gflow-cli 0.65.0__tar.gz → 0.66.1__tar.gz

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.65.0",
+  "version": "0.66.1",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/CHANGELOG.md

@@ -7,6 +7,84 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.1] — 2026-09-03
+
+### Fixed
+
+- **A migrated-origin run spent ~36 s discovering a failure knowable in microseconds
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** `flow.google.com` renders none
+  of the controls gflow drives, so every DOM probe is doomed before it starts — yet the run
+  still burned the full `detect_ui_mode` poll window (~8 s, both arms missing), the crop
+  selector cascade (~24 s) and the URL settle (4 s) before raising `FlowHostMigratedError`.
+  Because the rollout flaps per page load and callers retry on exit 36, that cost was paid on
+  **every attempt** of a retry loop. `get_ui_driver` now checks the host first and fails fast
+  with the same retryable exit 36. The old host is untouched and still gets full DOM detection;
+  a page whose URL cannot be read still probes rather than bailing, so a transient is never
+  mistaken for a migrated origin.
+
+- **Locale resolution was blind on `flow.google.com`, and silently discarded a locale it had
+  already learned ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).** The migrated
+  origin serves `/project/<id>` with no `/fx/<locale>/tools/flow` segment, so
+  `locale_segment_from_url` could never match there. The locale had not disappeared — it moved
+  into `<html lang>`, which stays correct on the migrated host. Two measured consequences:
+  `next_locale_state("pt", None)` returned PROVISIONAL, **demoting** an already-learned locale
+  on every migrated load (so a fully-migrated account could never learn it again, undoing
+  [#587](https://github.com/ffroliva/gflow-cli/issues/587)); and `await_url_settled` burned the
+  full 4 s timeout per navigation waiting for a shape that can no longer exist. gflow now falls
+  back to `<html lang>` when the URL carries no segment, and skips the settle wait entirely on
+  the migrated origin.
+
+  The fallback is evidence-backed, not assumed: measured on two accounts (`en` and `pt-BR`),
+  `<html lang>` **agreed with the URL segment wherever both existed**. Unlike
+  `navigator.language` — which reports the value gflow itself sets — it is server-rendered by
+  Flow. Where Flow does state the locale in the URL, that stays authoritative.
+
+## [0.66.0] — 2026-09-03
+
+### Fixed
+
+- **Flow's migration to `flow.google.com` was reported as selector drift
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** Google is moving Flow
+  off Labs onto its own origin. The migrated frontend renders **zero** Material Symbols
+  `<i>` elements, so every gflow selector — cohort detection included — misses at once,
+  and the run died with `UiSelectorDriftError` (exit 23, `retryable: false`): an error
+  that reads like the selectors rotted and sent operators hunting for the wrong cause.
+  The rollout **flaps per page load** — the same account and project land on the old
+  host on one navigation and the migrated one on the next — so a re-run frequently
+  succeeds, but the non-retryable classification made automated callers give up.
+  gflow now recognises the migrated origin and raises the distinct, **retryable**
+  `FlowHostMigratedError` (exit 36) naming the migration. Applies to CLI and MCP alike
+  (both route through the shared mode-switch raise site, and `retryable` has a single
+  source of truth). **This does not add support for the migrated frontend** — that is
+  separate work; see [KNOWN_ISSUES.md](KNOWN_ISSUES.md).
+
+- **A migrated page load was misread as a logged-out session
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** `_check_logged_in`
+  hard-required `labs.google` in the URL, so a perfectly valid authenticated session on
+  the migrated host failed the gate and drove a pointless re-auth. It now accepts both
+  Flow origins.
+
+### Security
+
+- **The authenticated-session URL gate matched hosts by substring.** `_check_logged_in`
+  tested `"labs.google" in page.url`, which any foreign URL satisfies merely by carrying
+  the string in its path or query (`https://evil.example/?next=labs.google/fx/tools/flow`).
+  The host is now parsed and matched exactly.
+
+### Changed
+
+- Incident bundles from a `flow.google.com` load previously reported
+  `url.host_category: "other"` / `url.route: "other"`, hiding the most useful fact about
+  the failure. The migrated origin is now classified as `flow_app`, with the same
+  identifier reduction applied.
+
+Live-verified 2026-09-03 at zero credits against the **real** migrated frontend, on an
+account inside the rollout: `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was
+`false` before the fix), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 /
+`retryable: true` — while a credit-free `image t2i` minutes earlier landed on the old host and
+completed exit 0, proving no regression. See
+[docs/LIVE_VERIFICATION_v0.66.0.md](docs/LIVE_VERIFICATION_v0.66.0.md).
+
 ## [0.65.0] — 2026-09-02
 
 ### Fixed
@@ -3659,7 +3737,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...HEAD
+[0.66.1]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...v0.66.1
+[0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
 [0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0
 [0.64.0]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...v0.64.0
 [0.63.0]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...v0.63.0

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/KNOWN_ISSUES.md

@@ -14,6 +14,52 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### Flow is migrating to `flow.google.com`; the migrated frontend is not drivable
+
+- **Status:** Open · **Severity:** High (every generation command fails on a migrated page load) · **Affected:** all `gflow image` / `gflow video` generation, CLI and MCP alike, on accounts the rollout has reached
+- **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
+- **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
+
+Google is moving Flow off Labs onto its own origin. On a migrated page load,
+`https://labs.google/fx/tools/flow/project/<id>` redirects to
+`https://flow.google.com/project/<id>` and serves a rewritten frontend that
+contains **zero `<i>` elements**. Every gflow selector anchors on Material
+Symbols ligatures (`i.google-symbols:text-is(...)`), so cohort detection and
+every mode control miss at once.
+
+**The rollout flaps per page load.** The same account, profile and project land
+on the old host on one navigation and the migrated one on the next, minutes
+apart, with no client change. Measured on one account ~35 minutes apart:
+
+```
+old host       labs.google/fx/<locale>/tools/flow/...   i=55  i.google-symbols=49  crop_* present   -> exit 0
+migrated host  flow.google.com/project/...              i=0   i.google-symbols=0   crop_* absent    -> exit 36
+```
+
+Note the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>`, not
+`/fx/<locale>/tools/flow/project/<id>`. Any host gate written as a substring test on
+`labs.google` could never have matched it.
+
+This is **not** selector rot, not [#493](https://github.com/ffroliva/gflow-cli/issues/493),
+and not the agentic cohort — the agentic indicators are absent too. It is a
+different origin serving different markup.
+
+**Workaround:** re-run the command. While the rollout flaps, a fresh navigation
+frequently lands the old frontend and the run completes normally. Automated
+callers get this for free: the failure is `FlowHostMigratedError` (exit 36) with
+`retryable: true`, so retry loops driven by the `--json` / MCP / worker error
+envelope will keep trying.
+
+**What gflow does today (v0.66.0):** recognises the migrated origin and fails
+with the distinct, retryable exit 36 instead of the misleading
+`UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
+accepts the migrated host, so a migrated load is no longer misread as a
+logged-out session. **Support for driving the new frontend is separate work and
+is not implemented** — once the rollout completes for an account, no retry will
+help until then.
+
+---
+
 ### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second
 
 - **Status:** Open · **Severity:** Medium (audible/visible on every internal seam of a chained extend) · **Affected:** `gflow video extend -n >1` with `-o`, and any scene mixing extend segments

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.65.0
+Version: 0.66.1
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/docs/DEBUGGING.md

@@ -106,7 +106,8 @@ at command startup).
 ### What triggers a capture (and what never does)
 
 Captured: `FlowAppError` (31), `FlowAgentUiError` (25),
-`UiModeUnavailableError` (28), `UiSelectorDriftError` (23),
+`FlowHostMigratedError` (36), `UiModeUnavailableError` (28),
+`UiSelectorDriftError` (23),
 `TransportTimeoutError` (9), `BrowserSessionClosedError` (15),
 `WireFormatError` (7), `WafRejectionError` (10), `NetworkError` (6),
 unexpected exceptions while a page is alive, and `ProfileLockedError` (11)

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/docs/INDEX.md

@@ -158,6 +158,10 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.64.0](LIVE_VERIFICATION_v0.64.0.md) (**#626 `--model omni-flash --end-frame` — first+last interpolation on Omni 1.1 Flash, verified 2026-09-02.** The guard this release removes was evidence-gated, so it was retired on evidence: a route-aborted submit capture on **two distinct Google accounts** (`ffroliva`, `denon82`) fired `video:batchAsyncGenerateVideoStartAndEndImage` with `startImage` AND `endImage` non-null at **zero credits**, ruling out a single-account artifact. The decisive layer is semantic, not structural: the paid 4s generation's **last frame IS the supplied end image** and its first frame is the start image — two visibly different subjects — which is the only check that distinguishes "Flow bound the end frame" from "Flow accepted and ignored it", and which layers 1–4 would pass either way. Render: 4.01s / 720×1280 / h264+aac / 2.4 MB, `MEDIA_GENERATION_STATUS_SUCCESSFUL`. The static capability table is **deleted**, not corrected — it went stale silently once and would again; a post-submit route check (`_assert_i2v_route`) now fails a run whose end frame Flow dropped back to the `StartImage` route, catching a rollback on any account without anyone re-reading a support page. One item is recorded as NOT verified rather than omitted: `--duration 10` + end frame is **submit-verified only** (`duration_set seconds=10` on the correct route with both images bound), because the status poll returned HTTP 401 mid-run and a retry 401'd at `project.create` before submitting — [#561](https://github.com/ffroliva/gflow-cli/issues/561), pre-existing, so verification was stopped rather than spending further credits on an environmental fault.) · previous: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
+**"What was live-verified for v0.66.1?"** → [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md) — **the two migrated-origin fixes, verified 2026-09-03 on profile `ffroliva` at ZERO credits, on BOTH sides of the still-flapping rollout.** On a real `flow.google.com` load `get_ui_driver` raised `FlowHostMigratedError` in **0 ms** (was ~36 s: ~8 s detect window + ~24 s crop cascade + 4 s URL settle), exit 36, `retryable: true`, `ui_driver.migrated_host_bail` logged; `await_url_settled` returned `null` in **0 ms** (measured 4018 ms before); and the locale was recovered as `en` from `html lang=en-GB` where the URL gave `null`. The no-regression half is the stronger evidence: minutes later the same command landed on the OLD host and completed **exit 0** with a real 768x1376 JPEG in 42.2 s, proving the host guard is scoped and does not short-circuit the working path. Three items recorded as NOT verified rather than omitted: driving the migrated frontend (still impossible, #639 stays open), the pt-BR recovery live (measured `html lang=pt` on `denon82` but exercised live only on `en-GB`), and the `en-GB`→`en` region reduction against a locale where region is load-bearing (`zh-Hans`/`zh-Hant`) — only two locales observed.
+
+**"What was live-verified for v0.66.0?"** → [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — **#639 Flow's `flow.google.com` migration, verified 2026-09-03 on profile `ffroliva` at ZERO credits.** The maintainer's own account turned out to be inside the rollout, so the fix was proven against the real migrated frontend rather than a reconstructed DOM: a read-only probe of `flow.google.com/project/<id>` measured `i_total: 0` (independently reproducing the reporter's central measurement) and drove the production functions against the live page — `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was `false` before the fix, i.e. a valid session read as logged-out), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 / `retryable: true`. The flap is confirmed on ONE account: a credit-free `image t2i` minutes earlier landed on the OLD host and completed exit 0 with a real 768x1376 JPEG (`ffd8ffe0`, 401,939 bytes, Pillow dims matching the API claim), proving the rewritten host gate does not regress the old path. Also recorded: the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>` — which is why a substring gate on `labs.google` could never match it; and the migrated composer is not control-less but exposes **no `data-testid`, zero ligature `<i>`, and 13 `button[aria-label]`** (`Settings trigger`, `Start generation`, …), recorded as recon for the follow-up WITH the caveat that `aria-label` is translated and therefore Tier-2 at best under the locale-invariance rule. One item is recorded as NOT verified rather than omitted: gflow **driving** the migrated frontend, which is out of scope and keeps #639 open. Verification also hit pre-existing [#561](https://github.com/ffroliva/gflow-cli/issues/561) (401 on `project.createProject`), A/B'd against unmodified `develop` to prove it was not this change, then routed around with an existing `--project`.
+
 **"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.
 
 **"Does the `referenceEntity` guard actually run, and is it a Web Worker or a Service Worker?"** → [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md) — **A/B-proven live on denon82 2026-09-02, zero credits.** Control (without #618): the guard never fired and the test failed; with #618: it fired and passed. Same account, same prompt, one variable. Settles the question that held #618 — it is a **dedicated Web Worker**, so `context.route` suffices and no `service_workers="block"` is needed. Also confirms `route.continue_(post_data=...)` does not corrupt the body (both runs produced a real image). The **video** glob was equally dead, which #615 never mentions. Residual: direct-wire routes still bypass structurally (#619).

gflow_cli-0.66.1/docs/LIVE_VERIFICATION_v0.66.0.md

@@ -0,0 +1,119 @@
+# Live Verification — v0.66.0 (issue #639, Flow's `flow.google.com` migration)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy (system Chrome)
+**Branch:** `bugfix/639-flow-google-com-migration` · **PR:** [#640](https://github.com/ffroliva/gflow-cli/pull/640)
+**Credits spent:** **0** — one Imagen image (images are credit-free; only Veo video spends) plus one read-only DOM probe.
+
+## What had to be proven
+
+The fix classifies a failure. Two independent claims, and offline tests can prove neither:
+
+1. **On a real migrated load**, `_mode_switch_error` returns `FlowHostMigratedError` (exit 36, retryable) — not `UiSelectorDriftError` (23).
+2. **On an old-host load**, nothing regressed — in particular the rewritten `_check_logged_in`
+   host gate, which sits on the auth path of *every* run.
+
+Both were verified against live Flow. The maintainer's own account turned out to be inside the
+rollout, so this did not need the reporter.
+
+## Layer 1 — the migration is real, and it flaps on one account
+
+Same account, same profile, minutes apart, same gflow build:
+
+| | old-host load | migrated load |
+|---|---|---|
+| final URL | `labs.google/fx/tools/flow/project/<id>` | `flow.google.com/project/<id>?pli=1` |
+| `document.querySelectorAll('i').length` | **55** (reporter) | **0** (measured here) |
+| `i.google-symbols` | 49 (reporter) | **0** (measured here) |
+| `crop_*` trigger | present | **absent** |
+| `gflow image t2i` | **exit 0**, image downloaded | **exit 36** |
+
+The migrated URL also **drops the `/fx/tools/flow` path entirely** — it is `/project/<id>`, not
+`/fx/<locale>/tools/flow/project/<id>`. That is why a substring gate on `labs.google` could never
+have matched it.
+
+## Layer 2 — the migrated path, measured (read-only, `$0`)
+
+Probe: launch the authenticated persistent context, navigate to the migrated project URL, wait 9 s
+for the composer, then run the real production functions against the live page.
+
+```json
+{
+  "final_url": "https://flow.google.com/project/c5550ed7-...?pli=1",
+  "flow_host_kind": "migrated",
+  "check_logged_in": true,
+  "dom": { "i_total": 0, "symbols": [], "crop": 0, "testids": [], "buttons": 19 },
+  "mode_switch_error_class": "FlowHostMigratedError",
+  "exit_code": 36,
+  "retryable": true
+}
+```
+
+- `i_total: 0` — **the reporter's central measurement reproduced independently.**
+- `check_logged_in: true` — the auth-gate fix works on the real migrated page. Before the fix this
+  was `false`, i.e. a valid session read as logged-out.
+- `FlowHostMigratedError` / `36` / `retryable: true` — **the fix fires on the real thing**, not
+  only on the DOM shape reconstructed in tests.
+
+## Layer 3 — no regression on the old host (full generation path, exit 0)
+
+`gflow image t2i --project <existing> --aspect 9:16 --count 1`
+
+```json
+{"status": "ok", "model": "NARWHAL",
+ "images": [{"media_name": "b7d7316a-...", "seed": 49027,
+             "dimensions": {"width": 768, "height": 1376},
+             "local_path": "tmp/lv639/images/2026-09-03/b7d7316a-..._1.jpg"}]}
+```
+
+Verification ledger:
+
+| Layer | Evidence |
+|---|---|
+| L1 file count | 1 file written |
+| L2 magic bytes | `ffd8ffe0` → JPEG · 401,939 bytes on disk |
+| L3 Pillow dims | `(768, 1376)` — **matches** the API-claimed dimensions |
+| L4 structlog | `image_mode_entered` → `image_model_selected` → `count_setter_completed` → `prompt_submitted` → `batch_request_intercepted` |
+| L5 wire | `flowMedia:batchGenerateImages` intercepted, `request0_keys` carried `imageAspectRatio`, `imageModelName`, `structuredPrompt` |
+
+The mode-switch cascade **found** its controls and generation completed — the rewritten host gate
+does not break the old path.
+
+## Layer 4 — A/B control (offline, but the discipline that makes the above meaningful)
+
+With all three fix sites neutered, **exactly 9 tests fail** — one per claimed behaviour. Restored:
+256 passed. No test passes vacuously.
+
+## Known limitation hit during verification, and how it was routed around
+
+A first `t2i` attempt died at **exit 3 / HTTP 401 on `project.createProject`** — open issue
+[#561](https://github.com/ffroliva/gflow-cli/issues/561), *not* this change: unmodified `develop`
+was A/B'd and failed **identically** (same exit, same route). Passing an existing `--project` skips
+project creation and routes past it. `gflow project list` succeeded throughout, confirming the
+session itself was valid — the #561 signature exactly.
+
+## Recon for the follow-up (support for the migrated frontend)
+
+The migrated composer is **not** control-less; it expresses controls differently. It exposes **no
+`data-testid`** and **zero ligature `<i>`**, but 13 `button[aria-label]` values:
+
+```
+Back button to go to previous page · More options for the project · Search ·
+Filtering and sorting options · Add media menu · Product help · Tile grid settings ·
+More options · Favourite · Reuse prompt · Add ingredients to the prompt box ·
+Settings trigger · Start generation
+```
+
+`Settings trigger` and `Start generation` are the functional equivalents of the classic `crop_*`
+trigger and submit button. **Caveat for whoever builds on this:** `aria-label` values are
+*translated*, so these strings are Tier-2 at best and violate the locale-invariance rule as literal
+selectors. The durable anchors are structural — button ordering within the composer container,
+`svg` presence, and ARIA *roles* — and deriving them needs a second probe across locales.
+
+## Verdict
+
+| Claim | Status |
+|---|---|
+| Exit 36 fires on a real migrated load | ✅ **VERIFIED LIVE** |
+| `_check_logged_in` accepts the real migrated host | ✅ **VERIFIED LIVE** |
+| Old-host generation path unregressed | ✅ **VERIFIED LIVE** (exit 0, real artifact) |
+| gflow *drives* the migrated frontend | ❌ **NOT CLAIMED** — out of scope; #639 stays open |

gflow_cli-0.66.1/docs/LIVE_VERIFICATION_v0.66.1.md

@@ -0,0 +1,69 @@
+# Live Verification — v0.66.1 (migrated-origin fixes for #639/#643)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy
+**Credits spent:** **0** — one Imagen image (images are credit-free) plus read-only probes.
+
+## What had to be proven
+
+Two fixes, both on the migrated-origin path, and both verifiable live because the account is
+inside Google's rollout:
+
+1. `get_ui_driver` fails fast on `flow.google.com` instead of probing a DOM that cannot answer.
+2. The account locale is recovered from `<html lang>` when the migrated URL carries no segment.
+
+Plus the property that matters more than either: **the old host still works.**
+
+## Layer 1 — the migrated path, measured on a real migrated load
+
+```json
+{
+  "final_url": "https://flow.google.com/project/c5550ed7-...",
+  "host_kind": "migrated",
+  "get_ui_driver": { "raised": "FlowHostMigratedError", "ms": 0,
+                     "exit_code": 36, "retryable": true, "names_host": true },
+  "await_url_settled": { "result": null, "ms": 0 },
+  "locale_recovery": { "html_lang": "en-GB", "from_url": null, "from_lang_attr": "en" }
+}
+```
+
+| | before | after (measured) |
+|---|---|---|
+| `detect_ui_mode` poll window | ~8 s | skipped |
+| crop selector cascade | ~24 s | skipped |
+| `await_url_settled` | 4018 ms | **0 ms** |
+| **time to exit 36** | **~36 s** | **0 ms** |
+| locale on migrated origin | `null` (and demoted a learned locale) | **`en`** recovered from `<html lang>` |
+
+`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than inferred.
+
+## Layer 2 — no regression on the old host (full generation, exit 0)
+
+The rollout still flaps on this account, and a `gflow image t2i --project <existing>` run landed
+on the **old** host during verification:
+
+```
+EXIT=0   ELAPSED_MS=42168
+status: ok | model: NARWHAL
+dims: 768x1376 | tmp/lv661/images/2026-09-03/0add6af6-...-_1.jpg
+```
+
+Real image generated and written. The host guard is scoped to the migrated origin and does not
+short-circuit the path that works.
+
+## Layer 3 — offline
+
+- 5 + 8 tests written **red first** across the two fixes.
+- **A/B controls:** neutering the early bail fails exactly 3; neutering the locale fix fails
+  exactly 8 — one per claimed behaviour, no test passing vacuously. No-regression tests pass in
+  **both** directions.
+- `1614 passed / 3 skipped`; ruff clean; pyright 78 = `develop` baseline.
+
+## Recorded as NOT verified rather than omitted
+
+- **Driving the migrated frontend.** Still impossible; #639 stays open. These fixes make the
+  failure fast and honest, not survivable.
+- **A non-English migrated locale end to end.** `html lang=pt` was measured on `denon82`'s
+  migrated load, but the recovery path was exercised live only on `en-GB` → `en`. The `pt` case
+  is unit-tested, not live-run.
+- **The `en-GB` → `en` region reduction against a locale where region is load-bearing**
+  (`zh-Hans`/`zh-Hant`). Only two locales observed; flagged in the docstring.

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/docs/PROJECT_STATUS.md

@@ -4,6 +4,81 @@
 
 ## Current release
 
+**v0.66.1 — alpha.** **The migrated-origin failure went from 36 seconds of doomed probing to
+instant, and stopped throwing away a locale it had already learned.**
+
+v0.66.0 taught gflow to *name* Google's `flow.google.com` migration
+([#639](https://github.com/ffroliva/gflow-cli/issues/639)). This release makes living with it
+cheap. Two fixes, both measured on real migrated loads rather than reasoned about:
+
+**Fail fast.** The migrated frontend renders none of the controls gflow drives, so every DOM
+probe was doomed before it started — yet a run still burned the `detect_ui_mode` poll window
+(~8 s, both arms missing), the crop cascade (~24 s) and the URL settle (4 s) before raising
+`FlowHostMigratedError`. Because the rollout flaps per page load and callers retry on exit 36,
+that was paid on **every attempt of a retry loop**. The host is knowable from `page.url` in
+microseconds; measured live, exit 36 now arrives in **0 ms**.
+
+**Stop discarding the locale.** The migrated origin serves `/project/<id>` with no
+`/fx/<locale>/tools/flow` segment, so locale resolution was structurally blind there — and
+`next_locale_state("pt", None)` then *demoted* an already-learned locale to PROVISIONAL on
+every migrated load, silently undoing [#587](https://github.com/ffroliva/gflow-cli/issues/587).
+The locale had not disappeared with the URL shape; it was in `<html lang>` the whole time.
+Measured on two accounts, `<html lang>` **agreed with the URL segment wherever both existed** —
+which is what licenses it as a fallback, where `navigator.language` (which reports the value
+gflow itself sets) would not
+([#643](https://github.com/ffroliva/gflow-cli/issues/643)).
+
+Neither fix makes the migrated frontend drivable — #639 stays open for that. What they buy is a
+failure that is instant and honest instead of slow and lossy.
+
+Verification: [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md) — proven on **both sides
+of the still-flapping rollout** at zero credits: 0 ms exit 36 on a migrated load, and minutes
+later **exit 0** with a real 768x1376 JPEG on an old-host load, proving the guard is scoped.
+
+<details><summary>v0.66.0 — naming Flow's flow.google.com migration</summary>
+
+**v0.66.0 — alpha.** **Google started moving Flow to a new domain, and gflow blamed its own
+selectors for it.**
+
+On a migrated page load, `labs.google/fx/tools/flow/project/<id>` redirects to
+`flow.google.com/project/<id>` and serves a rewritten frontend containing **zero `<i>`
+elements**. Every gflow selector anchors on Material Symbols ligatures, so cohort detection
+and every mode control missed at once and the run died `UiSelectorDriftError` — exit 23,
+`retryable: false`. That error means "a selector rotted, file a bug", so it sent operators
+hunting where nothing was broken. The selectors are correct for the host they were written
+against; that host is being replaced under them
+([#639](https://github.com/ffroliva/gflow-cli/issues/639), reported by
+[@maipmacrothorax-75](https://github.com/maipmacrothorax-75) with measurements from both
+sides of the rollout).
+
+The rollout **flaps per page load** — the same account, profile and project land on the old
+host on one navigation and the migrated one on the next — so a re-run frequently succeeds,
+which `retryable: false` was throwing away. gflow now recognises the migrated origin and
+raises a distinct, **retryable** `FlowHostMigratedError` (exit 36). CLI and MCP both inherit
+it: they share the raise site, and `is_retryable` is a single source of truth for the
+`--json`, MCP and worker envelopes.
+
+Tracing the same root cause turned up three things the report did not name. `_check_logged_in`
+hard-required `labs.google` in the URL, so a valid authenticated session on the migrated host
+was read as **logged-out** — and that gate was a *substring* match, satisfied by any foreign
+URL merely carrying the string in a path or query. Separately, `UiSelectorDriftError` is an
+incident-**capture** trigger, so swapping in a new class would have silently switched off
+bundle capture for exactly the failure whose evidence is most wanted; a test now pins that
+invariant across all four arms of the raise site rather than a list of names.
+
+**This does not add support for the migrated frontend.** It converts a confusing hard failure
+into a clear retryable one. Once the rollout completes for an account, no retry will help —
+#639 stays open for that work, with the anchor recon it needs already recorded.
+
+Verification: [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — proven against the
+**real** migrated frontend at zero credits (`i_total: 0`, `flow_host_kind: "migrated"`,
+`check_logged_in: true`, exit 36, `retryable: true`), with a credit-free `image t2i` on the
+old host minutes earlier completing exit 0 to prove no regression.
+
+</details>
+
+<details><summary>v0.65.0 — the referenceEntity guard that had never fired</summary>
+
 **v0.65.0 — alpha.** **A safety net that had never once fired, and two crashes that spent
 your credits before failing.**
 
@@ -45,6 +120,8 @@ regardless of matcher — [#619](https://github.com/ffroliva/gflow-cli/issues/61
 Verification:
 [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md).
 
+</details>
+
 <details><summary>v0.64.0 — <code>i2v --end-frame</code> on Omni 1.1 Flash</summary>
 
 **v0.64.0 — alpha.** **`gflow video i2v --model omni-flash --end-frame` — first+last
@@ -443,6 +520,8 @@ reporter-verified e2e on macOS).
 
 | Milestone | Status |
 |---|---|
+| Migrated-origin runs fail instantly (0 ms) and keep their learned locale | ✅ done (v0.66.1) |
+| Flow `flow.google.com` migration named as its own retryable failure (exit 36) | ✅ done (v0.66.0) |
 | Repo scaffold, CI, license, README, disclaimer | ✅ done |
 | Auth login flow (one-time browser capture) | ✅ done |
 | Video: `t2v` / `i2v` / `batch` (Veo 3.1) | ✅ done (v0.2.0a1) |

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/docs/USAGE.md

@@ -1642,6 +1642,7 @@ shell scripts can branch on the failure mode without parsing stderr.
 | `33` | — (`gflow doctor` verdict) | Doctor found warn/fail findings — a successful diagnosis, not an error class | Review the report; see [`gflow doctor`](#gflow-doctor) |
 | `34` | `SyncPartialError`    | `gflow data sync` failed on some projects but succeeded on others — completed writes stay committed | Retryable: re-run the same command; it resumes with what is still nameless (see [`gflow data sync`](#gflow-data-sync)) |
 | `35` | `ExtendUnavailableError` | No Veo extend model is orderable for this account and aspect — the extend family is tier-gated and there is no square variant. **Never auto-retry**: a tier gate does not clear on its own. |
+| `36` | `FlowHostMigratedError` | Flow served the project from `flow.google.com` — the origin Google is migrating the app onto — whose frontend renders none of the controls gflow drives. Not selector drift (23) | **Retryable while the rollout flaps**: the same account lands on the old host on one page load and the new one on the next, so re-running often succeeds. If every attempt now lands on `flow.google.com`, the migration has completed for your account and retrying will not help — see [#639](https://github.com/ffroliva/gflow-cli/issues/639) |
 | `130`| SIGINT                | User-interrupted (Ctrl-C)                        | —                                                          |
 
 **Exit code 16 — data store / migration error.** Fires when:

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.65.0"
+version = "0.66.1"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/src/gflow_cli/__init__.py

@@ -1,3 +1,3 @@
 """gflow-cli — unofficial CLI for Google Flow."""
 
-__version__ = "0.65.0"
+__version__ = "0.66.1"

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/src/gflow_cli/api/client.py

@@ -792,8 +792,23 @@ class FlowApiClient:
         segment = routes.locale_segment_from_url(settled or "")
         if segment is not None:
             logger.info("client.account_locale_resolved", locale=segment, url=settled)
-        else:
-            logger.info("client.account_locale_unresolved", last_url=settled)
+            return segment
+        # #643: the migrated flow.google.com origin serves /project/<id> with no
+        # locale segment, so the URL can never answer there — but Flow still
+        # renders the account locale into <html lang>. Without this the resolver
+        # returns None and `next_locale_state` DEMOTES an already-learned locale
+        # to PROVISIONAL (measured: a pt account lost its "pt" on every migrated
+        # load). Best-effort: a probe failure must never break navigation.
+        try:
+            lang = await page.evaluate("() => document.documentElement.lang || ''")
+        except Exception as exc:  # noqa: BLE001 - observation only
+            logger.info("client.account_locale_lang_probe_failed", error=type(exc).__name__)
+            lang = None
+        segment = routes.locale_segment_from_lang_attr(lang)
+        if segment is not None:
+            logger.info("client.account_locale_resolved", locale=segment, source="html_lang")
+            return segment
+        logger.info("client.account_locale_unresolved", last_url=settled)
         return segment
 
     async def _launch_persistent_context(self, kwargs: JsonObject) -> BrowserContext:

{gflow_cli-0.65.0 → gflow_cli-0.66.1}/src/gflow_cli/api/routes.py

@@ -212,6 +212,38 @@ def locale_segment_from_url(url: str) -> str | None:
     return match.group(1).lower()
 
 
+_LANG_ATTR_RE = re.compile(r"^([a-z]{2,3})(?:-[a-z]{2,4})?$")
+
+
+def locale_segment_from_lang_attr(lang: str | None) -> str | None:
+    """Derive Flow's locale SEGMENT from a page's ``<html lang>`` attribute (#643).
+
+    Needed because the migrated ``flow.google.com`` origin serves ``/project/<id>``
+    with **no locale segment at all** — :func:`locale_segment_from_url` is
+    structurally blind there. The locale did not disappear with the URL shape; it
+    is still served in the document.
+
+    Measured 2026-09-03 on two profiles, old host vs migrated:
+
+    * ``ffroliva``  old ``/fx/tools/flow`` (bare), ``lang=en``  -> migrated ``lang=en-GB``
+    * ``denon82``   old ``/fx/pt/tools/flow``,     ``lang=pt``  -> migrated ``lang=pt``
+
+    ``html lang`` **agreed with the URL segment wherever both existed**, which is
+    what licenses it as a fallback. Unlike ``navigator.language`` — which reports
+    the value gflow itself sets when it launches the context, and so answers
+    confidently but wrongly — this attribute is server-rendered by Flow.
+
+    The region suffix is dropped (``en-GB`` -> ``en``) because Flow's URL segments
+    carry no region, and the two derivations must stay comparable. Anything that
+    is not a plausible tag returns ``None`` — "build the bare URL" is always safe,
+    and guessing is the defect this exists to avoid.
+    """
+    if not lang:
+        return None
+    match = _LANG_ATTR_RE.match(lang.strip().lower())
+    return match.group(1) if match else None
+
+
 def project_editor_url(locale: str | None, project_id: str) -> str:
     """Build the user-facing Flow editor URL for an existing project.