gflow-cli 0.64.0__tar.gz → 0.66.0__tar.gz

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

gflow_cli-0.66.0/.github/workflows/star-history-watch.yml

@@ -0,0 +1,89 @@
+name: Star history watch
+
+# ── Why this exists ──────────────────────────────────────────────────────────
+# The star-history chart in README.md is the project's front door — it renders on
+# GitHub and on the PyPI project page. When it breaks it does so SILENTLY: the
+# endpoint answers HTTP 200 with `image/svg+xml`, and the body is a "GitHub
+# restricted access to star data" placard instead of a chart. Every status-code
+# check passes. That is how it stayed broken from 2026-08-30 to 2026-09-02 with
+# no signal — a human noticed it in a browser.
+#
+# The chart depends on the `sealed_token` param surviving in the README URL
+# (GitHub restricted the public /stargazers endpoint on 2026-06-30; star-history's
+# per-repo cache expires in under 3 days without a token-bearing request). So this
+# probes for the two ways it dies: the token gets stripped, or the underlying PAT
+# expires or is revoked.
+#
+# The URL is read out of README.md rather than hardcoded here, so the probe can
+# never drift from what is actually shipped.
+
+on:
+  schedule:
+    # Daily 06:00 UTC — an hour after the selector probe, well clear of it.
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    name: Probe the README star-history chart
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.repository == 'ffroliva/gflow-cli'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Fetch each star-history URL in README.md and inspect the SVG body
+        run: |
+          set -uo pipefail
+          urls=$(grep -o 'https://api\.star-history\.com/chart?[^"]*' README.md | sort -u)
+          if [ -z "$urls" ]; then
+            echo "::error::No star-history URL found in README.md. If the chart was removed on"
+            echo "::error::purpose, delete this workflow too."
+            exit 1
+          fi
+
+          failed=0
+          while IFS= read -r url; do
+            # Redact the sealed token before anything reaches the public log.
+            safe=$(printf '%s' "$url" | sed 's/sealed_token=.\{8\}.*/sealed_token=<redacted>/')
+            echo "── $safe"
+
+            case "$url" in
+              *sealed_token=*) ;;
+              *)
+                echo "::error::sealed_token is missing from this URL. A tokenless chart reverts to"
+                echo "::error::the restriction placard within ~3 days. See the comment in README.md."
+                failed=1
+                ;;
+            esac
+
+            # Cache-bust so we measure the live endpoint, not star-history's warm cache.
+            code=$(curl -sS --max-time 30 -o body.svg -w '%{http_code}' "$url&cb=$GITHUB_RUN_ID") || {
+              echo "::warning::curl failed — treating as a transient star-history outage, not a token problem."
+              continue
+            }
+            bytes=$(wc -c < body.svg)
+            echo "   http=$code bytes=$bytes"
+
+            if [ "$code" != "200" ]; then
+              echo "::warning::HTTP $code from star-history — likely their outage, not our token."
+              continue
+            fi
+            # The whole point: a 200 is not proof. Read the SVG text.
+            if grep -qi 'restricted access to star data' body.svg; then
+              echo "::error::Chart is serving the GitHub restriction placard. The sealed token is"
+              echo "::error::present but not working — the underlying PAT has most likely expired or"
+              echo "::error::been revoked. Mint a fine-grained PAT (metadata:read on this repo), seal"
+              echo "::error::it at star-history.com, and replace the sealed_token param in README.md."
+              failed=1
+            else
+              echo "   ✅ real chart"
+            fi
+          done <<< "$urls"
+
+          exit "$failed"

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/CHANGELOG.md

@@ -7,6 +7,141 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.0] — 2026-09-03
+
+### Fixed
+
+- **Flow's migration to `flow.google.com` was reported as selector drift
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** Google is moving Flow
+  off Labs onto its own origin. The migrated frontend renders **zero** Material Symbols
+  `<i>` elements, so every gflow selector — cohort detection included — misses at once,
+  and the run died with `UiSelectorDriftError` (exit 23, `retryable: false`): an error
+  that reads like the selectors rotted and sent operators hunting for the wrong cause.
+  The rollout **flaps per page load** — the same account and project land on the old
+  host on one navigation and the migrated one on the next — so a re-run frequently
+  succeeds, but the non-retryable classification made automated callers give up.
+  gflow now recognises the migrated origin and raises the distinct, **retryable**
+  `FlowHostMigratedError` (exit 36) naming the migration. Applies to CLI and MCP alike
+  (both route through the shared mode-switch raise site, and `retryable` has a single
+  source of truth). **This does not add support for the migrated frontend** — that is
+  separate work; see [KNOWN_ISSUES.md](KNOWN_ISSUES.md).
+
+- **A migrated page load was misread as a logged-out session
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** `_check_logged_in`
+  hard-required `labs.google` in the URL, so a perfectly valid authenticated session on
+  the migrated host failed the gate and drove a pointless re-auth. It now accepts both
+  Flow origins.
+
+### Security
+
+- **The authenticated-session URL gate matched hosts by substring.** `_check_logged_in`
+  tested `"labs.google" in page.url`, which any foreign URL satisfies merely by carrying
+  the string in its path or query (`https://evil.example/?next=labs.google/fx/tools/flow`).
+  The host is now parsed and matched exactly.
+
+### Changed
+
+- Incident bundles from a `flow.google.com` load previously reported
+  `url.host_category: "other"` / `url.route: "other"`, hiding the most useful fact about
+  the failure. The migrated origin is now classified as `flow_app`, with the same
+  identifier reduction applied.
+
+Live-verified 2026-09-03 at zero credits against the **real** migrated frontend, on an
+account inside the rollout: `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was
+`false` before the fix), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 /
+`retryable: true` — while a credit-free `image t2i` minutes earlier landed on the old host and
+completed exit 0, proving no regression. See
+[docs/LIVE_VERIFICATION_v0.66.0.md](docs/LIVE_VERIFICATION_v0.66.0.md).
+
+## [0.65.0] — 2026-09-02
+
+### Fixed
+
+- **`gflow video chain` and `gflow movie run` died MID-SPEND on `duration` × `model`
+  ([#634](https://github.com/ffroliva/gflow-cli/issues/634),
+  [#635](https://github.com/ffroliva/gflow-cli/issues/635)).** The same defect
+  [#632](https://github.com/ffroliva/gflow-cli/pull/632) fixed for single-clip i2v, but
+  on these two surfaces it crashed *after* earlier links or scenes had already rendered
+  and billed — surfacing as exit 1 `"Unexpected error"` with the explanation lost.
+
+  For chains it was not an occasional mismatch but a **guaranteed** crash:
+  `supports_duration()` is True for `omni_flash` alone, and chains reject `omni_flash`, so
+  no model a chain can use has a duration control. Every manifest `duration` was
+  unsatisfiable by construction — **including the one shipped as the documented example**
+  in `docs/USAGE.md`, which a test pinned as valid.
+
+  Tracing it surfaced a second hole: the `omni_flash` rejection only ever tested the
+  *chain-level* model, while `_build_link_request` prefers a per-link override — so
+  `"model": "omni-flash"` on a link walked past the invariant. Both now validate every
+  link's effective model before link 0 renders, and `--dry-run` refuses what the real run
+  refuses.
+
+  **BREAKING:** a `movie.toml` scene pairing a Veo model with a `duration` parsed before
+  and now fails at parse with exit 11. That combination could never have rendered; it
+  previously failed later and more expensively. Scene `duration` requires
+  `model = "omni-flash"`.
+
+- **`gflow video i2v --duration` with no `--model` died as `"Unexpected error"`
+  ([#630](https://github.com/ffroliva/gflow-cli/issues/630)).** An omitted `--model` on
+  i2v is not "no model" — it binds `veo-lite`, which renders no duration control, so the
+  guard was bypassed in exactly the default case and the DTO's bare `ValueError` escaped
+  as exit 1. It now exits 2 naming the model and the fix. MCP had the same hole and
+  queued the task before failing; `gflow_generate_video` now returns a 400 up front.
+
+- **The `referenceEntity` guard was unobservable, and its e2e could not fail
+  ([#620](https://github.com/ffroliva/gflow-cli/issues/620)).**
+  `tests/e2e/test_entity_smuggling_e2e.py` wrapped both checks in `if bodies:` /
+  `if modified:`, so it passed whether the guard fired or never fired — and the second
+  block only *printed*. It sat through #615 without noticing.
+
+  Fixing the assertions alone would not have been enough: the guard logged only when it
+  *stripped* something, so "never ran" and "ran, nothing to strip" were identical silence.
+  `ui_automation.batch_request_intercepted` now fires on every intercepted request from a
+  `finally` — every exit, including the parse-error branch — carrying
+  `had_reference_entities`, `modified` and `outcome`. **Absence of the event is now
+  evidence**, which is what turned the question blocking #615's fix into a measurement.
+
+- **Image e2e tests were priced in credits they do not cost.** `pyproject.toml` markers,
+  `docs/E2E_TESTING.md`'s cost table, `tests/e2e/conftest.py`, `CONTRIBUTING.md`,
+  `docs/USER_GUIDE.md` and ~20 strings across 13 files claimed image generation spends
+  credits. Only video (Veo) does; images draw on a **daily cap**, which is a rate limit,
+  not a charge. `scripts/canary/run_canary.py` carried the same error as a code constant
+  misnamed for four of its five entries (`_CREDIT_MARKERS` → `_MANUAL_ONLY_MARKERS`,
+  behaviour unchanged — the refusal is about not driving a live browser unattended). A
+  cost model that overstates the price of a free test discourages running it, and the test
+  it discouraged is the one that would have caught #615.
+
+- **The `referenceEntity` guard never ran, on any image or video generation
+  ([#615](https://github.com/ffroliva/gflow-cli/issues/615)).**
+  `_intercept_reference_entities` strips character entities the caller did not
+  request, so a "poisoned" entity left in the Flow composer cannot smuggle itself
+  into an unrelated generation. It had never fired once, on any released version.
+
+  The route glob `**/batchGenerateImages` requires the final path segment to equal
+  `batchGenerateImages`, but the real endpoint is `.../flowMedia:batchGenerateImages`
+  — so it could never match. The **video** guard was dead for the same reason
+  (`.../video:batchAsyncGenerateVideoText`), which the original report does not
+  mention. Registration also moved from the page to the browser context, which
+  covers worker-delegated requests the page level cannot observe.
+
+  The failure was invisible because the response listener does a substring test and
+  kept working normally, and because the guard logged only when it *stripped*
+  something — so "never ran" and "ran, nothing to strip" were identical silence. It
+  failed **open**, quietly. Reported by
+  [@DioServis](https://github.com/DioServis), who separated both causes.
+
+  **Verified live**, A/B-controlled at zero credits: with the fix absent the guard
+  never fired and the test failed; with it present the guard fired and the test
+  passed — same account, same prompt, one variable. That also settles whether Flow
+  delegates to a dedicated Web Worker (it does; `context.route` suffices) and
+  confirms the request rewrite does not corrupt the body. See
+  [docs/LIVE_VERIFICATION_reference_entity_guard.md](docs/LIVE_VERIFICATION_reference_entity_guard.md).
+
+  **Coverage is partial by construction:** direct-wire routes issued through
+  Playwright's `APIRequestContext` are not routable at all and bypass the guard
+  regardless of matcher — tracked in
+  [#619](https://github.com/ffroliva/gflow-cli/issues/619).
+
 ## [0.64.0] — 2026-09-02
 
 ### Added
@@ -3570,7 +3705,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...HEAD
+[0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
+[0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0
 [0.64.0]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...v0.64.0
 [0.63.0]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...v0.63.0
 [0.62.1]: https://github.com/ffroliva/gflow-cli/compare/v0.62.0...v0.62.1

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/CONTRIBUTING.md

@@ -55,7 +55,7 @@ def test_parse_uuid_from_url(): ...
 async def test_upload_returns_asset(): ...
 
 @pytest.mark.e2e               # Hits the real Flow API. Requires GFLOW_CLI_E2E_PROFILE env var.
-@pytest.mark.e2e_image         # Cost sub-marker: spends ~1 Imagen credit.
+@pytest.mark.e2e_image         # Cost sub-marker: zero credits; draws on the daily image cap.
 async def test_full_t2i_roundtrip(): ...
 
 @pytest.mark.e2e
@@ -71,14 +71,14 @@ export GFLOW_CLI_E2E_PROFILE=<profile-name>   # name of a logged-in profile
 # Zero-credit sanity check (auth + health)
 uv run pytest -m e2e_auth -v
 
-# Single image (1 Imagen credit)
+# Single image (zero credits; daily image cap)
 uv run pytest -m "e2e_image and not e2e_batch" -v
 
 # Full regression (all credits)
 GFLOW_CLI_E2E_RUN_VIDEO=1 uv run pytest -m e2e -v
 ```
 
-E2e tests spend real Veo/Imagen credits. Video tests default to opt-out — set
+E2e video tests spend real Veo credits (image tests are free, daily-capped). Video tests default to opt-out — set
 `GFLOW_CLI_E2E_RUN_VIDEO=1` to include them. Run the full suite on `develop`
 before opening a release PR to `main`.
 

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/KNOWN_ISSUES.md

@@ -14,6 +14,52 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### Flow is migrating to `flow.google.com`; the migrated frontend is not drivable
+
+- **Status:** Open · **Severity:** High (every generation command fails on a migrated page load) · **Affected:** all `gflow image` / `gflow video` generation, CLI and MCP alike, on accounts the rollout has reached
+- **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
+- **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
+
+Google is moving Flow off Labs onto its own origin. On a migrated page load,
+`https://labs.google/fx/tools/flow/project/<id>` redirects to
+`https://flow.google.com/project/<id>` and serves a rewritten frontend that
+contains **zero `<i>` elements**. Every gflow selector anchors on Material
+Symbols ligatures (`i.google-symbols:text-is(...)`), so cohort detection and
+every mode control miss at once.
+
+**The rollout flaps per page load.** The same account, profile and project land
+on the old host on one navigation and the migrated one on the next, minutes
+apart, with no client change. Measured on one account ~35 minutes apart:
+
+```
+old host       labs.google/fx/<locale>/tools/flow/...   i=55  i.google-symbols=49  crop_* present   -> exit 0
+migrated host  flow.google.com/project/...              i=0   i.google-symbols=0   crop_* absent    -> exit 36
+```
+
+Note the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>`, not
+`/fx/<locale>/tools/flow/project/<id>`. Any host gate written as a substring test on
+`labs.google` could never have matched it.
+
+This is **not** selector rot, not [#493](https://github.com/ffroliva/gflow-cli/issues/493),
+and not the agentic cohort — the agentic indicators are absent too. It is a
+different origin serving different markup.
+
+**Workaround:** re-run the command. While the rollout flaps, a fresh navigation
+frequently lands the old frontend and the run completes normally. Automated
+callers get this for free: the failure is `FlowHostMigratedError` (exit 36) with
+`retryable: true`, so retry loops driven by the `--json` / MCP / worker error
+envelope will keep trying.
+
+**What gflow does today (v0.66.0):** recognises the migrated origin and fails
+with the distinct, retryable exit 36 instead of the misleading
+`UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
+accepts the migrated host, so a migrated load is no longer misread as a
+logged-out session. **Support for driving the new frontend is separate work and
+is not implemented** — once the rollout completes for an account, no retry will
+help until then.
+
+---
+
 ### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second
 
 - **Status:** Open · **Severity:** Medium (audible/visible on every internal seam of a chained extend) · **Affected:** `gflow video extend -n >1` with `-o`, and any scene mixing extend segments
@@ -305,6 +351,35 @@ incident bundle's `ui.json` carries the same data). Attach it to
 [#493](https://github.com/ffroliva/gflow-cli/issues/493) — that would indicate a
 state genuinely different from the sidebar one.
 
+### The referenceEntity guard covers browser-driven generation only
+
+- **Status:** **Open** — structural, tracked in
+  [#619](https://github.com/ffroliva/gflow-cli/issues/619)
+- **Severity:** Low today · **Affects:** any future direct-wire route that carries
+  `referenceEntities`
+
+`_intercept_reference_entities` strips character entities the caller did not request. As
+of v0.65.0 it **does** run — it never had before
+([#615](https://github.com/ffroliva/gflow-cli/issues/615)), and the fix is A/B-verified
+live (see
+[LIVE_VERIFICATION_reference_entity_guard](docs/LIVE_VERIFICATION_reference_entity_guard.md)).
+
+But it guards by registering a Playwright route handler, so it can only ever observe
+**browser-initiated** traffic. Every direct-wire route goes through `client._post_json`,
+which issues the request via `page.request.post` — Playwright's `APIRequestContext`. Those
+calls leave from the Python side using the browser context's cookies and never enter the
+browser's network stack, so **no route handler observes them, at any level**. This is
+Playwright behaving as designed, not a bug in our usage.
+
+**It does not bite today:** no direct-wire route currently sends `referenceEntities`. It is
+recorded because the coverage gap is invisible from the outside — the guard looks
+comprehensive and is not — and because it is the same fail-open shape as #615 one layer
+down. Any new direct-wire route that carries entity references would inherit the blind spot
+silently.
+
+**No workaround needed today.** If you are adding a direct-wire route that sends
+`referenceEntities`, filter them at the call site rather than relying on the guard.
+
 ### Flow's new full-page media-library UI breaks entity attach (A/B rollout)
 
 - **Status:** **Open** — Flow-side staged rollout; tracked in

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.64.0
+Version: 0.66.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -229,9 +229,16 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 
 ### Star history
 
+<!-- DO NOT strip `sealed_token` from the URLs below. GitHub restricted the public
+     /stargazers endpoint (2026-06-30), so star-history can only build this chart from a
+     token-authenticated request. Its per-repo cache expires in <3 days, so a tokenless
+     URL renders a "GitHub restricted access to star data" placard — served as HTTP 200,
+     which is why nothing catches it. `.github/workflows/star-history-watch.yml` probes
+     for exactly that. The token is sealed with star-history's key and grants metadata
+     read on a public repo; it is safe in a public README, and they recommend it. -->
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
-  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
 </picture>
 
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/README.md

@@ -158,9 +158,16 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 
 ### Star history
 
+<!-- DO NOT strip `sealed_token` from the URLs below. GitHub restricted the public
+     /stargazers endpoint (2026-06-30), so star-history can only build this chart from a
+     token-authenticated request. Its per-repo cache expires in <3 days, so a tokenless
+     URL renders a "GitHub restricted access to star data" placard — served as HTTP 200,
+     which is why nothing catches it. `.github/workflows/star-history-watch.yml` probes
+     for exactly that. The token is sealed with star-history's key and grants metadata
+     read on a public repo; it is safe in a public README, and they recommend it. -->
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
-  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left&sealed_token=7kTiE_HExjjY2aT7O-_hMxY_Mf6n-ET17mi_RXcRjCSS5rHSBDMd7xFYCzT_yaXhAXrgF8AGTQc6mny_qfuJc7473KGqb-5U41Dpu-tpZIS1IYl-xVQR9ziGJtL0KWQVyWZU1IoUmLWwo43PhgVTo4MJfmWOvluFJq2zlGxE_iLl9wMRgpwQaiC4ufOK" />
 </picture>
 
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.64.0/website → gflow_cli-0.66.0}/docs/DEBUGGING.md

@@ -31,6 +31,9 @@ log events (`structlog` JSON lines):
 | `ui_automation.batch_response_dropped_project_id_mismatch` | URL contained `batchGenerateImages` but project-id filter rejected it | `url`, `filter_project_id` |
 | `ui_automation.batch_response_captured` | Response passed all filters AND parsed cleanly | `url`, `status` |
 | `ui_automation.batch_response_parse_failed` | Listener fired but `response.json()` raised | `url`, `error` |
+| `ui_automation.batch_request_intercepted` | EVERY generation request the referenceEntity guard observes, on every exit including a parse error. **Its ABSENCE means no route handler saw the submit at all** — a dead route matcher, or worker delegation the registered level cannot observe (#615, #620) | `url`, `had_reference_entities`, `modified`, `outcome`, `expected_entities` |
+| `ui_automation.batch_request_modified` | The guard actually STRIPPED an unrequested `referenceEntities` entry | `url`, `reason`, `expected_entities` |
+| `ui_automation.batch_request_modify_failed` | The guard ran but raised (e.g. a body it could not decode); the request is forwarded unchanged | `url`, `error` |
 | `ui_automation.batch_403_body` | A `batchGenerateImages` response returned HTTP 403; body prefix logged for WAF / reCAPTCHA diagnosis (subsequently raises `WafRejectionError`) | `body_prefix`, `route` |
 
 If `prompt_submitted` is followed by NO `batch_response_seen` log within the
@@ -103,7 +106,8 @@ at command startup).
 ### What triggers a capture (and what never does)
 
 Captured: `FlowAppError` (31), `FlowAgentUiError` (25),
-`UiModeUnavailableError` (28), `UiSelectorDriftError` (23),
+`FlowHostMigratedError` (36), `UiModeUnavailableError` (28),
+`UiSelectorDriftError` (23),
 `TransportTimeoutError` (9), `BrowserSessionClosedError` (15),
 `WireFormatError` (7), `WafRejectionError` (10), `NetworkError` (6),
 unexpected exceptions while a page is alive, and `ProfileLockedError` (11)

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/docs/DEVELOPMENT.md

@@ -91,7 +91,7 @@ See [docs/GITHUB.md § SonarCloud Quality Gate](GITHUB.md#sonarcloud-quality-gat
 
 ### E2e gate before merging develop → main
 
-E2e tests require a live authenticated profile and are **not run in CI** (they spend real Veo/Imagen credits). Before opening a `develop → main` release PR:
+E2e tests require a live authenticated profile and are **not run in CI** (video tests spend real Veo credits; image tests cost nothing but draw on a daily image cap). Before opening a `develop → main` release PR:
 
 ```bash
 export GFLOW_CLI_E2E_PROFILE=<your-profile-name>

{gflow_cli-0.64.0/website → gflow_cli-0.66.0}/docs/E2E_TESTING.md

@@ -17,8 +17,8 @@ layers. The dominant constraint is not developer time or CI compute but
 Layer 0 — Static Analysis     ruff · pyright · detect-secrets
 Layer 1 — Unit Tests           pure logic, no I/O
 Layer 2 — Integration Tests    real Provider plumbing, mocked HTTP/browser
-Layer 3 — Smoke Tests          1 Imagen credit, golden path only (post-release)
-Layer 4 — Full E2E Tests       real credits, all strategies (pre-release gate)
+Layer 3 — Smoke Tests          image gen only — ZERO credits, golden path (post-release)
+Layer 4 — Full E2E Tests       real Veo credits (video only), all strategies (pre-release gate)
 ```
 
 **Only Layers 3 and 4 ever hit the real Flow API.**
@@ -46,11 +46,18 @@ Tests in `tests/smoke/` carry `pytest.mark.smoke`.
 Each e2e test also carries **one or more cost sub-markers** so you can run
 exactly the cost tier you can afford:
 
+> **Image generation costs ZERO Flow credits.** Only video (Veo) spends credits.
+> Images are limited by a **daily cap**, not billed — hitting it is a rate limit,
+> not a charge. This table said "~1 Imagen credit" for years, which discouraged
+> running tests that were always free; that stale claim is what left the #615
+> `referenceEntity` guard unverified while it silently did nothing. Confirmed with
+> the maintainer 2026-09-02.
+
 | Marker | Credit cost | Typical wallclock | When to use |
 |---|---|---|---|
 | `e2e_auth` | 0 | < 30 s | auth/session/health-check — always safe to run |
-| `e2e_image` | ~1 Imagen | 30–120 s | text-to-image or image-to-image golden path |
-| `e2e_batch` | N × Imagen | 2–10 min | batch image generation |
+| `e2e_image` | **0** (daily cap) | 30–120 s | text-to-image or image-to-image golden path |
+| `e2e_batch` | **0** (daily cap) | 2–10 min | batch image generation |
 | `e2e_video` | ~1 Veo | 1–10 min | text-to-video or image-to-video |
 | `e2e_data` | (same as above) | +0 s | DB persistence check — combined with image/video |
 
@@ -61,9 +68,9 @@ data-layer assertions depend on a real generation having run first.
 
 ```
 e2e ─┬─ e2e_auth     (auth/session, health check — zero credits)
-     ├─ e2e_image    (t2i, i2i — 1 Imagen credit per test)
+     ├─ e2e_image    (t2i, i2i — ZERO credits, daily cap only)
      │   └─ e2e_data (+ DB assertions)
-     ├─ e2e_batch    (batch t2i — N Imagen credits)
+     ├─ e2e_batch    (batch t2i — ZERO credits, daily cap only)
      └─ e2e_video    (t2v, i2v — 1 Veo credit per test)
          └─ e2e_data (+ DB assertions)
 ```
@@ -79,7 +86,7 @@ e2e ─┬─ e2e_auth     (auth/session, health check — zero credits)
 | `GFLOW_CLI_E2E_VIDEO_ASPECT` | `"landscape"` | Aspect ratio for video e2e: `landscape` or `portrait`. |
 | `GFLOW_CLI_E2E_VIDEO_MODEL` | `"omni-flash"` | Veo model for i2v tests: `omni-flash` or `veo-fast`. |
 | `GFLOW_CLI_E2E_VIDEO_DURATION` | `"4"` | Seconds of video to generate in i2v tests (minimum credit unit). |
-| `GFLOW_CLI_E2E_RUN_ENTITY_PROV` | `"0"` | Set to `"1"` to run the entity-provenance e2e (#402) — asserts a generation Flow actually accepted records its `entity_ids` / `entity_names` in `operations.metadata_json`. Opt-in because it spends Imagen credits. |
+| `GFLOW_CLI_E2E_RUN_ENTITY_PROV` | `"0"` | Set to `"1"` to run the entity-provenance e2e (#402) — asserts a generation Flow actually accepted records its `entity_ids` / `entity_names` in `operations.metadata_json`. Opt-in because it drives a real browser generation (no credit cost — images are free). |
 | `GFLOW_CLI_E2E_BATCH_MANIFEST` | `test_assets/sample_batch.tsv` | TSV manifest for the batch image e2e. |
 | `GFLOW_CLI_E2E_BATCH_JITTER` | `"1"` | Set to `"0"` to disable inter-request jitter in batch tests. |
 | `GFLOW_CLI_E2E_PROMPT` | *(safe default)* | Prompt override for the smoke test. |
@@ -105,7 +112,7 @@ uv run pytest -m "not e2e and not smoke and not live" -q --cov=gflow_cli
 ```bash
 export GFLOW_CLI_E2E_PROFILE=<profile-name>
 
-# All smoke tests (includes the 1-credit golden-path image test)
+# All smoke tests (includes the golden-path image test — zero credits)
 uv run pytest -m smoke -v
 
 # Zero-credit only — account persistence check, no generation
@@ -114,7 +121,7 @@ uv run pytest -m smoke tests/smoke/test_profile_account_smoke.py -v
 
 | Smoke test | Credits | Notes |
 |---|---|---|
-| `test_real_flow.py` | ~1 Imagen | Full golden path; use `GFLOW_CLI_E2E_PROMPT` to override the prompt |
+| `test_real_flow.py` | **0** (daily cap) | Full golden path; use `GFLOW_CLI_E2E_PROMPT` to override the prompt |
 | `test_profile_account_smoke.py` | **0** | Auth verification only; backfills `.gflow_account` for pre-v0.10 profiles |
 
 ### Layer 4 — Cost-stratified e2e runs
@@ -128,7 +135,7 @@ uv run pytest -m "e2e_auth or (e2e and e2e_data and not e2e_image and not e2e_vi
 # Cheapest live generation: single image only
 uv run pytest -m "e2e_image and not e2e_batch" -v
 
-# Add batch (N Imagen credits — check sample_batch.tsv for row count)
+# Add batch (zero credits; consumes more of the daily image cap — see sample_batch.tsv for row count)
 uv run pytest -m "e2e_image" -v
 
 # Add video (1 Veo credit per test)
@@ -235,8 +242,10 @@ tiers (`e2e_image` / `e2e_video` / `smoke`) stay **strictly manual** via
 uv run python scripts/canary/run_canary.py --profile <name> --dry-run
 ```
 
-Credit-spending markers (`e2e_image`, `e2e_video`, `e2e_batch`, `e2e_character`,
-`smoke`) are **refused outright** — the canary never spends credits unattended.
+Generation markers (`e2e_image`, `e2e_video`, `e2e_batch`, `e2e_character`,
+`smoke`) are **refused outright** — the canary never drives a real generation
+unattended. (Only `e2e_video` spends credits; the image tiers are refused because
+they drive a live browser and draw on the daily image cap, not because they bill.)
 Run those manually via `/gflow:live-verify`.
 
 ### Schedule it
@@ -314,7 +323,7 @@ aging test.
 tests/
 ├── conftest.py                           # install_log_capture; auto-marker hook
 ├── smoke/
-│   ├── test_real_flow.py                 # [smoke] golden path, 1 Imagen credit
+│   ├── test_real_flow.py                 # [smoke] golden path, ZERO credits
 │   └── test_profile_account_smoke.py     # [smoke] profile account persistence — 0 credits
 └── e2e/
     ├── conftest.py                       # e2e_profile_dir, e2e_nosession_profile,
@@ -344,7 +353,7 @@ field bundle a user emails), which is unit-covered offline by
 
 | File | Credits | What it verifies |
 |------|---------|-----------------|
-| `test_real_flow.py` | 1 Imagen | Golden path: open Flow, submit prompt, save PNG, check dimensions |
+| `test_real_flow.py` | **0** | Golden path: open Flow, submit prompt, save PNG, check dimensions |
 | `test_profile_account_smoke.py` | 0 | `.gflow_account` file present + valid email; `list_profiles()` surfaces `google_account`; `gflow auth list --json` includes the field |
 
 > **Real environment required.** Both smoke tests require a profile that has been

{gflow_cli-0.64.0 → gflow_cli-0.66.0}/docs/INDEX.md

@@ -158,6 +158,12 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.64.0](LIVE_VERIFICATION_v0.64.0.md) (**#626 `--model omni-flash --end-frame` — first+last interpolation on Omni 1.1 Flash, verified 2026-09-02.** The guard this release removes was evidence-gated, so it was retired on evidence: a route-aborted submit capture on **two distinct Google accounts** (`ffroliva`, `denon82`) fired `video:batchAsyncGenerateVideoStartAndEndImage` with `startImage` AND `endImage` non-null at **zero credits**, ruling out a single-account artifact. The decisive layer is semantic, not structural: the paid 4s generation's **last frame IS the supplied end image** and its first frame is the start image — two visibly different subjects — which is the only check that distinguishes "Flow bound the end frame" from "Flow accepted and ignored it", and which layers 1–4 would pass either way. Render: 4.01s / 720×1280 / h264+aac / 2.4 MB, `MEDIA_GENERATION_STATUS_SUCCESSFUL`. The static capability table is **deleted**, not corrected — it went stale silently once and would again; a post-submit route check (`_assert_i2v_route`) now fails a run whose end frame Flow dropped back to the `StartImage` route, catching a rollback on any account without anyone re-reading a support page. One item is recorded as NOT verified rather than omitted: `--duration 10` + end frame is **submit-verified only** (`duration_set seconds=10` on the correct route with both images bound), because the status poll returned HTTP 401 mid-run and a retry 401'd at `project.create` before submitting — [#561](https://github.com/ffroliva/gflow-cli/issues/561), pre-existing, so verification was stopped rather than spending further credits on an environmental fault.) · previous: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
+**"What was live-verified for v0.66.0?"** → [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — **#639 Flow's `flow.google.com` migration, verified 2026-09-03 on profile `ffroliva` at ZERO credits.** The maintainer's own account turned out to be inside the rollout, so the fix was proven against the real migrated frontend rather than a reconstructed DOM: a read-only probe of `flow.google.com/project/<id>` measured `i_total: 0` (independently reproducing the reporter's central measurement) and drove the production functions against the live page — `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was `false` before the fix, i.e. a valid session read as logged-out), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 / `retryable: true`. The flap is confirmed on ONE account: a credit-free `image t2i` minutes earlier landed on the OLD host and completed exit 0 with a real 768x1376 JPEG (`ffd8ffe0`, 401,939 bytes, Pillow dims matching the API claim), proving the rewritten host gate does not regress the old path. Also recorded: the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>` — which is why a substring gate on `labs.google` could never match it; and the migrated composer is not control-less but exposes **no `data-testid`, zero ligature `<i>`, and 13 `button[aria-label]`** (`Settings trigger`, `Start generation`, …), recorded as recon for the follow-up WITH the caveat that `aria-label` is translated and therefore Tier-2 at best under the locale-invariance rule. One item is recorded as NOT verified rather than omitted: gflow **driving** the migrated frontend, which is out of scope and keeps #639 open. Verification also hit pre-existing [#561](https://github.com/ffroliva/gflow-cli/issues/561) (401 on `project.createProject`), A/B'd against unmodified `develop` to prove it was not this change, then routed around with an existing `--project`.
+
+**"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.
+
+**"Does the `referenceEntity` guard actually run, and is it a Web Worker or a Service Worker?"** → [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md) — **A/B-proven live on denon82 2026-09-02, zero credits.** Control (without #618): the guard never fired and the test failed; with #618: it fired and passed. Same account, same prompt, one variable. Settles the question that held #618 — it is a **dedicated Web Worker**, so `context.route` suffices and no `service_workers="block"` is needed. Also confirms `route.continue_(post_data=...)` does not corrupt the body (both runs produced a real image). The **video** glob was equally dead, which #615 never mentions. Residual: direct-wire routes still bypass structurally (#619).
+
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)
 **"What was live-verified for the video-download feature (#29)?"** → [LIVE_VERIFICATION_video_download](LIVE_VERIFICATION_video_download.md)
 **"What is the jitter matrix evidence for `gflow image batch`?"** → [`LIVE_VERIFICATION_image_batch.md`](LIVE_VERIFICATION_image_batch.md) — jitter matrix evidence for `gflow image batch` (always-same-project mode)