gflow-cli 0.64.0__tar.gz → 0.65.0__tar.gz

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

gflow_cli-0.65.0/.github/workflows/star-history-watch.yml

@@ -0,0 +1,89 @@
+name: Star history watch
+
+# ── Why this exists ──────────────────────────────────────────────────────────
+# The star-history chart in README.md is the project's front door — it renders on
+# GitHub and on the PyPI project page. When it breaks it does so SILENTLY: the
+# endpoint answers HTTP 200 with `image/svg+xml`, and the body is a "GitHub
+# restricted access to star data" placard instead of a chart. Every status-code
+# check passes. That is how it stayed broken from 2026-08-30 to 2026-09-02 with
+# no signal — a human noticed it in a browser.
+#
+# The chart depends on the `sealed_token` param surviving in the README URL
+# (GitHub restricted the public /stargazers endpoint on 2026-06-30; star-history's
+# per-repo cache expires in under 3 days without a token-bearing request). So this
+# probes for the two ways it dies: the token gets stripped, or the underlying PAT
+# expires or is revoked.
+#
+# The URL is read out of README.md rather than hardcoded here, so the probe can
+# never drift from what is actually shipped.
+
+on:
+  schedule:
+    # Daily 06:00 UTC — an hour after the selector probe, well clear of it.
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    name: Probe the README star-history chart
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.repository == 'ffroliva/gflow-cli'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Fetch each star-history URL in README.md and inspect the SVG body
+        run: |
+          set -uo pipefail
+          urls=$(grep -o 'https://api\.star-history\.com/chart?[^"]*' README.md | sort -u)
+          if [ -z "$urls" ]; then
+            echo "::error::No star-history URL found in README.md. If the chart was removed on"
+            echo "::error::purpose, delete this workflow too."
+            exit 1
+          fi
+
+          failed=0
+          while IFS= read -r url; do
+            # Redact the sealed token before anything reaches the public log.
+            safe=$(printf '%s' "$url" | sed 's/sealed_token=.\{8\}.*/sealed_token=<redacted>/')
+            echo "── $safe"
+
+            case "$url" in
+              *sealed_token=*) ;;
+              *)
+                echo "::error::sealed_token is missing from this URL. A tokenless chart reverts to"
+                echo "::error::the restriction placard within ~3 days. See the comment in README.md."
+                failed=1
+                ;;
+            esac
+
+            # Cache-bust so we measure the live endpoint, not star-history's warm cache.
+            code=$(curl -sS --max-time 30 -o body.svg -w '%{http_code}' "$url&cb=$GITHUB_RUN_ID") || {
+              echo "::warning::curl failed — treating as a transient star-history outage, not a token problem."
+              continue
+            }
+            bytes=$(wc -c < body.svg)
+            echo "   http=$code bytes=$bytes"
+
+            if [ "$code" != "200" ]; then
+              echo "::warning::HTTP $code from star-history — likely their outage, not our token."
+              continue
+            fi
+            # The whole point: a 200 is not proof. Read the SVG text.
+            if grep -qi 'restricted access to star data' body.svg; then
+              echo "::error::Chart is serving the GitHub restriction placard. The sealed token is"
+              echo "::error::present but not working — the underlying PAT has most likely expired or"
+              echo "::error::been revoked. Mint a fine-grained PAT (metadata:read on this repo), seal"
+              echo "::error::it at star-history.com, and replace the sealed_token param in README.md."
+              failed=1
+            else
+              echo "   ✅ real chart"
+            fi
+          done <<< "$urls"
+
+          exit "$failed"

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/CHANGELOG.md

@@ -7,6 +7,95 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.65.0] — 2026-09-02
+
+### Fixed
+
+- **`gflow video chain` and `gflow movie run` died MID-SPEND on `duration` × `model`
+  ([#634](https://github.com/ffroliva/gflow-cli/issues/634),
+  [#635](https://github.com/ffroliva/gflow-cli/issues/635)).** The same defect
+  [#632](https://github.com/ffroliva/gflow-cli/pull/632) fixed for single-clip i2v, but
+  on these two surfaces it crashed *after* earlier links or scenes had already rendered
+  and billed — surfacing as exit 1 `"Unexpected error"` with the explanation lost.
+
+  For chains it was not an occasional mismatch but a **guaranteed** crash:
+  `supports_duration()` is True for `omni_flash` alone, and chains reject `omni_flash`, so
+  no model a chain can use has a duration control. Every manifest `duration` was
+  unsatisfiable by construction — **including the one shipped as the documented example**
+  in `docs/USAGE.md`, which a test pinned as valid.
+
+  Tracing it surfaced a second hole: the `omni_flash` rejection only ever tested the
+  *chain-level* model, while `_build_link_request` prefers a per-link override — so
+  `"model": "omni-flash"` on a link walked past the invariant. Both now validate every
+  link's effective model before link 0 renders, and `--dry-run` refuses what the real run
+  refuses.
+
+  **BREAKING:** a `movie.toml` scene pairing a Veo model with a `duration` parsed before
+  and now fails at parse with exit 11. That combination could never have rendered; it
+  previously failed later and more expensively. Scene `duration` requires
+  `model = "omni-flash"`.
+
+- **`gflow video i2v --duration` with no `--model` died as `"Unexpected error"`
+  ([#630](https://github.com/ffroliva/gflow-cli/issues/630)).** An omitted `--model` on
+  i2v is not "no model" — it binds `veo-lite`, which renders no duration control, so the
+  guard was bypassed in exactly the default case and the DTO's bare `ValueError` escaped
+  as exit 1. It now exits 2 naming the model and the fix. MCP had the same hole and
+  queued the task before failing; `gflow_generate_video` now returns a 400 up front.
+
+- **The `referenceEntity` guard was unobservable, and its e2e could not fail
+  ([#620](https://github.com/ffroliva/gflow-cli/issues/620)).**
+  `tests/e2e/test_entity_smuggling_e2e.py` wrapped both checks in `if bodies:` /
+  `if modified:`, so it passed whether the guard fired or never fired — and the second
+  block only *printed*. It sat through #615 without noticing.
+
+  Fixing the assertions alone would not have been enough: the guard logged only when it
+  *stripped* something, so "never ran" and "ran, nothing to strip" were identical silence.
+  `ui_automation.batch_request_intercepted` now fires on every intercepted request from a
+  `finally` — every exit, including the parse-error branch — carrying
+  `had_reference_entities`, `modified` and `outcome`. **Absence of the event is now
+  evidence**, which is what turned the question blocking #615's fix into a measurement.
+
+- **Image e2e tests were priced in credits they do not cost.** `pyproject.toml` markers,
+  `docs/E2E_TESTING.md`'s cost table, `tests/e2e/conftest.py`, `CONTRIBUTING.md`,
+  `docs/USER_GUIDE.md` and ~20 strings across 13 files claimed image generation spends
+  credits. Only video (Veo) does; images draw on a **daily cap**, which is a rate limit,
+  not a charge. `scripts/canary/run_canary.py` carried the same error as a code constant
+  misnamed for four of its five entries (`_CREDIT_MARKERS` → `_MANUAL_ONLY_MARKERS`,
+  behaviour unchanged — the refusal is about not driving a live browser unattended). A
+  cost model that overstates the price of a free test discourages running it, and the test
+  it discouraged is the one that would have caught #615.
+
+- **The `referenceEntity` guard never ran, on any image or video generation
+  ([#615](https://github.com/ffroliva/gflow-cli/issues/615)).**
+  `_intercept_reference_entities` strips character entities the caller did not
+  request, so a "poisoned" entity left in the Flow composer cannot smuggle itself
+  into an unrelated generation. It had never fired once, on any released version.
+
+  The route glob `**/batchGenerateImages` requires the final path segment to equal
+  `batchGenerateImages`, but the real endpoint is `.../flowMedia:batchGenerateImages`
+  — so it could never match. The **video** guard was dead for the same reason
+  (`.../video:batchAsyncGenerateVideoText`), which the original report does not
+  mention. Registration also moved from the page to the browser context, which
+  covers worker-delegated requests the page level cannot observe.
+
+  The failure was invisible because the response listener does a substring test and
+  kept working normally, and because the guard logged only when it *stripped*
+  something — so "never ran" and "ran, nothing to strip" were identical silence. It
+  failed **open**, quietly. Reported by
+  [@DioServis](https://github.com/DioServis), who separated both causes.
+
+  **Verified live**, A/B-controlled at zero credits: with the fix absent the guard
+  never fired and the test failed; with it present the guard fired and the test
+  passed — same account, same prompt, one variable. That also settles whether Flow
+  delegates to a dedicated Web Worker (it does; `context.route` suffices) and
+  confirms the request rewrite does not corrupt the body. See
+  [docs/LIVE_VERIFICATION_reference_entity_guard.md](docs/LIVE_VERIFICATION_reference_entity_guard.md).
+
+  **Coverage is partial by construction:** direct-wire routes issued through
+  Playwright's `APIRequestContext` are not routable at all and bypass the guard
+  regardless of matcher — tracked in
+  [#619](https://github.com/ffroliva/gflow-cli/issues/619).
+
 ## [0.64.0] — 2026-09-02
 
 ### Added
@@ -3570,7 +3659,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...HEAD
+[0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0
 [0.64.0]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...v0.64.0
 [0.63.0]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...v0.63.0
 [0.62.1]: https://github.com/ffroliva/gflow-cli/compare/v0.62.0...v0.62.1

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/CONTRIBUTING.md

@@ -55,7 +55,7 @@ def test_parse_uuid_from_url(): ...
 async def test_upload_returns_asset(): ...
 
 @pytest.mark.e2e               # Hits the real Flow API. Requires GFLOW_CLI_E2E_PROFILE env var.
-@pytest.mark.e2e_image         # Cost sub-marker: spends ~1 Imagen credit.
+@pytest.mark.e2e_image         # Cost sub-marker: zero credits; draws on the daily image cap.
 async def test_full_t2i_roundtrip(): ...
 
 @pytest.mark.e2e
@@ -71,14 +71,14 @@ export GFLOW_CLI_E2E_PROFILE=<profile-name>   # name of a logged-in profile
 # Zero-credit sanity check (auth + health)
 uv run pytest -m e2e_auth -v
 
-# Single image (1 Imagen credit)
+# Single image (zero credits; daily image cap)
 uv run pytest -m "e2e_image and not e2e_batch" -v
 
 # Full regression (all credits)
 GFLOW_CLI_E2E_RUN_VIDEO=1 uv run pytest -m e2e -v
 ```
 
-E2e tests spend real Veo/Imagen credits. Video tests default to opt-out — set
+E2e video tests spend real Veo credits (image tests are free, daily-capped). Video tests default to opt-out — set
 `GFLOW_CLI_E2E_RUN_VIDEO=1` to include them. Run the full suite on `develop`
 before opening a release PR to `main`.
 

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/KNOWN_ISSUES.md

@@ -305,6 +305,35 @@ incident bundle's `ui.json` carries the same data). Attach it to
 [#493](https://github.com/ffroliva/gflow-cli/issues/493) — that would indicate a
 state genuinely different from the sidebar one.
 
+### The referenceEntity guard covers browser-driven generation only
+
+- **Status:** **Open** — structural, tracked in
+  [#619](https://github.com/ffroliva/gflow-cli/issues/619)
+- **Severity:** Low today · **Affects:** any future direct-wire route that carries
+  `referenceEntities`
+
+`_intercept_reference_entities` strips character entities the caller did not request. As
+of v0.65.0 it **does** run — it never had before
+([#615](https://github.com/ffroliva/gflow-cli/issues/615)), and the fix is A/B-verified
+live (see
+[LIVE_VERIFICATION_reference_entity_guard](docs/LIVE_VERIFICATION_reference_entity_guard.md)).
+
+But it guards by registering a Playwright route handler, so it can only ever observe
+**browser-initiated** traffic. Every direct-wire route goes through `client._post_json`,
+which issues the request via `page.request.post` — Playwright's `APIRequestContext`. Those
+calls leave from the Python side using the browser context's cookies and never enter the
+browser's network stack, so **no route handler observes them, at any level**. This is
+Playwright behaving as designed, not a bug in our usage.
+
+**It does not bite today:** no direct-wire route currently sends `referenceEntities`. It is
+recorded because the coverage gap is invisible from the outside — the guard looks
+comprehensive and is not — and because it is the same fail-open shape as #615 one layer
+down. Any new direct-wire route that carries entity references would inherit the blind spot
+silently.
+
+**No workaround needed today.** If you are adding a direct-wire route that sends
+`referenceEntities`, filter them at the call site rather than relying on the guard.
+
 ### Flow's new full-page media-library UI breaks entity attach (A/B rollout)
 
 - **Status:** **Open** — Flow-side staged rollout; tracked in

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.64.0
+Version: 0.65.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -229,9 +229,16 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 
 ### Star history
 
+<!-- DO NOT strip `sealed_token` from the URLs below. GitHub restricted the public
+     /stargazers endpoint (2026-06-30), so star-history can only build this chart from a
+     token-authenticated request. Its per-repo cache expires in <3 days, so a tokenless
+     URL renders a "GitHub restricted access to star data" placard — served as HTTP 200,
+     which is why nothing catches it. `.github/workflows/star-history-watch.yml` probes
+     for exactly that. The token is sealed with star-history's key and grants metadata
+     read on a public repo; it is safe in a public README, and they recommend it. -->
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
-  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
 </picture>
 
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/README.md

@@ -158,9 +158,16 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 
 ### Star history
 
+<!-- DO NOT strip `sealed_token` from the URLs below. GitHub restricted the public
+     /stargazers endpoint (2026-06-30), so star-history can only build this chart from a
+     token-authenticated request. Its per-repo cache expires in <3 days, so a tokenless
+     URL renders a "GitHub restricted access to star data" placard — served as HTTP 200,
+     which is why nothing catches it. `.github/workflows/star-history-watch.yml` probes
+     for exactly that. The token is sealed with star-history's key and grants metadata
+     read on a public repo; it is safe in a public README, and they recommend it. -->
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
-  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
 </picture>
 
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.64.0/website → gflow_cli-0.65.0}/docs/DEBUGGING.md

@@ -31,6 +31,9 @@ log events (`structlog` JSON lines):
 | `ui_automation.batch_response_dropped_project_id_mismatch` | URL contained `batchGenerateImages` but project-id filter rejected it | `url`, `filter_project_id` |
 | `ui_automation.batch_response_captured` | Response passed all filters AND parsed cleanly | `url`, `status` |
 | `ui_automation.batch_response_parse_failed` | Listener fired but `response.json()` raised | `url`, `error` |
+| `ui_automation.batch_request_intercepted` | EVERY generation request the referenceEntity guard observes, on every exit including a parse error. **Its ABSENCE means no route handler saw the submit at all** — a dead route matcher, or worker delegation the registered level cannot observe (#615, #620) | `url`, `had_reference_entities`, `modified`, `outcome`, `expected_entities` |
+| `ui_automation.batch_request_modified` | The guard actually STRIPPED an unrequested `referenceEntities` entry | `url`, `reason`, `expected_entities` |
+| `ui_automation.batch_request_modify_failed` | The guard ran but raised (e.g. a body it could not decode); the request is forwarded unchanged | `url`, `error` |
 | `ui_automation.batch_403_body` | A `batchGenerateImages` response returned HTTP 403; body prefix logged for WAF / reCAPTCHA diagnosis (subsequently raises `WafRejectionError`) | `body_prefix`, `route` |
 
 If `prompt_submitted` is followed by NO `batch_response_seen` log within the

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/docs/DEVELOPMENT.md

@@ -91,7 +91,7 @@ See [docs/GITHUB.md § SonarCloud Quality Gate](GITHUB.md#sonarcloud-quality-gat
 
 ### E2e gate before merging develop → main
 
-E2e tests require a live authenticated profile and are **not run in CI** (they spend real Veo/Imagen credits). Before opening a `develop → main` release PR:
+E2e tests require a live authenticated profile and are **not run in CI** (video tests spend real Veo credits; image tests cost nothing but draw on a daily image cap). Before opening a `develop → main` release PR:
 
 ```bash
 export GFLOW_CLI_E2E_PROFILE=<your-profile-name>

{gflow_cli-0.64.0/website → gflow_cli-0.65.0}/docs/E2E_TESTING.md

@@ -17,8 +17,8 @@ layers. The dominant constraint is not developer time or CI compute but
 Layer 0 — Static Analysis     ruff · pyright · detect-secrets
 Layer 1 — Unit Tests           pure logic, no I/O
 Layer 2 — Integration Tests    real Provider plumbing, mocked HTTP/browser
-Layer 3 — Smoke Tests          1 Imagen credit, golden path only (post-release)
-Layer 4 — Full E2E Tests       real credits, all strategies (pre-release gate)
+Layer 3 — Smoke Tests          image gen only — ZERO credits, golden path (post-release)
+Layer 4 — Full E2E Tests       real Veo credits (video only), all strategies (pre-release gate)
 ```
 
 **Only Layers 3 and 4 ever hit the real Flow API.**
@@ -46,11 +46,18 @@ Tests in `tests/smoke/` carry `pytest.mark.smoke`.
 Each e2e test also carries **one or more cost sub-markers** so you can run
 exactly the cost tier you can afford:
 
+> **Image generation costs ZERO Flow credits.** Only video (Veo) spends credits.
+> Images are limited by a **daily cap**, not billed — hitting it is a rate limit,
+> not a charge. This table said "~1 Imagen credit" for years, which discouraged
+> running tests that were always free; that stale claim is what left the #615
+> `referenceEntity` guard unverified while it silently did nothing. Confirmed with
+> the maintainer 2026-09-02.
+
 | Marker | Credit cost | Typical wallclock | When to use |
 |---|---|---|---|
 | `e2e_auth` | 0 | < 30 s | auth/session/health-check — always safe to run |
-| `e2e_image` | ~1 Imagen | 30–120 s | text-to-image or image-to-image golden path |
-| `e2e_batch` | N × Imagen | 2–10 min | batch image generation |
+| `e2e_image` | **0** (daily cap) | 30–120 s | text-to-image or image-to-image golden path |
+| `e2e_batch` | **0** (daily cap) | 2–10 min | batch image generation |
 | `e2e_video` | ~1 Veo | 1–10 min | text-to-video or image-to-video |
 | `e2e_data` | (same as above) | +0 s | DB persistence check — combined with image/video |
 
@@ -61,9 +68,9 @@ data-layer assertions depend on a real generation having run first.
 
 ```
 e2e ─┬─ e2e_auth     (auth/session, health check — zero credits)
-     ├─ e2e_image    (t2i, i2i — 1 Imagen credit per test)
+     ├─ e2e_image    (t2i, i2i — ZERO credits, daily cap only)
      │   └─ e2e_data (+ DB assertions)
-     ├─ e2e_batch    (batch t2i — N Imagen credits)
+     ├─ e2e_batch    (batch t2i — ZERO credits, daily cap only)
      └─ e2e_video    (t2v, i2v — 1 Veo credit per test)
          └─ e2e_data (+ DB assertions)
 ```
@@ -79,7 +86,7 @@ e2e ─┬─ e2e_auth     (auth/session, health check — zero credits)
 | `GFLOW_CLI_E2E_VIDEO_ASPECT` | `"landscape"` | Aspect ratio for video e2e: `landscape` or `portrait`. |
 | `GFLOW_CLI_E2E_VIDEO_MODEL` | `"omni-flash"` | Veo model for i2v tests: `omni-flash` or `veo-fast`. |
 | `GFLOW_CLI_E2E_VIDEO_DURATION` | `"4"` | Seconds of video to generate in i2v tests (minimum credit unit). |
-| `GFLOW_CLI_E2E_RUN_ENTITY_PROV` | `"0"` | Set to `"1"` to run the entity-provenance e2e (#402) — asserts a generation Flow actually accepted records its `entity_ids` / `entity_names` in `operations.metadata_json`. Opt-in because it spends Imagen credits. |
+| `GFLOW_CLI_E2E_RUN_ENTITY_PROV` | `"0"` | Set to `"1"` to run the entity-provenance e2e (#402) — asserts a generation Flow actually accepted records its `entity_ids` / `entity_names` in `operations.metadata_json`. Opt-in because it drives a real browser generation (no credit cost — images are free). |
 | `GFLOW_CLI_E2E_BATCH_MANIFEST` | `test_assets/sample_batch.tsv` | TSV manifest for the batch image e2e. |
 | `GFLOW_CLI_E2E_BATCH_JITTER` | `"1"` | Set to `"0"` to disable inter-request jitter in batch tests. |
 | `GFLOW_CLI_E2E_PROMPT` | *(safe default)* | Prompt override for the smoke test. |
@@ -105,7 +112,7 @@ uv run pytest -m "not e2e and not smoke and not live" -q --cov=gflow_cli
 ```bash
 export GFLOW_CLI_E2E_PROFILE=<profile-name>
 
-# All smoke tests (includes the 1-credit golden-path image test)
+# All smoke tests (includes the golden-path image test — zero credits)
 uv run pytest -m smoke -v
 
 # Zero-credit only — account persistence check, no generation
@@ -114,7 +121,7 @@ uv run pytest -m smoke tests/smoke/test_profile_account_smoke.py -v
 
 | Smoke test | Credits | Notes |
 |---|---|---|
-| `test_real_flow.py` | ~1 Imagen | Full golden path; use `GFLOW_CLI_E2E_PROMPT` to override the prompt |
+| `test_real_flow.py` | **0** (daily cap) | Full golden path; use `GFLOW_CLI_E2E_PROMPT` to override the prompt |
 | `test_profile_account_smoke.py` | **0** | Auth verification only; backfills `.gflow_account` for pre-v0.10 profiles |
 
 ### Layer 4 — Cost-stratified e2e runs
@@ -128,7 +135,7 @@ uv run pytest -m "e2e_auth or (e2e and e2e_data and not e2e_image and not e2e_vi
 # Cheapest live generation: single image only
 uv run pytest -m "e2e_image and not e2e_batch" -v
 
-# Add batch (N Imagen credits — check sample_batch.tsv for row count)
+# Add batch (zero credits; consumes more of the daily image cap — see sample_batch.tsv for row count)
 uv run pytest -m "e2e_image" -v
 
 # Add video (1 Veo credit per test)
@@ -235,8 +242,10 @@ tiers (`e2e_image` / `e2e_video` / `smoke`) stay **strictly manual** via
 uv run python scripts/canary/run_canary.py --profile <name> --dry-run
 ```
 
-Credit-spending markers (`e2e_image`, `e2e_video`, `e2e_batch`, `e2e_character`,
-`smoke`) are **refused outright** — the canary never spends credits unattended.
+Generation markers (`e2e_image`, `e2e_video`, `e2e_batch`, `e2e_character`,
+`smoke`) are **refused outright** — the canary never drives a real generation
+unattended. (Only `e2e_video` spends credits; the image tiers are refused because
+they drive a live browser and draw on the daily image cap, not because they bill.)
 Run those manually via `/gflow:live-verify`.
 
 ### Schedule it
@@ -314,7 +323,7 @@ aging test.
 tests/
 ├── conftest.py                           # install_log_capture; auto-marker hook
 ├── smoke/
-│   ├── test_real_flow.py                 # [smoke] golden path, 1 Imagen credit
+│   ├── test_real_flow.py                 # [smoke] golden path, ZERO credits
 │   └── test_profile_account_smoke.py     # [smoke] profile account persistence — 0 credits
 └── e2e/
     ├── conftest.py                       # e2e_profile_dir, e2e_nosession_profile,
@@ -344,7 +353,7 @@ field bundle a user emails), which is unit-covered offline by
 
 | File | Credits | What it verifies |
 |------|---------|-----------------|
-| `test_real_flow.py` | 1 Imagen | Golden path: open Flow, submit prompt, save PNG, check dimensions |
+| `test_real_flow.py` | **0** | Golden path: open Flow, submit prompt, save PNG, check dimensions |
 | `test_profile_account_smoke.py` | 0 | `.gflow_account` file present + valid email; `list_profiles()` surfaces `google_account`; `gflow auth list --json` includes the field |
 
 > **Real environment required.** Both smoke tests require a profile that has been

{gflow_cli-0.64.0 → gflow_cli-0.65.0}/docs/INDEX.md

@@ -158,6 +158,10 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.64.0](LIVE_VERIFICATION_v0.64.0.md) (**#626 `--model omni-flash --end-frame` — first+last interpolation on Omni 1.1 Flash, verified 2026-09-02.** The guard this release removes was evidence-gated, so it was retired on evidence: a route-aborted submit capture on **two distinct Google accounts** (`ffroliva`, `denon82`) fired `video:batchAsyncGenerateVideoStartAndEndImage` with `startImage` AND `endImage` non-null at **zero credits**, ruling out a single-account artifact. The decisive layer is semantic, not structural: the paid 4s generation's **last frame IS the supplied end image** and its first frame is the start image — two visibly different subjects — which is the only check that distinguishes "Flow bound the end frame" from "Flow accepted and ignored it", and which layers 1–4 would pass either way. Render: 4.01s / 720×1280 / h264+aac / 2.4 MB, `MEDIA_GENERATION_STATUS_SUCCESSFUL`. The static capability table is **deleted**, not corrected — it went stale silently once and would again; a post-submit route check (`_assert_i2v_route`) now fails a run whose end frame Flow dropped back to the `StartImage` route, catching a rollback on any account without anyone re-reading a support page. One item is recorded as NOT verified rather than omitted: `--duration 10` + end frame is **submit-verified only** (`duration_set seconds=10` on the correct route with both images bound), because the status poll returned HTTP 401 mid-run and a retry 401'd at `project.create` before submitting — [#561](https://github.com/ffroliva/gflow-cli/issues/561), pre-existing, so verification was stopped rather than spending further credits on an environmental fault.) · previous: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
+**"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.
+
+**"Does the `referenceEntity` guard actually run, and is it a Web Worker or a Service Worker?"** → [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md) — **A/B-proven live on denon82 2026-09-02, zero credits.** Control (without #618): the guard never fired and the test failed; with #618: it fired and passed. Same account, same prompt, one variable. Settles the question that held #618 — it is a **dedicated Web Worker**, so `context.route` suffices and no `service_workers="block"` is needed. Also confirms `route.continue_(post_data=...)` does not corrupt the body (both runs produced a real image). The **video** glob was equally dead, which #615 never mentions. Residual: direct-wire routes still bypass structurally (#619).
+
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)
 **"What was live-verified for the video-download feature (#29)?"** → [LIVE_VERIFICATION_video_download](LIVE_VERIFICATION_video_download.md)
 **"What is the jitter matrix evidence for `gflow image batch`?"** → [`LIVE_VERIFICATION_image_batch.md`](LIVE_VERIFICATION_image_batch.md) — jitter matrix evidence for `gflow image batch` (always-same-project mode)

gflow_cli-0.65.0/docs/LIVE_VERIFICATION_reference_entity_guard.md

@@ -0,0 +1,92 @@
+# Live verification — the `referenceEntity` guard (#615, #618, #620)
+
+**Date:** 2026-09-02 · **Profile:** `denon82` · **Cost:** zero credits (two image
+generations; images are daily-capped, not billed — see
+[E2E_TESTING](E2E_TESTING.md)) · **Transport:** `ui_automation`, headed Chrome
+
+## What was in question
+
+`_intercept_reference_entities` strips character entities the caller did not ask
+for, so a "poisoned" entity left in the Flow composer cannot smuggle itself into
+an unrelated generation. [#615](https://github.com/ffroliva/gflow-cli/issues/615)
+reported that it had never run.
+
+[PR #618](https://github.com/ffroliva/gflow-cli/pull/618) fixes two causes: the
+route glob could not match the real namespaced endpoint, and registration moved
+from `page.route` to `page.context.route`. It was held unmerged on one question
+no offline test can answer:
+
+> `BrowserContext.route` intercepts requests owned by a **dedicated Web Worker**,
+> but **not** a **Service Worker**. If Flow delegates via a Service Worker, the
+> fix is a no-op that passes every test and changes nothing in production.
+
+## Why this could be settled at all
+
+The guard used to log **only** when it stripped something. "Never ran" and "ran,
+nothing to strip" were byte-identical silence, so no run could distinguish them.
+[PR #637](https://github.com/ffroliva/gflow-cli/pull/637) adds
+`ui_automation.batch_request_intercepted`, emitted on every intercepted request
+from a `finally` — every exit, including the parse-error branch. **Absence of that
+event is now evidence**, which is what made this an experiment rather than an
+argument.
+
+## The A/B
+
+Identical test, identical account, identical prompt. One variable: whether #618's
+route fix is present. Both branches carry #637's signal, or the control could not
+be read.
+
+| Branch | Route registration | Result |
+|---|---|---|
+| `bugfix/entity-smuggling-e2e-asserts-620` (**control**, #618 absent) | `page.route("**/batchGenerateImages")` | **FAILED** — `The referenceEntity guard never ran` |
+| `scratch/e2e-615-620-proof` (#618 + #637) | `page.context.route(_GENERATION_ROUTE_RE)` | **PASSED** — guard fired |
+
+```
+control : 1 failed in 51.25s   (image generated; no batch_request_intercepted)
+with fix: 1 passed in 67.72s   (image generated; guard observed the submit)
+```
+
+## Ledger
+
+1. **The bug reproduces live.** The control run generated an image successfully
+   and the guard never saw the request. #615 is confirmed on the affected
+   surface, not merely reasoned about.
+2. **The fix works live.** The only changed variable is #618's matcher + level.
+3. **It is a dedicated Web Worker, not a Service Worker.** `context.route`
+   observes these requests. This is the answer #618 was held for; no
+   `service_workers="block"` is needed.
+4. **The rewrite does not corrupt the request.** Both runs produced a real image,
+   so `route.continue_(post_data=...)` forwards a body Flow still accepts — a path
+   no mock exercises and the one that would have broken generation outright.
+5. **The test discriminates.** It failed when the guard was dead and passed when
+   it was alive. It is not another test that cannot fail — which is precisely what
+   #620 was filed about.
+
+## Offline corroboration
+
+The matcher half needs no account. Playwright's own `glob_to_regex_pattern`:
+
+```
+'**/batchGenerateImages'      -> ^(.*/)batchGenerateImages$
+    https://…/projects/{id}/flowMedia:batchGenerateImages   -> NO MATCH
+'**/batchAsyncGenerateVideo*' -> ^(.*/)batchAsyncGenerateVideo([^/]*)$
+    https://…/v1/video:batchAsyncGenerateVideoText          -> NO MATCH
+```
+
+Note the **video** guard was equally dead. #615 names only the image endpoint;
+#618's substring regex covers both.
+
+## Residual limitations
+
+- **Only the browser-driven path is covered.** Direct-wire routes issued through
+  Playwright's `APIRequestContext` are not routable at all and bypass the guard
+  structurally — [#619](https://github.com/ffroliva/gflow-cli/issues/619). Harmless
+  today (no direct-wire route sends `referenceEntities`) but it is fail-open by
+  construction, and any claim that "the guard protects generations" carries that
+  footnote.
+- **Verified on the image path.** The video call site
+  (`ui_automation_video.py`) shares the same context manager and the same matcher,
+  which the offline check covers, but it was not exercised live here.
+- **One account, one cohort, one locale** (`denon82`, classic UI, `hl=en`). Flow's
+  UI has an A/B history ([#174](https://github.com/ffroliva/gflow-cli/issues/174));
+  a different cohort could delegate differently.