gflow-cli 0.62.0__tar.gz → 0.63.0__tar.gz

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

gflow_cli-0.63.0/.github/FUNDING.yml

@@ -0,0 +1,2 @@
+# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+github: ffroliva

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/.github/workflows/scorecard.yml

@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: results.sarif

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/AGENTS.md

@@ -4,12 +4,47 @@
 
 Supported tools that auto-discover this file: Cursor, Codex, Aider, Antigravity (`agy`), Jules, Devin, Windsurf, Zed, Warp, opencode, RooCode, Amp, Junie, Phoenix, GitHub Copilot, VS Code, Factory, Augment, Semgrep, Kilo Code, UiPath. Claude Code reads [CLAUDE.md](CLAUDE.md), which cross-references this file.
 
+## Skill Routing — the default workflow, not a menu
+
+**The `/gflow:` skills ARE this project's development lifecycle.** They are not
+optional tooling you may reach for; they are how work is done here. If a row below
+matches your situation, load that skill **before acting** — before exploring the
+codebase, before answering, before editing. A skill loaded after the work is a skill
+that did not run.
+
+| If you are about to… | Load first | Non-negotiable because |
+|---|---|---|
+| Touch a GitHub issue | `/gflow:issue-assessment <N>` | Read-only triage precedes any fix; classification changes what "fixing" means |
+| Propose a transport, auth, selector, or schema change | `/gflow:predict <proposal>` | Five adversarial personas return GO / CAUTION / STOP before code exists |
+| Start a feature | `/gflow:scenario` → `/gflow:plan` | Edge cases before tasks; tasks before code |
+| Resume work / ask "where are we?" | `/gflow:status` | The current plan's next unchecked task is the answer, not your guess |
+| Commit **anything** | `/gflow:check` | It is the exact CI gate; skipping it is how a format failure shipped past an 8-agent council (PR #269) |
+| Open or review a PR | `/gflow:pr-council-review <N>` (or `/gflow:branch-review`) | Standing-authorized. Run it — do not ask permission first |
+| Claim a generation feature works | `/gflow:live-verify` | Offline-green is never done-done on a generation path |
+| Cut a release | `/gflow:release` | It hard-gates on changelog → check → live-verify → doc-review; each is a STOP |
+| Audit docs before shipping | `/gflow:doc-review` | Catches same-release errors a read-through cannot |
+| See a red SonarCloud check | `/gflow:sonar <N>` | The gate measures *new* code; the fix is rarely where you would look |
+| Touch auth or reCAPTCHA | `/gflow:known-issues` | Known-broken surfaces have documented workarounds; rediscovering them costs days |
+
+**Canonical bodies live in `skills/<name>/SKILL.md`** — plain Markdown, agent-agnostic
+by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code reads.
+`.claude/commands/gflow/*.md` are thin Claude-Code wrappers that point at them.
+
+> **This table exists because routing by memory failed.** On 2026-09-01 an agent worked
+> a full session — recovering two interrupted sessions, merging five PRs — without ever
+> loading this file, because `CLAUDE.md` only *asked* it to. It reached step 10 of a
+> release before meeting the pipeline's own doc-review gate, and the required
+> `LIVE_VERIFICATION_v0.63.0.md` had not been written despite the feature having been
+> live-verified. `CLAUDE.md` now `@`-imports this file, so it is always in context. The
+> table is the other half: being loaded is useless if the mapping from situation to skill
+> is left to recall.
+
 ## Project at a glance
 
 - Unofficial Python CLI for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com`.
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
-- Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `composition.py`, `config.py`, `errors.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
-- Command surface: `gflow auth`, `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain — no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow models`, `gflow run`, `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
+- Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
+- Command surface: `gflow auth`, `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow project`, `gflow models`, `gflow run`, `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
 - Works with any Google account that has Flow access. All generations bill against the user's own Google account.
 
 ## Headed-browser dependency (architectural reality)
@@ -58,7 +93,7 @@ Or invoke the wrapper: `/gflow:check`.
 
 - Type hints everywhere; `pyright` strict on `src/gflow_cli`.
 - Structured logging only (`structlog`) — **never** raw `print()` or `import logging` in `src/`.
-- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–31, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
+- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–35, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
 - 100-char line length, `ruff` configured. Imports sorted by `ruff` (isort rules).
 - **YAGNI / least-code**: prefer the smallest change that works. No speculative abstractions (interface/factory with one implementation), no config or flags nobody sets, no dead constants/helpers, no reinventing the stdlib. Review carries this as its own lens — the **D14 over-engineering** dimension of [`pr-council-review`](skills/pr-council-review/SKILL.md) (baseline, always runs). Its rubric is portable; the `ponytail` plugin (see CONTRIBUTING) is an optional accelerant, not a dependency.
 - **MCP & CLI Schema Symmetry**: Any updates or additions to user-facing CLI command parameters (e.g., `gflow image t2i`, `gflow video`) must be mirrored in the corresponding MCP tool definitions. Never add option/argument fields to Click commands without updating the MCP server implementation. This symmetry is enforced programmatically in CI via `tests/mcp/test_cli_parity.py` (every CLI leaf command needs a mapped MCP tool or an explicit, reasoned exemption) plus the schema checks in `tests/mcp/test_server.py`.
@@ -97,7 +132,7 @@ All AI agents and harnesses working on `gflow-cli` follow this standard 10-phase
 | 7. Pre-Commit Quality | `/gflow:check` | The Impeccable Routine (hygiene, ruff, pyright, pytest) | All green local checks |
 | 8. Live Verification | `/gflow:live-verify` | 5-layer proof against real Flow transport | `docs/LIVE_VERIFICATION_vX.Y.Z.md` |
 | 9. PR & Issue Close | `/gflow:issue-resolve <N>` | PR, SonarCloud 0-issue gate, merge to develop | Closed GitHub issue |
-| 10. Release Pipeline | `/gflow:release` | Version bump, signed tag (`git tag -s`), PyPI publish | Shipped release & back-merge |
+| 10. Release Pipeline | `/gflow:release` | Version bump, signed tag (`git tag -s`), PyPI publish. **Internally gates on `/gflow:changelog` → `/gflow:check` → `/gflow:live-verify` → `/gflow:doc-review`; a failure at any of them is a STOP, not a warning.** | Shipped release & back-merge |
 
 ### Pipeline Continuation Mandate
 

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/CHANGELOG.md

@@ -7,6 +7,119 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.63.0] — 2026-09-01
+
+### Added
+
+- **`gflow video extend` — continue a clip past Flow's 8-second ceiling.** Veo's
+  extend route generates a new 8s segment seeded server-side from the source
+  clip, so motion and audio carry across the join instead of restarting from a
+  still (which is what `video chain` does, and why it needs a fade guard). Pass
+  one prompt per segment, or `--segments N` to reuse the last one:
+
+  ```bash
+  gflow video extend <media-id> "the wave recedes" --project <id>
+  gflow video extend <media-id> "drifts out to sea" --project <id> -n 4 -o long.mp4
+  ```
+
+  The result is a Flow Scene; `-o` renders it to a single mp4 through the
+  existing credit-free server-side concat.
+
+  > Known limitation, found in live verification: a segment carries ~7s of real
+  > content though Flow advertises and bills 8s, so each internal seam of a
+  > multi-segment render is preceded by ~1s of frozen frame and silence. Single
+  > segments are unaffected. Details and the open questions are in
+  > [KNOWN_ISSUES](KNOWN_ISSUES.md).
+
+  - **The model key is resolved per run, never hardcoded.** Flow's extend family
+    is tier-gated — `_ultra` variants are Advanced-only and read `UNAVAILABLE`
+    elsewhere — so the key comes from the account's own capability listing,
+    picking the cheapest orderable model exactly as Flow's own UI does. A pinned
+    key would 403 forever on the wrong tier.
+  - **Costs are shown before anything is submitted**, and a pre-flight balance
+    check refuses a run the balance cannot finish. `--dry-run` prints the plan
+    without opening a browser.
+  - **Serial by construction, and paced.** Segments submit one at a time with a
+    non-zero default jitter (`GFLOW_CLI_JITTER_RANGE`). A refusal aborts with
+    completed segments preserved and is never auto-retried.
+  - `1:1` is refused up front — Flow publishes no square extend model.
+
+### Fixed
+
+- **Ctrl+C during a billed run said nothing.** `run_with_handlers` exited 130
+  silently, so a user who interrupted a multi-segment run could not tell whether
+  anything had been charged or how to resume. It now reports credits spent,
+  segments completed and the resume handle. Fixed at the shared boundary, so
+  `video chain` and `movie run` gain it too.
+- **`sessionId` was not redacted.** `redact_metadata` covered `token` and
+  `recaptchaToken` but not `sessionId`, which the extend request carries. Not a
+  credential, but account-correlatable, and it would otherwise reach any logged
+  request body or diagnostics bundle verbatim.
+
+
+- **The offline test suite could `git checkout develop` in the developer's own
+  clone ([#605](https://github.com/ffroliva/gflow-cli/issues/605)).** git's
+  repository discovery walks *up* from `cwd`, and `--basetemp=tmp/pytest` puts
+  every `tmp_path` inside this repository, so an autopilot test whose temp `.git`
+  went missing had its `git checkout develop` silently resolved against the real
+  working tree — moving the developer off their branch mid-run (reflog-confirmed,
+  Windows-only, intermittent). Two independent guards now close it:
+  `scripts/autopilot/pr_triage_autopilot.py` pins every git call with
+  `--git-dir`/`--work-tree`, so a `repo_dir` that is not a repository fails loudly,
+  raising with git's own `fatal: not a git repository` text rather than
+  retargeting whatever clone encloses it (this also
+  hardens the VPS triage path against a mistyped `--repo-dir`), and
+  `tests/conftest.py` sets `GIT_CEILING_DIRECTORIES` to pytest's basetemp so no
+  test can walk out of its temp dir into this repo. What removed the temp `.git`
+  is still unexplained — it now surfaces as a plain "not a git repository" rather
+  than a silent branch switch.
+
+## [0.62.1] — 2026-08-30
+
+### Fixed
+
+- **`--model omni-flash` was unselectable after Flow renamed the picker entry
+  `Omni Flash` -> `Omni 1.1 Flash`
+  ([#604](https://github.com/ffroliva/gflow-cli/pull/604)).** Every explicit
+  `--model omni-flash` run failed with `VideoModelSelectionError` (exit 18) — the
+  fail-loud gate worked, so no credits were spent and nothing was billed to the
+  wrong tier, but the model could not be chosen. The selector now spans the
+  injected version segment, so it matches the old label, the current one, and the
+  next bump, while staying unique against the four `Veo 3.1 - *` tiers and
+  excluding any future `[Lower Priority]` Omni variant. The same
+  literal is fixed in `scripts/dev/spike_omni_flash_i2v_ui_recon.py`. The CLI
+  alias (`--model omni-flash`) and the enum value (`omni_flash`) deliberately did
+  not change — they are gflow's own contract for chain files, resume state, and
+  JSON output. Why `has-text` broke, and when *not* to widen a selector this way:
+  [KNOWN_ISSUES.md](KNOWN_ISSUES.md), 2026-08-30 correction.
+
+### Added
+
+- **[`docs/ACCOUNT_SAFETY.md`](docs/ACCOUNT_SAFETY.md) — one honest page answering
+  "will this get my account flagged?"
+  ([#602](https://github.com/ffroliva/gflow-cli/issues/602)).** Two Reddit
+  commenters asked the same question from opposite directions on the same day, and
+  the answer existed only as fragments across README, `DISCLAIMER.md`,
+  `DEBUGGING § WAF cadence`, `KNOWN_ISSUES` and `CONFIGURATION` — findable if you
+  already knew where to look, invisible to someone deciding whether to install.
+  The page separates the three things people conflate (a quota limit, a per-profile
+  WAF block, an account ban — only the first two have ever been observed here),
+  states what the tool does to stay unremarkable (headed real Chrome because
+  headless is an instant 403, ±25% randomisation on every interaction, 0.5–1.5 s
+  submission pacing, one project per multi-prompt run, isolated per-account
+  profiles, refuse-don't-retry), what it deliberately does **not** do (no proxy
+  rotation, no fingerprint spoofing beyond the opt-in patched engine, no headless
+  unlock, no pretence that it isn't automation), the knobs worth turning, the
+  [#241](https://github.com/ffroliva/gflow-cli/issues/241) field data on what
+  actually triggered a 403, and what cannot be promised. Linked from the README
+  banner, `docs/INDEX.md`, and back-linked from all three deep sources; published
+  to the docs site under Getting started.
+
+- Clarified in [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_jitter_range) that
+  `GFLOW_CLI_JITTER_RANGE` paces *submissions between prompts* and is a different
+  mechanism from the always-on ±25% per-interaction randomisation — the two were
+  easy to read as one knob.
+
 ## [0.62.0] — 2026-08-28
 
 ### Changed
@@ -3402,7 +3515,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.62.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...HEAD
+[0.63.0]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...v0.63.0
+[0.62.1]: https://github.com/ffroliva/gflow-cli/compare/v0.62.0...v0.62.1
 [0.62.0]: https://github.com/ffroliva/gflow-cli/compare/v0.61.0...v0.62.0
 [0.61.0]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...v0.61.0
 [0.60.0]: https://github.com/ffroliva/gflow-cli/compare/v0.59.0...v0.60.0

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/CLAUDE.md

@@ -6,11 +6,30 @@
 
 `gflow-cli` is an unofficial Python CLI that drives [Google Flow](https://labs.google/fx/tools/flow) (Veo image-to-video, Imagen text-to-image) from the terminal by reverse-engineering Flow's private REST API. See [README.md](README.md) for the user-facing overview.
 
+## System rules — loaded, not requested
+
+**[AGENTS.md](AGENTS.md) is imported below and is therefore already in context before
+you read this line.** It is the system rule for this project: the `/gflow:` skills are
+the default development lifecycle, and its Skill Routing table says which one to load
+for the situation in front of you. Follow it — it is not advisory, and "I hadn't read
+it yet" is not a reachable state.
+
+> **Why an import and not a bullet that says "read AGENTS.md".** That bullet is what
+> used to be here, and it failed exactly as written: an agent that skips it is not
+> corrected by anything, and no gate notices. A session on 2026-09-01 went straight
+> into work without it and reached step 10 of a release before discovering the
+> pipeline's own doc-review and live-verification gates. `@AGENTS.md` removes the
+> choice — the harness resolves the import and injects the file, with no agent
+> cooperation required. Never downgrade this back to prose.
+
+@AGENTS.md
+
 ## On every session start
 
-1. Read **[AGENTS.md](AGENTS.md)** — universal rules every agent must follow.
-2. Read **[docs/INDEX.md](docs/INDEX.md)** — routing layer for all project docs and commands.
-3. Pull deeper context on demand:
+1. Read **[docs/INDEX.md](docs/INDEX.md)** — routing layer for all project docs and
+   commands. Deliberately *not* imported: at 36 KB it is a lookup table, not a rule set,
+   and AGENTS.md points into it. Read it when you need to find a doc.
+2. Pull deeper context on demand:
    - Current task / where we left off → `/gflow:status`
    - Starting a new feature → `/gflow:predict` → `/gflow:scenario` → `/gflow:plan <feature>`
    - Touching auth or reCAPTCHA → `/gflow:known-issues`
@@ -20,8 +39,15 @@
 
 ## Claude-Code-specific
 
-- Slash commands live under `.claude/commands/gflow/` (all prefixed `/gflow:`).
-- Skills under `skills/` are auto-discoverable; `gflow-cli` ships its own at [`skills/gflow-cli/SKILL.md`](skills/gflow-cli/SKILL.md).
+- Slash commands live under `.claude/commands/gflow/` (all prefixed `/gflow:`). **These
+  are the invocable surface** — they appear in the session's skill list and may be called
+  with the `Skill` tool as `gflow:<name>`.
+- **`skills/<name>/SKILL.md` are the canonical bodies, and are NOT `Skill`-tool-invocable.**
+  They are plain Markdown, agent-agnostic on purpose so Codex/Cursor/Aider can read the
+  same file. `Skill(skill="release")` fails with `Unknown skill: release`; each wrapper in
+  `.claude/commands/gflow/` says to read its `skills/<name>/SKILL.md` directly, and that is
+  the supported path. (This bullet previously claimed they were "auto-discoverable", which
+  is false and sends agents into a failing tool call.)
 - Auto-memory at `~/.claude/projects/C--development-github-gflow-cli/memory/MEMORY.md` carries cross-session feedback and project state.
 - **Worktrees:** the native `EnterWorktree` tool branches from `origin/main` (the default branch). Feature work integrates via `develop` — after entering a fresh worktree, immediately `git switch -c <type>/<name> origin/develop` and delete the auto-created `worktree-*` branch. On Windows, worktree removal can fail on a file lock (the worktree's `.venv`); `git worktree prune` + manual delete later is fine.
 

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/KNOWN_ISSUES.md

@@ -14,6 +14,58 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second
+
+- **Status:** Open · **Severity:** Medium (audible/visible on every internal seam of a chained extend) · **Affected:** `gflow video extend -n >1` with `-o`, and any scene mixing extend segments
+- **Discovered:** 2026-09-01, by live verification of the extend feature. Offline tests could not have found it.
+
+**What happens.** `gflow video extend ... -n 2 -o out.mp4` produces a file whose
+audio drops to digital silence (−91 dB) for exactly one second before each
+internal seam, over a **frozen video frame**. The seam itself is clean; the dead
+second sits immediately before it.
+
+**Measured.** In a 3-clip render (original + 2 extensions), per-second mean volume:
+
+```
+ 7s -28.8   8s -26.4      <- original -> extension seam: continuous
+14s -29.1  15s -75.1  16s -33.9   <- extension -> extension seam: 1s dropout
+```
+
+Finer slices put the silence at 15.00–15.99s exactly. Reproduced independently on
+a second render made days earlier from different prompts (14s −22.4, **15s −70.1**,
+16s −23.9), so it is systematic, not a one-off.
+
+**Root cause.** The extension media is **7.000000 seconds** — both video and audio
+streams, confirmed by `ffprobe` on the downloaded clip. But:
+
+- the capability listing advertises `videoLengthSeconds: 8` for
+  `veo_3_1_extension_lite`, and
+- `getSceneWorkflows` reports `total_duration=8.0`, `end=8.0` for that clip.
+
+`ConcatInput` passes those metadata values through verbatim, so Flow's
+server-side concat stretches a 7s clip into an 8s slot by holding the last frame
+and muting. The final segment escapes it only because the render ends before its
+padding (23.02s for 3 clips, not 24s).
+
+**Why it matters more than it looks.** A freeze-hold is the specific failure the
+Compiled Growth parable runbook forbids — *"NEVER pad by freeze-holding a frame —
+reads as 'video stuck'"* — and that pipeline is the named consumer for extend.
+An N-segment chain has N−1 of these.
+
+**Not yet established** (do not fix on a guess):
+
+- whether 7.0s is constant across extend models, aspects and tiers, or specific
+  to `veo_3_1_extension_lite`;
+- whether Flow's own UI renders the same padding (i.e. whether this is our
+  concat inputs or Flow's behaviour end-to-end);
+- whether any API field reports the real media duration, which is what a clean
+  fix needs — clamping `ConcatInput.end` to a hardcoded 7.0 would be a guess
+  dressed as a fix.
+
+**Workaround today.** Render without `-o` and trim in post, or accept the
+freeze-hold. Single-segment extends are unaffected.
+
+
 ### An out-of-range Playwright silently wedges video generation
 
 - **Status:** Mitigated (v0.49.0 — upper-bounded dependency + fail-fast watchdog)
@@ -644,6 +696,12 @@ batch — so it is not a global incompatibility but a per-profile WAF state.
    or `GFLOW_CLI_JITTER_RANGE` (#241); cadence guidance in
    [DEBUGGING § WAF cadence](docs/DEBUGGING.md#waf-cadence).
 
+> **What this means for your account:** a 403 is a *per-profile* WAF score, not an
+> account ban — the same account on a different profile has succeeded the same day.
+> The full picture (what the tool does to stay unremarkable, what it deliberately
+> does not do, and what we cannot promise) is in
+> [docs/ACCOUNT_SAFETY.md](docs/ACCOUNT_SAFETY.md).
+
 **Tracked separately from** the architectural ["first-attempt listener-miss
 flake"](https://github.com/ffroliva/gflow-cli/pull/40) — that one was caused
 by editor mode confusion and is resolved by PR #40. WAF 403 is a fresh, distinct
@@ -664,6 +722,34 @@ issue and not blocked by any code change in this repo.
   Playwright kwarg (persists across all in-session navigations). Full resolution
   gate: live e2e with `gflow image t2i` (each model) on a non-EN Chrome profile.
 
+  **2026-08-30 correction — locale-stable is not version-stable.** The claim
+  above that branded product names are safe anchors holds for *translation* and
+  nothing else. Flow renamed the video tier `Omni Flash` to `Omni 1.1 Flash`,
+  and because Playwright's `has-text` is a CONTIGUOUS substring match, a version
+  number inserted mid-label dropped `has-text('Omni Flash')` to zero matches.
+  Every explicit `--model omni-flash` run then failed loud with
+  `VideoModelSelectionError` (exit 18, no credits spent) — the fail-loud gate
+  worked exactly as designed, but the model was unusable until the selector was
+  fixed. `VIDEO_MODEL_OPTION_SELECTORS[OMNI_FLASH]` now uses two ANDed
+  `has-text` clauses (`'Omni'` + `'Flash'`) that span the version segment, plus
+  the `:not(:has-text('[Lower Priority]'))` exclusion its `VEO_3_1_LITE` sibling
+  already carries — without it an 'Omni 1.1 Flash [Lower Priority]' tier would
+  match two menuitems and put the model straight back at exit 18.
+  `tests/flow_selectors/test_model_governance.py` grades it against BOTH labels
+  Flow has shipped plus a no-collision check against the four `Veo 3.1 - *`
+  tiers. The rule this generalises to is NOT a blanket "always match tokens" —
+  it depends on whether gflow's own identifier pins the version. `omni_flash`
+  carries no version, so the `1.1` in Flow's label is noise and the anchor must
+  span it. The four `Veo 3.1 - *` selectors deliberately keep the contiguous
+  version, because `VEO_3_1_FAST = "veo_3_1_fast"` makes `3.1` part of the
+  model's identity there: if Flow replaces that tier with a `Veo 3.2`, a loud
+  MISS is the CORRECT outcome, and widening those anchors to
+  `has-text('Veo'):has-text('Fast')`-style token pairs would silently bind
+  `--model veo-fast` to a different tier at a different credit price. Ask which
+  of the two shapes you have before widening. The CLI alias (`--model omni-flash`) and the enum value
+  (`omni_flash`) are gflow's own identifiers and deliberately did NOT change —
+  they are a stable contract for chain files, resume state, and JSON output.
+
   **2026-06-12 correction (issue #170):** the "all selector groups" claim above
   had two stragglers — `PICKER_INCLUDE_BUTTON` and `PICKER_CONTEXT_INCLUDE`
   hardcoded the pt-BR caption "Incluir no comando", breaking

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.62.0
+Version: 0.63.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.4; extra == 'dev'
+Requires-Dist: ruff==0.16.5; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'
@@ -83,10 +83,13 @@ Description-Content-Type: text/markdown
 [![Type checked: pyright](https://img.shields.io/badge/type%20checked-pyright-blue.svg)](https://github.com/microsoft/pyright)
 [![Tests: TDD](https://img.shields.io/badge/tests-TDD-brightgreen.svg)](CONTRIBUTING.md)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ffroliva_gflow-cli)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
 
 > ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
 >
+> 🛡️ **"Will this get my account flagged?"** The honest, specific answer — what the tool does to stay unremarkable (headed real Chrome, randomised interaction timing, paced submissions), what it deliberately does **not** do (no proxies, no fingerprint spoofing, no pretending it isn't automation), what you can tune, and what we cannot promise — is in [docs/ACCOUNT_SAFETY.md](docs/ACCOUNT_SAFETY.md).
+>
 > 💳 **What failure costs you.** Credits are only spent on Veo *video* generation — images and composition ops are free, so most breakage costs nothing. When Flow's UI drifts mid-run, the CLI fails fast and loudly with distinct exit codes (e.g. selector drift = exit 23) instead of resubmitting, and batch items are recorded locally *before* submission so a broken run never silently burns credits on a stale state. See [KNOWN_ISSUES](KNOWN_ISSUES.md) for the current risk list.
 >
 > 🌐 **Headed browser today.** gflow drives Flow through a persistent Playwright Chromium profile, because Google's auth and reCAPTCHA gates require it. The [Architecture](#architecture--current-limitations) section shows where you can help.
@@ -95,7 +98,7 @@ Description-Content-Type: text/markdown
 
 You have a Google account with Flow access, you have Veo credits, and you run real batch work. gflow-cli gives you:
 
-- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today.
+- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today, and `gflow video extend` continues an existing clip past Flow's 8s ceiling.
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
@@ -197,7 +200,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 ## Project status
 
-**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` HTTP-SSE) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
+**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain, extend) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` Streamable HTTP) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
 
 Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project is heading: [ROADMAP.md](ROADMAP.md).
 
@@ -224,4 +227,11 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 [![GitHub repo size](https://img.shields.io/github/repo-size/ffroliva/gflow-cli?cacheSeconds=3600)](https://github.com/ffroliva/gflow-cli)
 [![PyPI downloads](https://static.pepy.tech/badge/gflow-cli/month)](https://pepy.tech/project/gflow-cli)
 
+### Star history
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+</picture>
+
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/PLAN.md

@@ -716,7 +716,7 @@ Today the CLI writes media to `$GFLOW_CLI_OUTPUT_DIR` on the local filesystem. P
 | 11 | LF-only line endings via `.gitattributes` | Single repo source of truth; cross-platform contributors don't think about it |
 | 12 | `Provider` indirection (legacy `providers/`) removed | Superseded by `api.FlowApiClient`. Re-introduce when we add `OfficialVeoProvider` (planned v0.5+) |
 | 13 | CDP attach / stealth-engine alternatives deferred; **current stealth fix confirmed sufficient 2026-07-09** | Gate met: a 20-gen live baseline through the default stealth stack showed a **0.0% WAF 403 rate**, so the "confirm insufficient before implementing" bar is unmet — CDP-Attach and the Camoufox engine stay parked (Camoufox roadmap closed at Phase 2). Evidence: [superpowers/spikes/2026-07-09-camoufox-waf-403.md](superpowers/spikes/2026-07-09-camoufox-waf-403.md). |
-| 14 | HTTP status path (`get_video_status`) retired alongside `generate_video` | It is the same 401-dead path and would collide with the new `api/video.py:VideoStatus` value object — retiring both together keeps the domain clean. |
+| 14 | HTTP status path (`get_video_status`) retired alongside `generate_video` | It is the same 401-dead path and would collide with the new `api/video.py:VideoStatus` value object — retiring both together keeps the domain clean. **Scope note 2026-08-31:** "401-dead" was measured on `batchAsyncGenerateVideoText` in 2026-05 and has NOT been re-tested. It is not a property of `/v1/video:*` as a family — `batchAsyncGenerateVideoExtendVideo` returned **200** from our own transport with our own minted token on 2026-08-31 ([spike](docs/superpowers/spikes/2026-08-31-veo-extend-route-recon.md)). Do not cite this ADR as evidence that a direct-wire video route cannot work; re-measure the specific route. |
 
 ---
 

{gflow_cli-0.62.0 → gflow_cli-0.63.0}/README.md

@@ -12,10 +12,13 @@
 [![Type checked: pyright](https://img.shields.io/badge/type%20checked-pyright-blue.svg)](https://github.com/microsoft/pyright)
 [![Tests: TDD](https://img.shields.io/badge/tests-TDD-brightgreen.svg)](CONTRIBUTING.md)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ffroliva_gflow-cli)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
 
 > ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
 >
+> 🛡️ **"Will this get my account flagged?"** The honest, specific answer — what the tool does to stay unremarkable (headed real Chrome, randomised interaction timing, paced submissions), what it deliberately does **not** do (no proxies, no fingerprint spoofing, no pretending it isn't automation), what you can tune, and what we cannot promise — is in [docs/ACCOUNT_SAFETY.md](docs/ACCOUNT_SAFETY.md).
+>
 > 💳 **What failure costs you.** Credits are only spent on Veo *video* generation — images and composition ops are free, so most breakage costs nothing. When Flow's UI drifts mid-run, the CLI fails fast and loudly with distinct exit codes (e.g. selector drift = exit 23) instead of resubmitting, and batch items are recorded locally *before* submission so a broken run never silently burns credits on a stale state. See [KNOWN_ISSUES](KNOWN_ISSUES.md) for the current risk list.
 >
 > 🌐 **Headed browser today.** gflow drives Flow through a persistent Playwright Chromium profile, because Google's auth and reCAPTCHA gates require it. The [Architecture](#architecture--current-limitations) section shows where you can help.
@@ -24,7 +27,7 @@
 
 You have a Google account with Flow access, you have Veo credits, and you run real batch work. gflow-cli gives you:
 
-- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today.
+- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today, and `gflow video extend` continues an existing clip past Flow's 8s ceiling.
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
@@ -126,7 +129,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 ## Project status
 
-**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` HTTP-SSE) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
+**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain, extend) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` Streamable HTTP) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
 
 Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project is heading: [ROADMAP.md](ROADMAP.md).
 
@@ -153,4 +156,11 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 [![GitHub repo size](https://img.shields.io/github/repo-size/ffroliva/gflow-cli?cacheSeconds=3600)](https://github.com/ffroliva/gflow-cli)
 [![PyPI downloads](https://static.pepy.tech/badge/gflow-cli/month)](https://pepy.tech/project/gflow-cli)
 
+### Star history
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+</picture>
+
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.