gflow-cli 0.65.0__tar.gz → 0.66.0__tar.gz

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.0] — 2026-09-03
+
+### Fixed
+
+- **Flow's migration to `flow.google.com` was reported as selector drift
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** Google is moving Flow
+  off Labs onto its own origin. The migrated frontend renders **zero** Material Symbols
+  `<i>` elements, so every gflow selector — cohort detection included — misses at once,
+  and the run died with `UiSelectorDriftError` (exit 23, `retryable: false`): an error
+  that reads like the selectors rotted and sent operators hunting for the wrong cause.
+  The rollout **flaps per page load** — the same account and project land on the old
+  host on one navigation and the migrated one on the next — so a re-run frequently
+  succeeds, but the non-retryable classification made automated callers give up.
+  gflow now recognises the migrated origin and raises the distinct, **retryable**
+  `FlowHostMigratedError` (exit 36) naming the migration. Applies to CLI and MCP alike
+  (both route through the shared mode-switch raise site, and `retryable` has a single
+  source of truth). **This does not add support for the migrated frontend** — that is
+  separate work; see [KNOWN_ISSUES.md](KNOWN_ISSUES.md).
+
+- **A migrated page load was misread as a logged-out session
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** `_check_logged_in`
+  hard-required `labs.google` in the URL, so a perfectly valid authenticated session on
+  the migrated host failed the gate and drove a pointless re-auth. It now accepts both
+  Flow origins.
+
+### Security
+
+- **The authenticated-session URL gate matched hosts by substring.** `_check_logged_in`
+  tested `"labs.google" in page.url`, which any foreign URL satisfies merely by carrying
+  the string in its path or query (`https://evil.example/?next=labs.google/fx/tools/flow`).
+  The host is now parsed and matched exactly.
+
+### Changed
+
+- Incident bundles from a `flow.google.com` load previously reported
+  `url.host_category: "other"` / `url.route: "other"`, hiding the most useful fact about
+  the failure. The migrated origin is now classified as `flow_app`, with the same
+  identifier reduction applied.
+
+Live-verified 2026-09-03 at zero credits against the **real** migrated frontend, on an
+account inside the rollout: `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was
+`false` before the fix), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 /
+`retryable: true` — while a credit-free `image t2i` minutes earlier landed on the old host and
+completed exit 0, proving no regression. See
+[docs/LIVE_VERIFICATION_v0.66.0.md](docs/LIVE_VERIFICATION_v0.66.0.md).
+
 ## [0.65.0] — 2026-09-02
 
 ### Fixed
@@ -3659,7 +3705,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...HEAD
+[0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
 [0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0
 [0.64.0]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...v0.64.0
 [0.63.0]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...v0.63.0

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/KNOWN_ISSUES.md

@@ -14,6 +14,52 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### Flow is migrating to `flow.google.com`; the migrated frontend is not drivable
+
+- **Status:** Open · **Severity:** High (every generation command fails on a migrated page load) · **Affected:** all `gflow image` / `gflow video` generation, CLI and MCP alike, on accounts the rollout has reached
+- **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
+- **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
+
+Google is moving Flow off Labs onto its own origin. On a migrated page load,
+`https://labs.google/fx/tools/flow/project/<id>` redirects to
+`https://flow.google.com/project/<id>` and serves a rewritten frontend that
+contains **zero `<i>` elements**. Every gflow selector anchors on Material
+Symbols ligatures (`i.google-symbols:text-is(...)`), so cohort detection and
+every mode control miss at once.
+
+**The rollout flaps per page load.** The same account, profile and project land
+on the old host on one navigation and the migrated one on the next, minutes
+apart, with no client change. Measured on one account ~35 minutes apart:
+
+```
+old host       labs.google/fx/<locale>/tools/flow/...   i=55  i.google-symbols=49  crop_* present   -> exit 0
+migrated host  flow.google.com/project/...              i=0   i.google-symbols=0   crop_* absent    -> exit 36
+```
+
+Note the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>`, not
+`/fx/<locale>/tools/flow/project/<id>`. Any host gate written as a substring test on
+`labs.google` could never have matched it.
+
+This is **not** selector rot, not [#493](https://github.com/ffroliva/gflow-cli/issues/493),
+and not the agentic cohort — the agentic indicators are absent too. It is a
+different origin serving different markup.
+
+**Workaround:** re-run the command. While the rollout flaps, a fresh navigation
+frequently lands the old frontend and the run completes normally. Automated
+callers get this for free: the failure is `FlowHostMigratedError` (exit 36) with
+`retryable: true`, so retry loops driven by the `--json` / MCP / worker error
+envelope will keep trying.
+
+**What gflow does today (v0.66.0):** recognises the migrated origin and fails
+with the distinct, retryable exit 36 instead of the misleading
+`UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
+accepts the migrated host, so a migrated load is no longer misread as a
+logged-out session. **Support for driving the new frontend is separate work and
+is not implemented** — once the rollout completes for an account, no retry will
+help until then.
+
+---
+
 ### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second
 
 - **Status:** Open · **Severity:** Medium (audible/visible on every internal seam of a chained extend) · **Affected:** `gflow video extend -n >1` with `-o`, and any scene mixing extend segments

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.65.0
+Version: 0.66.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/docs/DEBUGGING.md

@@ -106,7 +106,8 @@ at command startup).
 ### What triggers a capture (and what never does)
 
 Captured: `FlowAppError` (31), `FlowAgentUiError` (25),
-`UiModeUnavailableError` (28), `UiSelectorDriftError` (23),
+`FlowHostMigratedError` (36), `UiModeUnavailableError` (28),
+`UiSelectorDriftError` (23),
 `TransportTimeoutError` (9), `BrowserSessionClosedError` (15),
 `WireFormatError` (7), `WafRejectionError` (10), `NetworkError` (6),
 unexpected exceptions while a page is alive, and `ProfileLockedError` (11)

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/docs/INDEX.md

@@ -158,6 +158,8 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.64.0](LIVE_VERIFICATION_v0.64.0.md) (**#626 `--model omni-flash --end-frame` — first+last interpolation on Omni 1.1 Flash, verified 2026-09-02.** The guard this release removes was evidence-gated, so it was retired on evidence: a route-aborted submit capture on **two distinct Google accounts** (`ffroliva`, `denon82`) fired `video:batchAsyncGenerateVideoStartAndEndImage` with `startImage` AND `endImage` non-null at **zero credits**, ruling out a single-account artifact. The decisive layer is semantic, not structural: the paid 4s generation's **last frame IS the supplied end image** and its first frame is the start image — two visibly different subjects — which is the only check that distinguishes "Flow bound the end frame" from "Flow accepted and ignored it", and which layers 1–4 would pass either way. Render: 4.01s / 720×1280 / h264+aac / 2.4 MB, `MEDIA_GENERATION_STATUS_SUCCESSFUL`. The static capability table is **deleted**, not corrected — it went stale silently once and would again; a post-submit route check (`_assert_i2v_route`) now fails a run whose end frame Flow dropped back to the `StartImage` route, catching a rollback on any account without anyone re-reading a support page. One item is recorded as NOT verified rather than omitted: `--duration 10` + end frame is **submit-verified only** (`duration_set seconds=10` on the correct route with both images bound), because the status poll returned HTTP 401 mid-run and a retry 401'd at `project.create` before submitting — [#561](https://github.com/ffroliva/gflow-cli/issues/561), pre-existing, so verification was stopped rather than spending further credits on an environmental fault.) · previous: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
+**"What was live-verified for v0.66.0?"** → [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — **#639 Flow's `flow.google.com` migration, verified 2026-09-03 on profile `ffroliva` at ZERO credits.** The maintainer's own account turned out to be inside the rollout, so the fix was proven against the real migrated frontend rather than a reconstructed DOM: a read-only probe of `flow.google.com/project/<id>` measured `i_total: 0` (independently reproducing the reporter's central measurement) and drove the production functions against the live page — `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was `false` before the fix, i.e. a valid session read as logged-out), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 / `retryable: true`. The flap is confirmed on ONE account: a credit-free `image t2i` minutes earlier landed on the OLD host and completed exit 0 with a real 768x1376 JPEG (`ffd8ffe0`, 401,939 bytes, Pillow dims matching the API claim), proving the rewritten host gate does not regress the old path. Also recorded: the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>` — which is why a substring gate on `labs.google` could never match it; and the migrated composer is not control-less but exposes **no `data-testid`, zero ligature `<i>`, and 13 `button[aria-label]`** (`Settings trigger`, `Start generation`, …), recorded as recon for the follow-up WITH the caveat that `aria-label` is translated and therefore Tier-2 at best under the locale-invariance rule. One item is recorded as NOT verified rather than omitted: gflow **driving** the migrated frontend, which is out of scope and keeps #639 open. Verification also hit pre-existing [#561](https://github.com/ffroliva/gflow-cli/issues/561) (401 on `project.createProject`), A/B'd against unmodified `develop` to prove it was not this change, then routed around with an existing `--project`.
+
 **"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.
 
 **"Does the `referenceEntity` guard actually run, and is it a Web Worker or a Service Worker?"** → [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md) — **A/B-proven live on denon82 2026-09-02, zero credits.** Control (without #618): the guard never fired and the test failed; with #618: it fired and passed. Same account, same prompt, one variable. Settles the question that held #618 — it is a **dedicated Web Worker**, so `context.route` suffices and no `service_workers="block"` is needed. Also confirms `route.continue_(post_data=...)` does not corrupt the body (both runs produced a real image). The **video** glob was equally dead, which #615 never mentions. Residual: direct-wire routes still bypass structurally (#619).

gflow_cli-0.66.0/docs/LIVE_VERIFICATION_v0.66.0.md

@@ -0,0 +1,119 @@
+# Live Verification — v0.66.0 (issue #639, Flow's `flow.google.com` migration)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy (system Chrome)
+**Branch:** `bugfix/639-flow-google-com-migration` · **PR:** [#640](https://github.com/ffroliva/gflow-cli/pull/640)
+**Credits spent:** **0** — one Imagen image (images are credit-free; only Veo video spends) plus one read-only DOM probe.
+
+## What had to be proven
+
+The fix classifies a failure. Two independent claims, and offline tests can prove neither:
+
+1. **On a real migrated load**, `_mode_switch_error` returns `FlowHostMigratedError` (exit 36, retryable) — not `UiSelectorDriftError` (23).
+2. **On an old-host load**, nothing regressed — in particular the rewritten `_check_logged_in`
+   host gate, which sits on the auth path of *every* run.
+
+Both were verified against live Flow. The maintainer's own account turned out to be inside the
+rollout, so this did not need the reporter.
+
+## Layer 1 — the migration is real, and it flaps on one account
+
+Same account, same profile, minutes apart, same gflow build:
+
+| | old-host load | migrated load |
+|---|---|---|
+| final URL | `labs.google/fx/tools/flow/project/<id>` | `flow.google.com/project/<id>?pli=1` |
+| `document.querySelectorAll('i').length` | **55** (reporter) | **0** (measured here) |
+| `i.google-symbols` | 49 (reporter) | **0** (measured here) |
+| `crop_*` trigger | present | **absent** |
+| `gflow image t2i` | **exit 0**, image downloaded | **exit 36** |
+
+The migrated URL also **drops the `/fx/tools/flow` path entirely** — it is `/project/<id>`, not
+`/fx/<locale>/tools/flow/project/<id>`. That is why a substring gate on `labs.google` could never
+have matched it.
+
+## Layer 2 — the migrated path, measured (read-only, `$0`)
+
+Probe: launch the authenticated persistent context, navigate to the migrated project URL, wait 9 s
+for the composer, then run the real production functions against the live page.
+
+```json
+{
+  "final_url": "https://flow.google.com/project/c5550ed7-...?pli=1",
+  "flow_host_kind": "migrated",
+  "check_logged_in": true,
+  "dom": { "i_total": 0, "symbols": [], "crop": 0, "testids": [], "buttons": 19 },
+  "mode_switch_error_class": "FlowHostMigratedError",
+  "exit_code": 36,
+  "retryable": true
+}
+```
+
+- `i_total: 0` — **the reporter's central measurement reproduced independently.**
+- `check_logged_in: true` — the auth-gate fix works on the real migrated page. Before the fix this
+  was `false`, i.e. a valid session read as logged-out.
+- `FlowHostMigratedError` / `36` / `retryable: true` — **the fix fires on the real thing**, not
+  only on the DOM shape reconstructed in tests.
+
+## Layer 3 — no regression on the old host (full generation path, exit 0)
+
+`gflow image t2i --project <existing> --aspect 9:16 --count 1`
+
+```json
+{"status": "ok", "model": "NARWHAL",
+ "images": [{"media_name": "b7d7316a-...", "seed": 49027,
+             "dimensions": {"width": 768, "height": 1376},
+             "local_path": "tmp/lv639/images/2026-09-03/b7d7316a-..._1.jpg"}]}
+```
+
+Verification ledger:
+
+| Layer | Evidence |
+|---|---|
+| L1 file count | 1 file written |
+| L2 magic bytes | `ffd8ffe0` → JPEG · 401,939 bytes on disk |
+| L3 Pillow dims | `(768, 1376)` — **matches** the API-claimed dimensions |
+| L4 structlog | `image_mode_entered` → `image_model_selected` → `count_setter_completed` → `prompt_submitted` → `batch_request_intercepted` |
+| L5 wire | `flowMedia:batchGenerateImages` intercepted, `request0_keys` carried `imageAspectRatio`, `imageModelName`, `structuredPrompt` |
+
+The mode-switch cascade **found** its controls and generation completed — the rewritten host gate
+does not break the old path.
+
+## Layer 4 — A/B control (offline, but the discipline that makes the above meaningful)
+
+With all three fix sites neutered, **exactly 9 tests fail** — one per claimed behaviour. Restored:
+256 passed. No test passes vacuously.
+
+## Known limitation hit during verification, and how it was routed around
+
+A first `t2i` attempt died at **exit 3 / HTTP 401 on `project.createProject`** — open issue
+[#561](https://github.com/ffroliva/gflow-cli/issues/561), *not* this change: unmodified `develop`
+was A/B'd and failed **identically** (same exit, same route). Passing an existing `--project` skips
+project creation and routes past it. `gflow project list` succeeded throughout, confirming the
+session itself was valid — the #561 signature exactly.
+
+## Recon for the follow-up (support for the migrated frontend)
+
+The migrated composer is **not** control-less; it expresses controls differently. It exposes **no
+`data-testid`** and **zero ligature `<i>`**, but 13 `button[aria-label]` values:
+
+```
+Back button to go to previous page · More options for the project · Search ·
+Filtering and sorting options · Add media menu · Product help · Tile grid settings ·
+More options · Favourite · Reuse prompt · Add ingredients to the prompt box ·
+Settings trigger · Start generation
+```
+
+`Settings trigger` and `Start generation` are the functional equivalents of the classic `crop_*`
+trigger and submit button. **Caveat for whoever builds on this:** `aria-label` values are
+*translated*, so these strings are Tier-2 at best and violate the locale-invariance rule as literal
+selectors. The durable anchors are structural — button ordering within the composer container,
+`svg` presence, and ARIA *roles* — and deriving them needs a second probe across locales.
+
+## Verdict
+
+| Claim | Status |
+|---|---|
+| Exit 36 fires on a real migrated load | ✅ **VERIFIED LIVE** |
+| `_check_logged_in` accepts the real migrated host | ✅ **VERIFIED LIVE** |
+| Old-host generation path unregressed | ✅ **VERIFIED LIVE** (exit 0, real artifact) |
+| gflow *drives* the migrated frontend | ❌ **NOT CLAIMED** — out of scope; #639 stays open |

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/docs/PROJECT_STATUS.md

@@ -4,6 +4,46 @@
 
 ## Current release
 
+**v0.66.0 — alpha.** **Google started moving Flow to a new domain, and gflow blamed its own
+selectors for it.**
+
+On a migrated page load, `labs.google/fx/tools/flow/project/<id>` redirects to
+`flow.google.com/project/<id>` and serves a rewritten frontend containing **zero `<i>`
+elements**. Every gflow selector anchors on Material Symbols ligatures, so cohort detection
+and every mode control missed at once and the run died `UiSelectorDriftError` — exit 23,
+`retryable: false`. That error means "a selector rotted, file a bug", so it sent operators
+hunting where nothing was broken. The selectors are correct for the host they were written
+against; that host is being replaced under them
+([#639](https://github.com/ffroliva/gflow-cli/issues/639), reported by
+[@maipmacrothorax-75](https://github.com/maipmacrothorax-75) with measurements from both
+sides of the rollout).
+
+The rollout **flaps per page load** — the same account, profile and project land on the old
+host on one navigation and the migrated one on the next — so a re-run frequently succeeds,
+which `retryable: false` was throwing away. gflow now recognises the migrated origin and
+raises a distinct, **retryable** `FlowHostMigratedError` (exit 36). CLI and MCP both inherit
+it: they share the raise site, and `is_retryable` is a single source of truth for the
+`--json`, MCP and worker envelopes.
+
+Tracing the same root cause turned up three things the report did not name. `_check_logged_in`
+hard-required `labs.google` in the URL, so a valid authenticated session on the migrated host
+was read as **logged-out** — and that gate was a *substring* match, satisfied by any foreign
+URL merely carrying the string in a path or query. Separately, `UiSelectorDriftError` is an
+incident-**capture** trigger, so swapping in a new class would have silently switched off
+bundle capture for exactly the failure whose evidence is most wanted; a test now pins that
+invariant across all four arms of the raise site rather than a list of names.
+
+**This does not add support for the migrated frontend.** It converts a confusing hard failure
+into a clear retryable one. Once the rollout completes for an account, no retry will help —
+#639 stays open for that work, with the anchor recon it needs already recorded.
+
+Verification: [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — proven against the
+**real** migrated frontend at zero credits (`i_total: 0`, `flow_host_kind: "migrated"`,
+`check_logged_in: true`, exit 36, `retryable: true`), with a credit-free `image t2i` on the
+old host minutes earlier completing exit 0 to prove no regression.
+
+<details><summary>v0.65.0 — the referenceEntity guard that had never fired</summary>
+
 **v0.65.0 — alpha.** **A safety net that had never once fired, and two crashes that spent
 your credits before failing.**
 
@@ -45,6 +85,8 @@ regardless of matcher — [#619](https://github.com/ffroliva/gflow-cli/issues/61
 Verification:
 [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md).
 
+</details>
+
 <details><summary>v0.64.0 — <code>i2v --end-frame</code> on Omni 1.1 Flash</summary>
 
 **v0.64.0 — alpha.** **`gflow video i2v --model omni-flash --end-frame` — first+last
@@ -443,6 +485,7 @@ reporter-verified e2e on macOS).
 
 | Milestone | Status |
 |---|---|
+| Flow `flow.google.com` migration named as its own retryable failure (exit 36) | ✅ done (v0.66.0) |
 | Repo scaffold, CI, license, README, disclaimer | ✅ done |
 | Auth login flow (one-time browser capture) | ✅ done |
 | Video: `t2v` / `i2v` / `batch` (Veo 3.1) | ✅ done (v0.2.0a1) |

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/docs/USAGE.md

@@ -1642,6 +1642,7 @@ shell scripts can branch on the failure mode without parsing stderr.
 | `33` | — (`gflow doctor` verdict) | Doctor found warn/fail findings — a successful diagnosis, not an error class | Review the report; see [`gflow doctor`](#gflow-doctor) |
 | `34` | `SyncPartialError`    | `gflow data sync` failed on some projects but succeeded on others — completed writes stay committed | Retryable: re-run the same command; it resumes with what is still nameless (see [`gflow data sync`](#gflow-data-sync)) |
 | `35` | `ExtendUnavailableError` | No Veo extend model is orderable for this account and aspect — the extend family is tier-gated and there is no square variant. **Never auto-retry**: a tier gate does not clear on its own. |
+| `36` | `FlowHostMigratedError` | Flow served the project from `flow.google.com` — the origin Google is migrating the app onto — whose frontend renders none of the controls gflow drives. Not selector drift (23) | **Retryable while the rollout flaps**: the same account lands on the old host on one page load and the new one on the next, so re-running often succeeds. If every attempt now lands on `flow.google.com`, the migration has completed for your account and retrying will not help — see [#639](https://github.com/ffroliva/gflow-cli/issues/639) |
 | `130`| SIGINT                | User-interrupted (Ctrl-C)                        | —                                                          |
 
 **Exit code 16 — data store / migration error.** Fires when:

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.65.0"
+version = "0.66.0"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/src/gflow_cli/__init__.py

@@ -1,3 +1,3 @@
 """gflow-cli — unofficial CLI for Google Flow."""
 
-__version__ = "0.65.0"
+__version__ = "0.66.0"

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/src/gflow_cli/api/transports/_common.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import json
 import uuid
 from typing import Any
+from urllib.parse import urlsplit
 
 import structlog
 
@@ -53,6 +54,37 @@ def mint_batch_id() -> str:
     return str(uuid.uuid4())
 
 
+# Flow's own origins. Google is migrating the app off labs.google onto
+# flow.google.com (issue #639) and the two FLAP per page load, so both are live
+# and every host gate has to accept both.
+_FLOW_HOSTS: dict[str, str] = {
+    "labs.google": "labs",
+    "flow.google.com": "migrated",
+}
+
+
+def flow_host_kind(url: object) -> str | None:
+    """Classify a URL's origin as ``"labs"``, ``"migrated"``, or ``None``.
+
+    Exact host match over a parsed https URL — never a substring test, which any
+    foreign URL satisfies just by mentioning the host in its path or query.
+
+    Total by construction: both callers read this straight off ``page.url`` on
+    best-effort paths where a probe error must never displace the real failure,
+    so anything unparseable — or not even a string — classifies as ``None``.
+    """
+    if not isinstance(url, str):
+        return None
+    try:
+        parts = urlsplit(url)
+        if parts.scheme != "https":
+            return None
+        host = (parts.hostname or "").lower()
+    except ValueError:
+        return None
+    return _FLOW_HOSTS.get(host)
+
+
 PROJECT_URL_FRAGMENT = "/project/"
 
 

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/src/gflow_cli/api/transports/ui_automation.py

@@ -34,6 +34,7 @@ from gflow_cli.api.transports._common import (
     close_menu,
     count_visible,
     extract_project_id,
+    flow_host_kind,
     generation_error,
     offered_menu_labels,
 )
@@ -1077,20 +1078,21 @@ class UiAutomationTransport(VideoGenerationMixin):
         """True if the page shows the authenticated Flow UI.
 
         Gates (pattern G13):
-        - URL is on labs.google AND contains /flow (locale-stable;
-          /fx/pt/tools/flow, /fx/es/tools/flow, etc. all match).
-        - URL is NOT on accounts.google.com.
+        - URL's host is one of Flow's own origins — ``labs.google`` or, since
+          #639, the migrated ``flow.google.com``. Locale-stable: /fx/pt/tools/flow,
+          /fx/es/tools/flow etc. all match, and so does the migrated /project/<id>.
         - /project/<uuid> URLs short-circuit to True (editor already open).
         - Otherwise reject if a top-level Sign-in CTA is visible.
 
+        The host is PARSED and matched exactly. This gate used to be the
+        substring test ``"labs.google" in page.url``, which any foreign URL
+        satisfies simply by carrying the string in a path or query.
+
         A failure in the locator probe is treated as "no Sign-in button"
         — the URL gate already established Flow context, and a transient
         DOM error shouldn't force a re-auth loop.
         """
-        if "accounts.google.com" in page.url:
-            return False
-        on_flow = "labs.google" in page.url and "/flow" in page.url
-        if not on_flow:
+        if flow_host_kind(page.url) is None:
             return False
         if _PROJECT_URL_FRAGMENT in page.url:
             return True

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/src/gflow_cli/api/transports/ui_automation_video.py

@@ -31,6 +31,7 @@ from gflow_cli.api.transports._common import (
     close_menu,
     count_visible,
     extract_project_id,
+    flow_host_kind,
     generation_error,
     offered_menu_labels,
 )
@@ -53,6 +54,7 @@ from gflow_cli.errors import (
     AuthExpiredError,
     FlowAgentUiError,
     FlowAppError,
+    FlowHostMigratedError,
     MediaUploadRejectedError,
     RateLimitError,
     ReferenceNotFoundError,
@@ -1432,7 +1434,7 @@ class VideoGenerationMixin:
     @staticmethod
     async def _mode_switch_error(
         page: Page, out_dir: Path | None, *, media: str
-    ) -> FlowAppError | FlowAgentUiError | UiSelectorDriftError:
+    ) -> FlowAppError | FlowHostMigratedError | FlowAgentUiError | UiSelectorDriftError:
         """Build (do NOT raise — the caller raises) the right error for a
         ``mode_switch_trigger`` miss on the ``image``/``video`` path: dump DOM
         diagnostics, then classify — a transient :class:`FlowAppError` if Flow's app
@@ -1451,6 +1453,20 @@ class VideoGenerationMixin:
                     f"{diag_clause}"
                 )
             )
+        # #639: checked BEFORE the cohort probe, because the cohort indicators are
+        # themselves ligature selectors — on the migrated frontend they miss for the
+        # same reason everything else does, so their silence proves nothing here.
+        if flow_host_kind(page.url) == "migrated":
+            return FlowHostMigratedError(
+                detail=(
+                    "Flow served this project from flow.google.com — the origin Google "
+                    "is migrating the app onto — whose frontend renders none of the "
+                    f"controls gflow drives, so there is no {media} generation control "
+                    "here. This is not selector drift. The migration currently flaps "
+                    "per page load, so retrying often lands the old frontend."
+                    f"{diag_clause}"
+                )
+            )
         cohort = await VideoGenerationMixin._detect_non_classic_cohort(page)
         if cohort is not None:
             return FlowAgentUiError(

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/src/gflow_cli/diagnostics.py

@@ -138,6 +138,10 @@ class ErrorBodySummary:
 # dot. Everything else is ``other`` and its raw host/path is never persisted.
 _HOST_CATEGORIES: tuple[tuple[str, str], ...] = (
     ("labs.google", "flow_app"),
+    # #639: Google is migrating Flow onto its own origin. Without this the
+    # incident bundle from a migrated load reported host_category "other",
+    # hiding the single most useful fact about the failure.
+    ("flow.google.com", "flow_app"),
     ("aisandbox-pa.googleapis.com", "aisandbox"),
     ("accounts.google.com", "google_auth"),
     ("storage.googleapis.com", "google_cdn"),
@@ -1840,6 +1844,7 @@ def _capture_triggers() -> tuple[type[BaseException], ...]:
         BrowserSessionClosedError,
         FlowAgentUiError,
         FlowAppError,
+        FlowHostMigratedError,
         NetworkError,
         TransportTimeoutError,
         UiModeUnavailableError,
@@ -1851,6 +1856,10 @@ def _capture_triggers() -> tuple[type[BaseException], ...]:
     return (
         FlowAppError,
         FlowAgentUiError,
+        # #639: this arm REPLACED UiSelectorDriftError on the migrated frontend.
+        # Omitting it here would silently disable capture for the one failure whose
+        # bundle we most need to build selector support for the new origin.
+        FlowHostMigratedError,
         UiModeUnavailableError,
         UiSelectorDriftError,
         TransportTimeoutError,
@@ -1865,6 +1874,7 @@ def _screenshot_triggers() -> tuple[type[BaseException], ...]:
     from gflow_cli.errors import (
         FlowAgentUiError,
         FlowAppError,
+        FlowHostMigratedError,
         TransportTimeoutError,
         UiModeUnavailableError,
         UiSelectorDriftError,
@@ -1873,6 +1883,7 @@ def _screenshot_triggers() -> tuple[type[BaseException], ...]:
     return (
         FlowAppError,
         FlowAgentUiError,
+        FlowHostMigratedError,
         UiModeUnavailableError,
         UiSelectorDriftError,
         TransportTimeoutError,

{gflow_cli-0.65.0 → gflow_cli-0.66.0}/src/gflow_cli/errors.py

@@ -30,6 +30,7 @@ __all__ = [
     "FlowAgentUiError",
     "FlowApiError",
     "FlowAppError",
+    "FlowHostMigratedError",
     "FrameExtractionError",
     "GFlowError",
     "MediaAttributionError",
@@ -671,6 +672,36 @@ class FlowAppError(GFlowError):
     )
 
 
+class FlowHostMigratedError(GFlowError):
+    """Raised when Flow served the project from ``flow.google.com`` — the origin
+    Google is migrating the app onto (issue #639) — instead of ``labs.google``.
+
+    The migrated frontend is a different build: it renders none of the Material
+    Symbols ligature elements every gflow selector anchors on, so cohort
+    detection and every mode control miss at once. That is NOT selector rot, and
+    reporting it as :class:`UiSelectorDriftError` (exit 23, "file a bug about the
+    selector") sent operators hunting for the wrong cause.
+
+    **Retryable** (exit code 36): the migration flaps per page load — the same
+    account, profile and project land on the old host on one navigation and the
+    new one on the next — so a re-run frequently succeeds. This error does NOT
+    mean gflow supports the migrated frontend; it names the situation and lets
+    callers retry into it.
+    """
+
+    problem_type = "https://gflow-cli.dev/errors/flow-host-migrated"
+    title = "Flow served the migrated flow.google.com frontend"
+    _default_remediation = (
+        "Google is moving Flow from labs.google to flow.google.com, and gflow-cli "
+        "cannot drive the migrated frontend yet — it ships none of the UI controls "
+        "gflow automates. The migration currently flaps per page load, so retrying "
+        "often lands the old frontend and succeeds. If EVERY attempt now lands on "
+        "flow.google.com, the rollout has completed for your account and retrying "
+        "will not help — follow "
+        "https://github.com/ffroliva/gflow-cli/issues/639 for support status."
+    )
+
+
 class UiModeUnavailableError(GFlowError):
     """Raised when the Flow UI arm a command REQUIRES (``--ui-mode`` /
     ``GFLOW_CLI_UI_MODE``, or inferred — e.g. ``-i`` instructions force agentic)
@@ -1152,6 +1183,12 @@ EXIT_CODE_MAP: dict[type[GFlowError], int] = {
     BrowserEngineUnavailableError: 24,
     FlowAgentUiError: 25,
     FlowAppError: 31,
+    # FlowHostMigratedError (#639): Flow served the migrated
+    # flow.google.com frontend, whose DOM gflow cannot drive. Direct
+    # GFlowError subclass; exit 36 lets scripts distinguish "wrong Flow
+    # frontend, retry" from genuine selector drift (23), which it used to
+    # masquerade as.
+    FlowHostMigratedError: 36,
     # UiModeUnavailableError (issue #299): a command's required arm (--ui-mode /
     # inferred) couldn't be reached after a best-effort switch. Direct GFlowError
     # subclass — retryable policy abort, distinct from FlowAgentUiError (25).
@@ -1208,6 +1245,9 @@ RETRYABLE_ERRORS: tuple[type[GFlowError], ...] = (
     BrowserSessionClosedError,
     FlowAppError,
     FlowAgentUiError,
+    # #639: the labs.google / flow.google.com migration flaps per page
+    # load, so re-navigating often lands the drivable frontend.
+    FlowHostMigratedError,
     # #299: the cohort is server-assigned per page load and flaps — the
     # documented remediation for exit 28 IS "retry"; the machine flag must
     # agree with the docs.