gflow-cli 0.66.0__tar.gz → 0.66.1__tar.gz

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.66.0",
+  "version": "0.66.1",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.1] — 2026-09-03
+
+### Fixed
+
+- **A migrated-origin run spent ~36 s discovering a failure knowable in microseconds
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** `flow.google.com` renders none
+  of the controls gflow drives, so every DOM probe is doomed before it starts — yet the run
+  still burned the full `detect_ui_mode` poll window (~8 s, both arms missing), the crop
+  selector cascade (~24 s) and the URL settle (4 s) before raising `FlowHostMigratedError`.
+  Because the rollout flaps per page load and callers retry on exit 36, that cost was paid on
+  **every attempt** of a retry loop. `get_ui_driver` now checks the host first and fails fast
+  with the same retryable exit 36. The old host is untouched and still gets full DOM detection;
+  a page whose URL cannot be read still probes rather than bailing, so a transient is never
+  mistaken for a migrated origin.
+
+- **Locale resolution was blind on `flow.google.com`, and silently discarded a locale it had
+  already learned ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).** The migrated
+  origin serves `/project/<id>` with no `/fx/<locale>/tools/flow` segment, so
+  `locale_segment_from_url` could never match there. The locale had not disappeared — it moved
+  into `<html lang>`, which stays correct on the migrated host. Two measured consequences:
+  `next_locale_state("pt", None)` returned PROVISIONAL, **demoting** an already-learned locale
+  on every migrated load (so a fully-migrated account could never learn it again, undoing
+  [#587](https://github.com/ffroliva/gflow-cli/issues/587)); and `await_url_settled` burned the
+  full 4 s timeout per navigation waiting for a shape that can no longer exist. gflow now falls
+  back to `<html lang>` when the URL carries no segment, and skips the settle wait entirely on
+  the migrated origin.
+
+  The fallback is evidence-backed, not assumed: measured on two accounts (`en` and `pt-BR`),
+  `<html lang>` **agreed with the URL segment wherever both existed**. Unlike
+  `navigator.language` — which reports the value gflow itself sets — it is server-rendered by
+  Flow. Where Flow does state the locale in the URL, that stays authoritative.
+
 ## [0.66.0] — 2026-09-03
 
 ### Fixed
@@ -3705,7 +3737,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...HEAD
+[0.66.1]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...v0.66.1
 [0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
 [0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0
 [0.64.0]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...v0.64.0

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.66.0
+Version: 0.66.1
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/docs/INDEX.md

@@ -158,6 +158,8 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.64.0](LIVE_VERIFICATION_v0.64.0.md) (**#626 `--model omni-flash --end-frame` — first+last interpolation on Omni 1.1 Flash, verified 2026-09-02.** The guard this release removes was evidence-gated, so it was retired on evidence: a route-aborted submit capture on **two distinct Google accounts** (`ffroliva`, `denon82`) fired `video:batchAsyncGenerateVideoStartAndEndImage` with `startImage` AND `endImage` non-null at **zero credits**, ruling out a single-account artifact. The decisive layer is semantic, not structural: the paid 4s generation's **last frame IS the supplied end image** and its first frame is the start image — two visibly different subjects — which is the only check that distinguishes "Flow bound the end frame" from "Flow accepted and ignored it", and which layers 1–4 would pass either way. Render: 4.01s / 720×1280 / h264+aac / 2.4 MB, `MEDIA_GENERATION_STATUS_SUCCESSFUL`. The static capability table is **deleted**, not corrected — it went stale silently once and would again; a post-submit route check (`_assert_i2v_route`) now fails a run whose end frame Flow dropped back to the `StartImage` route, catching a rollback on any account without anyone re-reading a support page. One item is recorded as NOT verified rather than omitted: `--duration 10` + end frame is **submit-verified only** (`duration_set seconds=10` on the correct route with both images bound), because the status poll returned HTTP 401 mid-run and a retry 401'd at `project.create` before submitting — [#561](https://github.com/ffroliva/gflow-cli/issues/561), pre-existing, so verification was stopped rather than spending further credits on an environmental fault.) · previous: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
+**"What was live-verified for v0.66.1?"** → [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md) — **the two migrated-origin fixes, verified 2026-09-03 on profile `ffroliva` at ZERO credits, on BOTH sides of the still-flapping rollout.** On a real `flow.google.com` load `get_ui_driver` raised `FlowHostMigratedError` in **0 ms** (was ~36 s: ~8 s detect window + ~24 s crop cascade + 4 s URL settle), exit 36, `retryable: true`, `ui_driver.migrated_host_bail` logged; `await_url_settled` returned `null` in **0 ms** (measured 4018 ms before); and the locale was recovered as `en` from `html lang=en-GB` where the URL gave `null`. The no-regression half is the stronger evidence: minutes later the same command landed on the OLD host and completed **exit 0** with a real 768x1376 JPEG in 42.2 s, proving the host guard is scoped and does not short-circuit the working path. Three items recorded as NOT verified rather than omitted: driving the migrated frontend (still impossible, #639 stays open), the pt-BR recovery live (measured `html lang=pt` on `denon82` but exercised live only on `en-GB`), and the `en-GB`→`en` region reduction against a locale where region is load-bearing (`zh-Hans`/`zh-Hant`) — only two locales observed.
+
 **"What was live-verified for v0.66.0?"** → [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — **#639 Flow's `flow.google.com` migration, verified 2026-09-03 on profile `ffroliva` at ZERO credits.** The maintainer's own account turned out to be inside the rollout, so the fix was proven against the real migrated frontend rather than a reconstructed DOM: a read-only probe of `flow.google.com/project/<id>` measured `i_total: 0` (independently reproducing the reporter's central measurement) and drove the production functions against the live page — `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was `false` before the fix, i.e. a valid session read as logged-out), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 / `retryable: true`. The flap is confirmed on ONE account: a credit-free `image t2i` minutes earlier landed on the OLD host and completed exit 0 with a real 768x1376 JPEG (`ffd8ffe0`, 401,939 bytes, Pillow dims matching the API claim), proving the rewritten host gate does not regress the old path. Also recorded: the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>` — which is why a substring gate on `labs.google` could never match it; and the migrated composer is not control-less but exposes **no `data-testid`, zero ligature `<i>`, and 13 `button[aria-label]`** (`Settings trigger`, `Start generation`, …), recorded as recon for the follow-up WITH the caveat that `aria-label` is translated and therefore Tier-2 at best under the locale-invariance rule. One item is recorded as NOT verified rather than omitted: gflow **driving** the migrated frontend, which is out of scope and keeps #639 open. Verification also hit pre-existing [#561](https://github.com/ffroliva/gflow-cli/issues/561) (401 on `project.createProject`), A/B'd against unmodified `develop` to prove it was not this change, then routed around with an existing `--project`.
 
 **"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.

gflow_cli-0.66.1/docs/LIVE_VERIFICATION_v0.66.1.md

@@ -0,0 +1,69 @@
+# Live Verification — v0.66.1 (migrated-origin fixes for #639/#643)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy
+**Credits spent:** **0** — one Imagen image (images are credit-free) plus read-only probes.
+
+## What had to be proven
+
+Two fixes, both on the migrated-origin path, and both verifiable live because the account is
+inside Google's rollout:
+
+1. `get_ui_driver` fails fast on `flow.google.com` instead of probing a DOM that cannot answer.
+2. The account locale is recovered from `<html lang>` when the migrated URL carries no segment.
+
+Plus the property that matters more than either: **the old host still works.**
+
+## Layer 1 — the migrated path, measured on a real migrated load
+
+```json
+{
+  "final_url": "https://flow.google.com/project/c5550ed7-...",
+  "host_kind": "migrated",
+  "get_ui_driver": { "raised": "FlowHostMigratedError", "ms": 0,
+                     "exit_code": 36, "retryable": true, "names_host": true },
+  "await_url_settled": { "result": null, "ms": 0 },
+  "locale_recovery": { "html_lang": "en-GB", "from_url": null, "from_lang_attr": "en" }
+}
+```
+
+| | before | after (measured) |
+|---|---|---|
+| `detect_ui_mode` poll window | ~8 s | skipped |
+| crop selector cascade | ~24 s | skipped |
+| `await_url_settled` | 4018 ms | **0 ms** |
+| **time to exit 36** | **~36 s** | **0 ms** |
+| locale on migrated origin | `null` (and demoted a learned locale) | **`en`** recovered from `<html lang>` |
+
+`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than inferred.
+
+## Layer 2 — no regression on the old host (full generation, exit 0)
+
+The rollout still flaps on this account, and a `gflow image t2i --project <existing>` run landed
+on the **old** host during verification:
+
+```
+EXIT=0   ELAPSED_MS=42168
+status: ok | model: NARWHAL
+dims: 768x1376 | tmp/lv661/images/2026-09-03/0add6af6-...-_1.jpg
+```
+
+Real image generated and written. The host guard is scoped to the migrated origin and does not
+short-circuit the path that works.
+
+## Layer 3 — offline
+
+- 5 + 8 tests written **red first** across the two fixes.
+- **A/B controls:** neutering the early bail fails exactly 3; neutering the locale fix fails
+  exactly 8 — one per claimed behaviour, no test passing vacuously. No-regression tests pass in
+  **both** directions.
+- `1614 passed / 3 skipped`; ruff clean; pyright 78 = `develop` baseline.
+
+## Recorded as NOT verified rather than omitted
+
+- **Driving the migrated frontend.** Still impossible; #639 stays open. These fixes make the
+  failure fast and honest, not survivable.
+- **A non-English migrated locale end to end.** `html lang=pt` was measured on `denon82`'s
+  migrated load, but the recovery path was exercised live only on `en-GB` → `en`. The `pt` case
+  is unit-tested, not live-run.
+- **The `en-GB` → `en` region reduction against a locale where region is load-bearing**
+  (`zh-Hans`/`zh-Hant`). Only two locales observed; flagged in the docstring.

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/docs/PROJECT_STATUS.md

@@ -4,6 +4,39 @@
 
 ## Current release
 
+**v0.66.1 — alpha.** **The migrated-origin failure went from 36 seconds of doomed probing to
+instant, and stopped throwing away a locale it had already learned.**
+
+v0.66.0 taught gflow to *name* Google's `flow.google.com` migration
+([#639](https://github.com/ffroliva/gflow-cli/issues/639)). This release makes living with it
+cheap. Two fixes, both measured on real migrated loads rather than reasoned about:
+
+**Fail fast.** The migrated frontend renders none of the controls gflow drives, so every DOM
+probe was doomed before it started — yet a run still burned the `detect_ui_mode` poll window
+(~8 s, both arms missing), the crop cascade (~24 s) and the URL settle (4 s) before raising
+`FlowHostMigratedError`. Because the rollout flaps per page load and callers retry on exit 36,
+that was paid on **every attempt of a retry loop**. The host is knowable from `page.url` in
+microseconds; measured live, exit 36 now arrives in **0 ms**.
+
+**Stop discarding the locale.** The migrated origin serves `/project/<id>` with no
+`/fx/<locale>/tools/flow` segment, so locale resolution was structurally blind there — and
+`next_locale_state("pt", None)` then *demoted* an already-learned locale to PROVISIONAL on
+every migrated load, silently undoing [#587](https://github.com/ffroliva/gflow-cli/issues/587).
+The locale had not disappeared with the URL shape; it was in `<html lang>` the whole time.
+Measured on two accounts, `<html lang>` **agreed with the URL segment wherever both existed** —
+which is what licenses it as a fallback, where `navigator.language` (which reports the value
+gflow itself sets) would not
+([#643](https://github.com/ffroliva/gflow-cli/issues/643)).
+
+Neither fix makes the migrated frontend drivable — #639 stays open for that. What they buy is a
+failure that is instant and honest instead of slow and lossy.
+
+Verification: [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md) — proven on **both sides
+of the still-flapping rollout** at zero credits: 0 ms exit 36 on a migrated load, and minutes
+later **exit 0** with a real 768x1376 JPEG on an old-host load, proving the guard is scoped.
+
+<details><summary>v0.66.0 — naming Flow's flow.google.com migration</summary>
+
 **v0.66.0 — alpha.** **Google started moving Flow to a new domain, and gflow blamed its own
 selectors for it.**
 
@@ -42,6 +75,8 @@ Verification: [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — prov
 `check_logged_in: true`, exit 36, `retryable: true`), with a credit-free `image t2i` on the
 old host minutes earlier completing exit 0 to prove no regression.
 
+</details>
+
 <details><summary>v0.65.0 — the referenceEntity guard that had never fired</summary>
 
 **v0.65.0 — alpha.** **A safety net that had never once fired, and two crashes that spent
@@ -485,6 +520,7 @@ reporter-verified e2e on macOS).
 
 | Milestone | Status |
 |---|---|
+| Migrated-origin runs fail instantly (0 ms) and keep their learned locale | ✅ done (v0.66.1) |
 | Flow `flow.google.com` migration named as its own retryable failure (exit 36) | ✅ done (v0.66.0) |
 | Repo scaffold, CI, license, README, disclaimer | ✅ done |
 | Auth login flow (one-time browser capture) | ✅ done |

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.66.0"
+version = "0.66.1"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/src/gflow_cli/__init__.py

@@ -1,3 +1,3 @@
 """gflow-cli — unofficial CLI for Google Flow."""
 
-__version__ = "0.66.0"
+__version__ = "0.66.1"

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/src/gflow_cli/api/client.py

@@ -792,8 +792,23 @@ class FlowApiClient:
         segment = routes.locale_segment_from_url(settled or "")
         if segment is not None:
             logger.info("client.account_locale_resolved", locale=segment, url=settled)
-        else:
-            logger.info("client.account_locale_unresolved", last_url=settled)
+            return segment
+        # #643: the migrated flow.google.com origin serves /project/<id> with no
+        # locale segment, so the URL can never answer there — but Flow still
+        # renders the account locale into <html lang>. Without this the resolver
+        # returns None and `next_locale_state` DEMOTES an already-learned locale
+        # to PROVISIONAL (measured: a pt account lost its "pt" on every migrated
+        # load). Best-effort: a probe failure must never break navigation.
+        try:
+            lang = await page.evaluate("() => document.documentElement.lang || ''")
+        except Exception as exc:  # noqa: BLE001 - observation only
+            logger.info("client.account_locale_lang_probe_failed", error=type(exc).__name__)
+            lang = None
+        segment = routes.locale_segment_from_lang_attr(lang)
+        if segment is not None:
+            logger.info("client.account_locale_resolved", locale=segment, source="html_lang")
+            return segment
+        logger.info("client.account_locale_unresolved", last_url=settled)
         return segment
 
     async def _launch_persistent_context(self, kwargs: JsonObject) -> BrowserContext:

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/src/gflow_cli/api/routes.py

@@ -212,6 +212,38 @@ def locale_segment_from_url(url: str) -> str | None:
     return match.group(1).lower()
 
 
+_LANG_ATTR_RE = re.compile(r"^([a-z]{2,3})(?:-[a-z]{2,4})?$")
+
+
+def locale_segment_from_lang_attr(lang: str | None) -> str | None:
+    """Derive Flow's locale SEGMENT from a page's ``<html lang>`` attribute (#643).
+
+    Needed because the migrated ``flow.google.com`` origin serves ``/project/<id>``
+    with **no locale segment at all** — :func:`locale_segment_from_url` is
+    structurally blind there. The locale did not disappear with the URL shape; it
+    is still served in the document.
+
+    Measured 2026-09-03 on two profiles, old host vs migrated:
+
+    * ``ffroliva``  old ``/fx/tools/flow`` (bare), ``lang=en``  -> migrated ``lang=en-GB``
+    * ``denon82``   old ``/fx/pt/tools/flow``,     ``lang=pt``  -> migrated ``lang=pt``
+
+    ``html lang`` **agreed with the URL segment wherever both existed**, which is
+    what licenses it as a fallback. Unlike ``navigator.language`` — which reports
+    the value gflow itself sets when it launches the context, and so answers
+    confidently but wrongly — this attribute is server-rendered by Flow.
+
+    The region suffix is dropped (``en-GB`` -> ``en``) because Flow's URL segments
+    carry no region, and the two derivations must stay comparable. Anything that
+    is not a plausible tag returns ``None`` — "build the bare URL" is always safe,
+    and guessing is the defect this exists to avoid.
+    """
+    if not lang:
+        return None
+    match = _LANG_ATTR_RE.match(lang.strip().lower())
+    return match.group(1) if match else None
+
+
 def project_editor_url(locale: str | None, project_id: str) -> str:
     """Build the user-facing Flow editor URL for an existing project.
 

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/src/gflow_cli/api/transports/_common.py

@@ -224,6 +224,12 @@ async def await_url_settled(page: Any) -> str | None:
         current = ""
     if current and FLOW_LOCALISED_URL_RE.match(current):
         return current
+    # #643: on the migrated origin the localised shape can NEVER appear — the path
+    # is /project/<id>, with no /fx/<locale>/tools/flow segment. Waiting for it
+    # burned the full timeout (measured 4018 ms on every migrated navigation) to
+    # return the None we can return now.
+    if flow_host_kind(current) == "migrated":
+        return None
 
     try:
         await page.wait_for_url(FLOW_LOCALISED_URL_RE, timeout=URL_SETTLE_TIMEOUT_MS)

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/src/gflow_cli/api/transports/drivers/factory.py

@@ -152,6 +152,27 @@ async def get_ui_driver(
     Call per generation — the cohort flaps per page load, so a cached driver
     goes stale on the next navigation / batch item.
     """
+    # #639: the migrated flow.google.com frontend renders none of the controls
+    # gflow drives, so every probe below is doomed before it starts. Finding that
+    # out the slow way costs ~32 s per attempt (the ~8 s detect_ui_mode poll
+    # window, both arms missing, plus the ~24 s crop cascade) -- and because the
+    # rollout flaps and callers retry on exit 36, that is paid on every attempt of
+    # a retry loop. The host is knowable from page.url in microseconds.
+    from gflow_cli.api.transports._common import flow_host_kind
+
+    if flow_host_kind(getattr(page, "url", None)) == "migrated":
+        from gflow_cli.errors import FlowHostMigratedError
+
+        log.info("ui_driver.migrated_host_bail")
+        raise FlowHostMigratedError(
+            detail=(
+                "Flow served this project from flow.google.com — the origin Google is "
+                "migrating the app onto — whose frontend renders none of the controls "
+                "gflow drives. This is not selector drift. The migration flaps per page "
+                "load, so retrying often lands the old frontend."
+            )
+        )
+
     # Prerequisite switch: when a specific arm is required and the current one
     # differs, attempt the DOM toggle for that direction (best-effort — the
     # server can pin the arm). The re-probe below VERIFIES whether it took.

gflow_cli-0.66.1/tests/api/test_routes_locale.py

@@ -0,0 +1,185 @@
+"""Locale-segment extraction from a settled Flow URL (issue #580).
+
+gflow hardcoded `locale="en-US"` for every account, so a pt-BR account was sent to
+`/fx/en/...` and Flow redirected it to `/fx/pt/...` AFTER `page.goto` had already
+returned — leaving the next DOM action operating on a page about to be navigated
+away. The only trustworthy source of the account locale is where Flow itself lands
+(`auth/session` carries no locale, and `navigator.language` reports the value gflow
+sets at launch). This parses that landing URL.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from gflow_cli.api.routes import locale_segment_from_lang_attr, locale_segment_from_url
+
+PID = "2ddc3a33-97db-41a0-a0d3-7f9488b0d5a9"
+
+
+@pytest.mark.parametrize(
+    ("url", "expected"),
+    [
+        # measured live on denon82 (pt-BR)
+        (f"https://labs.google/fx/pt/tools/flow/project/{PID}", "pt"),
+        ("https://labs.google/fx/pt/tools/flow", "pt"),
+        ("https://labs.google/fx/pt/tools/flow?hl=en", "pt"),
+        ("https://labs.google/fx/en/tools/flow", "en"),
+        ("https://labs.google/fx/ja/tools/flow", "ja"),
+        # three-letter segments are legal BCP-47 primary tags
+        ("https://labs.google/fx/fil/tools/flow", "fil"),
+    ],
+)
+def test_extracts_locale_segment(url: str, expected: str) -> None:
+    assert locale_segment_from_url(url) == expected
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        # no segment at all — Flow serves this and normalises later
+        f"https://labs.google/fx/tools/flow/project/{PID}",
+        "https://labs.google/fx/tools/flow",
+        # `tools` is not a locale: the guard must not mistake the next path
+        # component for one just because it sits in the segment position.
+        "https://labs.google/fx/tools",
+        # junk in the segment slot
+        "https://labs.google/fx/PROJECT/tools/flow",
+        "https://labs.google/fx/toolong/tools/flow",
+        "https://labs.google/fx/1/tools/flow",
+        "https://labs.google/fx/p-t/tools/flow",
+        # not a Flow URL
+        "https://example.invalid/fx/pt/tools/flow",
+        "https://labs.google/other/pt/tools/flow",
+        "",
+    ],
+)
+def test_returns_none_when_no_trustworthy_segment(url: str) -> None:
+    """No segment is strictly better than a guessed one.
+
+    Falling back to the bare URL is never worse than today's behaviour; guessing
+    `en` is exactly the bug.
+    """
+    assert locale_segment_from_url(url) is None
+
+
+def test_bcp47_tail_is_dropped() -> None:
+    """`pt-BR` in the path reduces to the primary tag Flow actually serves."""
+    assert locale_segment_from_url("https://labs.google/fx/pt-BR/tools/flow") == "pt"
+
+
+# ---------------------------------------------------------------------------
+# #643: on flow.google.com the locale left the URL but NOT the document
+# ---------------------------------------------------------------------------
+
+
+class TestLocaleSegmentFromLangAttr:
+    """The migrated origin serves `/project/<id>` with no locale segment, so
+    `locale_segment_from_url` is structurally blind there — but the locale is
+    still being served, in `<html lang>`.
+
+    Measured on two profiles, old host vs migrated:
+
+        ffroliva  old: /fx/tools/flow (bare)    lang=en     migrated: lang=en-GB
+        denon82   old: /fx/**pt**/tools/flow    lang=pt     migrated: lang=pt
+
+    `html lang` AGREED with the URL segment wherever both existed, which is what
+    makes it a trustworthy fallback. Unlike `navigator.language` — which reports
+    the value gflow itself sets when it launches the context — this attribute is
+    server-rendered by Flow.
+    """
+
+    def test_plain_segment(self) -> None:
+        assert locale_segment_from_lang_attr("pt") == "pt"
+
+    def test_region_suffix_is_reduced_to_the_segment(self) -> None:
+        """Measured: the migrated English account renders `en-GB`; Flow's URL
+        segment form is `en`, so the region must be dropped to stay comparable."""
+        assert locale_segment_from_lang_attr("en-GB") == "en"
+        assert locale_segment_from_lang_attr("pt-BR") == "pt"
+
+    def test_case_is_normalised(self) -> None:
+        assert locale_segment_from_lang_attr("PT-br") == "pt"
+
+    def test_three_letter_segment_allowed(self) -> None:
+        assert locale_segment_from_lang_attr("fil") == "fil"
+
+    def test_junk_is_none_not_a_guess(self) -> None:
+        for bad in ("", "   ", "x", "english", "e n", "1234", "zz-ZZ-ZZ-ZZ"):
+            assert locale_segment_from_lang_attr(bad) is None, bad
+
+    def test_none_input(self) -> None:
+        assert locale_segment_from_lang_attr(None) is None
+
+    def test_agrees_with_url_derivation_where_both_exist(self) -> None:
+        """The property that licenses the fallback: on the OLD host, both
+        sources are present and they must not disagree."""
+        url = "https://labs.google/fx/pt/tools/flow"
+        assert locale_segment_from_url(url) == locale_segment_from_lang_attr("pt")
+
+
+# ---------------------------------------------------------------------------
+# #643: the resolver must USE the fallback, not just have one available
+# ---------------------------------------------------------------------------
+
+
+class TestResolveAccountLocaleFallsBackToHtmlLang:
+    """`_resolve_account_locale` derived the locale from the settled URL only.
+
+    On the migrated origin that URL carries no segment, so it resolved `None` —
+    and `next_locale_state("pt", None)` then returned PROVISIONAL, DEMOTING a
+    correctly-learned locale (measured on `denon82`). The locale was sitting in
+    `<html lang>` the whole time.
+    """
+
+    @staticmethod
+    def _page(url: str, lang: str) -> MagicMock:
+        page = MagicMock()
+        page.url = url
+        page.wait_for_url = AsyncMock()
+        page.evaluate = AsyncMock(return_value=lang)
+        return page
+
+    @pytest.mark.asyncio
+    async def test_migrated_host_recovers_locale_from_html_lang(self) -> None:
+        from gflow_cli.api.client import FlowApiClient
+
+        page = self._page("https://flow.google.com/project/abc-123", "pt")
+        got = await FlowApiClient._resolve_account_locale(object(), page)  # type: ignore[arg-type]
+        assert got == "pt"
+
+    @pytest.mark.asyncio
+    async def test_migrated_english_region_tag_reduces_to_segment(self) -> None:
+        from gflow_cli.api.client import FlowApiClient
+
+        page = self._page("https://flow.google.com/", "en-GB")
+        got = await FlowApiClient._resolve_account_locale(object(), page)  # type: ignore[arg-type]
+        assert got == "en"
+
+    @pytest.mark.asyncio
+    async def test_url_segment_still_wins_on_the_old_host(self) -> None:
+        """No regression: where Flow states the locale in the URL, that stays
+        authoritative — the fallback must not override it."""
+        from gflow_cli.api.client import FlowApiClient
+
+        page = self._page("https://labs.google/fx/pt/tools/flow", "de")
+        got = await FlowApiClient._resolve_account_locale(object(), page)  # type: ignore[arg-type]
+        assert got == "pt"
+        page.evaluate.assert_not_awaited()
+
+    @pytest.mark.asyncio
+    async def test_unreadable_lang_stays_none_rather_than_guessing(self) -> None:
+        from gflow_cli.api.client import FlowApiClient
+
+        page = self._page("https://flow.google.com/", "")
+        assert await FlowApiClient._resolve_account_locale(object(), page) is None  # type: ignore[arg-type]
+
+    @pytest.mark.asyncio
+    async def test_evaluate_failure_is_survivable(self) -> None:
+        from gflow_cli.api.client import FlowApiClient
+
+        page = self._page("https://flow.google.com/", "pt")
+        page.evaluate = AsyncMock(side_effect=RuntimeError("no execution context"))
+        assert await FlowApiClient._resolve_account_locale(object(), page) is None  # type: ignore[arg-type]

{gflow_cli-0.66.0 → gflow_cli-0.66.1}/tests/api/transports/drivers/test_ui_mode.py

@@ -11,7 +11,7 @@ arm (which today drops `-i` cards and mis-hints aspect ratios).
 
 from __future__ import annotations
 
-from unittest.mock import AsyncMock
+from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
@@ -317,3 +317,98 @@ def test_worker_video_ui_mode_agentic_payload_rejected() -> None:
 
     with _pytest.raises(ValueError, match="agentic"):
         build_video_request({"prompt": "a", "ui_mode": "agentic"})
+
+
+# ---------------------------------------------------------------------------
+# #639 follow-up: fail fast on the migrated origin instead of probing a DOM
+# that cannot answer
+# ---------------------------------------------------------------------------
+
+
+_CROP = "i.google-symbols:text-is('crop_16_9')"
+
+
+def _page_with_present(present: set[str]):
+    page = MagicMock()
+
+    def locator(sel: str):
+        loc = MagicMock()
+        loc.count = AsyncMock(return_value=1 if sel in present else 0)
+        return loc
+
+    page.locator = MagicMock(side_effect=locator)
+    return page
+
+
+class TestMigratedOriginFailsFast:
+    """`flow.google.com` renders none of the controls gflow drives, so every
+    probe below is doomed before it starts. Measured cost of finding that out
+    the slow way, per attempt:
+
+        detect_ui_mode poll window   ~8 s   (both arms miss, falls to deadline)
+        crop selector cascade       ~24 s
+                                    -----
+                                    ~32 s   before FlowHostMigratedError is raised
+
+    The migration flaps per load and callers retry on exit 36, so that cost is
+    paid on every attempt of a retry loop. The host is knowable in microseconds
+    from `page.url`, so none of it needs to be spent.
+    """
+
+    @pytest.mark.asyncio
+    async def test_raises_before_probing_the_dom(self) -> None:
+        from gflow_cli.api.transports.drivers.factory import get_ui_driver
+        from gflow_cli.errors import FlowHostMigratedError
+
+        page = MagicMock()
+        page.url = "https://flow.google.com/project/abc-123"
+        page.locator = MagicMock(side_effect=AssertionError("must not probe the DOM"))
+
+        with pytest.raises(FlowHostMigratedError):
+            await get_ui_driver(page)
+        page.locator.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_error_is_retryable_with_exit_36(self) -> None:
+        from gflow_cli.api.transports.drivers.factory import get_ui_driver
+        from gflow_cli.errors import EXIT_CODE_MAP, FlowHostMigratedError, is_retryable
+
+        page = MagicMock()
+        page.url = "https://flow.google.com/"
+        page.locator = MagicMock(side_effect=AssertionError("must not probe the DOM"))
+
+        with pytest.raises(FlowHostMigratedError) as exc:
+            await get_ui_driver(page)
+        assert is_retryable(exc.value)
+        assert EXIT_CODE_MAP[FlowHostMigratedError] == 36
+
+    @pytest.mark.asyncio
+    async def test_bail_names_the_migration_not_selector_drift(self) -> None:
+        from gflow_cli.api.transports.drivers.factory import get_ui_driver
+        from gflow_cli.errors import FlowHostMigratedError
+
+        page = MagicMock()
+        page.url = "https://flow.google.com/"
+        page.locator = MagicMock(side_effect=AssertionError("must not probe the DOM"))
+        with pytest.raises(FlowHostMigratedError) as exc:
+            await get_ui_driver(page)
+        assert "flow.google.com" in str(exc.value)
+
+    @pytest.mark.asyncio
+    async def test_labs_host_is_untouched(self) -> None:
+        """No regression: the old host must still go through full DOM detection."""
+        from gflow_cli.api.transports.drivers.factory import detect_ui_mode
+
+        page = _page_with_present({_CROP})
+        page.url = "https://labs.google/fx/tools/flow/project/abc"
+        assert await detect_ui_mode(page, timeout_s=0.1, poll_interval_s=0.01) == "classic"
+
+    @pytest.mark.asyncio
+    async def test_unreadable_url_still_probes_rather_than_bailing(self) -> None:
+        """Defensive: a page whose .url is not a usable string must NOT be
+        mistaken for a migrated host — that would turn a transient into a
+        permanent-looking abort."""
+        from gflow_cli.api.transports.drivers.factory import detect_ui_mode
+
+        page = _page_with_present({_CROP})  # MagicMock .url, never assigned
+        assert await detect_ui_mode(page, timeout_s=0.1, poll_interval_s=0.01) == "classic"