gflow-cli 0.6.0a4__tar.gz → 0.6.0a6__tar.gz

gflow_cli-0.6.0a6/.github/CODEOWNERS

@@ -0,0 +1,22 @@
+# CODEOWNERS — https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# These owners are automatically requested for review on every PR that touches
+# the matched paths. Ownership does not prevent external contributors from
+# opening PRs — it ensures a maintainer is always in the review loop.
+
+# Global fallback — everything not matched below
+*                       @ffroliva
+
+# Core source
+/src/                   @ffroliva
+
+# CI and security gates — changes here require extra care
+/.github/               @ffroliva
+/scripts/ci/            @ffroliva
+/.pre-commit-config.yaml @ffroliva
+/.gitleaks.toml         @ffroliva
+/.secrets.baseline      @ffroliva
+/.gitignore             @ffroliva
+
+# Auth handling — sensitive, never bypass review
+/src/gflow_cli/auth.py  @ffroliva

gflow_cli-0.6.0a6/.github/dependabot.yml

@@ -0,0 +1,34 @@
+# Dependabot configuration
+# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Python dependencies (pip/uv — Dependabot reads pyproject.toml)
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "python"
+    ignore:
+      # Playwright has its own browser download step; pin manually.
+      - dependency-name: "playwright"
+        update-types: ["version-update:semver-major"]
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"

gflow_cli-0.6.0a6/.github/workflows/ci.yml

@@ -0,0 +1,96 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Security gate: runs first, on every push/PR, never skippable ──────────
+  secrets-scan:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history so gitleaks can diff against base
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # ── Main test matrix ──────────────────────────────────────────────────────
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+
+      - name: Set up Python
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install deps
+        run: uv sync --extra dev
+
+      - name: Repo hygiene (no artefacts, no hardcoded paths)
+        run: uv run python scripts/ci/check_repo_hygiene.py
+
+      - name: Lint
+        run: uv run ruff check src tests
+
+      - name: Format check
+        run: uv run ruff format --check src tests
+
+      - name: Type check
+        run: uv run pyright src
+
+      - name: Test (smoke only) + coverage
+        # e2e tests (tests/e2e/) require a logged-in Chromium profile
+        # and live Flow auth — never runnable in CI. They self-mark with
+        # `pytestmark = pytest.mark.e2e` (file-level) and are opt-in via
+        # `-m e2e` per their module docstring. `live` marker is reserved for
+        # `GFLOW_LIVE=1` tests that hit the real Flow API. Both are excluded
+        # from the default smoke run; `tests/smoke/test_real_flow.py` already
+        # self-skips via `pytest.mark.skipif(GFLOW_E2E != "1")`.
+        run: uv run python -m pytest -q -m "not e2e and not live" --cov=gflow_cli --cov-report=xml
+
+      # Upload coverage XML so the sonar job can consume it
+      - name: Upload coverage report
+        if: matrix.python-version == '3.11'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          retention-days: 1
+
+  # ── SonarCloud analysis ───────────────────────────────────────────────────
+  sonar:
+    name: SonarCloud analysis
+    runs-on: ubuntu-latest
+    needs: test   # wait for tests + coverage report
+    if: always()  # run even if test matrix has failures — Sonar should see the state
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # shallow clones break blame / new-code detection
+
+      - name: Download coverage report
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-xml
+        continue-on-error: true  # graceful if coverage upload was skipped
+
+      - name: SonarCloud scan
+        uses: SonarSource/sonarcloud-github-action@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # PR decoration
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}    # set in repo → Settings → Secrets

{gflow_cli-0.6.0a4 → gflow_cli-0.6.0a6}/.gitignore

@@ -43,12 +43,25 @@ secrets.json           # generic secrets file
 # Generated outputs
 out/
 tmp/
+gflow-output/
 *.mp4
 *.png
+*.jpg
+*.jpeg
 !docs/**/*.png         # docs images are OK
 !tests/fixtures/**/*.png
+!test_assets/fixtures/**/*.jpg
+!test_assets/fixtures/**/*.jpeg
 samples/*.captured.json # sandbox-recorded API exchanges may contain PII
 
+# CDP browser session lock files (contain PID, port, profile name)
+.gflow-cdp.lock
+**/.gflow-cdp.lock
+
+# Runtime artefact dirs written by smoke/debug scripts — belong under tmp/ only
+test_assets/smoke_*/
+test_assets/debug_*/
+
 # Live Flow traffic captures — NEVER commit (contain real Bearer tokens / API keys).
 # Diagnostic scripts MUST default-write here, NOT to samples/captured/.
 # Sanitised reference samples (no secrets) can still live under samples/captured/.

gflow_cli-0.6.0a6/.gitleaks.toml

@@ -0,0 +1,33 @@
+# gitleaks configuration for gflow-cli
+# Docs: https://github.com/gitleaks/gitleaks#configuration
+#
+# This file tells gitleaks which patterns to IGNORE (allowlist) so that
+# legitimate test fixtures and documentation snippets don't trigger false
+# positives. The default ruleset catches: Google API keys, OAuth tokens,
+# GitHub tokens, generic secrets, private keys, and more.
+
+title = "gflow-cli gitleaks config"
+
+[allowlist]
+  description = "Known-safe patterns in this repo"
+
+  # Sample/fixture files contain placeholder UUIDs and sanitised JSON — not real tokens.
+  paths = [
+    "samples/",
+    "tests/fixtures/",
+    "docs/",
+    "CHANGELOG.md",
+    "README.md",
+  ]
+
+  # Regex patterns that are safe to ignore across the whole repo.
+  # Format: list of Go regex strings matched against the secret value.
+  regexes = [
+    # Placeholder project/asset UUIDs in test fixtures (all-hex, fixed length,
+    # committed deliberately as sample data with no auth value).
+    "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+  ]
+
+  # Specific commit SHAs that were already reviewed and cleared.
+  # Add a SHA here only after manually verifying no live credentials exist.
+  commits = []

gflow_cli-0.6.0a6/.pre-commit-config.yaml

@@ -0,0 +1,38 @@
+# Pre-commit hooks for gflow-cli
+# Install: pip install pre-commit && pre-commit install
+# Run manually: pre-commit run --all-files
+#
+# Gates enforced:
+#   1. ruff lint + format (fast, catches import order / style / unused imports)
+#   2. repo-hygiene (blocks tracked images, CDP lock files, hardcoded Windows paths)
+#
+# The hygiene hook is the primary defence against accidental leakage of:
+#   - generated output artefacts (*.jpg, *.jpeg, test_assets/smoke_*/, test_assets/debug_*/)
+#   - CDP lock files (.gflow-cdp.lock) that contain browser session metadata
+#   - hardcoded machine-specific paths in scripts/ (C:\Users\<name>\...)
+
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.11.10
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: local
+    hooks:
+      - id: repo-hygiene
+        name: Repo hygiene (no artefacts, no hardcoded paths)
+        language: python
+        entry: python scripts/ci/check_repo_hygiene.py
+        pass_filenames: false
+        always_run: true
+        additional_dependencies: []
+
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        name: Detect secrets
+        args: ["--baseline", ".secrets.baseline"]
+        exclude: "\.secrets\.baseline$"

gflow_cli-0.6.0a6/.secrets.baseline

@@ -0,0 +1,152 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        "\\.venv|tmp|samples/captured"
+      ]
+    }
+  ],
+  "results": {
+    "tests\\api\\transports\\test_sapisidhash.py": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "tests\\api\\transports\\test_sapisidhash.py",
+        "hashed_secret": "53506367ae14180a65ad639f12ef857370f1ab06",
+        "is_verified": false,
+        "line_number": 385
+      }
+    ],
+    "tests\\test_observability.py": [
+      {
+        "type": "Secret Keyword",
+        "filename": "tests\\test_observability.py",
+        "hashed_secret": "ae08c5886eb2b1feb7c53d7774dc1eef39281da6",
+        "is_verified": false,
+        "line_number": 69
+      }
+    ]
+  },
+  "generated_at": "2026-05-16T17:49:16Z"
+}

{gflow_cli-0.6.0a4 → gflow_cli-0.6.0a6}/CHANGELOG.md

@@ -7,6 +7,101 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0a6] — 2026-05-17
+
+> **Stability & code-quality release.** Fixes a concurrency bug in image
+> generation, restores a green CI pipeline (the test job had been hanging
+> indefinitely), and clears every open SonarCloud issue so the project's
+> Quality Gate passes.
+
+### Fixed
+
+- **Concurrent `generate_images` calls are now serialized**, and every batch
+  creates a fresh Flow project — prevents project-reuse races when multiple
+  image generations overlap.
+- **CI test job no longer hangs.** `RealChromeStrategy` launches Chrome with
+  `asyncio.create_subprocess_exec`, but its tests patched `subprocess.Popen`;
+  asyncio's POSIX subprocess transport uses `Popen` internally, so the mock
+  left the event loop's child watcher unresolved forever — the test job ran
+  until cancelled and never wrote a coverage report. Tests now patch
+  `asyncio.create_subprocess_exec` directly.
+- **structlog log-capture test isolation** — a `browser_manager` test asserted
+  on a log event that an earlier test had already cached onto the production
+  logger chain (`cache_logger_on_first_use=True`). It now patches in a fresh
+  logger proxy and passes regardless of suite order.
+
+### Changed
+
+- **All open SonarCloud issues resolved** and the Quality Gate now passes:
+  the S6418 BLOCKER and 10× S5443 CRITICAL test findings, 16 mechanical
+  issues, async-hygiene rules (S7503 / S7487 / S7493), and 5
+  cognitive-complexity (S3776) extractions. The two remaining Security
+  Hotspots — `random`-based retry jitter and protocol-mandated SHA-1 in
+  `sapisidhash` — were reviewed and marked Safe.
+
+### Security / Compliance
+
+- **Removed accidentally tracked artefacts** — 7 files were untracked from git:
+  `denon82/.gflow-cdp.lock`, `test_assets/debug_editor/buttons.json`,
+  `test_assets/debug_settings/settings_panel.json`, and 4 AI-generated JPGs
+  in `test_assets/smoke_e2e_*/`. None contained credentials or API tokens, but
+  the CDP lock file exposed a profile name and browser PID and the debug JSON
+  files contained Flow UI text. Files were removed from HEAD forward (no history
+  rewrite — see decision rationale in `PLAN.md` ADR #3).
+
+- **`.gitignore` hardened** — added `*.jpg`, `*.jpeg`, `**/.gflow-cdp.lock`,
+  `test_assets/smoke_*/`, `test_assets/debug_*/`, and `gflow-output/` to
+  prevent recurrence. Fixture allowlist added (`!test_assets/fixtures/**/*.jpg`).
+
+- **Hygiene gate added to CI** — `scripts/ci/check_repo_hygiene.py` runs on
+  every push and PR before lint. Fails if tracked files match the denylist or
+  if any `scripts/**/*.py` contains a hardcoded Windows absolute path or writes
+  output to `test_assets/`.
+
+- **`.pre-commit-config.yaml` added** — ships ruff (lint + format) and the
+  hygiene gate as pre-commit hooks. Install with:
+  `pip install pre-commit && pre-commit install`.
+
+- **Debug scripts de-hardcoded** — `scripts/debug_editor.py`,
+  `scripts/debug_gen_settings.py`, `scripts/debug_settings.py` previously
+  contained `PROFILE = r"C:\Users\ffrol\..."` (Windows username + Google
+  profile name) and wrote output to `test_assets/`. Replaced with argparse
+  `--profile` flag + `auth.profile_dir(args.profile)` and output redirected to
+  `tmp/debug/<name>/`.
+
+- **CI workflow scrubbed** — removed a hardcoded profile name (`denon82`) from
+  a comment in `.github/workflows/ci.yml`.
+
+### CI / Tooling
+
+- **GitHub Actions migrated to Node.js 24** ahead of the June 2026 forced
+  migration (`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24`).
+- **SonarCloud Quality Gate badge** added to the README.
+
+## [0.6.0a5] — 2026-05-16
+
+> **CLI transport proven end-to-end.** The `ui_automation` transport now
+> generates images correctly from the `gflow image t2i` command — count,
+> aspect ratio, and file download all work. Root cause of the persistent 403
+> was `headless=True`; reCAPTCHA Enterprise immediately rejects headless
+> Chromium.
+
+### Fixed
+
+- **`headless` default changed `True` → `False`** in `config.py` and
+  `FlowApiClient.__init__` — the `ui_automation` transport requires a headed
+  (visible) Chrome window; reCAPTCHA Enterprise scores headless browsers as
+  bots and returns an immediate 403 on `batchGenerateImages`.
+- **13 unit test mock regressions** fixed after the v0.6.0a4 transport rewrite:
+  - `add_init_script = AsyncMock()` added to `_patch_playwright` and
+    `fake_context` fixtures (`test_client.py`, `test_concurrency.py`).
+  - `keyboard.insert_text = AsyncMock()` added to `_make_prompt_page`
+    (transport now uses `insert_text` instead of `type`).
+  - `_FakeHttpxResponse.headers` added (download auto-detects `.jpg`/`.png`
+    from `Content-Type`).
+  - `_capture_batch_response` / `_await_captured` return `list[dict]` —
+    test assertions updated throughout `test_ui_automation.py`.
+
 ## [0.6.0a4] — 2026-05-17
 
 > **Unified output resolution + batch orchestration refactor.** This release
@@ -538,7 +633,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.6.0a1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.6.0a6...HEAD
+[0.6.0a6]: https://github.com/ffroliva/gflow-cli/compare/v0.6.0a5...v0.6.0a6
+[0.6.0a5]: https://github.com/ffroliva/gflow-cli/compare/v0.6.0a4...v0.6.0a5
 [0.6.0a1]: https://github.com/ffroliva/gflow-cli/compare/v0.5.0a1...v0.6.0a1
 [0.5.0a1]: https://github.com/ffroliva/gflow-cli/compare/v0.4.0a2...v0.5.0a1
 [0.3.0a1]: https://github.com/ffroliva/gflow-cli/releases/tag/v0.3.0a1

{gflow_cli-0.6.0a4 → gflow_cli-0.6.0a6}/CLAUDE.md

@@ -67,16 +67,24 @@ Dependency rule: **`domain/` depends on nothing**. `application/` depends on `do
 
 ## How to verify your work
 
-Run all four BEFORE asking to commit:
+Run all five BEFORE asking to commit:
 
 ```bash
+uv run python scripts/ci/check_repo_hygiene.py  # hygiene gate (run first)
 uv run ruff check src tests          # lint
 uv run ruff format --check src tests # formatting
 uv run pyright src                   # types
 uv run pytest -q --cov=gflow_cli      # tests + coverage
 ```
 
-CI runs the same four on every push (see `.github/workflows/ci.yml`).
+CI runs the same five on every push (see `.github/workflows/ci.yml`).
+
+## Output path rule — MANDATORY
+
+**All script and test runtime output goes to `tmp/`.** Never to `test_assets/`
+or the repo root. `test_assets/` is for committed test *fixtures* (static
+input files checked into git). The CI hygiene gate (`check_repo_hygiene.py`)
+actively blocks commits that violate this rule.
 
 ## Where to look
 

{gflow_cli-0.6.0a4 → gflow_cli-0.6.0a6}/CONTRIBUTING.md

@@ -59,24 +59,29 @@ CI runs `unit` + `integration` on every push. `live` tests run only on the maint
 ## Quality gates (run before commit)
 
 ```bash
+uv run python scripts/ci/check_repo_hygiene.py  # artefact + path hygiene
 uv run ruff check src tests          # lint
 uv run ruff format src tests         # auto-format
 uv run pyright src                   # type-check (strict on src/gflow_cli/)
 uv run pytest -q --cov=gflow_cli      # tests + coverage
 ```
 
-CI runs all four on every push. Local pre-commit hook recommended:
+CI runs all five on every push. Install local pre-commit hooks (recommended):
 
-```yaml
-# .pre-commit-config.yaml — install with `pip install pre-commit && pre-commit install`
-repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.9
-    hooks:
-      - id: ruff
-      - id: ruff-format
+```bash
+pip install pre-commit && pre-commit install
 ```
 
+The `.pre-commit-config.yaml` already ships ruff and the hygiene gate.
+
+### Script output convention
+
+All runtime output — smoke runs, debug dumps, generated images — **must** go
+to `tmp/` (already gitignored). `test_assets/` is for committed test
+*fixtures* only (static input files for unit tests). Never write to
+`test_assets/smoke_*/` or `test_assets/debug_*/` from scripts; the hygiene
+gate blocks this.
+
 ## Adding a new API route
 
 1. **Capture the live request** — add a sanitised JSON sample under `samples/captured/` (numbered, e.g. `08_<route>.json`; scrub project IDs, asset UUIDs, bearer tokens, and reCAPTCHA tokens).

{gflow_cli-0.6.0a4 → gflow_cli-0.6.0a6}/KNOWN_ISSUES.md

@@ -111,6 +111,20 @@ gflow video batch manifest.remaining.tsv
 
 ---
 
+### REST API 401 unauthorized on project creation
+
+- **Status:** Open (Mitigated) · **Severity:** High · **Affects:** v0.2.0a1+ · **Fixed in:** v0.6.0a5 (planned)
+
+Even with a valid browser session (cookies present), calling Flow's REST API directly via `fetch` or `page.request` (e.g., `project.createProject`) may return HTTP 401. This blocks the CLI's standard "pre-flight" sequence for generations.
+
+**Root cause:** Google's backend has tightened security on its private trpc/REST endpoints, likely requiring specific headers (`Origin`, `Referer`) or a more complete browser fingerprint that raw script-driven requests lack.
+
+**Workaround:** Use the **UI Mimicry** approach (used by the `scripts/smoke_worker_style.py` diagnostic). This strategy performs actions by clicking real buttons in the Flow editor instead of making raw REST calls.
+
+**Roadmap:** v0.6.0a5 will refactor the `ui_automation` transport to handle its own project creation via the UI, bypassing the REST-based `create_project` blocker entirely for image generation.
+
+---
+
 ### Output dir is not tidied automatically
 
 - **Status:** Open · **Severity:** Low · **By design**

{gflow_cli-0.6.0a4 → gflow_cli-0.6.0a6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.6.0a4
+Version: 0.6.0a6
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -66,6 +66,7 @@ Description-Content-Type: text/markdown
 [![Code style: ruff](https://img.shields.io/badge/code%20style-ruff-000000.svg)](https://github.com/astral-sh/ruff)
 [![Type checked: pyright](https://img.shields.io/badge/type%20checked-pyright-blue.svg)](https://github.com/microsoft/pyright)
 [![Tests: TDD](https://img.shields.io/badge/tests-TDD-brightgreen.svg)](#development--tdd-workflow)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ffroliva_gflow-cli)
 
 > ⚠️ **Not affiliated with Google.** Reverse-engineered from public Flow web traffic. Endpoints can change at any time. See full [DISCLAIMER](DISCLAIMER.md) before use.
 
@@ -108,7 +109,7 @@ Read the full [DISCLAIMER](DISCLAIMER.md) before deploying this in any productio
 
 ## Project status
 
-**v0.5.0a1 — alpha.** Video (T2V/I2V/batch), image (T2I/I2I/upload), the new **`gflow run` JSON-batch command**, and the **`ui_automation` default transport** are functional end-to-end against a live Google AI Pro/Ultra Flow account. Three earlier HTTP transport strategies (`evaluate_fetch` / `bearer` / `sapisidhash`) move to an `experimental/` subpackage in this release; the production path is `ui_automation`.
+**v0.6.0a5 — alpha.** Video (T2V/I2V/batch), image (T2I/I2I/upload), the new **`gflow run` JSON-batch command**, and the **`ui_automation` default transport** are functional end-to-end against a live Google AI Pro/Ultra Flow account. Three earlier HTTP transport strategies (`evaluate_fetch` / `bearer` / `sapisidhash`) move to an `experimental/` subpackage in this release; the production path is `ui_automation`.
 
 | Milestone | Status |
 |---|---|
@@ -128,7 +129,7 @@ Read the full [DISCLAIMER](DISCLAIMER.md) before deploying this in any productio
 | Shell multi-prompt `gflow image t2i` (`PROMPT...`, `--prompts-file`, `--stdin`) | ✅ done (v0.6.0a1) |
 | Provider abstraction for official Veo 3.1 API | ⏳ planned (v0.6+) |
 
-### What's new in v0.5.0a1
+### What's new in v0.6.0a5
 
 - `UiAutomationTransport` is now the default image-generation strategy — Playwright-driven UI mimicry against the Flow editor on a logged-in Pro/Ultra profile (no externally-exposed CDP debug port).
 - New top-level `gflow run --config <file>` command for JSON-described sequential batches (1–50 prompts per file, `--continue-on-error` / `--fail-fast` modes). See [`docs/USAGE.md`](docs/USAGE.md#gflow-run) for the schema.