gflow-cli 0.66.1__tar.gz → 0.67.0__tar.gz

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.66.1",
+  "version": "0.67.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/.env.template

@@ -181,6 +181,14 @@
 # reached. -i instructions force agentic automatically. See docs/CONFIGURATION.md.
 # GFLOW_CLI_UI_MODE=auto
 
+# Which Flow frontend gflow drives (#639). auto (default): flow.google.com is the
+# default host for what it can serve today (video t2v with --project) on every
+# account; requests it cannot serve yet keep the labs driver on an unmoved
+# account, and a moved account gets the migrated composer for everything ported.
+# flow.google.com: force the migrated composer for everything.
+# labs.google: never use it — a moved account fails with exit 36 (kill switch).
+# GFLOW_CLI_FLOW_HOST=auto
+
 # DEPRECATED — use GFLOW_CLI_UI_MODE=classic. true maps to ui_mode=classic, but the
 # old silent agentic fallback is gone: a classic-required run now aborts (exit 28).
 # GFLOW_CLI_PREFER_CLASSIC=false

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/.github/workflows/ci.yml

@@ -196,6 +196,9 @@ jobs:
       - name: Website docs mirror in sync (regenerate-and-diff)
         run: uv run python scripts/ci/generate_website_docs.py --check
 
+      - name: Council memory (every cited slug resolves, every file is cited)
+        run: uv run python scripts/ci/check_council_memory.py
+
       - name: Lint
         run: uv run ruff check src tests
 

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/AGENTS.md

@@ -41,7 +41,7 @@ by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code
 
 ## Project at a glance
 
-- Unofficial Python CLI for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com`.
+- Unofficial Python CLI for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video today; `GFLOW_CLI_FLOW_HOST`).
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
 - Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
 - Command surface: `gflow auth`, `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow project`, `gflow models`, `gflow run`, `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
@@ -76,6 +76,7 @@ uv run python scripts/ci/check_repo_hygiene.py
 uv run python scripts/ci/check_doc_links.py
 uv run python scripts/ci/check_website_docs_pii.py
 uv run python scripts/ci/generate_website_docs.py --check
+uv run python scripts/ci/check_council_memory.py
 uv run ruff check src tests
 uv run ruff format --check src tests
 uv run pyright src
@@ -101,7 +102,7 @@ the five other mirror axes), which no command here can check and no CI gate can
 
 - Type hints everywhere; `pyright` strict on `src/gflow_cli`.
 - Structured logging only (`structlog`) — **never** raw `print()` or `import logging` in `src/`.
-- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–35, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
+- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–36, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
 - 100-char line length, `ruff` configured. Imports sorted by `ruff` (isort rules).
 - **YAGNI / least-code**: prefer the smallest change that works. No speculative abstractions (interface/factory with one implementation), no config or flags nobody sets, no dead constants/helpers, no reinventing the stdlib. Review carries this as its own lens — the **D14 over-engineering** dimension of [`pr-council-review`](skills/pr-council-review/SKILL.md) (baseline, always runs). Its rubric is portable; the `ponytail` plugin (see CONTRIBUTING) is an optional accelerant, not a dependency.
 - **MCP & CLI Schema Symmetry**: Any updates or additions to user-facing CLI command parameters (e.g., `gflow image t2i`, `gflow video`) must be mirrored in the corresponding MCP tool definitions. Never add option/argument fields to Click commands without updating the MCP server implementation. This symmetry is enforced programmatically in CI via `tests/mcp/test_cli_parity.py` (every CLI leaf command needs a mapped MCP tool or an explicit, reasoned exemption) plus the schema checks in `tests/mcp/test_server.py`.

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/CHANGELOG.md

@@ -7,6 +7,149 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.67.0] — 2026-09-05
+
+### Added
+
+- **Text-to-video on Flow's migrated `flow.google.com` host** (#639). An account
+  Google has moved off labs.google no longer exits 36 on `gflow video t2v`: the new
+  migrated composer drives the Angular editor (option-group radios, model menu,
+  `contenteditable` composer, `arrow_forward` submit) and then *observes* the app's
+  own `batchexecute` replies — `YhhmEf` submit, `jwpduf` status, `as29s` result —
+  before downloading the clip. Under the default
+  `GFLOW_CLI_FLOW_HOST=auto`, flow.google.com is now the **default host for every
+  request it can serve** — t2v with `--project`, on moved and unmoved accounts
+  alike (the new host serves both); what it cannot serve yet keeps the labs
+  driver on an unmoved account. `flow.google.com` forces it for everything,
+  `labs.google` is the kill switch. `--project` is required on
+  that host for now; everything except t2v still exits 36 there. Recon with two
+  real generations: `docs/superpowers/spikes/2026-09-05-migrated-host-wire-protocol.md`.
+
+### Changed
+
+- **Exit 36 (`FlowHostMigratedError`) is no longer retryable** (#639). Two $0 spikes
+  settled the mechanism: labs.google serves a normal 200 to a fully authenticated
+  session, then the app itself runs `location.replace('https://flow.google.com' +
+  path)` from a `useEffect`, gated on a server-assigned per-account config boolean.
+  It is a one-way rollout — 5/5 and 7/7 on a flagged account — not the per-page-load
+  flap the error text claimed, so once an account is flagged a retry never lands the
+  old frontend. The remediation, the `_mode_switch_error` fallback, `docs/USAGE.md`,
+  `docs/MCP.md`, `KNOWN_ISSUES.md` and `docs/PROJECT_STATUS.md` no longer invite a
+  retry, and the MCP, worker and `--json` envelopes carry `retryable: false`.
+  Detection is unchanged from v0.66.2: Playwright updates `page.url` in the same
+  tick it emits the hop's `framenavigated`, so re-checking it wherever the run is
+  about to spend time — the shape the reporter measured at 4.1 s — was already right
+  (maintainer A/B on the same machine and profile: 16.0 s vs 16.6 s on unmodified
+  `develop`, Chrome launch included).
+
+- **`--duration` now accepts 4s/6s/8s on the Veo 3.1 models** (#650, @stgmt); `10`
+  stays `omni-flash`-only. Flow's duration control turns out to be account/cohort-
+  dependent — some accounts render the row for Veo, some render none, on the same
+  frontend — so the static table that refused it everywhere was wrong for part of
+  the userbase. `supports_duration()` is gone; one shared
+  `validate_duration_for_model()` now backs the DTO, CLI, chain, movie manifest and
+  MCP surfaces. On an account **without** the control the run now reaches the browser
+  and aborts pre-submit with no credits spent — exit 23 on the labs driver, exit 11
+  on the migrated `flow.google.com` host, where the maintainer cohort renders the
+  duration row for Omni 1.1 Flash only (measured 2026-09-05) — instead of refusing
+  instantly at the CLI edge — a deliberate trade, since a static per-model table
+  cannot express a per-account capability.
+
+### Fixed
+
+- **`--model` on the migrated host selected the model and then lost the settings pane**
+  (#665). After the model menu — a second overlay — opened and closed, the driver
+  resolved `.cdk-overlay-pane.last` to the detached menu pane, so every axis after the
+  switch read "0 option groups". The pane is now the overlay that contains the option
+  groups; a regression test keeps a stale menu pane as the last overlay.
+- **MCP `gflow_generate_video` accepted any `duration` when `model` was omitted**
+  (#659): `duration=99` queued and burned a browser run. The tool now validates the
+  value against the supported set regardless of model, like the CLI's choice list.
+
+## [0.66.3] — 2026-09-03
+
+### Fixed
+
+- **`<html lang>` was read before the app set it, so every account whose URL could not answer
+  resolved to `en` ([#651](https://github.com/ffroliva/gflow-cli/issues/651)).** Flow serves an
+  **`en` shell** and rewrites `lang` during hydration. The single early read added by
+  [#643](https://github.com/ffroliva/gflow-cli/issues/643) therefore returned the shell value —
+  and the accounts it hit are exactly the ones #643 was written for: those where the URL carries
+  no locale segment. Reported by
+  [@maipmacrothorax-75](https://github.com/maipmacrothorax-75) on a pt-BR account resolving `en`
+  while both pages served `<html lang="pt">`, with the mechanism offered explicitly as a guess.
+
+  The guess is confirmed, and it reproduces on the **old** host — so this was never a migration
+  bug. Measured on a pt account, two consecutive loads:
+
+  | t (ms) | `lang` | `readyState` |
+  |---|---|---|
+  | 887 | `en` | interactive |
+  | **1510** | `en` | **complete** |
+  | 2092 | `en` | complete |
+  | **2488** | **`pt`** | complete |
+
+  **`readyState` is not a usable signal** — it reaches `complete` a full second *before* the
+  flip, so the obvious "wait for complete, then read" would have shipped the same bug with more
+  code. The DOM node count oscillates (136 → 300 → 249 → 251) and does not discriminate either.
+  Nothing cheap predicts the flip, so `_resolve_account_locale` now **observes** it: read once,
+  bounded-wait for the value to change, re-read.
+
+  A timeout is an **answer**, not a failure — either the account's locale genuinely equals the
+  shell default, or the page never hydrated in the window. Both leave the first read as the best
+  available answer, which is exactly the previous behaviour, so the branch can never be worse
+  than what it replaces. It is logged as `client.account_locale_lang_unchanged` so the field can
+  tell the two apart. Cost: an account whose locale **is** the shell default pays the 4 s bound
+  once per process.
+
+## [0.66.2] — 2026-09-03
+
+### Fixed
+
+
+- **v0.66.1's migrated-origin fast-fail never fired on a real run
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** The guard read `page.url` once,
+  at `get_ui_driver` entry — but `routes.project_editor_url` only ever builds a `labs.google`
+  URL and the hop to `flow.google.com` is a *post-`goto`* redirect that neither settle path
+  waits for (no locale → `_settle_if_redirecting` returns immediately; a known locale →
+  `await_url_settled` short-circuits because the labs URL already matches the localised shape).
+  So the guard classified a pre-redirect URL, declined, and the run paid ~54 s before failing
+  anyway through the slow selector-probe path. Measured by the reporter on three consecutive
+  v0.66.1 runs: **57.0 / 57.1 / 58.3 s**, with `ui_driver.migrated_host_bail` absent from the
+  timeline entirely. The host check is now a shared `raise_if_migrated` helper called at the
+  three points the run is *about to spend time* — `get_ui_driver` entry, each `detect_ui_mode`
+  poll tick, and `_exit_agent_mode` once the media panel is found absent — so it adds no wait
+  and no navigation to the old host, and aborts as soon as the redirect is observable. The
+  event now names its call site, so the fast path is visible in a field timeline instead of
+  inferred. Two blanket `except Exception` handlers that would have demoted the abort to a
+  warning now re-raise it.
+
+- **A `NOT_REDIRECTED` locale cache was an absorbing state, which made the #643 `<html lang>`
+  recovery unreachable on exactly the profiles that needed it
+  ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).** `_bootstrap_and_resolve_locale`
+  returned *before* `_resolve_account_locale` — the only site of that recovery and the only
+  caller of `next_locale_state` — so nothing could ever move a latched profile off the state.
+  Every profile that saw two migrated loads on ≤0.66.0 latched this way. `NOT_REDIRECTED` now
+  skips the settle only, and still reads the locale: measured 56/56 on a latched profile whose
+  page declares `lang="en"` on every load. The 4 s settle stays skipped — deleting the early
+  return outright was rejected, because on that account the cached "not redirected" is a true
+  observation.
+
+- **A `<html lang>` locale was treated as evidence that Flow redirects the account, which
+  switched the URL settle back on permanently ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).**
+  Shipped in v0.66.1 and present on `develop`: #643's `<html lang>` fallback returns a segment for
+  an account Flow serves **bare** and never redirects, and `next_locale_state` recorded it as the
+  cached state. Every later bootstrap then saw `cached != NOT_REDIRECTED`, settled, and burned the
+  full 4 s `URL_SETTLE_TIMEOUT_MS` waiting for a redirect that never comes — the exact cost #587
+  exists to remove, on any non-redirecting account with a `lang` attribute. Only a **URL-derived**
+  segment is now folded into that cache; the lang-derived one is used in-process to build URLs and
+  never persisted. Measured on a real profile: warm bootstrap **7.41 s → 2.66 s**, with the locale
+  still recovered.
+
+- **`docs/MCP.md`'s retryable-class list was incomplete**, which would have told an MCP agent not
+  to auto-retry failures the envelope marks `retryable: true`. It omitted `FlowHostMigratedError`,
+  `UiModeUnavailableError` and `SyncPartialError`; it now matches `errors.RETRYABLE_ERRORS`.
+
 ## [0.66.1] — 2026-09-03
 
 ### Fixed
@@ -3737,7 +3880,10 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.67.0...HEAD
+[0.67.0]: https://github.com/ffroliva/gflow-cli/compare/v0.66.3...v0.67.0
+[0.66.3]: https://github.com/ffroliva/gflow-cli/compare/v0.66.2...v0.66.3
+[0.66.2]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...v0.66.2
 [0.66.1]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...v0.66.1
 [0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
 [0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/KNOWN_ISSUES.md

@@ -14,9 +14,9 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
-### Flow is migrating to `flow.google.com`; the migrated frontend is not drivable
+### Flow is migrating to `flow.google.com`; gflow drives the migrated frontend for t2v (rest of the matrix pending)
 
-- **Status:** Open · **Severity:** High (every generation command fails on a migrated page load) · **Affected:** all `gflow image` / `gflow video` generation, CLI and MCP alike, on accounts the rollout has reached
+- **Status:** Open (partially resolved) · **Severity:** High for everything except text-to-video · **Affected:** on accounts the rollout has reached, `gflow video t2v` now runs on the migrated host (with `--project`); `image`, i2v/r2v, characters, scenes, extend, instructions and tools are not ported yet and still exit 36
 - **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
 - **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
 
@@ -27,9 +27,10 @@ contains **zero `<i>` elements**. Every gflow selector anchors on Material
 Symbols ligatures (`i.google-symbols:text-is(...)`), so cohort detection and
 every mode control miss at once.
 
-**The rollout flaps per page load.** The same account, profile and project land
-on the old host on one navigation and the migrated one on the next, minutes
-apart, with no client change. Measured on one account ~35 minutes apart:
+**v0.66.0 read the rollout as flapping per page load** — the same account, profile
+and project landing on the old host on one navigation and the migrated one on the
+next, minutes apart. Those two captures straddled the account's one-time switch
+(see the 2026-09-04 note under Workaround). Measured on one account ~35 minutes apart:
 
 ```
 old host       labs.google/fx/<locale>/tools/flow/...   i=55  i.google-symbols=49  crop_* present   -> exit 0
@@ -44,19 +45,47 @@ This is **not** selector rot, not [#493](https://github.com/ffroliva/gflow-cli/i
 and not the agentic cohort — the agentic indicators are absent too. It is a
 different origin serving different markup.
 
-**Workaround:** re-run the command. While the rollout flaps, a fresh navigation
-frequently lands the old frontend and the run completes normally. Automated
-callers get this for free: the failure is `FlowHostMigratedError` (exit 36) with
-`retryable: true`, so retry loops driven by the `--json` / MCP / worker error
-envelope will keep trying.
-
-**What gflow does today (v0.66.0):** recognises the migrated origin and fails
-with the distinct, retryable exit 36 instead of the misleading
+**What works now — text-to-video on the migrated host.** `gflow video t2v … --project <id>`
+drives the migrated editor directly (settings through its option groups, prompt,
+submit, then it observes the app's own `batchexecute` status replies and downloads
+the clip). Two real clips were generated this way on 2026-09-05 — spike
+`docs/superpowers/spikes/2026-09-05-migrated-host-wire-protocol.md`. Routing
+(`GFLOW_CLI_FLOW_HOST=auto`): flow.google.com is the **default** host for that
+command on every account — moved or not; `flow.google.com` forces it for
+everything, and `labs.google` switches the migrated composer off. Limits today: `--project` is required (project creation from the
+migrated editor is not ported), and only `t2v` — everything else still exits 36.
+
+**Workaround for the rest:** none client-side. The handoff
+is a per-account setting the labs.google app applies on every load (measured
+5/5 and 7/7 with no flap, 2026-09-04 — spike
+`docs/superpowers/spikes/2026-09-04-migrated-host-handoff-mechanism.md`), so
+once the account is flagged, re-running will not land the old frontend. Earlier text here said the rollout
+"flaps" and told you to retry; that observation straddled the account's one-time
+switch and is withdrawn. The REST surface (`gflow project list`, `gflow data …`)
+is unaffected. Automated callers now receive `retryable: false` so retry loops
+stop instead of burning a doomed attempt each time.
+
+**What gflow does today for the rest of the matrix:** recognises the migrated
+origin — `page.url` is re-checked at every point the run is about to spend time,
+which Playwright updates in the same tick as the hand-off navigation — and fails
+with the distinct, non-retryable exit 36 instead of the misleading
 `UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
 accepts the migrated host, so a migrated load is no longer misread as a
-logged-out session. **Support for driving the new frontend is separate work and
-is not implemented** — once the rollout completes for an account, no retry will
-help until then.
+logged-out session. Text-to-video is driven (above); image, i2v/r2v, characters,
+scenes, extend, instructions, tools and project creation are the remaining work
+tracked here — no retry helps for those until each is ported.
+
+> **v0.66.1's fast-fail did not fire in the field, and v0.66.2 is the correction.**
+> The guard read `page.url` once, at `get_ui_driver` entry — before the hop to
+> `flow.google.com` had landed, because `project_editor_url` only builds
+> `labs.google` URLs and the redirect arrives *after* `page.goto` returns.
+> Measured by the reporter on three consecutive v0.66.1 runs: exit 36 at **57.0 /
+> 57.1 / 58.3 s**, through the slow selector-probe path. v0.66.2 re-checks the host
+> at the points the run already blocks, so the abort costs the old host nothing and
+> lands as soon as the redirect is observable. The same release stops a
+> `NOT_REDIRECTED` locale cache from disabling the `<html lang>` recovery (#643),
+> which had made that state unrecoverable on exactly the profiles it was written
+> for.
 
 ---
 
@@ -255,31 +284,59 @@ listing endpoint (privacy-gated to `store` history mode), and `gflow doctor`
 (#542) surfaces the affected-row count. Freshly generated rows whose caption
 has not landed yet stay nameless until the next sync sweep.
 
-### Video duration tab probe misses on the current Frames-submode DOM
-
-- **Status:** Open ([#288](https://github.com/ffroliva/gflow-cli/issues/288))
-- **Severity:** Medium · **Affected:** `gflow video` with an explicit `--duration`
-  on at least some Classic-profile cohorts (3/3 miss on a live 2026-07-11 run)
-
-The `duration_tab` selector cascade (`[role='tab']:text-is('4s')` /
-`:has-text('4s')`) fails to match on Flow's current Frames-submode settings
-panel. Pre-fix this silently produced a clip of Flow's default length; since
-the #289 fix the run fails fast with `UiSelectorDriftError` (exit 23) and a
-`debug_no_duration_tab.png` screenshot — live-verified 2026-07-11 on the
-denon82 profile (aborted pre-submit, saving the 10-credit generation).
-**Workaround:** omit `--duration` to accept Flow's default.
+### Video duration control is absent on some account cohorts
+
+- **Status:** Mitigated — fail-fast shipped in
+  [#289](https://github.com/ffroliva/gflow-cli/pull/289).
+  [#288](https://github.com/ffroliva/gflow-cli/issues/288) and
+  [#451](https://github.com/ffroliva/gflow-cli/issues/451) are closed; the
+  Flow-side behaviour is unresolved and untracked upstream. gflow's own static
+  gate was relaxed in [#650](https://github.com/ffroliva/gflow-cli/pull/650).
+- **Severity:** Medium · **Affected:** `gflow video` with an explicit
+  `--duration` (3/3 miss on a live 2026-07-11 run; re-confirmed by a $0
+  capability capture 2026-09-03)
+
+**Workaround:** omit `--duration` and accept Flow's default clip length.
+
+**What actually happens today.** gflow accepts `--duration 4`, `6` or `8` on the
+Veo 3.1 models and `10` on `omni-flash` only — the CLI no longer refuses a
+duration it cannot know your account supports. What it still cannot do is tell
+your cohort apart before opening the browser, so on an account that renders no
+duration row the run reaches Flow's settings popover and fails there — on the
+labs driver as `UiSelectorDriftError` (exit 23) with a `debug_no_duration_tab.png`
+screenshot, on the migrated `flow.google.com` host as `ConfigurationError` (exit 11)
+naming the duration axis (the maintainer cohort renders the row for Omni 1.1 Flash
+only there, measured 2026-09-05).
+That abort is **pre-submit**, so no credits are spent — live-verified 2026-07-11
+on the denon82 profile.
 
 **Root cause (confirmed live 2026-07-11, screenshot evidence on #288): the
 duration control is ABSENT from this cohort's settings popover** — the panel
 renders mode tabs (Imagem/Video), sub-mode (Frames/Elementos), aspect
 (9:16/16:9), count (1x–x4; labels renamed to xN since — see #404), and the
-model dropdown (Veo 3.1 - Lite), and
-nothing else. The earlier locale hypothesis is refuted: the UI renders in
-Portuguese and the sibling count tabs (`1x`/`x2`) match fine; there is simply
-no duration row to click. Whether Flow removed clip-length selection for this
-cohort/model or moved it elsewhere is unknown — until that's answered,
-`--duration` cannot be honored on affected cohorts and the fail-fast is the
-correct behavior, not a selector bug to patch.
+model dropdown (Veo 3.1 - Lite), and nothing else. The earlier locale hypothesis
+is refuted: the UI renders in Portuguese and the sibling count tabs (`1x`/`x2`)
+match fine; there is simply no duration row to click.
+
+**Updated 2026-09-04 — it is a cohort difference, not a removal.** A third
+profile on the *same* `labs.google` frontend renders `4s/6s/8s` on all three
+selectable Veo 3.1 models, at different credit prices, in a credit-free capture
+whose count tabs came back on every model. (`veo_3_1_lite_lower_priority` missed
+its picker, so it is unmeasured either way.) Some accounts have the control, some
+do not; the cohort key — region, account age, experiment bucket — is unknown.
+
+Because the gate is a static per-model table rather than a read of your session,
+gflow cannot express that difference: it now allows `4/6/8` on every Veo 3.1
+model, and an account without the control discovers this in the browser rather
+than at the CLI edge. Trading an instant, wrong rejection for a slower, correct
+attempt was the deliberate call in #650. A session-level capability probe would
+remove the trade entirely and nobody has written one.
+
+**Reporting.** If Flow's UI shows a duration row for a Veo model on your account,
+that is useful — it narrows the cohort key. Attach the exact `--model` /
+`--duration` invocation and the error text; a `--model omni-flash` run
+additionally yields the probe name and `debug_no_duration_tab.png`. No tokens or
+signed URLs.
 
 ### macOS: generation runs logged-out → HTTP 401, even with `--browser chrome`
 

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.66.1
+Version: 0.67.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -194,6 +194,8 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). `flow.google.com` is the default host for what gflow has ported to it — text-to-video today — on every account; the rest of the matrix keeps the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 
 **How you can help:** if you have driven `aisandbox-pa.googleapis.com` from outside a real Chrome session, or you understand Google's anti-bot stack here, please open an issue. A working REST transport would unlock serverless deployments, true horizontal concurrency, and roughly 10x the project's reach. Details: [docs/ARCHITECTURE.md § Headed-browser dependency](docs/ARCHITECTURE.md#headed-browser-dependency--current-limitation).

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/README.md

@@ -123,6 +123,8 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). `flow.google.com` is the default host for what gflow has ported to it — text-to-video today — on every account; the rest of the matrix keeps the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 
 **How you can help:** if you have driven `aisandbox-pa.googleapis.com` from outside a real Chrome session, or you understand Google's anti-bot stack here, please open an issue. A working REST transport would unlock serverless deployments, true horizontal concurrency, and roughly 10x the project's reach. Details: [docs/ARCHITECTURE.md § Headed-browser dependency](docs/ARCHITECTURE.md#headed-browser-dependency--current-limitation).

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/deploy/PR-TRIAGE-AUTOPILOT-OPS.md

@@ -44,6 +44,31 @@ An **empty** directory is a valid deployment — D5 then reports that no memory
 >
 > The orchestrator validates the resolved path on the host and refuses to start with an actionable error if it is missing, rather than failing later inside the container.
 
+> **The memory namespace is NOT synced to this host, and that is currently the
+> autopilot's biggest blind spot.** Claude Code keys memory by working-directory
+> path, not repo identity, so `/opt/gflow-cli` starts empty — see
+> `docs/superpowers/specs/2026-07-04-pr-triage-autopilot-design.md` (the one-way
+> local-to-VPS sync it describes was never implemented). The orchestrator now logs
+> a warning when the resolved directory holds no `*.md`, and D5 must report
+> `UNAVAILABLE` rather than GREEN. On PR #650 it reported "no memory entry
+> contradicts this PR" from an empty mount while the local store recorded that
+> exact PR as REJECTED. Until a sync exists, read every autonomous D5 verdict as
+> "not checked".
+
+## 2b. What lands in the public PR comment
+
+The container's stdout is **sliced** before posting: from the first `# PR #`
+heading to the line before `SUMMARY_VERDICT:`. Everything else — the wrapper's
+Docker/iptables progress, the agent's preamble, the machine marker — is dropped.
+The wrapper logs operationally to **stderr**, which the orchestrator keeps for
+`RuntimeError` context and the log file but never posts. Both halves exist
+because a triage comment on PR #650 published the build steps, a raw Docker
+network id, and the bridge subnet to an external contributor.
+
+Adding a new operational `echo` to `run_sandboxed_review.sh`? Send it to `>&2`.
+Anything on stdout outside the two markers is silently discarded from the
+comment; anything between them is published verbatim.
+
 ---
 
 ## 3. Ephemeral Sandbox Firewall Hardening

{gflow_cli-0.66.1/website → gflow_cli-0.67.0}/docs/ARCHITECTURE.md

@@ -435,6 +435,8 @@ We attempted three pure-HTTP transport strategies before settling on `ui_automat
 
 All three now live as standalone modules under `src/gflow_cli/api/transports/experimental/` (`evaluate_fetch.py` / `bearer.py` / `sapisidhash.py`), preserved for reference and future iteration. None survives Google's anti-bot stack for mutation/generation endpoints, so the production path is `ui_automation`.
 
+**The migrated `flow.google.com` host (#639, v0.67.0).** Google is moving accounts off `labs.google` onto `flow.google.com`, a rewritten frontend with a different widget toolkit and a `batchexecute` wire instead of `aisandbox-pa` REST. `src/gflow_cli/api/transports/migrated_composer.py` drives that editor for text-to-video — still through the same real-Chrome Playwright session — by operating the composer UI and then *observing* the app's own `batchexecute` replies (`YhhmEf` submit, `jwpduf` status, `as29s` result) before downloading the clip. `GFLOW_CLI_FLOW_HOST` routes between the two (`auto` = migrated host for every request it can serve, `--project` required there); the rest of the command matrix keeps `ui_automation` on unmoved accounts and exits 36 on moved ones. Recon: `docs/superpowers/spikes/2026-09-05-migrated-host-wire-protocol.md`.
+
 **Standalone-only transports.** `bearer` and `sapisidhash` discard any caller-supplied Playwright page and launch their own browser under a fresh `ProfileLease`, so they are **standalone-only** — they cannot run inside a `FlowApiClient` that already holds the profile lease (the second acquire would self-lock with `ProfileLockedError`). Selecting either via `GFLOW_CLI_TRANSPORT` (or the Python API) while the client owns the profile now fails fast with a clear `ConfigurationError` naming the transport, rather than the opaque lock error. `evaluate_fetch` is exempt: it reuses the client's shared page and takes no second lease. The standalone-only set lives in `STANDALONE_ONLY_TRANSPORTS` (`api/transports/__init__.py`); to drive `bearer`/`sapisidhash`, run them outside an owning client.
 
 ### What this costs users

{gflow_cli-0.66.1 → gflow_cli-0.67.0}/docs/CONFIGURATION.md

@@ -356,6 +356,16 @@ GFLOW_CLI_HISTORY_PROMPTS=redacted gflow image t2i "confidential brief"
 **Video commands:** `gflow video t2v`/`i2v` joined the policy in [#299](https://github.com/ffroliva/gflow-cli/issues/299) PR-A. The video pipeline only has a classic driver, so `auto` ≡ `classic` there: both verify the classic editor pre-submit and abort with exit 28 if it is unreachable. An env-sourced `agentic` **degrades to classic with a logged warning** (so a value set for image workflows can't hard-fail your video runs); only an explicit agentic *request* errors — the `--ui-mode agentic` flag immediately at the CLI edge (exit 2), or the MCP `ui_mode="agentic"` param with a 400 envelope — because no agentic video driver exists yet. `video r2v` and `video chain` have no flag and follow the env-only path.
 **Supersedes:** `GFLOW_CLI_PREFER_CLASSIC` and `GFLOW_CLI_FORCE_AGENT_UI` (below).
 
+### `GFLOW_CLI_FLOW_HOST`
+
+**What:** Which Flow frontend gflow drives. Google is moving accounts from `labs.google/fx/tools/flow` onto `flow.google.com` one at a time ([#639](https://github.com/ffroliva/gflow-cli/issues/639)); the two are the same product on different widget toolkits and different wire protocols, so each has its own driver.
+**Values:**
+- `auto` (default) — **`flow.google.com` is the default host for every request it can serve today** (`video t2v` with `--project`), on moved and unmoved accounts alike — the new host serves both. A request the new host cannot serve yet keeps the labs driver on an unmoved account; a moved account has no labs to fall back to: other modes exit 36, a missing `--project` or a labs-only model exit 11.
+- `flow.google.com` — force the migrated composer for everything, including what it cannot serve yet (those requests then exit 36/11 instead of falling back).
+- `labs.google` — never use the migrated composer; a moved account fails with exit 36 (kill switch).
+**Default:** `auto`
+**Scope today:** the migrated composer covers `gflow video t2v` with `--project <id>` (settings via the option groups, model picker, submit, status observed on the page's own `batchexecute` replies, download from the signed CDN URL). Image, i2v/r2v, characters, scenes, extend, instructions and tools are not ported yet and exit 36 on a moved account. MCP inherits the setting from the server/daemon environment, not per call.
+
 ### `GFLOW_CLI_PREFER_CLASSIC` *(deprecated — use `GFLOW_CLI_UI_MODE=classic`)*
 
 **Deprecated** in favor of [`GFLOW_CLI_UI_MODE`](#gflow_cli_ui_mode). `true` now maps to `ui_mode=classic` (emits a `DeprecationWarning`). **Behavior change:** the old silent fallback to agentic when the toggle was unavailable is gone — a classic-required run now **aborts with exit 28** instead of producing an agentic-cohort result. `GFLOW_CLI_UI_MODE` (and `--ui-mode`) take precedence when both are set.

{gflow_cli-0.66.1/website → gflow_cli-0.67.0}/docs/E2E_TESTING.md

@@ -452,6 +452,27 @@ This work is tracked in the project backlog.
 
 ---
 
+## Migrated host (`flow.google.com`) — `tests/e2e/test_migrated_host_e2e.py`
+
+Google is moving accounts onto `flow.google.com` (#639). Under the default
+`GFLOW_CLI_FLOW_HOST=auto` every `video t2v` with an existing project runs on the
+new host, on moved and unmoved accounts alike, so these tests hold for any
+logged-in profile. They need a project id on that host:
+
+```bash
+GFLOW_CLI_E2E_PROFILE=<profile> GFLOW_CLI_E2E_PROJECT=<project-uuid> \
+    uv run pytest -m e2e tests/e2e/test_migrated_host_e2e.py -v
+```
+
+| Test | Marker | Cost | Proves |
+|---|---|---|---|
+| `test_e2e_migrated_host_serves_this_account` | `e2e_auth` | 0 | a direct load of `flow.google.com/project/<id>` renders the migrated editor for this account |
+| `test_e2e_kill_switch_keeps_exit_36_on_a_moved_account` | `e2e_auth` | 0 | `GFLOW_CLI_FLOW_HOST=labs.google` still yields the distinct exit 36 on a moved account (skips on an unmoved one) |
+| `test_e2e_t2v_runs_on_flow_google_com_by_default` | `e2e_video` | 1 clip (12 credits measured) | `migrated.dispatch` → `submit_observed` → `result`, a real mp4 (`ftyp`), recorder-visible ids |
+
+`GFLOW_CLI_E2E_FLOW_HOST` overrides the routing for the paid test (e.g.
+`flow.google.com` to force it); `GFLOW_CLI_E2E_VIDEO_DURATION` applies as elsewhere.
+
 ## See also
 
 - [CONTRIBUTING.md § Test categories](../CONTRIBUTING.md#test-categories)