gflow-cli 0.56.0__tar.gz → 0.57.1__tar.gz

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.56.0",
+  "version": "0.57.1",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.env.template

@@ -143,6 +143,11 @@
 # editable/source installs. Set to 0 to disable.
 # GFLOW_CLI_UPDATE_CHECK=1
 
+# MCP no-spend mode (#496): when set to 1, the MCP server (gflow mcp run AND
+# gflow serve) never registers the credit-spending generate tools — agents
+# cannot see them in tools/list. Equivalent to the --no-spend flag.
+# GFLOW_MCP_NO_SPEND=0
+
 # Run Playwright in headless mode for non-`auth login` commands (true|false).
 # Default: false — headed real Chrome is the PRODUCTION default, not a
 # fallback. The ui_automation transport (the only production transport)

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/dependabot.yml

@@ -110,3 +110,47 @@ updates:
       github-actions:
         applies-to: version-updates
         patterns: ["*"]
+
+  # npm — the PR-triage sandbox's pinned Claude Code CLI
+  # (scripts/autopilot/package-lock.json, installed via `npm ci` in
+  # Dockerfile.triage).
+  - package-ecosystem: "npm"
+    directory: "/scripts/autopilot"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+
+  # Docker — the digest-pinned node:20-slim base of Dockerfile.triage.
+  - package-ecosystem: "docker"
+    directory: "/scripts/autopilot"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+
+  # uv — the hash-pinned MkDocs set for the Pages build
+  # (website/requirements.txt, compiled from website/requirements.in).
+  # "uv", NOT "pip", for the same reason as the root entry: the pip ecosystem
+  # would regenerate the file with pip-compile, clobbering the uv-authored
+  # header/format; dependabot's uv ecosystem recompiles .in → .txt via
+  # `uv pip compile` and keeps the hashes.
+  - package-ecosystem: "uv"
+    directory: "/website"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+      - "python"

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/ci.yml

@@ -5,6 +5,11 @@ on:
     branches: [develop, main]
   pull_request:
 
+# Least-privilege default token for every job (OpenSSF Scorecard:
+# Token-Permissions). Jobs that need more elevate per-job below.
+permissions:
+  contents: read
+
 env:
   # Suppress Node.js deprecation warnings and align with user request to use Node 22/remove noise.
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
@@ -15,13 +20,16 @@ jobs:
   secrets-scan:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # gitleaks-action PR feedback comments
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0  # full history so gitleaks can diff against base
 
       - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v3
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -30,9 +38,9 @@ jobs:
     name: Dependency audit (pip-audit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       - name: Audit locked dependencies for known CVEs
         # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
         #
@@ -45,7 +53,9 @@ jobs:
         # alerts flagged them against uv.lock; this gate could not see them.
         run: |
           uv export --frozen --all-extras --format requirements-txt --no-emit-project > requirements-audit.txt
-          uvx pip-audit -r requirements-audit.txt
+          # pip-audit version pinned for a reproducible gate (uvx has no
+          # dependabot ecosystem — bump by hand when it drifts).
+          uvx pip-audit==2.10.1 -r requirements-audit.txt
 
   # ── Supply-chain gate: resolve WITHOUT the lockfile ───────────────────────
   # Every other job installs via `uv sync`, which honours uv.lock. That means CI
@@ -62,10 +72,10 @@ jobs:
     name: Dependency resolution drift (no lockfile)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -116,10 +126,10 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}
@@ -152,12 +162,17 @@ jobs:
         # e2e/live tests require a logged-in Chromium profile and may spend
         # Flow credits. pyproject.toml excludes both markers by default; CI
         # intentionally relies on that default smoke set.
-        run: uv run python -m pytest -q --cov=gflow_cli --cov-report=xml
+        run: uv run python -m pytest -q --cov=gflow_cli --cov-report=xml --junitxml=pytest-report.xml
+
+      - name: Test-count guard (a green build that ran nothing is not green)
+        # Floor well below the real count (~2900): catches collection collapse
+        # (bad marker/-k filter, broken conftest), never routine deletions.
+        run: uv run python scripts/ci/check_test_count.py pytest-report.xml 2000
 
       # Upload coverage XML so the sonar job can consume it
       - name: Upload coverage report
         if: matrix.python-version == '3.11'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage-xml
           path: coverage.xml
@@ -180,10 +195,10 @@ jobs:
       matrix:
         os: [windows-latest, macos-latest, ubuntu-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -192,13 +207,21 @@ jobs:
         run: uv sync --extra dev
 
       - name: ProfileLease unit + subprocess tests
-        run: uv run python -m pytest tests/test_profile_lease.py tests/test_profile_lease_subprocess.py -q
+        run: uv run python -m pytest tests/test_profile_lease.py tests/test_profile_lease_subprocess.py -q --junitxml=pytest-lease.xml
+
+      - name: Test-count guard (lease matrix ran its suite)
+        # Floor well below the ~29 executed per OS leg — catches collapse, not
+        # routine test consolidation.
+        run: uv run python scripts/ci/check_test_count.py pytest-lease.xml 10
 
   # ── SonarCloud analysis ───────────────────────────────────────────────────
   sonar:
     name: SonarCloud analysis
     runs-on: ubuntu-latest
     needs: test   # wait for tests + coverage report
+    permissions:
+      contents: read
+      pull-requests: read  # PR-context analysis / decoration lookups
     # Forked pull_request runs do not receive repository secrets, so SONAR_TOKEN
     # is empty there and the scanner fails before analysis. Dependabot-triggered
     # runs are the same case: GitHub serves them the separate Dependabot secrets
@@ -212,12 +235,12 @@ jobs:
         github.event.pull_request.head.repo.full_name == github.repository
       )
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0  # shallow clones break blame / new-code detection
 
       - name: Download coverage report
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: coverage-xml
         continue-on-error: true  # graceful if coverage upload was skipped
@@ -242,7 +265,12 @@ jobs:
 
       - name: SonarCloud scan
         if: steps.sonarcloud_health.outputs.up == 'true'
-        uses: SonarSource/sonarcloud-github-action@v5.0.0
+        # sonarcloud-github-action is ARCHIVED upstream (dependabot never bumps
+        # archived actions, so its pin would rot silently); sonarqube-scan-action
+        # is SonarSource's maintained successor and serves SonarCloud when
+        # SONAR_HOST_URL points at it.
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # PR decoration
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}    # set in repo → Settings → Secrets
+          SONAR_HOST_URL: https://sonarcloud.io

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/deps-watch.yml

@@ -28,10 +28,10 @@ jobs:
     name: Audit + report upgradable dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -43,6 +43,9 @@ jobs:
           # anything reachable solely through an optional extra goes unaudited.
           # See the matching note in ci.yml — this is how aiohttp/pyasn1 hid.
           uv export --frozen --all-extras --format requirements-txt --no-emit-project > requirements-audit.txt
+          # pip-audit deliberately floats here (unlike the pinned gate in
+          # ci.yml): this weekly watch job never gates a merge, and fresh
+          # advisory tooling is exactly what it is for.
           uvx pip-audit -r requirements-audit.txt
 
       # ── The reports: never fail the run, and still run when the audit fails

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/external-pr-triage.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Triage external pull request
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const pr = context.payload.pull_request;

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/governance-advisory.yml

@@ -19,12 +19,12 @@ jobs:
     name: Materiality + traceability (advisory)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # full history so `git diff origin/<base>..HEAD` resolves
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Classify touched paths (advisory, never blocks)
         run: |

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/governance-benchmark.yml

@@ -18,12 +18,12 @@ jobs:
     name: Materiality gate backtest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # full history — the backtest replays every commit
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Run backtest (advisory; writes to job summary)
         run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY"

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/labels.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create or update labels
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             // Every label referenced by .github/dependabot.yml. Keep in sync.

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/main-base-guard.yml

@@ -30,7 +30,7 @@ jobs:
     name: Release must carry /gflow:release artifacts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Verify release artifacts
         env:
           BASE_REF: ${{ github.base_ref }}

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/pages.yml

@@ -12,10 +12,10 @@ on:
       - ".github/workflows/pages.yml"
   workflow_dispatch:
 
+# Write scopes live at JOB level on the deploy job only (Scorecard
+# Token-Permissions: workflow-level write would grant the build job too).
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Never cancel an in-progress deploy; queue instead.
 concurrency:
@@ -26,12 +26,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
       - name: Install MkDocs Material
-        run: pip install "mkdocs-material>=9,<10"
+        # Hash-pinned (Scorecard Pinned-Dependencies). Compiled from
+        # website/requirements.in — regeneration command in that file's header.
+        run: pip install --require-hashes -r website/requirements.txt
       - name: Build docs portal
         working-directory: website
         run: mkdocs build
@@ -40,16 +42,19 @@ jobs:
           mkdir -p _site
           cp index.html _site/
           cp -r website/site _site/docs
-      - uses: actions/upload-pages-artifact@v5
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: _site
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write # actual Pages deployment
+      id-token: write # OIDC handshake with the Pages service
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.github/workflows/release.yml

@@ -5,13 +5,17 @@ on:
     tags:
       - "v*.*.*"
 
+# Write scopes live at JOB level (Scorecard Token-Permissions: workflow-level
+# write grants every job — current and future — the elevated token).
 permissions:
-  contents: write       # for creating GitHub Releases
-  id-token: write       # for PyPI Trusted Publishing (OIDC)
+  contents: read
 
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for creating GitHub Releases
+      id-token: write # for PyPI Trusted Publishing (OIDC)
     environment:
       name: pypi
       url: https://pypi.org/p/gflow-cli
@@ -19,12 +23,12 @@ jobs:
       ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
       NODE_VERSION: '22'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set up Python
         run: uv python install 3.12
@@ -57,12 +61,12 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         # No api-token needed — uses OIDC Trusted Publishing.
         # Configure once at https://pypi.org/manage/account/publishing/
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           generate_release_notes: true
           files: dist/*

gflow_cli-0.57.1/.github/workflows/scorecard.yml

@@ -0,0 +1,52 @@
+name: OpenSSF Scorecard
+
+# Self-run of the OpenSSF Scorecard supply-chain checks (T2 batch decision,
+# 2026-08-13). Deliberately enabled AFTER the permissions + SHA-pinning
+# hardening landed, so the first published public score reflects the hardened
+# state — Token-Permissions and Pinned-Dependencies are heavily weighted.
+# publish_results feeds the public API/badge:
+#   https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge
+
+on:
+  # Re-evaluates the Branch-Protection check when protection rules change.
+  branch_protection_rule:
+  schedule:
+    - cron: "30 3 * * 1" # weekly, Monday 03:30 UTC
+  push:
+    branches: [develop] # default branch — required for publish_results
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload the SARIF to the Security tab
+      id-token: write # OIDC identity for publish_results signing
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Publishing makes the score available via the public API and badge.
+          # The repo is public; every input to the score already is too.
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        with:
+          sarif_file: results.sarif

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/.gitignore

@@ -19,6 +19,7 @@ pytest-of-*/
 .coverage
 .coverage.*
 coverage.xml
+pytest-*.xml
 htmlcov/
 .tox/
 .mypy_cache/
@@ -98,3 +99,6 @@ worktrees/
 
 # MkDocs build output
 website/site/
+
+# Local git hooks dir (core.hooksPath target) — machine-local tooling, never shipped
+.githooks/

{gflow_cli-0.56.0 → gflow_cli-0.57.1}/CHANGELOG.md

@@ -7,6 +7,158 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.57.1] — 2026-08-14
+
+### Fixed
+
+- **`gflow video`/`image` can no longer get stuck behind Flow's expanded chat
+  sidebar (#493).** Expanding the sidebar removes the classic composer
+  **entirely** — no `crop_*` settings trigger *and* no Agent pill — which is
+  exactly the fingerprint reported in #493 ("no `crop_*` settings button", "the
+  Agente pill matches neither selector"). It also explains the exit code: with
+  no agentic indicator on screen either, the cohort detector matches nothing, so
+  the run dies as `UiSelectorDriftError` (exit 23) instead of the retryable
+  agentic error (25). Recovery hinged on a single selector scoped to the
+  sidebar's `edit_square` affordance; a cohort whose sidebar lacks that ligature
+  never found the X, so the sidebar never closed and the composer never came
+  back. `ensure_media_mode` now falls back to an unscoped close **only** from
+  the demonstrably stuck state (no `crop_*` **and** no pill), where the classic
+  composer is gone and there is nothing else a close button could belong to.
+  Reproduced live and A/B-proven: with the scoped selector neutered the fallback
+  recovers; with both neutered it does not.
+
+- **`--duration` now fails fast instead of masquerading as UI drift (#451, #288).**
+  Flow's video settings popover is **model-conditional**: only `omni-flash` renders
+  a `4s/6s/8s/10s` row, and the Veo 3.1 models render **no duration control at all**
+  — verified live on two accounts and two locales. `api/video.py` had claimed "the
+  four `VEO_3_1_*` models cap at 8s", which presumed a control that is never drawn,
+  so `_select_video_duration` hunted a missing element and died with
+  `UiSelectorDriftError` (exit 23) after ~30 s. That is why the bug reproduced
+  identically on playwright 1.59 and 1.61 (the version bound was correctly
+  exonerated) and why the locale hypothesis was refuted — it was never either.
+  `--duration` with a Veo model now exits **2 before any browser work**, naming the
+  model and the fix. New `VideoModel.supports_duration()`; the DTO guards it too, for
+  API callers.
+- **`--reference-entity` no longer advertised on `video i2v`, where it always failed.**
+  The flag was registered on `t2v`/`i2v`/`r2v`, but `_validate_i2v_symmetry` rejects
+  reference entities on i2v — so the i2v form raised for every caller who believed
+  the help text. It is now applied to `t2v`/`r2v` only. The reverse error was in the
+  docs: `REFERENCE_STRATEGIES.md`, `USAGE.md` and the `t2v` help text all stated "the
+  video path has no `--reference-entity` flag" while `cli_video.py` registered it —
+  corrected in all four places.
+- **A named remote reference that isn't in the picker now raises a typed error.**
+  `--ref-name` searches Flow's picker, which indexes Flow's own short auto-caption —
+  not the generation prompt — so a prompt passed as `--ref-name` surfaced as a bare
+  Playwright `TimeoutError` after 8 s, with no exit code to branch on and no hint
+  that the *name* was the problem. Now `ReferenceNotFoundError` (**exit 32**), listing
+  what the picker actually offered.
+- `reference_cap_for` now records the live-verified ingredient rule it already
+  encoded: `veo-quality` refuses image ingredients (Flow: "You cannot use image
+  ingredients with this model") while Omni Flash / Fast / Lite accept them, and a cap
+  of 0 *is* the answer to "does this model take ingredients?". Deliberately no second
+  predicate — one was written, found to have no production caller, and deleted.
+
+- **MCP `gflow_generate_image` `ui_mode` now matches the video tool's contract.**
+  The image tool rejected an unknown `ui_mode` with a flat `error` **string**, so a
+  client reading `error["title"]` — the RFC 9457 shape every other 400 from these
+  tools uses since #498 — crashed with `TypeError: string indices must be integers`.
+  It was also case-sensitive, while the CLI's `--ui-mode` is
+  `click.Choice(case_sensitive=False)` and the video tool normalizes. Both are fixed:
+  the value is lower-cased and an invalid one returns the standard problem-details
+  envelope. Found by `/code-review` against docs that asserted the param "mirrors the
+  CLI" — it did not.
+- **`GFLOW_MCP_NO_SPEND` documentation corrected (no behavior change).**
+  [CONFIGURATION](docs/CONFIGURATION.md) described the falsy set as a literal lowercase
+  list, so a reader setting `GFLOW_MCP_NO_SPEND=FALSE` would conclude no-spend was
+  **on** when the value is lower-cased before comparison and it is **off**. On the one
+  variable whose purpose is a hard guarantee against spending credits, the wrong
+  reading failed toward spending. Now states the match is case-insensitive.
+
+## [0.57.0] — 2026-08-14
+
+### Added
+
+- **`--ui-mode` on `gflow video t2v`/`i2v` + `ui_mode` on MCP `gflow_generate_video` (#299 PR-A).** The video path joins the UI-mode policy that images have had since v0.34.0: the transport now binds its driver through `get_ui_driver` (after editor mount + overlay dismissal) instead of a hardcoded classic bind. Video only has a classic driver, so `auto` ≡ `classic`; an env-sourced `GFLOW_CLI_UI_MODE=agentic` (set for image workflows) degrades to classic with a logged warning, while the explicit `--ui-mode agentic` flag (or MCP `ui_mode="agentic"`) is rejected up front — CLI exit 2 before any browser work, since exit 28's "retry may land it" remediation would mislead for a driver that doesn't exist. The worker queue codec round-trips the new payload field (it previously decoded `ui_mode` for image payloads only).
+
+- **`gflow mcp run --no-spend` (#496).** Registration-time gating of the
+  credit-spending MCP tools: under the flag (or `GFLOW_MCP_NO_SPEND=1`, which
+  also covers `gflow serve`) the `gflow_generate_image` and
+  `gflow_generate_video` tools are never registered, so a connected agent
+  cannot even see them in `tools/list` — invisible beats refused (no wasted
+  calls, no refusal path for prompt injection to probe, no reliance on the
+  model honoring an error; pattern ported from teams-mcp's read-only mode).
+  Both generate tools are gated because image generation is only
+  *empirically* free and no-spend is a hard guarantee. Listing, instructions,
+  and other read-only tools stay available.
+- **MCP tool `gflow_auth_status` (#497).** A zero-required-arg, credit-free,
+  non-interactive Flow session probe wrapping the same fail-closed
+  `verify_flow_profile` check as `gflow auth status`. Agents call it before a
+  generation tool to fail fast on expired auth — the queue is async, so an
+  auth failure otherwise surfaces only later, from the daemon. Returns
+  `authenticated` + the verified email, or a problem-details envelope whose
+  `remediation_hint` points at the CLI login (or at retrying, for a network
+  `verification_error` that re-login cannot fix). `auth status` accordingly
+  moves out of the MCP parity exemptions; login/logout stay CLI-only.
+
+### Changed
+
+- **Agentic mode-switching hardened (#299 PR-B).** The agentic direction now uses the same real-click-first + `aria-pressed` verification discipline the classic direction has had since v0.38.x: `mode_control.ensure_agent_mode` replaces the transport's `_force_agent_mode`, which verified via the `tune` ligature (a documented false-positive source) and force-clicked unconditionally — a forced click can flip the DOM without firing the React handler that persists the server-side preference. Unknown editor variants (the #493 shape) no-op with a warning and are never blind-force-clicked, and the sanctioned mode-control reload carries an explicit 15 s timeout instead of riding Playwright's 30 s default outside every budget. KNOWN_ISSUES records the server-side cohort-pinning evidence (#338) the fail-fast design rests on.
+- **Video generation on an agentic cohort now fails fast pre-submit (#299 PR-A).** When Flow serves the agentic editor and classic can't be recovered, `gflow video` commands abort with `UiModeUnavailableError` (exit 28, zero credits, retryable — the cohort flaps per page load) *before* submission, instead of burning 30–40 s of doomed selector timeouts and dying mid-flow with exit 23/25.
+
+- **MCP `gflow://docs/known-issues` resource is now bounded (#501).** The old
+  resource returned all of KNOWN_ISSUES.md (~70 KB, growing every release) on
+  every read — pure context injection. The default read is now a small index
+  (issue titles + status + slugs, a few KB); one templated resource
+  (`gflow://docs/known-issues/{slug}`) serves a single issue's full text,
+  capped at 16 KB. No unbounded read path remains.
+
+### Fixed
+
+- **MCP response-contract breaches (#498).** Both generate tools now refuse
+  rate-limited calls with the same RFC 9457 problem-details envelope (the
+  image tool used a plain error string; the video tool's detail claimed a
+  nonexistent "1 request per 30 seconds" policy — the real brake is the
+  shared token bucket, capacity 8 / refill 1 per 20 s). `gflow_list_projects`
+  paginates honestly: a new `offset` parameter, plus `count`/`offset`/
+  `has_more`/`next_offset` in the response, replacing the hardcoded first
+  page whose `total` field reported the page size as the table total —
+  catalogs larger than `limit` were unreachable through MCP.
+
+- **Post-merge `/code-review` fixes for the #495–#501 wave.** The rate-limited
+  envelope is now built from the canonical `RateLimitError` (type
+  `…/errors/rate-limit`, `retryable`/`message` present) instead of a
+  hand-minted variant; `gflow_auth_status` labels a network
+  `verification_error` as `…/errors/verification-error` (503, retryable)
+  rather than `auth-expired` (401), so type-dispatching agents stop pushing
+  users into unnecessary re-logins, and its description no longer overclaims
+  "never opens a browser" (the cookie-decryption fallback may boot a headless
+  one); `gflow_list_projects` clamps `limit`/`offset` (a `limit<=0` call
+  previously produced an infinite `next_offset` loop and negative limits
+  reached SQLite as unbounded `LIMIT -1`); `--no-spend` gained a single
+  env-var parser (Click's `envvar` dual-parse meant `off` could disable the
+  flag yet enable the policy), an idempotent registration policy, a `serve`
+  flag, a `.env.template` row, and a no-spend-aware agent guide that no
+  longer instructs agents to call unregistered tools; the known-issues index
+  recognizes both documented `**Status:**` styles and caps the echoed slug in
+  unknown-slug replies (the last unbounded reflection path).
+
+### Removed
+
+- **MCP tool `gflow_list_characters` (#499).** It was a stub that always
+  answered `{"status": "ok", "characters": []}` — to an agent that reads as
+  "the user has no characters", an active lie that steered clients away from
+  real `@Name` references. The tool is gone from `tools/list`, the agent-guide
+  resource, and the parity table (`character list` is now an explicit parity
+  exemption). It returns only when it can serve real Flow-side data. Use
+  `gflow character list --project <id>` in the terminal meanwhile.
+
+### Security
+
+- **CI supply-chain hardening.** Every workflow now runs with a least-privilege token (`ci.yml` gained the top-level `permissions: contents: read` it was missing — the other eight already had one; gitleaks elevates `pull-requests: write` per-job); every `uses:` action across all nine workflows is pinned to a full commit SHA with a version comment (dependabot's `github-actions` group keeps pins fresh); the CI test jobs enforce a test-count floor via `scripts/ci/check_test_count.py` ("a green build that ran nothing is not green"); and `check_repo_hygiene.py` now fails on version disagreement between `pyproject.toml`, `__init__.py`, and `.codex-plugin/plugin.json`.
+- **Remaining in-workflow package installs pinned (Scorecard Pinned-Dependencies).** The Pages build now installs MkDocs Material with `pip install --require-hashes` from a compiled `website/requirements.txt`; the PR-triage sandbox image (`Dockerfile.triage`) pins its Node base by digest and installs the Claude Code CLI via `npm ci` from a committed lockfile instead of a floating `npm install -g`; the CI dependency audit pins its `pip-audit` tool version (the non-gating weekly `deps-watch` job deliberately keeps a floating pip-audit — fresh advisory tooling is its purpose). New dependabot entries (uv / npm / docker) keep all three sets of pins fresh. The remaining deliberate won't-fix Scorecard alerts (SAST, Fuzzing, CII Best Practices) are dismissed on the repo with recorded reasons.
+- **OpenSSF Scorecard self-run.** A new SHA-pinned `scorecard.yml` workflow (weekly + on push to `develop`) runs the OpenSSF Scorecard supply-chain checks with `publish_results: true`, feeding the public API/badge and the repo Security tab — enabled deliberately after the permissions/pinning hardening so the first published score reflects the hardened state. The score surfaces as a badge in the README and on the website index page, with a docs/SECURITY.md section explaining what it measures; `release.yml`/`pages.yml` write scopes moved from workflow level to the jobs that need them.
+
+
 ## [0.56.0] — 2026-08-13
 
 ### Added
@@ -2825,7 +2977,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.56.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...HEAD
+[0.57.1]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...v0.57.1
+[0.57.0]: https://github.com/ffroliva/gflow-cli/compare/v0.56.0...v0.57.0
 [0.56.0]: https://github.com/ffroliva/gflow-cli/compare/v0.55.0...v0.56.0
 [0.55.0]: https://github.com/ffroliva/gflow-cli/compare/v0.54.0...v0.55.0
 [0.54.0]: https://github.com/ffroliva/gflow-cli/compare/v0.53.1...v0.54.0