gflow-cli 0.6.0a6__tar.gz → 0.8.0__tar.gz

{gflow_cli-0.6.0a6 → gflow_cli-0.8.0}/.claude/README.md

@@ -10,7 +10,12 @@ This directory holds **internal maintainer workflows** that are bundled with the
 .claude/
 ├── README.md              ← this file
 └── commands/              ← repo-local slash commands
-    └── release.md         ← `/release` — automates the version-bump + tag + push flow
+    └── gflow/             ← `/gflow:*` namespace (avoids collision with built-ins)
+        ├── check.md       ← `/gflow:check` — hygiene + ruff + pyright + pytest
+        ├── plan.md        ← `/gflow:plan` — show active phase / superpowers plan
+        ├── known-issues.md← `/gflow:known-issues` — open/mitigated items
+        ├── changelog.md   ← `/gflow:changelog` — [Unreleased] + last tagged
+        └── release.md     ← `/gflow:release` — full release flow (signed tags)
 ```
 
 Optional additions when needed:
@@ -25,9 +30,9 @@ Optional additions when needed:
 
 ## Adding a slash command
 
-Drop a Markdown file into `commands/`. Filename (without `.md`) becomes the command name. The first paragraph is the description Claude shows in `/help`. The rest is the prompt the agent executes.
+Drop a Markdown file into `commands/gflow/` to add a `/gflow:<name>` command. Filename (without `.md`) becomes the command name. The first paragraph is the description Claude shows in `/help`. The rest is the prompt the agent executes. **Use the `gflow/` subdirectory** so commands stay namespaced and don't collide with Claude Code built-ins or user-global commands.
 
-Example: `commands/foo.md` → invoked as `/foo`.
+Example: `commands/gflow/foo.md` → invoked as `/gflow:foo`.
 
 ## Adding an internal skill
 

gflow_cli-0.8.0/.claude/commands/gflow/changelog.md

@@ -0,0 +1,21 @@
+---
+description: Show unreleased changes and last tagged version — insight into recent work.
+---
+
+# `/gflow:changelog` — Recent changes
+
+Read CHANGELOG.md and surface what's queued and what recently shipped.
+
+## Steps
+
+1. Read [CHANGELOG.md](../../../CHANGELOG.md)
+2. Return:
+   - All entries under `## [Unreleased]` (empty = nothing queued yet)
+   - The most recent versioned section (last tagged release) for comparison
+3. One-line summary: "X features, Y fixes queued since vZ."
+
+## When to call
+
+- Before cutting a release (called automatically by `/gflow:release` as its first step)
+- When you need a quick picture of recent work without opening the file
+- When writing a commit message and unsure if a change is user-visible enough to log

gflow_cli-0.8.0/.claude/commands/gflow/check.md

@@ -0,0 +1,48 @@
+---
+description: Auto-fix lint and formatting, then report types and tests. Run before every commit.
+---
+
+# `/gflow:check` — Quality gates
+
+Run in order. Stop and report if a step fails after the fix pass.
+
+## Steps
+
+**1. Repo hygiene** (read-only — checks tmp/ output rule, secret files, etc.)
+
+```bash
+PYTHONUTF8=1 uv run python scripts/ci/check_repo_hygiene.py
+```
+
+**2. Auto-fix lint and formatting** (rewrites files in place)
+
+```bash
+uv run ruff check --fix src tests
+uv run ruff format src tests
+```
+
+Report which files were modified. Do NOT stage or commit — leave the diff for review.
+
+**3. Type check** (report only — cannot auto-fix)
+
+```bash
+uv run pyright src
+```
+
+**4. Tests + coverage** (report only)
+
+```bash
+uv run pytest -q --cov=gflow_cli --cov-fail-under=80
+```
+
+## Output
+
+- List files changed by the fix pass (empty = nothing needed fixing)
+- All pyright errors with `file:line` references
+- Pytest summary line and coverage percentage
+- Final verdict: all gates pass / which gates failed
+
+## Notes
+
+Ruff fix and format may rewrite multiple files. Always `git diff` before staging.
+Pyright errors and test failures require manual intervention — do not attempt silent workarounds.

gflow_cli-0.8.0/.claude/commands/gflow/doc-review.md

@@ -0,0 +1,137 @@
+---
+description: Use before cutting any gflow-cli release or after a major feature lands — systematic audit of version refs, INDEX completeness, per-release evidence files, CHANGELOG footer, skill files, and memory records for staleness.
+---
+
+# `/gflow:doc-review` — Documentation Review Gate
+
+Run this gate before cutting a release. Every item reports **PASS / UPDATED / WARN / FAIL**. Any **FAIL** blocks the release.
+
+---
+
+## 1. Version references
+
+Check these files for stale version strings (old numbers, outdated status labels):
+
+| File | What to verify |
+|---|---|
+| `README.md` | Status badge, "What's new" section, install example, milestone table |
+| `CLAUDE.md` | `Active phase` — version, PyPI status, active backlog pointer |
+| `PLAN.md` | Phase status (`IN PROGRESS` / `DONE`) and version annotations |
+| `KNOWN_ISSUES.md` | `Open` entries resolved by this release → move to `Resolved` with evidence |
+| `CHANGELOG.md` | `[Unreleased]` empty; link footer matches new version |
+| `pyproject.toml` + `src/gflow_cli/__init__.py` | Both set to the new version |
+
+Quick grep to spot stragglers:
+
+```bash
+grep -rn "v[0-9]\+\.[0-9]" README.md CLAUDE.md PLAN.md KNOWN_ISSUES.md CHANGELOG.md pyproject.toml
+```
+
+---
+
+## 2. `docs/INDEX.md` completeness
+
+Every `.md` in `docs/` needs an entry; every entry must point to a real file.
+
+```bash
+# files in docs/ missing from INDEX.md
+for f in docs/*.md; do
+  grep -q "$(basename "$f")" docs/INDEX.md || echo "MISSING from INDEX: $f"
+done
+
+# entries in INDEX.md pointing to deleted files
+grep -o 'docs/[^)]*\.md' docs/INDEX.md | while read path; do
+  [ -f "$path" ] || echo "DEAD LINK in INDEX: $path"
+done
+```
+
+---
+
+## 3. Per-release evidence file
+
+After each release a `docs/LIVE_VERIFICATION_vX.Y.Z.md` must exist.
+
+- Latest version has one (create stub if live run already documented elsewhere)
+- `docs/INDEX.md` has an entry for it
+- Previous versions' files are preserved (historical record — never delete)
+
+---
+
+## 4. `.claude/commands/gflow/` skill files
+
+Scan all skills for stale phase/version references:
+
+```bash
+grep -rn "v[0-9]\+\.[0-9]\|Phase [A-Z0-9]" .claude/commands/gflow/
+```
+
+Update in the release prep commit if any references are wrong.
+
+---
+
+## 5. CHANGELOG link footer
+
+```bash
+# Verify [Unreleased] compares from the new version, not an older one
+tail -10 CHANGELOG.md
+```
+
+Must read: `[Unreleased]: …compare/vNEW_VERSION…HEAD`
+
+---
+
+## 6. Memory files
+
+Check `C:\Users\ffrol\.claude\projects\C--development-github-gflow-cli\memory\`:
+
+| File | What to verify |
+|---|---|
+| `MEMORY.md` | All listed files exist; no dangling entries |
+| `phase-b-followups.md` | Items shipped in this release marked done |
+| `video-generation-spec.md` | PR/status accurate |
+| `image-generation-401-next.md` | Resolution status and evidence pointer still valid |
+| `release-signing.md` | Procedure section matches what was actually done |
+
+```bash
+# Check MEMORY.md index integrity
+cd "C:\Users\ffrol\.claude\projects\C--development-github-gflow-cli\memory"
+grep -o '\[.*\]([^)]*\.md)' MEMORY.md | grep -o '([^)]*)' | tr -d '()' | while read f; do
+  [ -f "$f" ] || echo "DEAD LINK: $f"
+done
+```
+
+---
+
+## 7. Stale file cleanup (optional)
+
+Flag (do not delete without user confirmation):
+
+- Temporary debugging artifacts in `docs/` or repo root that were never meant to be permanent
+- Draft specs whose work has fully shipped (move to `docs/archive/` or add "SHIPPED" header)
+- `LIVE_VERIFICATION` files older than two releases that could be archived
+
+Always ask the user before removing or archiving.
+
+---
+
+## Output format
+
+After each section write one line:
+
+```
+[1] Version refs      — PASS
+[2] INDEX completeness — UPDATED (added LIVE_VERIFICATION_v0.7.0.md entry)
+[3] Evidence file     — PASS
+[4] Skill files       — UPDATED (removed stale "Phase A in progress" in plan.md)
+[5] CHANGELOG footer  — PASS
+[6] Memory files      — WARN: release-signing.md procedure section may need update — check with user
+[7] Stale files       — PASS
+```
+
+Then list every **UPDATED** change and every **WARN** / **FAIL** finding for the user to review.
+
+---
+
+## Integration with `/gflow:release`
+
+This skill is invoked at **step 9** of `/gflow:release` (between "review commands for staleness" and "commit the release prep"). All discovered fixes are folded into the release prep commit unless genuinely unrelated to the release.

gflow_cli-0.8.0/.claude/commands/gflow/known-issues.md

@@ -0,0 +1,20 @@
+---
+description: Surface open known issues. Call before touching auth, reCAPTCHA, or anything previously flagged.
+---
+
+# `/gflow:known-issues` — Open issues
+
+Read KNOWN_ISSUES.md and return items that are still open or mitigated (not resolved).
+
+## Steps
+
+1. Read [KNOWN_ISSUES.md](../../../KNOWN_ISSUES.md)
+2. Return only items with status **open** or **mitigated**
+3. Flag any that are relevant to the current task context
+
+## When to call
+
+- Before touching `src/gflow_cli/auth.py`
+- Before touching `src/gflow_cli/api/recaptcha.py`
+- Before any work the user flags as "this felt flaky before"
+- When a test or behaviour feels unexpectedly broken

gflow_cli-0.8.0/.claude/commands/gflow/plan.md

@@ -0,0 +1,39 @@
+---
+description: Show the active plan — next task if a superpowers plan is running, current phase otherwise.
+---
+
+# `/gflow:plan` — Active plan
+
+## Steps
+
+**1. Check conversation context.**
+
+Has the user mentioned a specific feature or invoked the write-plan skill in this session?
+If yes, note the feature name (e.g. `shell-multi-prompt`, `image-mvp`, `phase-4-hardening`).
+
+**2. Run the discovery script.**
+
+With a feature name identified in step 1:
+```bash
+uv run python scripts/dev/active_plan.py --feature <feature-name>
+```
+
+Without a feature name (uses most-recent superpowers plan, falls back to PLAN.md):
+```bash
+uv run python scripts/dev/active_plan.py
+```
+
+**3. Return the output verbatim.**
+
+The script already filters to the relevant block. Do not read additional files.
+
+## What the script returns
+
+- **Superpowers plan active:** file path, title, goal, progress (X/N steps), and the next unchecked task block
+- **No superpowers plan:** the first incomplete phase from `PLAN.md` (scope, sequence, definition of done)
+
+## When to call
+
+- When starting a task and unsure what's in scope
+- When the user asks "what are we working on?" or "what's next?"
+- Before adding a feature, to check it belongs to the current scope

gflow_cli-0.8.0/.claude/commands/gflow/release.md

@@ -0,0 +1,168 @@
+---
+description: Cut a new gflow-cli release — bump version, update CHANGELOG, tag, push, and back-merge.
+---
+
+# `/gflow:release` — Cut a new release
+
+Follow this sequence verbatim. Every step matters.
+
+> **Branch-protection note:** `main` blocks direct pushes. The release commit travels
+> via a `chore/release-vX.Y.Z` branch PR. The signed tag is pushed independently
+> (tag pushes bypass branch protection and trigger the CI release workflow immediately).
+
+## Inputs
+
+Ask the user (if not already provided):
+
+1. **Version** — the new version (e.g. `0.4.0`, `0.4.0a3`, `1.0.0rc1`). Use PEP 440 prerelease suffixes (`aN`, `bN`, `rcN`). If they don't know, run `/gflow:changelog` first and propose the next bump (PATCH for fixes only, MINOR for new features, MAJOR for breaks).
+2. **Pre-release?** — prerelease versions stay marked as GitHub prereleases. Only the user can say when a release line is ready for the stable tag.
+
+---
+
+## Sequence
+
+**1. Review what's queued.**
+
+Run `/gflow:changelog` — confirm the `[Unreleased]` block is non-empty and accurate before proceeding.
+
+**2. Verify clean working tree.**
+
+```bash
+git status --short
+```
+
+Must be empty. If not, abort and tell the user to commit or stash first.
+
+**3. Verify `main` is up-to-date.**
+
+```bash
+git rev-parse --abbrev-ref HEAD     # must be "main"
+git fetch origin
+git rev-list HEAD..origin/main      # must be empty
+```
+
+If not on `main`, switch: `git checkout main && git pull origin main`.
+If `main` is behind, pull first.
+
+**4. Run quality gates.**
+
+Run `/gflow:check` — all gates must pass. Abort if any fail.
+
+**5. Create a release branch.**
+
+```bash
+git checkout -b chore/release-v<NEW_VERSION>
+```
+
+All release prep commits live here; this branch gets PR'd into `main`.
+
+**6. Bump version** in `pyproject.toml`:
+
+```toml
+[project]
+version = "<NEW_VERSION>"
+```
+
+**7. Bump package version** in `src/gflow_cli/__init__.py`:
+
+```python
+__version__ = "<NEW_VERSION>"
+```
+
+**8. Update version assertion tests** if present:
+
+```bash
+rg -n "__version__|<OLD_VERSION>|version assertion" tests src pyproject.toml
+```
+
+**9. Migrate CHANGELOG.**
+
+- Move all entries under `## [Unreleased]` to a new `## [<NEW_VERSION>] — YYYY-MM-DD` section.
+- Leave `## [Unreleased]` empty.
+- Update the link footer:
+  ```
+  [Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v<NEW_VERSION>...HEAD
+  [<NEW_VERSION>]: https://github.com/ffroliva/gflow-cli/releases/tag/v<NEW_VERSION>
+  ```
+
+**10. Run the documentation review gate.**
+
+Run `/gflow:doc-review` — audit all version refs, INDEX completeness, evidence files, skill files, CHANGELOG footer, and memory files. Fix every **FAIL** before continuing. Fold all discovered fixes into the release prep commit.
+
+**11. Commit the release prep.**
+
+```bash
+git add pyproject.toml src/gflow_cli/__init__.py CHANGELOG.md
+git add docs/ .claude/commands/gflow/        # include any doc-review fixes
+git commit -m "chore(release): v<NEW_VERSION>"
+```
+
+**12. Tag the release commit.** Use `-s` for a signed annotated tag so GitHub shows **"Verified"** AND `.github/workflows/release.yml` passes the signed-tag gate (unsigned or lightweight tags are rejected by CI).
+
+```bash
+git tag -s v<NEW_VERSION> -m "v<NEW_VERSION>"
+```
+
+Signing requirements:
+- **SSH signing (preferred):** `git config --global gpg.format ssh` + `user.signingkey` pointing at your public key.
+- **GPG:** any registered GPG key works.
+- Run `git config --global user.signingkey` to confirm a key is configured.
+
+**13. Push the tag first** (bypasses branch protection; triggers the CI release workflow immediately):
+
+```bash
+git push origin v<NEW_VERSION>
+```
+
+CI will start building the release. Watch <https://github.com/ffroliva/gflow-cli/actions>.
+
+**14. Push the release branch and open the PR.**
+
+```bash
+git push origin chore/release-v<NEW_VERSION>
+```
+
+Open PR `chore/release-v<NEW_VERSION> → main` with title `chore(release): v<NEW_VERSION>`. Merge it once CI is green. (The release workflow already ran from the tag push in step 13 — the PR is to keep `main` up-to-date with the bump commit.)
+
+**15. Back-merge `main` into `develop`.**
+
+After the release PR is merged, bring the bump commit back to `develop` so branches stay aligned:
+
+```bash
+git checkout develop
+git pull origin develop
+git fetch origin main
+git merge origin/main --no-ff -m "chore: back-merge main (v<NEW_VERSION>) into develop"
+git push origin develop
+```
+
+If there are conflicts (rare — only if `develop` has commits that touched the same lines as the bump), resolve them, keeping `develop`'s unreleased work and `main`'s version bump.
+
+**16. Report.**
+
+Tell the user:
+- Tag push triggered `.github/workflows/release.yml`.
+- Watch <https://github.com/ffroliva/gflow-cli/actions> for the release workflow.
+- On success: PyPI publish + GitHub Release with auto-generated notes.
+- On failure (most common: PyPI Trusted Publishing not yet configured): point to <https://pypi.org/manage/account/publishing/>.
+- `develop` is now synced with `main` (back-merge done in step 15).
+- Next development cycle starts on `develop` — open `## [Unreleased]` in CHANGELOG is ready.
+
+---
+
+## Critical reminders
+
+- **NEVER** add `Co-Authored-By: Claude` (or any AI co-author) to the release commit.
+- **NEVER** force-push a release tag once it's on GitHub. Ship a PATCH fix instead.
+- **NEVER** `--no-verify` past hooks. Fix the underlying issue.
+- **NEVER** push directly to `main` — branch protection will reject it. Always use a PR.
+- If quality gates fail at step 4, **STOP**. Surface the failures to the user.
+- If doc-review fails at step 10, **STOP**. Fix before committing.
+
+---
+
+## See also
+
+- [RELEASE.md](../../../RELEASE.md) — full release protocol, prerelease policy, and checklist
+- [README § Releases](../../../README.md#releases) — release policy and cadence
+- [PLAN § Phase 5](../../../PLAN.md#phase-5--public-alpha-release-on-pypi) — first-release exit criteria

gflow_cli-0.8.0/.continue-here.md

@@ -0,0 +1,118 @@
+---
+phase: phase-b-video-download
+task: 0
+total_tasks: 6
+status: ready_to_execute
+last_updated: 2026-05-20T16:22:15.971Z
+---
+
+<current_state>
+Plan written and saved. No code written yet. Ready to execute Task 1 of 6.
+
+Branch: develop (clean, up-to-date after back-merge of main v0.7.0)
+Plan file: docs/superpowers/plans/2026-05-20-video-download-t2v-cli.md
+</current_state>
+
+<completed_work>
+
+This session (prior to plan writing):
+- v0.7.0 release protocol fixed: new /gflow:release (16 steps) with branch-protection-aware push, doc-review gate, back-merge step
+- New /gflow:doc-review skill created at .claude/commands/gflow/doc-review.md
+- PR #34 merged to develop; back-merge main (v0.7.0) → develop done (d012bcd)
+- Memory items D and F in phase-b-followups.md marked resolved
+- develop is fully clean and synced with main
+
+Plan tasks (NOT YET STARTED — all 6 remain):
+- Task 1: VideoResult dataclass in api/video.py
+- Task 2: _download_video helper on VideoGenerationMixin
+- Task 3: generate_video returns VideoResult, gains download=True param
+- Task 4: FlowApiClient.download_video wraps self.download()
+- Task 5: gflow video t2v CLI restored (--aspect / --profile / --out-dir)
+- Task 6: CHANGELOG entries
+</completed_work>
+
+<remaining_work>
+
+All 6 plan tasks. Execute in order — each has TDD steps (RED→GREEN→commit).
+
+Task 1: VideoResult dataclass
+  - Add to src/gflow_cli/api/video.py after VideoStatus
+  - Test in tests/api/test_video.py
+
+Task 2: _download_video on VideoGenerationMixin
+  - Add to src/gflow_cli/api/transports/ui_automation_video.py
+  - Uses page.request.get(routes.media_download_url(media_id), max_redirects=5, timeout=180_000)
+  - Test in tests/api/transports/test_ui_automation_video.py
+
+Task 3: Update generate_video signature
+  - Add download: bool = True param
+  - Return type VideoStatus → VideoResult
+  - After _poll_video_status: if download and status.succeeded → _download_video
+  - Both generate_video and _generate_video_locked change signatures
+
+Task 4: FlowApiClient.download_video
+  - 3-line wrapper: return await self.download(media_id, out_path)
+  - Add after download_image in src/gflow_cli/api/client.py
+  - Test in tests/api/test_client.py
+
+Task 5: cli_video.py T2V restoration
+  - Replace entire file content (plan has full replacement)
+  - Uses UiAutomationTransport directly (not FlowApiClient)
+  - prompt becomes required argument (was optional)
+  - New options: --aspect (9:16/16:9), --profile, --out-dir
+  - Test in tests/cli/test_cli_video.py
+
+Task 6: CHANGELOG
+  - Add entries under [Unreleased]
+</remaining_work>
+
+<decisions_made>
+
+- VideoResult(status: VideoStatus, local_path: Path | None) — new frozen dataclass,
+  NOT a tuple, for clean ergonomics (same pattern as GeneratedImage on image side)
+
+- generate_video is a breaking change (VideoStatus → VideoResult return type) —
+  acceptable in Phase B; no external callers known
+
+- _run_t2v uses UiAutomationTransport directly, NOT FlowApiClient —
+  YAGNI: FlowApiClient.generate_video wrapper deferred; transport pattern
+  proven by tmp/fetch_video.py
+
+- Download uses page.request.get (Playwright, follows 302 natively) NOT httpx —
+  httpx _download static method is image-only and doesn't follow redirects;
+  video needs the 302 to GCS followed with auth context
+
+- Aspect.from_cli() used in CLI (not a hand-rolled mapping) — already exists in
+  src/gflow_cli/api/video.py line 37
+
+- Default aspect for t2v CLI: 9:16 (PORTRAIT) — matches GenerateVideoRequest default
+</decisions_made>
+
+<blockers>
+None. Plan is fully self-contained and executable.
+</blockers>
+
+<context>
+Phase B of gflow-cli. Phase A shipped T2V transport (generate_video on
+UiAutomationTransport) in v0.7.0 but generate_video never downloaded the mp4.
+This plan adds the download primitive and wires the CLI.
+
+Key files to understand:
+- src/gflow_cli/api/video.py — VideoStatus, GenerateVideoRequest, Aspect.from_cli()
+- src/gflow_cli/api/transports/ui_automation_video.py — VideoGenerationMixin, generate_video, _poll_video_status
+- src/gflow_cli/api/routes.py — media_download_url(media_id) → getMediaUrlRedirect URL
+- src/gflow_cli/api/client.py — download() at ~line 510 (already handles the redirect)
+- src/gflow_cli/cli_video.py — all stubs, full replacement planned
+- tmp/fetch_video.py — throwaway proof-of-concept for the download approach
+
+After this plan, the remaining Phase B items are:
+- I2V on UiAutomationTransport (Mode.I2V raises NotImplementedError)
+- R2V on UiAutomationTransport (Mode.R2V raises NotImplementedError)
+- T2V portrait live verification (one credit, one run)
+- Listener-miss flake investigation
+</context>
+
+<next_action>
+Read docs/superpowers/plans/2026-05-20-video-download-t2v-cli.md then
+invoke superpowers:subagent-driven-development to execute Task 1.
+</next_action>

{gflow_cli-0.6.0a6 → gflow_cli-0.8.0}/.github/CODEOWNERS

@@ -20,3 +20,4 @@
 
 # Auth handling — sensitive, never bypass review
 /src/gflow_cli/auth.py  @ffroliva
+/src/gflow_cli/auth/    @ffroliva

gflow_cli-0.8.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## Summary
+
+<!-- What changed and why? Link issues with "Fixes #123" when applicable. -->
+
+## Validation
+
+<!-- List the focused commands you ran, plus any checks you could not run. -->
+
+- [ ] Focused tests added or updated for behavior changes
+- [ ] `uv run ruff check src tests`
+- [ ] `uv run pyright src`
+- [ ] Relevant pytest command:
+
+## Contribution Checklist
+
+- [ ] This PR targets `develop`, unless it is a release or emergency fix
+- [ ] My commits use my real Git identity or GitHub noreply email
+- [ ] External contribution commits include `Signed-off-by:` (`git commit -s`)
+- [ ] I did not include secrets, cookies, account tokens, signed URLs, or private captured data
+- [ ] I reviewed any AI-assisted changes before submitting

gflow_cli-0.8.0/.github/copilot-instructions.md

@@ -0,0 +1,24 @@
+# Copilot Code Review Instructions
+
+Review this repository as a Python CLI that automates browser-authenticated
+Google Flow workflows. Treat auth, browser automation, CI, release, and secret
+handling changes as high-risk even when the diff is small.
+
+For pull request reviews:
+
+- Check that PRs target `develop`, unless they are release PRs.
+- Flag unclear contributor provenance, missing DCO sign-off, placeholder author
+  emails, and any copied private data.
+- Look for leaked tokens, cookies, signed URLs, local profile paths, and captured
+  Google/Flow request data.
+- For auth/browser changes, check that the implementation preserves profile
+  isolation, does not weaken local path boundaries, and avoids remote debugging
+  unless explicitly documented.
+- For CI changes, check forked-PR secret behavior and avoid recommending
+  `pull_request_target` for jobs that checkout or execute contributor code.
+- For behavior changes, expect focused tests and docs/changelog updates.
+- Keep findings concrete: reference files/lines, explain the user-visible risk,
+  and separate blocking issues from cosmetic suggestions.
+
+Do not approve pull requests. Copilot review is advisory; maintainer approval is
+still required.