml=pytest-report.xml
+
+      - name: Test-count guard (a green build that ran nothing is not green)
+        # Floor well below the real count (~2900): catches collection collapse
+        # (bad marker/-k filter, broken conftest), never routine deletions.
+        run: uv run python scripts/ci/check_test_count.py pytest-report.xml 2000
 
       # Upload coverage XML so the sonar job can consume it
       - name: Upload coverage report
         if: matrix.python-version == '3.11'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage-xml
           path: coverage.xml
@@ -180,10 +195,10 @@ jobs:
       matrix:
         os: [windows-latest, macos-latest, ubuntu-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -192,13 +207,21 @@ jobs:
         run: uv sync --extra dev
 
       - name: ProfileLease unit + subprocess tests
-        run: uv run python -m pytest tests/test_profile_lease.py tests/test_profile_lease_subprocess.py -q
+        run: uv run python -m pytest tests/test_profile_lease.py tests/test_profile_lease_subprocess.py -q --junitxml=pytest-lease.xml
+
+      - name: Test-count guard (lease matrix ran its suite)
+        # Floor well below the ~29 executed per OS leg — catches collapse, not
+        # routine test consolidation.
+        run: uv run python scripts/ci/check_test_count.py pytest-lease.xml 10
 
   # ── SonarCloud analysis ───────────────────────────────────────────────────
   sonar:
     name: SonarCloud analysis
     runs-on: ubuntu-latest
     needs: test   # wait for tests + coverage report
+    permissions:
+      contents: read
+      pull-requests: read  # PR-context analysis / decoration lookups
     # Forked pull_request runs do not receive repository secrets, so SONAR_TOKEN
     # is empty there and the scanner fails before analysis. Dependabot-triggered
     # runs are the same case: GitHub serves them the separate Dependabot secrets
@@ -212,12 +235,12 @@ jobs:
         github.event.pull_request.head.repo.full_name == github.repository
       )
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0  # shallow clones break blame / new-code detection
 
       - name: Download coverage report
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: coverage-xml
         continue-on-error: true  # graceful if coverage upload was skipped
@@ -242,7 +265,12 @@ jobs:
 
       - name: SonarCloud scan
         if: steps.sonarcloud_health.outputs.up == 'true'
-        uses: SonarSource/sonarcloud-github-action@v5.0.0
+        # sonarcloud-github-action is ARCHIVED upstream (dependabot never bumps
+        # archived actions, so its pin would rot silently); sonarqube-scan-action
+        # is SonarSource's maintained successor and serves SonarCloud when
+        # SONAR_HOST_URL points at it.
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # PR decoration
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}    # set in repo → Settings → Secrets
+          SONAR_HOST_URL: https://sonarcloud.io

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/deps-watch.yml

@@ -28,10 +28,10 @@ jobs:
     name: Audit + report upgradable dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -43,6 +43,9 @@ jobs:
           # anything reachable solely through an optional extra goes unaudited.
           # See the matching note in ci.yml — this is how aiohttp/pyasn1 hid.
           uv export --frozen --all-extras --format requirements-txt --no-emit-project > requirements-audit.txt
+          # pip-audit deliberately floats here (unlike the pinned gate in
+          # ci.yml): this weekly watch job never gates a merge, and fresh
+          # advisory tooling is exactly what it is for.
           uvx pip-audit -r requirements-audit.txt
 
       # ── The reports: never fail the run, and still run when the audit fails

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/external-pr-triage.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Triage external pull request
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const pr = context.payload.pull_request;

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/governance-advisory.yml

@@ -19,12 +19,12 @@ jobs:
     name: Materiality + traceability (advisory)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # full history so `git diff origin/<base>..HEAD` resolves
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Classify touched paths (advisory, never blocks)
         run: |

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/governance-benchmark.yml

@@ -18,12 +18,12 @@ jobs:
     name: Materiality gate backtest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # full history — the backtest replays every commit
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Run backtest (advisory; writes to job summary)
         run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY"

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/labels.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create or update labels
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             // Every label referenced by .github/dependabot.yml. Keep in sync.

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/main-base-guard.yml

@@ -30,7 +30,7 @@ jobs:
     name: Release must carry /gflow:release artifacts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Verify release artifacts
         env:
           BASE_REF: ${{ github.base_ref }}

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/pages.yml

@@ -12,10 +12,10 @@ on:
       - ".github/workflows/pages.yml"
   workflow_dispatch:
 
+# Write scopes live at JOB level on the deploy job only (Scorecard
+# Token-Permissions: workflow-level write would grant the build job too).
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Never cancel an in-progress deploy; queue instead.
 concurrency:
@@ -26,12 +26,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
       - name: Install MkDocs Material
-        run: pip install "mkdocs-material>=9,<10"
+        # Hash-pinned (Scorecard Pinned-Dependencies). Compiled from
+        # website/requirements.in — regeneration command in that file's header.
+        run: pip install --require-hashes -r website/requirements.txt
       - name: Build docs portal
         working-directory: website
         run: mkdocs build
@@ -40,16 +42,19 @@ jobs:
           mkdir -p _site
           cp index.html _site/
           cp -r website/site _site/docs
-      - uses: actions/upload-pages-artifact@v5
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: _site
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write # actual Pages deployment
+      id-token: write # OIDC handshake with the Pages service
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.github/workflows/release.yml

@@ -5,13 +5,17 @@ on:
     tags:
       - "v*.*.*"
 
+# Write scopes live at JOB level (Scorecard Token-Permissions: workflow-level
+# write grants every job — current and future — the elevated token).
 permissions:
-  contents: write       # for creating GitHub Releases
-  id-token: write       # for PyPI Trusted Publishing (OIDC)
+  contents: read
 
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for creating GitHub Releases
+      id-token: write # for PyPI Trusted Publishing (OIDC)
     environment:
       name: pypi
       url: https://pypi.org/p/gflow-cli
@@ -19,12 +23,12 @@ jobs:
       ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
       NODE_VERSION: '22'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.12
@@ -57,12 +61,12 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         # No api-token needed — uses OIDC Trusted Publishing.
         # Configure once at https://pypi.org/manage/account/publishing/
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           generate_release_notes: true
           files: dist/*

gflow_cli-0.57.0/.github/workflows/scorecard.yml

@@ -0,0 +1,52 @@
+name: OpenSSF Scorecard
+
+# Self-run of the OpenSSF Scorecard supply-chain checks (T2 batch decision,
+# 2026-08-13). Deliberately enabled AFTER the permissions + SHA-pinning
+# hardening landed, so the first published public score reflects the hardened
+# state — Token-Permissions and Pinned-Dependencies are heavily weighted.
+# publish_results feeds the public API/badge:
+#   https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge
+
+on:
+  # Re-evaluates the Branch-Protection check when protection rules change.
+  branch_protection_rule:
+  schedule:
+    - cron: "30 3 * * 1" # weekly, Monday 03:30 UTC
+  push:
+    branches: [develop] # default branch — required for publish_results
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload the SARIF to the Security tab
+      id-token: write # OIDC identity for publish_results signing
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Publishing makes the score available via the public API and badge.
+          # The repo is public; every input to the score already is too.
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          sarif_file: results.sarif

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/.gitignore

@@ -19,6 +19,7 @@ pytest-of-*/
 .coverage
 .coverage.*
 coverage.xml
+pytest-*.xml
 htmlcov/
 .tox/
 .mypy_cache/
@@ -98,3 +99,6 @@ worktrees/
 
 # MkDocs build output
 website/site/
+
+# Local git hooks dir (core.hooksPath target) — machine-local tooling, never shipped
+.githooks/

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/CHANGELOG.md

@@ -7,6 +7,120 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.57.0] — 2026-08-14
+
+### Added
+
+- **`--ui-mode` on `gflow video t2v`/`i2v` + `ui_mode` on MCP `gflow_generate_video` (#299 PR-A).** The video path joins the UI-mode policy that images have had since v0.34.0: the transport now binds its driver through `get_ui_driver` (after editor mount + overlay dismissal) instead of a hardcoded classic bind. Video only has a classic driver, so `auto` ≡ `classic`; an env-sourced `GFLOW_CLI_UI_MODE=agentic` (set for image workflows) degrades to classic with a logged warning, while the explicit `--ui-mode agentic` flag (or MCP `ui_mode="agentic"`) is rejected up front — CLI exit 2 before any browser work, since exit 28's "retry may land it" remediation would mislead for a driver that doesn't exist. The worker queue codec round-trips the new payload field (it previously decoded `ui_mode` for image payloads only).
+
+- **`gflow mcp run --no-spend` (#496).** Registration-time gating of the
+  credit-spending MCP tools: under the flag (or `GFLOW_MCP_NO_SPEND=1`, which
+  also covers `gflow serve`) the `gflow_generate_image` and
+  `gflow_generate_video` tools are never registered, so a connected agent
+  cannot even see them in `tools/list` — invisible beats refused (no wasted
+  calls, no refusal path for prompt injection to probe, no reliance on the
+  model honoring an error; pattern ported from teams-mcp's read-only mode).
+  Both generate tools are gated because image generation is only
+  *empirically* free and no-spend is a hard guarantee. Listing, instructions,
+  and other read-only tools stay available.
+- **MCP tool `gflow_auth_status` (#497).** A zero-required-arg, credit-free,
+  non-interactive Flow session probe wrapping the same fail-closed
+  `verify_flow_profile` check as `gflow auth status`. Agents call it before a
+  generation tool to fail fast on expired auth — the queue is async, so an
+  auth failure otherwise surfaces only later, from the daemon. Returns
+  `authenticated` + the verified email, or a problem-details envelope whose
+  `remediation_hint` points at the CLI login (or at retrying, for a network
+  `verification_error` that re-login cannot fix). `auth status` accordingly
+  moves out of the MCP parity exemptions; login/logout stay CLI-only.
+
+### Changed
+
+- **Agentic mode-switching hardened (#299 PR-B).** The agentic direction now uses the same real-click-first + `aria-pressed` verification discipline the classic direction has had since v0.38.x: `mode_control.ensure_agent_mode` replaces the transport's `_force_agent_mode`, which verified via the `tune` ligature (a documented false-positive source) and force-clicked unconditionally — a forced click can flip the DOM without firing the React handler that persists the server-side preference. Unknown editor variants (the #493 shape) no-op with a warning and are never blind-force-clicked, and the sanctioned mode-control reload carries an explicit 15 s timeout instead of riding Playwright's 30 s default outside every budget. KNOWN_ISSUES records the server-side cohort-pinning evidence (#338) the fail-fast design rests on.
+- **Video generation on an agentic cohort now fails fast pre-submit (#299 PR-A).** When Flow serves the agentic editor and classic can't be recovered, `gflow video` commands abort with `UiModeUnavailableError` (exit 28, zero credits, retryable — the cohort flaps per page load) *before* submission, instead of burning 30–40 s of doomed selector timeouts and dying mid-flow with exit 23/25.
+
+- **MCP `gflow://docs/known-issues` resource is now bounded (#501).** The old
+  resource returned all of KNOWN_ISSUES.md (~70 KB, growing every release) on
+  every read — pure context injection. The default read is now a small index
+  (issue titles + status + slugs, a few KB); one templated resource
+  (`gflow://docs/known-issues/{slug}`) serves a single issue's full text,
+  capped at 16 KB. No unbounded read path remains.
+
+### Fixed
+
+- **MCP response-contract breaches (#498).** Both generate tools now refuse
+  rate-limited calls with the same RFC 9457 problem-details envelope (the
+  image tool used a plain error string; the video tool's detail claimed a
+  nonexistent "1 request per 30 seconds" policy — the real brake is the
+  shared token bucket, capacity 8 / refill 1 per 20 s). `gflow_list_projects`
+  paginates honestly: a new `offset` parameter, plus `count`/`offset`/
+  `has_more`/`next_offset` in the response, replacing the hardcoded first
+  page whose `total` field reported the page size as the table total —
+  catalogs larger than `limit` were unreachable through MCP.
+
+- **Post-merge `/code-review` fixes for the #495–#501 wave.** The rate-limited
+  envelope is now built from the canonical `RateLimitError` (type
+  `…/errors/rate-limit`, `retryable`/`message` present) instead of a
+  hand-minted variant; `gflow_auth_status` labels a network
+  `verification_error` as `…/errors/verification-error` (503, retryable)
+  rather than `auth-expired` (401), so type-dispatching agents stop pushing
+  users into unnecessary re-logins, and its description no longer overclaims
+  "never opens a browser" (the cookie-decryption fallback may boot a headless
+  one); `gflow_list_projects` clamps `limit`/`offset` (a `limit<=0` call
+  previously produced an infinite `next_offset` loop and negative limits
+  reached SQLite as unbounded `LIMIT -1`); `--no-spend` gained a single
+  env-var parser (Click's `envvar` dual-parse meant `off` could disable the
+  flag yet enable the policy), an idempotent registration policy, a `serve`
+  flag, a `.env.template` row, and a no-spend-aware agent guide that no
+  longer instructs agents to call unregistered tools; the known-issues index
+  recognizes both documented `**Status:**` styles and caps the echoed slug in
+  unknown-slug replies (the last unbounded reflection path).
+
+### Removed
+
+- **MCP tool `gflow_list_characters` (#499).** It was a stub that always
+  answered `{"status": "ok", "characters": []}` — to an agent that reads as
+  "the user has no characters", an active lie that steered clients away from
+  real `@Name` references. The tool is gone from `tools/list`, the agent-guide
+  resource, and the parity table (`character list` is now an explicit parity
+  exemption). It returns only when it can serve real Flow-side data. Use
+  `gflow character list --project <id>` in the terminal meanwhile.
+
+### Security
+
+- **CI supply-chain hardening.** Every workflow now runs with a least-privilege token (`ci.yml` gained the top-level `permissions: contents: read` it was missing — the other eight already had one; gitleaks elevates `pull-requests: write` per-job); every `uses:` action across all nine workflows is pinned to a full commit SHA with a version comment (dependabot's `github-actions` group keeps pins fresh); the CI test jobs enforce a test-count floor via `scripts/ci/check_test_count.py` ("a green build that ran nothing is not green"); and `check_repo_hygiene.py` now fails on version disagreement between `pyproject.toml`, `__init__.py`, and `.codex-plugin/plugin.json`.
+- **Remaining in-workflow package installs pinned (Scorecard Pinned-Dependencies).** The Pages build now installs MkDocs Material with `pip install --require-hashes` from a compiled `website/requirements.txt`; the PR-triage sandbox image (`Dockerfile.triage`) pins its Node base by digest and installs the Claude Code CLI via `npm ci` from a committed lockfile instead of a floating `npm install -g`; the CI dependency audit pins its `pip-audit` tool version (the non-gating weekly `deps-watch` job deliberately keeps a floating pip-audit — fresh advisory tooling is its purpose). New dependabot entries (uv / npm / docker) keep all three sets of pins fresh. The remaining deliberate won't-fix Scorecard alerts (SAST, Fuzzing, CII Best Practices) are dismissed on the repo with recorded reasons.
+- **OpenSSF Scorecard self-run.** A new SHA-pinned `scorecard.yml` workflow (weekly + on push to `develop`) runs the OpenSSF Scorecard supply-chain checks with `publish_results: true`, feeding the public API/badge and the repo Security tab — enabled deliberately after the permissions/pinning hardening so the first published score reflects the hardened state. The score surfaces as a badge in the README and on the website index page, with a docs/SECURITY.md section explaining what it measures; `release.yml`/`pages.yml` write scopes moved from workflow level to the jobs that need them.
+
+
+## [0.56.0] — 2026-08-13
+
+### Added
+
+- **Once-a-day PyPI update notice (#479).** gflow now prints a one-line stderr notice when a newer version is on PyPI: cache-served (zero added latency — a stale cache refreshes on a background daemon thread for the next run), capped at one poll per day even when the poll fails, and never blocks or fails a command. Skipped in CI (`CI` env var), for editable/local-source installs (PEP 610 detection), and when `GFLOW_CLI_UPDATE_CHECK=0`.
+
+- **Opt-in bounded wait for profile-lease contention (#478).** `GFLOW_CLI_LEASE_WAIT_SECONDS=N` makes a command that hits same-profile contention poll the kernel lock (0.5 s cadence, sync and async call sites alike) and take over as soon as the current holder — a CLI command or a `gflow serve` daemon queue task, both of which release at their natural end — finishes; on timeout it raises the same `ProfileLockedError` (exit 11). Default `0` keeps the historical fail-fast. Triage note: the issue's fuller cooperative-handoff protocol (release-request channel, minimum-hold window) was validated against the actual architecture and dropped — the daemon acquires the lease per task, so every holder's safe release point already coincides with lease release; holders are never asked to release early, which satisfies the no-release-mid-call requirement by construction. Same-process contention always fails fast (waiting on yourself deadlocks).
+
+- **Chromium downgrade guard for persisted profiles (#477).** Opening a profile with an older Chromium major version than last wrote it triggers Chromium's downgrade cleanup, which can shred the newer session store and surface as a mystery post-upgrade logout. Every bundled-Chromium open of a persisted profile (generation client, UI-automation transport, the experimental transports, headless verification probe) now compares the profile's `Last Version` against the active engine's bundled Chromium (`playwright`, or `patchright` when selected) and refuses on a major-version downgrade (`ProfileEngineDowngradeError`, exit 11; the fail-closed verification probe reports it as a verification failure) with an error naming both versions and the remedy. Best-effort: `chrome`-strategy profiles and unknown/unparseable versions skip the check; same-major build rollbacks are allowed; `gflow auth login` stays unguarded as the recovery path.
+
+### Fixed
+
+- **Mode-switch drift errors now name the right evidence (#493).** An external
+  report showed a third, unrecognized Flow editor layout (composer frame slots +
+  Agent toggle, no classic `crop_*` settings button) falling through to
+  `UiSelectorDriftError` (exit 23). The fall-through detail now states that no
+  known Flow cohort matched — i.e. the editor may be a new layout this version
+  does not recognize — and the class remediation no longer asks for a "debug
+  screenshot from this message" that the mode-switch probe never writes: it
+  points at the artifacts that actually exist (the PII-safe
+  `diag_mode_switch_miss.json` DOM signature and/or the referenced screenshot,
+  plus the incident bundle's `report.md`). Recognizing the new variant itself is
+  tracked in #493 and needs an affected account's diagnostics JSON. A post-merge
+  `/code-review` pass extended the same correction to the neighboring surfaces it
+  had missed: `FlowAgentUiError`'s privacy caveat now also covers the standalone
+  `debug_forced_agent_ui.png` its raise site writes, and the KNOWN_ISSUES
+  fallback points at the incident bundle's `ui.json` (which carries the DOM
+  signature) instead of `report.md` (which does not).
+
 ## [0.55.0] — 2026-08-13
 
 ### Added
@@ -2796,7 +2910,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.55.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...HEAD
+[0.57.0]: https://github.com/ffroliva/gflow-cli/compare/v0.56.0...v0.57.0
+[0.56.0]: https://github.com/ffroliva/gflow-cli/compare/v0.55.0...v0.56.0
 [0.55.0]: https://github.com/ffroliva/gflow-cli/compare/v0.54.0...v0.55.0
 [0.54.0]: https://github.com/ffroliva/gflow-cli/compare/v0.53.1...v0.54.0
 [0.53.1]: https://github.com/ffroliva/gflow-cli/compare/v0.53.0...v0.53.1

{gflow_cli-0.55.0 → gflow_cli-0.57.0}/CONFIGURATION.md

@@ -7,7 +7,9 @@
 | `GFLOW_CLI_HOME` | Platform data dir | Root directory for profiles and config. |
 | `GFLOW_CLI_OUTPUT_DIR` | `~/Downloads/gflow-cli` | Where generated images and videos are saved. |
 | `CHROME_BINARY` | (autodetect) | Override Chrome binary path. Falls back to platform-standard locations. |
-| `GFLOW_CLI_CONCURRENCY` | `4` | Maximum parallel API requests per batch. |
+| `GFLOW_CLI_CONCURRENCY` | `1` | Page-pool size per batch (raising above 1 currently has no effect — see [docs/CONFIGURATION.md](docs/CONFIGURATION.md)). |
+| `GFLOW_CLI_UPDATE_CHECK` | `1` | Once-a-day stderr notice when a newer gflow-cli is on PyPI; `0` disables (v0.56.0). |
+| `GFLOW_CLI_LEASE_WAIT_SECONDS` | `0` | Bounded wait on same-profile lease contention instead of fail-fast (v0.56.0). |
 | `GFLOW_CLI_LLM_BASE_URL` | Google compat endpoint | OpenAI-compatible endpoint for the prompt tools (`--tool`). The on/off switch. |
 | `GFLOW_CLI_LLM_API_KEY` | _(unset)_ | Credential for that endpoint. Optional — omit for a keyless local gateway. [Google key](https://aistudio.google.com/apikey). |
 | `GFLOW_CLI_LLM_MODEL` | _(unset)_ | Model, and therefore the provider selector. Unset = the gateway chooses. |