gflow-cli 0.66.1__tar.gz → 0.66.2__tar.gz

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.66.1",
+  "version": "0.66.2",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/CHANGELOG.md

@@ -7,6 +7,53 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.2] — 2026-09-03
+
+### Fixed
+
+- **v0.66.1's migrated-origin fast-fail never fired on a real run
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** The guard read `page.url` once,
+  at `get_ui_driver` entry — but `routes.project_editor_url` only ever builds a `labs.google`
+  URL and the hop to `flow.google.com` is a *post-`goto`* redirect that neither settle path
+  waits for (no locale → `_settle_if_redirecting` returns immediately; a known locale →
+  `await_url_settled` short-circuits because the labs URL already matches the localised shape).
+  So the guard classified a pre-redirect URL, declined, and the run paid ~54 s before failing
+  anyway through the slow selector-probe path. Measured by the reporter on three consecutive
+  v0.66.1 runs: **57.0 / 57.1 / 58.3 s**, with `ui_driver.migrated_host_bail` absent from the
+  timeline entirely. The host check is now a shared `raise_if_migrated` helper called at the
+  three points the run is *about to spend time* — `get_ui_driver` entry, each `detect_ui_mode`
+  poll tick, and `_exit_agent_mode` once the media panel is found absent — so it adds no wait
+  and no navigation to the old host, and aborts as soon as the redirect is observable. The
+  event now names its call site, so the fast path is visible in a field timeline instead of
+  inferred. Two blanket `except Exception` handlers that would have demoted the abort to a
+  warning now re-raise it.
+
+- **A `NOT_REDIRECTED` locale cache was an absorbing state, which made the #643 `<html lang>`
+  recovery unreachable on exactly the profiles that needed it
+  ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).** `_bootstrap_and_resolve_locale`
+  returned *before* `_resolve_account_locale` — the only site of that recovery and the only
+  caller of `next_locale_state` — so nothing could ever move a latched profile off the state.
+  Every profile that saw two migrated loads on ≤0.66.0 latched this way. `NOT_REDIRECTED` now
+  skips the settle only, and still reads the locale: measured 56/56 on a latched profile whose
+  page declares `lang="en"` on every load. The 4 s settle stays skipped — deleting the early
+  return outright was rejected, because on that account the cached "not redirected" is a true
+  observation.
+
+- **A `<html lang>` locale was treated as evidence that Flow redirects the account, which
+  switched the URL settle back on permanently ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).**
+  Shipped in v0.66.1 and present on `develop`: #643's `<html lang>` fallback returns a segment for
+  an account Flow serves **bare** and never redirects, and `next_locale_state` recorded it as the
+  cached state. Every later bootstrap then saw `cached != NOT_REDIRECTED`, settled, and burned the
+  full 4 s `URL_SETTLE_TIMEOUT_MS` waiting for a redirect that never comes — the exact cost #587
+  exists to remove, on any non-redirecting account with a `lang` attribute. Only a **URL-derived**
+  segment is now folded into that cache; the lang-derived one is used in-process to build URLs and
+  never persisted. Measured on a real profile: warm bootstrap **7.41 s → 2.66 s**, with the locale
+  still recovered.
+
+- **`docs/MCP.md`'s retryable-class list was incomplete**, which would have told an MCP agent not
+  to auto-retry failures the envelope marks `retryable: true`. It omitted `FlowHostMigratedError`,
+  `UiModeUnavailableError` and `SyncPartialError`; it now matches `errors.RETRYABLE_ERRORS`.
+
 ## [0.66.1] — 2026-09-03
 
 ### Fixed
@@ -3737,7 +3784,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.2...HEAD
+[0.66.2]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...v0.66.2
 [0.66.1]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...v0.66.1
 [0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
 [0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/KNOWN_ISSUES.md

@@ -50,7 +50,7 @@ callers get this for free: the failure is `FlowHostMigratedError` (exit 36) with
 `retryable: true`, so retry loops driven by the `--json` / MCP / worker error
 envelope will keep trying.
 
-**What gflow does today (v0.66.0):** recognises the migrated origin and fails
+**What gflow does today (v0.66.2):** recognises the migrated origin and fails
 with the distinct, retryable exit 36 instead of the misleading
 `UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
 accepts the migrated host, so a migrated load is no longer misread as a
@@ -58,6 +58,18 @@ logged-out session. **Support for driving the new frontend is separate work and
 is not implemented** — once the rollout completes for an account, no retry will
 help until then.
 
+> **v0.66.1's fast-fail did not fire in the field, and v0.66.2 is the correction.**
+> The guard read `page.url` once, at `get_ui_driver` entry — before the hop to
+> `flow.google.com` had landed, because `project_editor_url` only builds
+> `labs.google` URLs and the redirect arrives *after* `page.goto` returns.
+> Measured by the reporter on three consecutive v0.66.1 runs: exit 36 at **57.0 /
+> 57.1 / 58.3 s**, through the slow selector-probe path. v0.66.2 re-checks the host
+> at the points the run already blocks, so the abort costs the old host nothing and
+> lands as soon as the redirect is observable. The same release stops a
+> `NOT_REDIRECTED` locale cache from disabling the `<html lang>` recovery (#643),
+> which had made that state unrecoverable on exactly the profiles it was written
+> for.
+
 ---
 
 ### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.66.1
+Version: 0.66.2
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/docs/INDEX.md

@@ -162,6 +162,8 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 
 **"What was live-verified for v0.66.0?"** → [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — **#639 Flow's `flow.google.com` migration, verified 2026-09-03 on profile `ffroliva` at ZERO credits.** The maintainer's own account turned out to be inside the rollout, so the fix was proven against the real migrated frontend rather than a reconstructed DOM: a read-only probe of `flow.google.com/project/<id>` measured `i_total: 0` (independently reproducing the reporter's central measurement) and drove the production functions against the live page — `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was `false` before the fix, i.e. a valid session read as logged-out), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 / `retryable: true`. The flap is confirmed on ONE account: a credit-free `image t2i` minutes earlier landed on the OLD host and completed exit 0 with a real 768x1376 JPEG (`ffd8ffe0`, 401,939 bytes, Pillow dims matching the API claim), proving the rewritten host gate does not regress the old path. Also recorded: the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>` — which is why a substring gate on `labs.google` could never match it; and the migrated composer is not control-less but exposes **no `data-testid`, zero ligature `<i>`, and 13 `button[aria-label]`** (`Settings trigger`, `Start generation`, …), recorded as recon for the follow-up WITH the caveat that `aria-label` is translated and therefore Tier-2 at best under the locale-invariance rule. One item is recorded as NOT verified rather than omitted: gflow **driving** the migrated frontend, which is out of scope and keeps #639 open. Verification also hit pre-existing [#561](https://github.com/ffroliva/gflow-cli/issues/561) (401 on `project.createProject`), A/B'd against unmodified `develop` to prove it was not this change, then routed around with an existing `--project`.
 
+**"What was live-verified for v0.66.2?"** → [LIVE_VERIFICATION_v0.66.2](LIVE_VERIFICATION_v0.66.2.md) — the old host proven live at zero credits (**exit 0**, real 768x1376 JPEG, twice), the locale cache measured **7.41 s → 2.66 s**, and the migrated path recorded as **NOT verified** because the rollout flapped back (72/72 navigations landed on `labs.google`). No time-to-exit-36 is claimed — this release exists because v0.66.1 reported one from the wrong entrypoint, so see also the correction block atop [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md).
+
 **"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.
 
 **"Does the `referenceEntity` guard actually run, and is it a Web Worker or a Service Worker?"** → [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md) — **A/B-proven live on denon82 2026-09-02, zero credits.** Control (without #618): the guard never fired and the test failed; with #618: it fired and passed. Same account, same prompt, one variable. Settles the question that held #618 — it is a **dedicated Web Worker**, so `context.route` suffices and no `service_workers="block"` is needed. Also confirms `route.continue_(post_data=...)` does not corrupt the body (both runs produced a real image). The **video** glob was equally dead, which #615 never mentions. Residual: direct-wire routes still bypass structurally (#619).

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/docs/LIVE_VERIFICATION_v0.66.1.md

@@ -3,6 +3,34 @@
 **Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy
 **Credits spent:** **0** — one Imagen image (images are credit-free) plus read-only probes.
 
+> ## ⚠️ Correction (2026-09-03, same day) — Layer 1's latency numbers are not user-visible
+>
+> **Layer 1 below measured `get_ui_driver` in isolation, on a page already sitting on
+> `flow.google.com`.** That precondition never holds on a real run: `project_editor_url`
+> only ever builds a `labs.google` URL and the hop to the migrated origin is a
+> *post-`goto`* redirect that neither settle path waits for, so on the CLI route the guard
+> read a pre-redirect URL and declined.
+>
+> The reporter of #639 measured the real path on three consecutive v0.66.1 runs: **57.0 /
+> 57.1 / 58.3 s**, terminating through `ui_automation_video.selector_probe_failed` — the
+> slow path — with `ui_driver.migrated_host_bail` **absent from the timeline entirely**.
+>
+> So of the rows below: `"get_ui_driver": {"ms": 0}` and **`time to exit 36 — 0 ms` are
+> true of the isolated probe and false of every CLI run.** The claim
+> *"`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than
+> inferred"* is the one the field timeline falsified — the event was never emitted, and
+> nothing here noticed because the isolated probe emitted it.
+>
+> The same gap hid the locale fix: `client.py` returned before `_resolve_account_locale`
+> on a `NOT_REDIRECTED` cache, so the `<html lang>` recovery Layer 1 exercised **directly**
+> is unreachable through the client on exactly the profiles that need it. `profile_ffroliva`
+> is latched that way today.
+>
+> Both are fixed for v0.66.2 — see [LIVE_VERIFICATION_v0.66.2](LIVE_VERIFICATION_v0.66.2.md).
+> **Layer 2 (no regression on the old host) stands unchanged and is still the load-bearing
+> result here.** The lesson is recorded rather than the numbers quietly edited: a function
+> measured in isolation is not a verification of the path users take.
+
 ## What had to be proven
 
 Two fixes, both on the migrated-origin path, and both verifiable live because the account is
@@ -31,10 +59,13 @@ Plus the property that matters more than either: **the old host still works.**
 | `detect_ui_mode` poll window | ~8 s | skipped |
 | crop selector cascade | ~24 s | skipped |
 | `await_url_settled` | 4018 ms | **0 ms** |
-| **time to exit 36** | **~36 s** | **0 ms** |
+| **time to exit 36** (isolated probe) | ~36 s | **0 ms** |
+| **time to exit 36** (real CLI run) | ~57 s | **~57 s — UNCHANGED, see the correction above** |
 | locale on migrated origin | `null` (and demoted a learned locale) | **`en`** recovered from `<html lang>` |
 
-`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than inferred.
+~~`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than inferred.~~
+**Retracted.** It is logged by the isolated probe and by nothing on the CLI route — the field
+timeline has no such event. Observability of a path you did not exercise is not observability.
 
 ## Layer 2 — no regression on the old host (full generation, exit 0)
 

gflow_cli-0.66.2/docs/LIVE_VERIFICATION_v0.66.2.md

@@ -0,0 +1,170 @@
+# Live Verification — v0.66.2 (the migrated-host gate actually fires; the locale cache stops lying)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy
+**Credits spent:** **0** — two Imagen images (images are credit-free) plus 72 read-only navigations.
+
+## What had to be proven, and the honest constraint
+
+This release fixes defects that v0.66.1's *own* verification missed, so the bar for it is higher
+than usual: **v0.66.1 measured `get_ui_driver` in isolation on an already-migrated page and
+reported `0 ms`, which was true of the probe and false of every CLI run.** See the correction at
+the top of [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md).
+
+**The constraint this time is the inverse of last time.** Google's rollout flapped *back* on both
+maintainer accounts during this work:
+
+| profile | navigations | landed migrated | landed old host |
+|---|---|---|---|
+| `ffroliva` | 60 | **0** | 60 |
+| `denon82` | 12 | **0** | 12 |
+
+Measured with `scripts/dev/measure_migrated_host_flip.py` across three sweeps on `ffroliva` and
+one on `denon82`, over ~2 hours (the raw per-navigation record is in the `scripts/dev/_spike_out/` JSON the
+instrument writes; the planning artifacts were consolidated at release per the repo's
+spec-to-memory convention).
+
+So **the migrated path was not reachable from this machine and is NOT live-verified here.** It is
+unit-tested and A/B-controlled only. That is stated in the NOT-verified section below rather than
+folded into the green column — which is precisely the mistake being corrected.
+
+What *is* live-verifiable is the property that matters most today: **the old host, which 100% of
+real loads currently take, is unaffected** — and the locale behaviour, which is fully exercisable.
+
+## Layer 1 — the locale cache stops conflating two different questions
+
+`profile_ffroliva/.gflow_locale` was **empty** — `NOT_REDIRECTED` — before the run. Under v0.66.1
+that state returned before `_resolve_account_locale`, so the `<html lang>` recovery #643 shipped
+could never run on it.
+
+```
+cache before:  ''                                                    (NOT_REDIRECTED)
+client.account_locale_resolved   locale=en  source=html_lang
+client.account_locale_cached     locale=en  settle_skipped=true
+cache after:   ''                                                    (NOT_REDIRECTED — unchanged)
+```
+
+Three things at once, all measured:
+
+1. **The locale is recovered from the document**, not the URL — `source=html_lang`. The latch no
+   longer blocks it.
+2. **The settle stays skipped** (`settle_skipped=true`). The #587 win is intact — which is why
+   deleting the early return outright was rejected: on this account "not redirected" is a *true*
+   observation, confirmed 60/60.
+3. **The cached state is unchanged.** This is the correction the council forced (see below): the
+   cache answers *"does Flow redirect this account?"*, and a `<html lang>` attribute is no
+   evidence of a redirect — every account has one.
+
+### The regression the council caught, and the measurement that proved it
+
+The first cut of this fix folded the recovered locale into the cache. Two independent reviewers
+(D1 correctness, D4 tests) flagged it; `scripts/dev/measure_locale_probe.py` then reproduced it
+without being asked:
+
+```
+BEFORE:  ffroliva  warm  7.41s   cached 'en'    !! warm arm slower than cold — investigate
+                                 transport.url_settle_gave_up  timeout_ms=4000.0   (x2)
+
+AFTER:   ffroliva  cold  6.99s   cached '?'
+         ffroliva  warm  2.66s   cached ''      settle off, locale still 'en'
+```
+
+Writing the locale in flipped `cached != NOT_REDIRECTED`, which turned the settle back on
+permanently and cost the full 4 s `URL_SETTLE_TIMEOUT_MS` on every future bootstrap — the exact
+cost #587 exists to remove.
+
+**Tracing it found a live defect in v0.66.1 itself, present on `develop` today.** #643's
+`<html lang>` fallback returns a segment for an account Flow serves *bare* and never redirects, and
+`next_locale_state` recorded that as evidence of a redirect. So **any** non-redirecting account
+with a `lang` attribute has been paying 4 s per bootstrap since v0.66.1 — no latch required. The
+fix folds only the **URL-derived** segment into the state; the lang-derived one is used in-process
+for URL building and never persisted.
+
+## Layer 2 — the risk this fix introduces, exercised rather than assumed
+
+Recovering the locale changes what gflow navigates to: this profile previously built the **bare**
+`labs.google/fx/tools/flow/project/<id>` and now builds `/fx/en/tools/flow/project/<id>`. If `en`
+were the wrong segment, every navigation would bounce.
+
+```
+ui_automation.entering_existing_project  url=https://labs.google/fx/en/tools/flow/project/c5550ed7-…
+ui_automation.url_stable_after_goto      same URL, +549 ms, settle_skipped=false
+ui_driver.ui_mode.attempt_exit_agent     +507 ms
+ui_driver.bound                          mode=classic
+```
+
+`url_stable_after_goto`, **not** `url_redirected_after_goto`: Flow accepted the segment and did
+not bounce it. Confirmed on both live runs.
+
+## Layer 3 — no regression on the old host: full generation, exit 0, twice
+
+```
+run 1 (pre-council-fix build)   EXIT=0   768×1376 JPEG · 427.8 KB · ff d8 ff
+run 2 (final build)             EXIT=0   768×1376 JPEG · 413.5 KB · ff d8 ff
+```
+
+Real images generated and written; `ui_driver.bound  mode=classic` on both; no
+`ui_driver.migrated_host_bail` event on either — correct, the host is `labs.google`.
+
+**On wall-clock:** run 1 took 36.6 s and run 2 took 86 s, and **neither number is evidence about
+this diff.** Run 2's extra time is Flow's own generation latency plus a 34.4 s
+`browser_teardown.context_close_error` — a bounded Chrome-close timeout at `api/_engine.py:159`
+that fires *after* all generation work, is already handled (warning → force close → exit 0), and
+is untouched by this branch. A single-run timing delta sits well inside that variance, so the
+"adds no wait" claim rests on the A/B control and on code shape (`page.url` is a cached property;
+`flow_host_kind` is one `urlsplit` plus a dict lookup; `_media_panel_present` uses `.count()` and
+does not wait) — **not** on the totals. Claiming "faster" from these runs would repeat exactly the
+error this release corrects.
+
+## Layer 4 — offline
+
+- Tests written **red first**: 4 red for the locale latch, 4 red for the host gate, before any
+  production change.
+- **A/B controls**, re-derived independently by a council reviewer with its own harness:
+  neutering `raise_if_migrated` fails **exactly 7** and **no** old-host test; restoring the
+  pre-#639 early return fails **exactly 5**. Nothing passes vacuously in either direction.
+- The council's must-fix added two more tests that would have caught the regression it found:
+  a two-bootstrap cycle (one bootstrap cannot observe a cache flipping the settle back on), and
+  a lang-only-locale case pinning that a `lang` attribute is not evidence of a redirect.
+- `ruff check` / `ruff format --check` clean on `src tests`; `pyright src` at the `develop`
+  baseline; repo hygiene, doc links, website-docs PII, and the `website/docs` mirror all green.
+
+## Layer 5 — the MCP surface
+
+No CLI leaf, option, or request-DTO field changed, so `tests/mcp/test_cli_parity.py` needs no new
+mapping and `worker/codec.py` no new payload key — the fix is in the transport both surfaces
+share (independently traced by the parity reviewer: `worker/daemon.py` and `mcp/tools.py` both
+construct the same `FlowApiClient`). What *is* MCP-specific is the queue envelope, different code
+from the CLI's `--json` path, carrying the flag the reporter's orchestrator actually reads:
+
+```
+queue error record:  exit_code = 36,  retryable = True
+```
+
+Pinned by `tests/worker/test_daemon.py::test_migrated_host_error_crosses_the_queued_path`. Noted
+honestly: that test pins the write side; the `wait=True` read-back in `mcp/tools.py` is generic
+code exercised by its neighbours, so the round trip is pinned end-to-end only by construction.
+
+`docs/MCP.md` listed the retryable classes by name and omitted three of them
+(`FlowHostMigratedError`, `UiModeUnavailableError`, `SyncPartialError`); the list now matches
+`errors.RETRYABLE_ERRORS` exactly, mirror regenerated.
+
+Side effect: `mcp/tools.py` builds project editor links from `account_locale_for()`, which reads
+the *cached* state. Because the lang-derived locale is deliberately not persisted, those links are
+unchanged by this branch — the earlier claim that they become "account-correct" was wrong and is
+retracted here rather than shipped.
+
+## Recorded as NOT verified rather than omitted
+
+- **The migrated path firing fast.** 72/72 navigations landed on the old host, so no migrated load
+  was available to time. The gate is proven by unit tests and A/B control, **not** by a live run.
+  The instrument is committed; the honest next step is a later flap or a run from the reporter's
+  permanently-migrated account.
+- **The achieved time-to-exit-36 on a real migrated run.** Unmeasured, and deliberately not
+  estimated. The design does not depend on it — the guard sits where the run already blocks.
+- **Driving the migrated frontend.** Still impossible. #639 stays open; this PR says `Refs`.
+- **A non-English profile recovering live.** `denon82` is cached `"pt"` (it genuinely redirects),
+  so the lang-recovery path was exercised live only on `en`. The `pt` case is unit-tested.
+- **The `en-GB` → `en` region reduction where region is load-bearing** (`zh-Hans`/`zh-Hant`).
+  Unchanged from v0.66.1, still only two locales observed.
+- **Full-suite coverage %.** The targeted suites ran without `--cov` (an unscoped `pytest --cov`
+  OOMs this machine); the 80% floor is enforced by CI.

{gflow_cli-0.66.1/website → gflow_cli-0.66.2}/docs/MCP.md

@@ -127,7 +127,13 @@ marks a transient failure a scheduler can re-run without operator intervention
 WAF/reCAPTCHA bounce (`WafRejectionError`), rate-limit (`RateLimitError`),
 transport timeout (`TransportTimeoutError`), network blip (`NetworkError`), a
 dropped browser session (`BrowserSessionClosedError`), a Flow web-app crash
-(`FlowAppError`), and an agentic-cohort flap (`FlowAgentUiError`). Everything
+(`FlowAppError`), an agentic-cohort flap (`FlowAgentUiError`), a page load served
+by the migrated `flow.google.com` frontend (`FlowHostMigratedError`,
+[#639](https://github.com/ffroliva/gflow-cli/issues/639) — the rollout flaps per
+page load, so a retry often lands the frontend gflow can drive), an unreachable
+UI arm (`UiModeUnavailableError`), and a partially-completed sync
+(`SyncPartialError`). That list is the whole of `errors.RETRYABLE_ERRORS`.
+Everything
 else (auth, content-policy, configuration, security) is terminal
 (`retryable: false`): retrying the identical request fails the same way. This
 flag is the **same shared classification** the CLI `--json` payload and the

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/docs/PROJECT_STATUS.md

@@ -4,36 +4,67 @@
 
 ## Current release
 
-**v0.66.1 — alpha.** **The migrated-origin failure went from 36 seconds of doomed probing to
-instant, and stopped throwing away a locale it had already learned.**
-
-v0.66.0 taught gflow to *name* Google's `flow.google.com` migration
-([#639](https://github.com/ffroliva/gflow-cli/issues/639)). This release makes living with it
-cheap. Two fixes, both measured on real migrated loads rather than reasoned about:
-
-**Fail fast.** The migrated frontend renders none of the controls gflow drives, so every DOM
-probe was doomed before it started — yet a run still burned the `detect_ui_mode` poll window
-(~8 s, both arms missing), the crop cascade (~24 s) and the URL settle (4 s) before raising
-`FlowHostMigratedError`. Because the rollout flaps per page load and callers retry on exit 36,
-that was paid on **every attempt of a retry loop**. The host is knowable from `page.url` in
-microseconds; measured live, exit 36 now arrives in **0 ms**.
-
-**Stop discarding the locale.** The migrated origin serves `/project/<id>` with no
-`/fx/<locale>/tools/flow` segment, so locale resolution was structurally blind there — and
-`next_locale_state("pt", None)` then *demoted* an already-learned locale to PROVISIONAL on
-every migrated load, silently undoing [#587](https://github.com/ffroliva/gflow-cli/issues/587).
-The locale had not disappeared with the URL shape; it was in `<html lang>` the whole time.
-Measured on two accounts, `<html lang>` **agreed with the URL segment wherever both existed** —
-which is what licenses it as a fallback, where `navigator.language` (which reports the value
-gflow itself sets) would not
+**v0.66.2 — alpha.** **The fast-fail v0.66.1 announced had never once fired, and the locale
+cache was answering a question nobody asked it.**
+
+v0.66.1 claimed exit 36 arrived in 0 ms on Google's migrated `flow.google.com` frontend
+([#639](https://github.com/ffroliva/gflow-cli/issues/639)). It did not. That number came from
+calling `get_ui_driver` **in isolation on a page already sitting on the migrated origin** — a
+state no real run ever reaches, because `project_editor_url` only ever builds a `labs.google`
+URL and the hop to the new origin is a *post-`goto`* redirect that neither settle path waits
+for. The guard read a pre-redirect URL and declined. The reporter measured the truth on three
+consecutive runs: **57.0 / 57.1 / 58.3 s**, through the slow selector-probe path, with the bail
+event absent from the timeline entirely.
+
+**Check the host where the run already blocks.** A shared `raise_if_migrated()` now runs at
+`get_ui_driver` entry, on every `detect_ui_mode` poll tick, in `_exit_agent_mode` once the media
+panel is found absent, and inside `mode_control`'s 8 s composer poll — the last of which was
+found by review after the first fix shipped, and covers both `--ui-mode agentic` and a redirect
+landing mid-`ensure_media_mode`. None of these adds a wait: `page.url` is a cached property and
+`flow_host_kind` is one parse plus a dict lookup. Three blanket `except Exception` handlers that
+would have demoted the abort to a warning now re-raise it.
+
+**Stop letting a `lang` attribute mean "this account redirects".** Two locale defects, both
+shipped in v0.66.1. `NOT_REDIRECTED` was an *absorbing* state: it returned before the only site
+of the `<html lang>` recovery, so the profiles #643 was written for could never use it. And the
+recovered locale was then recorded as evidence of a redirect — which it is not, since every
+account declares one — switching the URL settle back on permanently and costing the full 4 s
+`URL_SETTLE_TIMEOUT_MS` on every bootstrap of any non-redirecting account. Measured on a real
+profile: **7.41 s → 2.66 s**, locale still recovered
 ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).
 
-Neither fix makes the migrated frontend drivable — #639 stays open for that. What they buy is a
-failure that is instant and honest instead of slow and lossy.
+Two designs were rejected **by measurement**, not preference: a bounded settle (72/72
+navigations across two accounts showed no post-`goto` URL change at all, so the bound would be
+pure dead time), and caching "this profile is migrated" to navigate straight to
+`flow.google.com` (it would have locked both maintainer accounts out of a working frontend the
+day it shipped).
 
-Verification: [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md) — proven on **both sides
-of the still-flapping rollout** at zero credits: 0 ms exit 36 on a migrated load, and minutes
-later **exit 0** with a real 768x1376 JPEG on an old-host load, proving the guard is scoped.
+Still not drivable — #639 stays open for that.
+
+Verification: [LIVE_VERIFICATION_v0.66.2](LIVE_VERIFICATION_v0.66.2.md). The old host is proven
+live at zero credits (**exit 0**, real 768x1376 JPEG, twice). **The migrated path is recorded as
+NOT verified**: the rollout flapped back mid-work and 72/72 navigations landed on `labs.google`,
+so the gate rests on unit tests and A/B controls, and **no time-to-exit-36 is claimed anywhere**.
+Given this release exists because a number was reported from the wrong entrypoint, inventing a
+replacement would have repeated the error.
+
+<details><summary>v0.66.1 — a fast-fail that never fired (superseded by v0.66.2)</summary>
+
+**v0.66.1 — alpha.** Intended to make the migrated-origin failure instant and to stop discarding
+a learned locale. **Both fixes were real but neither reached the path users take**, and this
+entry is kept to record that rather than to claim it.
+
+The `0 ms` exit 36 reported here was measured on `get_ui_driver` in isolation, on an
+already-migrated page; the CLI route was unchanged at ~57 s. The `<html lang>` locale recovery
+was likewise exercised directly, while the client returned before it on any profile cached
+`NOT_REDIRECTED`. v0.66.2 fixes both, and additionally a settle regression this release
+introduced. See the correction block at the top of
+[LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md).
+
+What did hold: `_check_logged_in` accepting the migrated host, and the old-host no-regression
+result (exit 0 with a real JPEG), which was the load-bearing evidence in that release.
+
+</details>
 
 <details><summary>v0.66.0 — naming Flow's flow.google.com migration</summary>
 

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.66.1"
+version = "0.66.2"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }

gflow_cli-0.66.2/scripts/dev/measure_migrated_host_flip.py

@@ -0,0 +1,152 @@
+"""Measure WHEN ``page.url`` flips to ``flow.google.com`` after ``goto`` returns (#639).
+
+Zero credits — pure navigation, nothing is submitted.
+
+**The question this exists to answer.** v0.66.1 added a fast-fail: ``get_ui_driver``
+raises ``FlowHostMigratedError`` when ``flow_host_kind(page.url) == "migrated"``
+(``drivers/factory.py``). In the field it never fires — the reporter of #639
+measured exit 36 arriving at ~57 s on three consecutive v0.66.1 runs, through the
+slow selector-probe path, with ``ui_driver.migrated_host_bail`` absent from the
+timeline.
+
+The hypothesis is that the guard reads a **pre-redirect** URL: ``project_editor_url``
+only ever builds a ``labs.google`` URL, the hop to ``flow.google.com`` lands AFTER
+``page.goto(wait_until="domcontentloaded")`` returns, and neither settle path waits
+for it (``_settle_if_redirecting`` returns immediately with no locale;
+``await_url_settled`` short-circuits with one, because the labs URL already matches
+``FLOW_LOCALISED_URL_RE``).
+
+That hypothesis is a *timing* claim, so no unit test can close it. The number it
+turns on — **how long after ``goto`` the flip actually lands** — is also what
+decides the fix: a flip at ~50 ms means a cheap bounded wait is viable, a flip at
+several seconds means the guard has to be re-checked at a point the run already
+waits at, or the navigation has to target the migrated origin directly.
+
+**What it reports**, per navigation: the URL the moment ``goto`` returns, every
+subsequent URL change with its offset, the offset at which ``flow_host_kind``
+first answers ``"migrated"``, and ``document.documentElement.lang`` at the end.
+
+    uv run python scripts/dev/measure_migrated_host_flip.py ffroliva <project-id>
+    uv run python scripts/dev/measure_migrated_host_flip.py --rounds 3 ffroliva <project-id>
+
+On Windows prefer ``.venv/Scripts/python.exe`` (memory: `uv run pytest` is broken
+there; the same launcher quirk applies to long-running scripts).
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import sys
+from pathlib import Path
+from time import perf_counter
+from typing import Any
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "src"))
+
+from gflow_cli.api import routes  # noqa: E402
+from gflow_cli.api.transports._common import flow_host_kind  # noqa: E402
+from gflow_cli.profile_store import read_account_locale  # noqa: E402
+
+from _spike_common import build_client, default_out_path, resolve_profile_dir  # noqa: E402, isort: skip
+
+# Fine enough to distinguish "already flipped when goto returned" from "flipped a
+# few hundred ms later" — the distinction the fix turns on.
+POLL_MS = 25
+WATCH_S = 20.0
+
+
+async def _watch(page: Any, label: str, url: str, watch_s: float = WATCH_S) -> dict[str, Any]:
+    """Navigate, then sample ``page.url`` until it settles or *watch_s* elapses."""
+    started = perf_counter()
+    await page.goto(url, wait_until="domcontentloaded", timeout=45_000)
+    at_goto_return = perf_counter() - started
+    seen = page.url
+    changes: list[dict[str, Any]] = [{"ms": round(at_goto_return * 1000), "url": seen}]
+    flipped_ms: float | None = None
+    if flow_host_kind(seen) == "migrated":
+        flipped_ms = at_goto_return * 1000
+
+    while perf_counter() - started < watch_s:
+        await page.wait_for_timeout(POLL_MS)
+        current = page.url
+        if current == seen:
+            continue
+        seen = current
+        offset = (perf_counter() - started) * 1000
+        changes.append({"ms": round(offset), "url": current})
+        if flipped_ms is None and flow_host_kind(current) == "migrated":
+            flipped_ms = offset
+
+    try:
+        lang = await page.evaluate("() => document.documentElement.lang || ''")
+    except Exception as exc:  # noqa: BLE001 — observation only
+        lang = f"<probe failed: {type(exc).__name__}>"
+
+    return {
+        "label": label,
+        "requested": url,
+        "url_when_goto_returned": changes[0]["url"],
+        "goto_returned_ms": round(at_goto_return * 1000),
+        "host_kind_when_goto_returned": flow_host_kind(changes[0]["url"]),
+        "migrated_flip_ms": None if flipped_ms is None else round(flipped_ms),
+        "changes": changes,
+        "final_url": seen,
+        "final_host_kind": flow_host_kind(seen),
+        "html_lang": lang,
+    }
+
+
+async def _main(profile: str, project_id: str, rounds: int, watch_s: float) -> int:
+    profile_dir = resolve_profile_dir(profile)
+    cached_locale = read_account_locale(profile_dir)
+    rows: list[dict[str, Any]] = []
+
+    async with build_client(profile_dir) as client:
+        page = client._page  # noqa: SLF001 — dev instrument
+        assert page is not None
+        # The locale the client actually resolved decides which URL shape the
+        # transport builds, so both are recorded rather than assumed.
+        locale = client._account_locale  # noqa: SLF001 — dev instrument
+        editor_url = routes.project_editor_url(locale, project_id)
+
+        for i in range(rounds):
+            rows.append(await _watch(page, f"bootstrap[{i}]", routes.EDITOR_BOOTSTRAP_URL, watch_s))
+            rows.append(await _watch(page, f"project[{i}]", editor_url, watch_s))
+
+    out = {
+        "profile": profile,
+        "cached_locale_state": repr(cached_locale),
+        "resolved_account_locale": locale,
+        "project_editor_url": editor_url,
+        "poll_ms": POLL_MS,
+        "watch_s": watch_s,
+        "navigations": rows,
+    }
+    path = default_out_path("migrated_host_flip")
+    path.write_text(json.dumps(out, indent=2), encoding="utf-8")
+
+    print(f"\ncached locale state: {cached_locale!r}   resolved: {locale!r}")
+    print(f"project URL built:   {editor_url}")
+    print(f"\n{'navigation':<14} {'goto ret':>9} {'host@goto':>10} {'flip':>8}  final host")
+    print("-" * 62)
+    for r in rows:
+        flip = "—" if r["migrated_flip_ms"] is None else f'{r["migrated_flip_ms"]} ms'
+        print(
+            f'{r["label"]:<14} {r["goto_returned_ms"]:>7} ms '
+            f'{str(r["host_kind_when_goto_returned"]):>10} {flip:>8}  {r["final_host_kind"]}'
+        )
+    print(f"\nhtml lang (last): {rows[-1]['html_lang']!r}")
+    print(f"written: {path}")
+    return 0
+
+
+if __name__ == "__main__":
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("profile")
+    ap.add_argument("project_id")
+    ap.add_argument("--rounds", type=int, default=2)
+    ap.add_argument("--watch", type=float, default=WATCH_S)
+    ns = ap.parse_args()
+    raise SystemExit(asyncio.run(_main(ns.profile, ns.project_id, ns.rounds, ns.watch)))

{gflow_cli-0.66.1 → gflow_cli-0.66.2}/src/gflow_cli/__init__.py

@@ -1,3 +1,3 @@
 """gflow-cli — unofficial CLI for Google Flow."""
 
-__version__ = "0.66.1"
+__version__ = "0.66.2"