gflow-cli 0.58.0__tar.gz → 0.60.0__tar.gz

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.env.template

@@ -143,6 +143,13 @@
 # editable/source installs. Set to 0 to disable.
 # GFLOW_CLI_UPDATE_CHECK=1
 
+# Whether generation prompts (and the prompt-derived display names used as the
+# picker search key) are stored in the local catalog — store | redacted.
+# Under 'redacted', `gflow doctor` reports missing display names as info
+# (backfill is deliberately suppressed) instead of warn, and name backfill via
+# `gflow data sync --names` requires switching back to 'store' first.
+# GFLOW_CLI_HISTORY_PROMPTS=store
+
 # MCP no-spend mode (#496): when set to 1, the MCP server (gflow mcp run AND
 # gflow serve) never registers the credit-spending generate tools — agents
 # cannot see them in tools/list. Equivalent to the --no-spend flag.

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/ci.yml

@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0  # full history so gitleaks can diff against base
 
       - name: Run gitleaks
@@ -39,8 +40,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Audit locked dependencies for known CVEs
         # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
         #
@@ -57,6 +60,42 @@ jobs:
           # dependabot ecosystem — bump by hand when it drifts).
           uvx pip-audit==2.10.1 -r requirements-audit.txt
 
+  # ── Security gate: static analysis of the workflows themselves ───────────
+  # Everything else in this file audits the Python we ship. Nothing audited the
+  # CI that ships it, and CI is a supply-chain surface in its own right: it
+  # holds a repository token, it publishes to PyPI, and its inputs (branch
+  # names, PR titles, fork content) are attacker-controllable text.
+  #
+  # zizmor is what turns that into a gate. It found real defects on its first
+  # run over this repo (#565): 12 checkouts persisting the job token into the
+  # workspace, and `${{ github.base_ref }}` interpolated straight into a
+  # governance-advisory shell script. Both are fixed; this job is what stops
+  # them coming back one copy-pasted step at a time.
+  workflow-audit:
+    name: Workflow audit (zizmor)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+
+      - name: Audit workflows (zizmor)
+        # --offline: the online audits need a GH token and reach the network, so
+        #   they would make this gate non-deterministic and unrunnable on fork
+        #   PRs. Action freshness/pinning is already covered by Dependabot plus
+        #   Scorecard's Pinned-Dependencies check.
+        # --min-severity low: informational findings are advisory, not defects.
+        #   The one open today is `superfluous-actions` on
+        #   softprops/action-gh-release; rewriting the release publisher is not
+        #   a hardening change and is deliberately declined (docs/GITHUB.md).
+        # Version pinned for a reproducible gate — uvx has no Dependabot
+        # ecosystem, so bump it by hand (the pin is asserted by
+        # tests/scripts/test_workflow_hardening.py, which fails if the two drift).
+        run: uvx zizmor==1.29.0 --offline --min-severity low .github/workflows/
+
   # ── Supply-chain gate: resolve WITHOUT the lockfile ───────────────────────
   # Every other job installs via `uv sync`, which honours uv.lock. That means CI
   # never exercises the version RANGES in pyproject.toml — the exact blind spot
@@ -73,9 +112,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install 3.13
@@ -127,18 +168,24 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}
 
+      # --frozen: install from the committed uv.lock without re-resolving it.
+      # Plain `uv sync` REWRITES uv.lock in place, which would silently repair
+      # the exact version drift the hygiene gate below exists to catch.
       - name: Install deps
-        run: uv sync --extra dev
+        run: uv sync --frozen --extra dev
 
-      - name: Repo hygiene (no artefacts, no hardcoded paths)
-        run: uv run python scripts/ci/check_repo_hygiene.py
+      # --no-sync for the same reason: `uv run` re-locks before running.
+      - name: Repo hygiene (no artefacts, no hardcoded paths, version lockstep)
+        run: uv run --no-sync python scripts/ci/check_repo_hygiene.py
 
       - name: Documentation links
         run: uv run python scripts/ci/check_doc_links.py
@@ -196,9 +243,11 @@ jobs:
         os: [windows-latest, macos-latest, ubuntu-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install 3.13
@@ -237,6 +286,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0  # shallow clones break blame / new-code detection
 
       - name: Download coverage report

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/deps-watch.yml

@@ -29,9 +29,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Set up Python
         run: uv python install 3.13

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/external-pr-triage.yml

@@ -1,7 +1,15 @@
 name: External PR Triage
 
+# `pull_request_target` is deliberate and is the reason this file is the
+# highest-risk surface in the repo: labelling a fork's PR needs a token forks
+# cannot be given, and `pull_request` does not have one. The trigger is only
+# unsafe when the workflow CHECKS OUT or EXECUTES the untrusted head — this one
+# never does: there is no `actions/checkout` step at all, every PR field is read
+# from `context.payload` inside github-script, and permissions are scoped to
+# `issues`/`pull-requests` write. Keep all three properties or drop the
+# suppression with them.
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, reopened, synchronize, ready_for_review, edited]
 
 permissions:

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/governance-advisory.yml

@@ -21,13 +21,21 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0 # full history so `git diff origin/<base>..HEAD` resolves
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Classify touched paths (advisory, never blocks)
+        # BASE_REF arrives through `env:`, never interpolated into the script
+        # body: a branch name is attacker-supplied text, and `${{ ... }}` is
+        # substituted before the shell ever sees it (zizmor: template-injection).
+        # The fetch is belt-and-braces — `fetch-depth: 0` above already brings
+        # the base branch down — and needs no credential on a public repo.
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: |
-          git fetch --no-tags origin "${{ github.base_ref }}" || true
+          git fetch --no-tags origin "$BASE_REF" || true
           uv run python scripts/ci/check_materiality.py \
-            --base "origin/${{ github.base_ref }}"
+            --base "origin/$BASE_REF"

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/governance-benchmark.yml

@@ -20,10 +20,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0 # full history — the backtest replays every commit
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Run backtest (advisory; writes to job summary)
         run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY"

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/main-base-guard.yml

@@ -31,6 +31,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Verify release artifacts
         env:
           BASE_REF: ${{ github.base_ref }}

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/pages.yml

@@ -27,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/release.yml

@@ -25,10 +25,17 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # This is the one workflow that publishes artefacts (PyPI + GitHub
+          # Release), so it must not restore a cache any other workflow can
+          # write: a poisoned entry would reach a signed release. Releases are
+          # rare; the cold resolve costs seconds (zizmor: cache-poisoning).
+          enable-cache: false
 
       - name: Set up Python
         run: uv python install 3.12

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/.github/workflows/scorecard.yml

@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           sarif_file: results.sarif

gflow_cli-0.60.0/.github/workflows/selector-probe.yml

@@ -0,0 +1,26 @@
+name: Selector drift probe
+
+on:
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.repository == 'ffroliva/gflow-cli'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with: { persist-credentials: false }
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - run: uv sync --frozen
+      - run: uv run playwright install chromium --with-deps
+      - name: Probe
+        env:
+          GFLOW_CI_SESSION_TOKEN: ${{ secrets.GFLOW_CI_SESSION_TOKEN }}
+          GFLOW_CI_PROJECT_ID: ${{ secrets.GFLOW_CI_PROJECT_ID }}
+        run: uv run python scripts/probe/run_probe.py --surface editor

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/AGENTS.md

@@ -58,7 +58,7 @@ Or invoke the wrapper: `/gflow:check`.
 
 - Type hints everywhere; `pyright` strict on `src/gflow_cli`.
 - Structured logging only (`structlog`) — **never** raw `print()` or `import logging` in `src/`.
-- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–31, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping.
+- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–31, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
 - 100-char line length, `ruff` configured. Imports sorted by `ruff` (isort rules).
 - **YAGNI / least-code**: prefer the smallest change that works. No speculative abstractions (interface/factory with one implementation), no config or flags nobody sets, no dead constants/helpers, no reinventing the stdlib. Review carries this as its own lens — the **D14 over-engineering** dimension of [`pr-council-review`](skills/pr-council-review/SKILL.md) (baseline, always runs). Its rubric is portable; the `ponytail` plugin (see CONTRIBUTING) is an optional accelerant, not a dependency.
 - **MCP & CLI Schema Symmetry**: Any updates or additions to user-facing CLI command parameters (e.g., `gflow image t2i`, `gflow video`) must be mirrored in the corresponding MCP tool definitions. Never add option/argument fields to Click commands without updating the MCP server implementation. This symmetry is enforced programmatically in CI via `tests/mcp/test_cli_parity.py` (every CLI leaf command needs a mapped MCP tool or an explicit, reasoned exemption) plus the schema checks in `tests/mcp/test_server.py`.

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/CHANGELOG.md

@@ -7,6 +7,140 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.60.0] — 2026-08-25
+
+### Added
+
+- **Selector registry + nightly CI drift probe
+  ([#404](https://github.com/ffroliva/gflow-cli/issues/404),
+  [#493](https://github.com/ffroliva/gflow-cli/issues/493),
+  [#313](https://github.com/ffroliva/gflow-cli/issues/313)).** New
+  `gflow_cli.flow_selectors` package: a structured, enumerable inventory of the
+  Flow DOM selectors gflow depends on (`Surface`, `Selector`) plus a pure
+  grader (`HIT` / `FALLBACK` / `AMBIGUOUS` / `MISS` / `EXPECTED_ABSENT`), so
+  selector drift is *named* rather than inferred from a failing test. A $0
+  probe (`scripts/probe/run_probe.py`, driven by the `selector-probe` workflow
+  on `schedule` + `workflow_dispatch` only) walks the registry against a live
+  editor: navigate and read only, never generates. Exit 0 clean / 1 drift /
+  2 inconclusive — an expired token or dead project is never published as
+  drift.
+
+- **Incident bundles record what was submitted
+  ([#528](https://github.com/ffroliva/gflow-cli/issues/528)).**
+  `network.json` gains a `generation_requests` array carrying a counts-only
+  summary of each outgoing generation submit (body size, reference-entity
+  count, reference-field count). The reference shape that triggers a policy 400
+  was previously visible only in the stderr stream, so bundles attached to an
+  issue could not be diagnosed. Counts and booleans only — no key names, field
+  values, or prompt text — matching the existing §5.3 retention boundary.
+
+### Changed
+
+- **All labs.google requests now carry `origin`/`referer`
+  ([#578](https://github.com/ffroliva/gflow-cli/pull/578)).** Header
+  construction moved into a single `_request_headers()` shared by
+  `_post_json`/`_patch_json`/`_get_json`, which previously assembled headers
+  inline three times and could diverge per verb. The labs lane now sends the
+  same `origin`/`referer` every other lane already sent. A live A/B against
+  `project.createProject` showed these headers are **not** required — an
+  origin-less mutation still returns 200 — so this is consistency and
+  defence-in-depth, not a fix for any observed failure.
+
+### Fixed
+
+- **Content-policy 400s are no longer misclassified as `WireFormatError`
+  ([#528](https://github.com/ffroliva/gflow-cli/issues/528)).** An HTTP 400 from
+  `flowMedia:batchGenerateImages` or `batchAsyncGenerateVideo*` now raises
+  `ContentPolicyError` with remediation that names the levers that actually
+  work — reduce to a single face-bearing reference, replace age-explicit person
+  descriptors with relational or role nouns — and states outright that
+  shortening the prompt does not help. Previously these surfaced as "the
+  request was rejected as malformed… retry with a simpler prompt text", which
+  sends operators down a path that cannot succeed. Same defect shape as
+  [#379](https://github.com/ffroliva/gflow-cli/issues/379) (429), one status
+  over, and the self-documenting-errors goal of
+  [#380](https://github.com/ffroliva/gflow-cli/issues/380).
+- **Video generation gained the 429 branch the image path got in #379.** A
+  quota hit on `batchAsyncGenerateVideo*` raised `WireFormatError` instead of
+  `RateLimitError`, losing `Retry-After` and the retryable classification.
+- **`generate_images_batch` no longer reports a bare, remediation-free
+  `GFlowError`** when every response failed — it classifies the first error the
+  same way the single-prompt path does.
+
+### Security
+
+- **CI/CD supply-chain hardening
+  ([#565](https://github.com/ffroliva/gflow-cli/issues/565)).** Every
+  `actions/checkout` step now sets `persist-credentials: false` (12 existing
+  steps fixed across `ci.yml`, `deps-watch.yml`, `governance-advisory.yml`,
+  `governance-benchmark.yml`, `main-base-guard.yml`, `pages.yml` and
+  `release.yml`); the default leaves the job token in `.git/config` for the rest
+  of the job. No workflow needed it — releases publish over PyPI Trusted
+  Publishing (OIDC) and Pages deploys over `actions/deploy-pages`. A new
+  `workflow-audit` job runs [zizmor](https://github.com/zizmorcore/zizmor)
+  (pinned, `--offline`) over `.github/workflows/` on every push and PR, so the
+  class cannot come back. Its first run also caught two defects the manual pass
+  missed: `${{ github.base_ref }}` interpolated directly into a
+  `governance-advisory.yml` shell script (template injection — the value now
+  arrives through `env:`), and a shared uv cache restored by the publishing
+  release job (cache poisoning — caching is now off there). The
+  `pull_request_target` trigger in `external-pr-triage.yml` is suppressed inline
+  with its rationale, and a changelog-guard workflow was evaluated and declined
+  — both decisions recorded in
+  [docs/GITHUB.md § Workflow Security Gates](docs/GITHUB.md#workflow-security-gates).
+
+## [0.59.0] — 2026-08-16
+
+### Added
+
+- **Refresh-on-miss: stale catalog names self-heal during generation
+  ([#546](https://github.com/ffroliva/gflow-cli/issues/546)).** When a UUID
+  reference's picker name-search misses (e.g. the asset was renamed in the
+  Flow UI after being cataloged), the transport now consults the credit-free
+  `flow.projectInitialData` listing once (~0.5 s) for the *current* name,
+  retries the search exactly once, and attaches the existing tile — instead
+  of silently downgrading to a duplicate upload. The fresh name is written
+  back with `sync.source = "refresh"` provenance (`store` history mode only;
+  `redacted` heals the run without touching disk). Applies to `image i2i
+  --ref <uuid>` and `video i2v` frame refs; any resolver failure is logged
+  and the pre-existing fallback chain proceeds unchanged. Completes the
+  [#543](https://github.com/ffroliva/gflow-cli/issues/543) freshness model —
+  see [MEDIA_LIBRARY § freshness](docs/MEDIA_LIBRARY.md).
+
+- **`gflow doctor` — read-only pre-flight diagnostics
+  ([#542](https://github.com/ffroliva/gflow-cli/issues/542)).** Ten checks
+  across the catalog (missing display names / local files / sha256), the
+  database (migration drift, WAL state + `PRAGMA quick_check`), stuck
+  operations and queue tasks (24h recency threshold), and the environment
+  (deprecated env vars, missing Playwright Chromium, auth profiles without
+  cookies). Brew-doctor philosophy: diagnoses, never heals — nothing is
+  migrated, repaired, or written, and all DB access is strictly read-only.
+  Exit `0` when clean, `33` when any warn/fail finding is present (a
+  successful diagnosis, not an error class); internal errors keep their typed
+  codes (e.g. `16` for `DataStoreError`). `--json` emits an experimental
+  machine-readable envelope (`overall_status` + per-check `checks[]` entries).
+  Output is redaction-safe: rows are identified by UUID only, paths are
+  sanitized, and under `GFLOW_CLI_HISTORY_PROMPTS=redacted` the display-name
+  check reports info instead of warn. See
+  [USAGE § `gflow doctor`](docs/USAGE.md#gflow-doctor).
+
+- **`gflow data sync --names` — reconcile catalog display names from Flow's
+  listing endpoint ([#543](https://github.com/ffroliva/gflow-cli/issues/543)).**
+  Sweeps nameless catalog rows project-by-project via the credit-free
+  `flow.projectInitialData` listing (~0.5s/project, session-cookie auth, no
+  generation surface) and writes back the display names the picker searches
+  by — restoring the [#529](https://github.com/ffroliva/gflow-cli/issues/529)
+  picker contract (search by name, verify by UUID) for rows recorded before
+  their caption existed. Rows whose media no longer exists remotely are
+  ghost-marked `sync.status = "missing_remote"` (tombstones, never deletions)
+  only when the listing is provably complete. Write-by-default with
+  `--dry-run` preview; scoped via `--project` / `--limit` / `--since` /
+  `--max-projects`; idempotent re-runs. Refuses under
+  `GFLOW_CLI_HISTORY_PROMPTS=redacted` (exit `11`); exit `34`
+  (`SyncPartialError`, retryable) when some projects fail mid-sweep. This is
+  the remediation `gflow doctor`'s missing-display-name check points at. See
+  [USAGE § `gflow data sync`](docs/USAGE.md#gflow-data-sync).
+
 ## [0.58.0] — 2026-08-16
 
 ### Fixed
@@ -3021,7 +3155,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.58.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...HEAD
+[0.60.0]: https://github.com/ffroliva/gflow-cli/compare/v0.59.0...v0.60.0
+[0.59.0]: https://github.com/ffroliva/gflow-cli/compare/v0.58.0...v0.59.0
 [0.58.0]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...v0.58.0
 [0.57.1]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...v0.57.1
 [0.57.0]: https://github.com/ffroliva/gflow-cli/compare/v0.56.0...v0.57.0

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/KNOWN_ISSUES.md

@@ -142,7 +142,7 @@ full-page media-library UI (#174) can fail earlier at `mode_switch_trigger`.
 
 ### Fresh generations may record without a `display_name` (async Flow caption)
 
-- **Status:** Open — tracked in [#543](https://github.com/ffroliva/gflow-cli/issues/543) (backfill command)
+- **Status:** Mitigated — remedies shipped via [#543](https://github.com/ffroliva/gflow-cli/issues/543) and [#542](https://github.com/ffroliva/gflow-cli/issues/542)
 - **Affected:** UUID `--ref` / frame references to *just-generated* assets (v0.58.0+)
 
 Flow computes an asset's caption (`displayName`) asynchronously server-side, so
@@ -151,9 +151,11 @@ stores no name (observed live 2026-08-16 during the r2v e2e). Such rows skip
 the picker-selection path and use the integrity-verified local-file upload
 fallback instead — correct but a duplicate upload. Also by design, rows
 recorded before v0.58.0 and all rows under
-`GFLOW_CLI_HISTORY_PROMPTS=redacted` have no stored name. #543 proposes a
-credit-free, privacy-gated `gflow data backfill-names` command; #542's
-`gflow doctor` will surface the affected-row count.
+`GFLOW_CLI_HISTORY_PROMPTS=redacted` have no stored name. **Remedies:**
+`gflow data sync --names` (#543) backfills names credit-free from the Flow
+listing endpoint (privacy-gated to `store` history mode), and `gflow doctor`
+(#542) surfaces the affected-row count. Freshly generated rows whose caption
+has not landed yet stay nameless until the next sync sweep.
 
 ### Video duration tab probe misses on the current Frames-submode DOM
 

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.58.0
+Version: 0.60.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.2; extra == 'dev'
+Requires-Dist: ruff==0.16.4; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/deploy/PR-TRIAGE-AUTOPILOT-OPS.md

@@ -16,6 +16,8 @@ The autopilot orchestrator (`scripts/autopilot/pr_triage_autopilot.py`) runs as
 | `TELEGRAM_USER_ID` | Autopilot orchestrator (host) | The chat ID to receive triage alert messages. |
 | `PR_TRIAGE_ENGINE` | Autopilot orchestrator (host), optional | Review engine selector. Default `council-claude`; any other value exits at startup (`council-multi-cli` is reserved backlog). |
 | `HERMES_OPS_DIR` | Autopilot orchestrator (host), optional | Location of the hermes-ops checkout hosting the Resend email notifier. Default `/opt/hermes-ops`. |
+| `GH_SANDBOX_TOKEN` | Review **container** | Fine-grained **read-only** PAT for the repo under review. The container only reads the PR; the host posts the comment. If unset the orchestrator falls back and raises an alert rather than degrading silently. Stored in the SOPS secret store. |
+| `GFLOW_TRIAGE_MEMORY_DIR` | Autopilot orchestrator (host), optional | Council memory directory mounted read-only for D5. Set it only to override the XDG default (`$XDG_DATA_HOME/gflow-cli/memory`, i.e. `~/.local/share/gflow-cli/memory`). **Never put a machine-specific path in the cron line** — see §2. |
 | `RESEND_API_KEY` | Email notifier (hermes-ops) | Resend API key consumed by `$HERMES_OPS_DIR/scripts/notify/email_notify.py`. |
 | `HERMES_NOTIFY_EMAIL_TO` | Email notifier (hermes-ops) | Recipient address for high-signal triage emails. |
 | `HERMES_NOTIFY_EMAIL_FROM` | Email notifier (hermes-ops) | Verified sender address for the Resend account. |
@@ -28,8 +30,19 @@ The autopilot orchestrator (`scripts/autopilot/pr_triage_autopilot.py`) runs as
 
 Deploy the following layout on the VPS:
 - `/opt/gflow-cli`: Dedicated git repository checkout representing the active branch.
-- `/opt/experience-vault`: Host experience vault directory structure.
-- `/opt/experience-vault/projects/C--development-github-gflow-cli/memory`: The project-specific memory namespace to mount.
+- `~hermes/.local/share/gflow-cli/memory`: Council memory namespace, mounted read-only into the sandbox for dimension D5.
+
+Create the memory directory once, as the user the cron runs under:
+
+```bash
+sudo -u hermes mkdir -p ~hermes/.local/share/gflow-cli/memory
+```
+
+An **empty** directory is a valid deployment — D5 then reports that no memory is available, and the other 13 dimensions run normally. Populate it only if you want the council to consult durable project memory.
+
+> **The memory path is resolved by the orchestrator, never hardcoded.** Precedence is `--memory-dir` > `$GFLOW_TRIAGE_MEMORY_DIR` > `$XDG_DATA_HOME/gflow-cli/memory` (XDG default, falling back to `~/.local/share`). `XDG_DATA_HOME` is the correct slot per the XDG Base Directory Specification: council memory is durable knowledge that should be backed up, not regenerable cache or throwaway state.
+>
+> The orchestrator validates the resolved path on the host and refuses to start with an actionable error if it is missing, rather than failing later inside the container.
 
 ---
 
@@ -51,7 +64,7 @@ Ensure `iptables` is installed on the host VPS. If `iptables` permissions are wi
 Configure a cron job checking every hour on the hour under the `hermes` system user:
 
 ```cron
-0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory >> /var/log/hermes/pr_triage.log 2>&1
+0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli >> /var/log/hermes/pr_triage.log 2>&1
 ```
 
 Sourcing `/opt/hermes/.env` first (`set -a` exports everything it defines) is what delivers `GH_COMMENT_TOKEN`, `TELEGRAM_*`, and the `RESEND_API_KEY` / `HERMES_NOTIFY_EMAIL_*` vars to the process. Without it the email channel silently disables itself, and without `GH_COMMENT_TOKEN` the run exits 1.
@@ -83,6 +96,17 @@ Do **NOT** register the orchestrator directly via `hermes cron create --script p
 - **(a) Plain crontab** — the line above, under the `hermes` system user.
 - **(b) Thin shim in `HERMES_HOME/scripts/`** — a script that does `cd /opt/gflow-cli && exec uv run python scripts/autopilot/pr_triage_autopilot.py "$@"` (mirrors the existing EV ops-health shim pattern), registered with `hermes cron create "1h" --no-agent --script <shim> --deliver telegram`.
 
+### Log rotation
+
+`pr_triage.log` grows without bound otherwise. Install once, as root:
+
+```bash
+install -m 644 /opt/gflow-cli/deploy/logrotate-pr-triage /etc/logrotate.d/pr-triage
+logrotate --debug /etc/logrotate.d/pr-triage    # dry-run
+```
+
+Scoped to `pr_triage.log` alone — the rest of `/var/log/hermes/` belongs to hermes-ops, and two packages rotating one glob is how logs get silently truncated.
+
 ### Check Logs & Status
 - **Log Location**: `/var/log/hermes/pr_triage.log`
 - **Triage Ledger**: `/opt/gflow-cli/pr_triage_ledger.jsonl` tracks verdicts and failure states.
@@ -110,5 +134,5 @@ If a PR enters the `FAILED_PERMANENT` state in `pr_triage_ledger.jsonl` due to 3
 2. Fix the underlying environmental or syntax issue.
 3. To trigger a re-review, delete or edit the `FAILED_PERMANENT` entries for that PR number/SHA in `pr_triage_ledger.jsonl`, then run the script manually:
    ```bash
-   uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory
+   uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli
    ```

gflow_cli-0.60.0/deploy/logrotate-pr-triage

@@ -0,0 +1,21 @@
+# logrotate config for the PR-Triage Autopilot log.
+#
+# Install on the VPS as root:
+#   install -m 644 /opt/gflow-cli/deploy/logrotate-pr-triage /etc/logrotate.d/pr-triage
+#   logrotate --debug /etc/logrotate.d/pr-triage   # dry-run to verify
+#
+# Scoped to pr_triage.log alone, not /var/log/hermes/*.log: the rest of that
+# directory belongs to hermes-ops, and two packages rotating the same glob is
+# how you get silently truncated logs.
+/var/log/hermes/pr_triage.log {
+    weekly
+    rotate 8
+    compress
+    delaycompress
+    missingok
+    notifempty
+    # The hourly cron reopens the file on each tick, but copytruncate keeps
+    # rotation safe if the orchestrator is ever run as a long-lived process.
+    copytruncate
+    su hermes hermes
+}

{gflow_cli-0.58.0 → gflow_cli-0.60.0}/docs/DATA_LAYER.md

@@ -69,6 +69,30 @@ same treatment `character create` already gave them. Keep that in mind before
 adding a key here: anything prompt-derived must be hashed by its own builder
 (as `tool` does) rather than relying on column-level redaction.
 
+### Asset `metadata_json.sync.*` provenance (#543)
+
+`assets.metadata_json` carries a `sync` object recording what
+`gflow data sync --names` did to the row and when — so a restored name is
+distinguishable from one recorded at generation time, and a ghost mark carries
+its own audit trail:
+
+| Key | Shape | Writer |
+|---|---|---|
+| `sync.named_at` | UTC ISO timestamp | `DataRepository.set_asset_display_name` — set (with `$.display_name`) when a sync sweep writes or overwrites the name; skipped when the stored name is already identical, so re-runs never churn the timestamp |
+| `sync.source` | `"sync"` \| `"refresh"` | Same writer, same statement — provenance for the name value: `"sync"` from a bulk `gflow data sync --names` sweep; `"refresh"` from the refresh-on-miss resolver (#546, `cli_image`), which writes back the freshly fetched name after a picker miss |
+| `sync.status` | `"missing_remote"` | `DataRepository.mark_asset_missing_remote` — the ghost tombstone, set only when a **complete** remote listing lacks the asset; rows are flagged, never deleted, and tombstoned rows are excluded from later sweeps; cleared automatically if the media reappears in a listing |
+| `sync.checked_at` | UTC ISO timestamp | Same writer — when the absence was last confirmed |
+
+All four are written via single-statement atomic `json_set` updates that
+preserve unrelated metadata keys. See
+[USAGE § `gflow data sync`](USAGE.md#gflow-data-sync).
+
+Two caveats: an in-flight generation's recorder completion can overwrite
+`metadata_json` written concurrently by a sync sweep — self-healing, since the
+row simply re-enters the next sweep. And the nested `sync.*` stamps rely on
+SQLite's `json_set` auto-creating intermediate objects; a very old system
+SQLite (pre-json1 era, roughly < 3.9) may silently no-op them.
+
 ### What is NOT recorded
 
 - Signed CDN URLs (e.g., `fifeUrl?Signature=...`) — they expire and contain bearer-style tokens.