gflow-cli 0.73.1__tar.gz → 0.74.0__tar.gz

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.73.1",
+  "version": "0.74.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.env.template

@@ -187,9 +187,11 @@
 # --initial-frame; video r2v from local --ref files; image t2i; and image i2i from
 # local files — all with --project) on every
 # account; requests it cannot serve yet keep the labs driver on an unmoved
-# account, and a moved account gets the migrated composer for everything ported.
+# account; where Flow serves flow.google.com you get the migrated composer for
+# everything ported to it.
 # flow.google.com: force the migrated composer for everything.
-# labs.google: never use it — a moved account fails with exit 36 (kill switch).
+# labs.google: never use it — where Flow serves flow.google.com, requests fail
+# with exit 36 (kill switch).
 # GFLOW_CLI_FLOW_HOST=auto
 
 # DEPRECATED — use GFLOW_CLI_UI_MODE=classic. true maps to ui_mode=classic, but the

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - name: Audit locked dependencies for known CVEs
         # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
         #
@@ -80,7 +80,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Audit workflows (zizmor)
         # --offline: the online audits need a GH token and reach the network, so
@@ -116,7 +116,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -172,7 +172,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}
@@ -260,7 +260,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Set up Python
         run: uv python install 3.13

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/deps-watch.yml

@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Set up Python
         run: uv python install 3.13

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/governance-advisory.yml

@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0 # full history so `git diff origin/<base>..HEAD` resolves
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Classify touched paths (advisory, never blocks)
         # BASE_REF arrives through `env:`, never interpolated into the script

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/governance-benchmark.yml

@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0 # full history — the backtest replays every commit
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Run backtest (advisory; writes to job summary)
         run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY"

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # This is the one workflow that publishes artefacts (PyPI + GitHub
           # Release), so it must not restore a cache any other workflow can

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/scorecard.yml

@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           sarif_file: results.sarif

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/.github/workflows/selector-probe.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with: { persist-credentials: false }
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv sync --frozen
       - run: uv run playwright install chromium --with-deps
       - name: Probe

gflow_cli-0.74.0/.github/workflows/sponsors.yml

@@ -0,0 +1,85 @@
+name: Sponsors hall of fame
+
+# ── Why this exists ──────────────────────────────────────────────────────────
+# The sponsor tiers promise a place in the hall of fame (README.md and docs/SPONSORS.md). A list
+# kept by hand drifts the day someone sponsors, stops, or goes private — and "goes private" is the
+# one that must never lag. This regenerates the block daily from GitHub Sponsors.
+#
+# Commits straight to develop instead of opening a PR: this repository does not let Actions create
+# pull requests, and loosening that setting for a generated list is the wrong trade. The guard
+# below refuses to commit if anything other than the generated pages changed.
+#
+# Needs a SPONSORS_READ_TOKEN secret: a classic PAT with only the `read:user` scope (the default
+# GITHUB_TOKEN cannot read sponsorships). Without it the job skips with a notice.
+
+on:
+  schedule:
+    # Daily 06:30 UTC — clear of the 05:00 selector probe and the 06:00 star-history watch.
+    - cron: "30 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sponsors-hall-of-fame
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    name: Refresh the sponsor hall of fame
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.repository == 'ffroliva/gflow-cli'
+    permissions:
+      contents: write
+    env:
+      HAS_TOKEN: ${{ secrets.SPONSORS_READ_TOKEN != '' }}
+    steps:
+      - name: Skip without a sponsors token
+        if: env.HAS_TOKEN != 'true'
+        run: echo "::notice::SPONSORS_READ_TOKEN is not set; the hall of fame was not refreshed."
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        if: env.HAS_TOKEN == 'true'
+        with:
+          ref: develop
+          persist-credentials: false
+
+      - name: Regenerate the hall of fame
+        if: env.HAS_TOKEN == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.SPONSORS_READ_TOKEN }}
+        run: python3 scripts/ci/update_sponsors.py
+
+      - name: Regenerate the website mirror
+        # Its own step so the sponsors token never reaches a script that does not need it.
+        if: env.HAS_TOKEN == 'true'
+        run: python3 scripts/ci/generate_website_docs.py
+
+      - name: Commit when the list changed
+        if: env.HAS_TOKEN == 'true'
+        env:
+          # Scoped to this step: checkout keeps no credentials (persist-credentials: false).
+          PUSH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          changed=$(git status --porcelain | awk '{print $2}')
+          if [ -z "$changed" ]; then
+            echo "Hall of fame unchanged."
+            exit 0
+          fi
+          allowed='^(README\.md|docs/SPONSORS\.md|website/docs/SPONSORS\.md)$'
+          # Not `grep -q`: an early exit could SIGPIPE printf and, under pipefail, skip the guard.
+          if printf '%s\n' "$changed" | grep -vE "$allowed" >/dev/null; then
+            echo "::error::Refusing to commit: files outside the hall of fame changed:"
+            printf '%s\n' "$changed" | grep -vE "$allowed"
+            exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "docs(sponsors): refresh hall of fame"
+          auth=$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 -w0)
+          echo "::add-mask::$auth"
+          header="http.https://github.com/.extraheader=AUTHORIZATION: basic $auth"
+          git -c "$header" push origin HEAD:develop

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/AGENTS.md

@@ -135,6 +135,43 @@ the five other mirror axes), which no command here can check and no CI gate can
   drifts, which is the exact failure this row exists to prevent.
 - **Locale-Invariance Discipline for UI Automation**: **Never** write text-label string selectors (`has-text(...)` or multi-locale text lists) for DOM elements, overlays, announcements, menus, tabs, or buttons. All DOM selectors in `src/gflow_cli/api/transports/` must be 100% language-agnostic, anchoring exclusively on structural properties: **Tier 1 Anchors** — e.g. hyperlinks (`a[href*='changelog']`), icon ligatures (`button:has(i.google-symbols:text('close'))`), ARIA roles (`[role='banner']`, `button[data-dismiss]`), and hierarchical DOM relationships (`[role='dialog']:has(a[href*='changelog']) button`). Relying on translated display labels or maintaining multi-locale text cascades is strictly forbidden as an anti-pattern hack.
 
+- **Host-Membership Discipline**: say which host Flow **served**; never use host
+  membership to assert a **capability**. "This account is migrated, therefore X is
+  unavailable" is an inference the evidence does not support, and **"X is labs-only" is
+  not merely unproven — it is unfalsifiable here.** A 2026-09-14 survey (3 accounts x 2
+  entry points x 2 runs, [spike](docs/superpowers/spikes/2026-09-14-two-domain-protocol-survey.md))
+  found `labs.google/fx/tools/flow` answering **HTTP 308 Permanent Redirect** to
+  flow.google.com on all three profiles here that still hold a live Flow session (6/6
+  visits) — so none of those can reach labs to test such a claim, while those same three
+  differ in which capabilities work. Host membership is uniform where capability is not;
+  it does not predict capability. An account served labs *has* been driven before
+  (v0.67.0, a pt-locale profile), so this is about what we can test today, not about labs
+  being gone.
+
+  The same survey found the graduated app's Angular root is **`aisandbox-root`** — the
+  same name as `aisandbox-pa.googleapis.com`. One product lineage, two frontends. So a
+  feature gflow cannot drive on flow.google.com is **not ported yet** (a fact about our
+  selectors) rather than "labs-only" (a claim about Flow's service).
+
+  | Do not write | Write |
+  |---|---|
+  | "X is labs-only" | "X is not ported to the migrated composer yet" |
+  | "on a migrated account, X fails" | "on an account served flow.google.com, gflow cannot drive X yet" |
+  | "moved / unmoved account" | "the host Flow served" — and if you have not observed the labs arm, say so |
+  | "the migrated cohort cannot X" | name the surface and the observation that showed it |
+
+  Naming the host is fine — `flow.google.com` really is where Google moved the app.
+  Identifiers stay put: `FlowHostMigratedError`, `GFLOW_CLI_FLOW_HOST` and
+  `migrated_composer.py` are public contracts, and renaming them is churn, not accuracy.
+
+  **This governs CLAIMS, not routing.** `migrated_route()` and `migrated_can_serve()`
+  branch on the host Flow actually **served**, which is an observation, not a membership —
+  keep them. "Host membership predicts nothing" is about what you may *assert* to a user or
+  write into a doc, never a licence to delete a branch. In particular the labs arm of
+  `migrated_route()` has never been observed taken on our accounts, and it stays: we hold
+  no account that could disprove it, which is a reason to keep code and never a reason to
+  make a claim.
+
 ## PR instructions
 
 - Branch naming: `feature/`, `bugfix/`, `hotfix/`, `chore/`, `docs/`, `test/`, `release/` — never `claude/` or unprefixed.

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/CHANGELOG.md

@@ -7,6 +7,153 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.74.0] — 2026-09-14
+
+### Added
+
+- **Sponsorship: a Support section, a sponsor hall of fame, and a Funding link on PyPI.** The
+  README gains one-click sponsor links; [docs/SPONSORS.md](docs/SPONSORS.md) lists the tiers and
+  what each one gets. `.github/workflows/sponsors.yml` refreshes the hall of fame daily from GitHub
+  Sponsors, plus a Gold row at the top of both pages, and only ever lists sponsors who chose to
+  sponsor publicly. No CLI or MCP behaviour
+  changes.
+
+### Changed
+
+- **On `flow.google.com`, an agent-only composer now exits `25` (`FlowAgentUiError`) where
+  it previously exited `23` (`UiSelectorDriftError`)** — and reports `retryable: false`
+  rather than inheriting that class's retryable default. Scripts branching on `23` for
+  this failure must add `25`. Nothing else moved: a trigger missing from the DOM is still
+  exit 23. See the `### Fixed` entry below for why
+  ([#799](https://github.com/ffroliva/gflow-cli/issues/799)).
+
+### Fixed
+
+- **Migrated-host i2v: the Frames picker is confirmed when it does not commit on the
+  pick (#792).** On some cohorts Flow's Frames picker no longer closes when an asset is
+  clicked — it waits for its own "Add to prompt" confirm. gflow sat out
+  `FRAME_COMMIT_HIDDEN_S` waiting for an auto-close that never came and raised
+  `UiSelectorDriftError` with the asset already picked, so i2v dispatch failed before
+  submit (no credits spent). The picker is now given a short grace period and, if it is
+  still up, its confirm is clicked. Anchored on `button.detail-add-to-prompt-btn`, a
+  class measured on this exact surface — never on the translated label. Where the pick
+  already commits, nothing changes: a closing picker no longer carries the button.
+- **A re-run of the same start frame no longer binds a stale look-alike (#792).** The
+  Frames picker is searched by display name and an upload is listed under its file name,
+  so attaching the same keyframe twice left two identical library entries; the search
+  could bind the older one and the submit-body check then failed with `eb1hJf does not
+  carry the uploaded start frame`. What is uploaded is now a run-unique copy
+  (`<stem>-<8 hex>.<ext>`), so the search has exactly one match by construction and the
+  library's sort order is no longer trusted. **This applies to every local file this
+  driver uploads on the migrated host** — `video i2v --initial-frame`, `video r2v --ref`
+  and `image i2i --ref` alike, since all three find their upload again by display name.
+  Expect the tagged names when you browse the project's library on flow.google.com.
+
+  Reported, root-caused and verified end-to-end on the affected cohort by **@ai4U23**.
+
+- **`gflow credits` stopped sending migrated accounts to re-login, on the raise site they
+  actually hit (#795).** v0.73.2 fixed the message for a labs session that mints no token.
+  It did not help the cohort that gets a token and has aisandbox-pa reject it, and it could
+  not: the service caught its own accurate verdict and re-derived it through a browser,
+  which fails inside the shared, route-blind aisandbox retry helper and so reported
+  *"aisandbox-pa returned 401 after token refresh — SAPISID cookie missing, expired, or
+  unreadable. Re-run `gflow auth login`"*. Every word of that is wrong here: aisandbox-pa
+  answered, SAPISID is what let labs mint the token, and on a migrated account re-login can
+  roll the profile's strategy marker back and start #791.
+
+  The browser is no longer consulted once aisandbox-pa has **answered**: it asks the same
+  endpoint for the same Bearer and gets the same refusal. The other raise site — labs
+  answering with no token — keeps its browser rescue, because that one is not proven
+  unreachable: httpx sends labs.google cookies only, while the browser carries the full jar
+  and bootstraps a real navigation, which can renew a session httpx cannot. If that rescue
+  fails too, the fast path's diagnosis is what survives, not the route-blind default.
+
+  `gflow credits list` also reports the remediation per profile now. It rendered only the
+  class title, so the multi-profile surface — and `gflow_get_credits(all_profiles=true)`
+  with it — was the one place that still could not say why, or that re-login would not help.
+
+  Measured on a migrated profile: `gflow credits user` went from ~7 s to ~2 s with no
+  browser launch, and across 9 saved profiles `credits list` dropped from 9 Chrome launches
+  to 6 — the 3 on the aisandbox-401 cohort skip it, the rest keep their rescue. Applies to
+  the MCP twin `gflow_get_credits` identically: both doors share the service and the
+  envelope.
+
+  `credits` itself is still unavailable on migrated accounts; the balance surface for that
+  cohort has not been located. #795 stays open for it.
+
+- **The migrated agent-only composer is named before submit instead of reported as
+  selector drift (#799).** Google has put some accounts on a `flow.google.com` composer
+  that has **no classic arm at all** — the prompt box is the agent panel, and aspect,
+  model and count live in Agent settings as defaults rather than per-request controls.
+  gflow waited 30 s for a control that is structurally absent and raised
+  `UiSelectorDriftError` (exit 23), which reads as *our* frontend bug and invites a retry
+  that cannot work.
+
+  It now raises `FlowAgentUiError` — **exit 25, `retryable: false`** — naming the cohort
+  and saying plainly that no flag or profile change helps. The discriminator is the chip:
+  the DOM is identical to #749's recoverable agent mode (settings trigger present under a
+  bare `hidden`), and what separates them is that a recoverable account still has a
+  `button.agent-mode-chip` to turn off while this one has none. A trigger that has left
+  the DOM entirely is unchanged — that is a renamed selector, our bug, and still drift.
+
+  `retryable` moved from `FlowAppError` to the error base to make that possible — its own
+  comment set the condition, *"move it up if, and only if, a second class needs it"*, and
+  this is the second. No existing error's retryability changed.
+
+  Reported with the DOM evidence that made it diagnosable by **@Cstanish127**. gflow-cli
+  still has no driver for that composer; #799 stays open for it.
+## [0.73.2] — 2026-09-12
+
+### Fixed
+
+- **A missing browser-strategy marker no longer reports as a network problem (#796).**
+  The Playwright cookie reader refuses a profile whose `.gflow_browser_strategy` marker
+  is absent, and that `SecurityError` was flattened into `VERIFICATION_ERROR` — whose
+  guidance is "check network connectivity", for a file on the user's own disk. It is
+  also precisely the state a failed first login leaves behind, since that rolls the
+  marker back. A new `PROFILE_MARKER_MISSING` outcome carries its own message and the
+  remediation that actually works (`gflow auth login --browser chrome`), on the CLI and
+  on the MCP twin (HTTP 409, `retryable: false` — it is neither a network blip nor an
+  expired session).
+- **`gflow credits` no longer blames SAPISID for a host it never contacted (#795).** When
+  labs.google answers 200 with no `access_token` — the normal shape for an account Google
+  has migrated to `flow.google.com` — the failure was raised as "aisandbox-pa
+  authentication failed" with the remediation "SAPISID cookie missing, expired, or
+  unreadable". aisandbox-pa had not been contacted, and SAPISID was present and fine, so
+  the advice sent users into a re-login loop that cannot terminate on that cohort. The
+  remediation now names the real cause. `credits` itself remains labs-only on migrated
+  accounts — tracked in #795.
+- **Incident bundles from a `flow.google.com` failure are no longer blank (#792).** The
+  migrated composer parked its pooled page on `about:blank` in a bare `finally`, so on
+  the FAILURE path it navigated away *before* `FlowApiClient._capture_incident` read the
+  page — whose own contract is to stage the bundle "while the page is still alive".
+  Every migrated video and image failure therefore shipped `tag_counts.div = 0`, a white
+  screenshot and `host_category = "other"` beside a network journal that proved the app
+  was alive, which reads exactly like a lost browser tab and is unusable as evidence.
+  The park is deferred past the capture and drained at the **top of the next run**, before
+  the route decision reads `page.url` — which is where the invariant it protects (a stale
+  project URL must not route the next request) is actually consumed, and the only place
+  that also covers the `post_with_retry` path, where a retryable 5xx re-enters the
+  transport without passing the client's failure boundary at all. Cancellation still
+  attempts the park inline and latches, since no bundle is staged for it.
+  Note a failure bundle's `sensitive/screenshot.png` is now a real capture of the
+  logged-in page rather than a blank frame — the review-before-sharing posture in
+  SECURITY.md applies to it as it already did to every other screenshot.
+
+- **The `/about` landing's `retryable=False` is now a measurement, not a preserved
+  default.** A live occurrence was caught on a second account and the #756 stability
+  probe re-run unmodified: **5/5** attempts landed on `/about` over ~3 minutes, on the
+  account's own project, with a healthy session — so a retry is doomed and costs ~35 s
+  each. Four places that said the measurement *could not* be made are corrected — two
+  code comments, the exit-31 row in [USAGE](docs/USAGE.md) and the `retryable` note in
+  [MCP](docs/MCP.md); behaviour is unchanged. Still unmeasured: the cause, and whether
+  it ever clears.
+- **An auth-status test no longer depends on how wide the terminal is.** Several steps
+  assert a substring of Rich's output, which hard-wraps — so a temp path landing near
+  the wrap column split `experiments` into `profile_e` + `xperiments` and failed on
+  formatting rather than behaviour. Pinned at the shared `CliRunner` fixture, which is
+  the one chokepoint for every invoke in that file.
+
 ## [0.73.1] — 2026-09-11
 
 ### Fixed
@@ -4867,7 +5014,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.73.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.74.0...HEAD
+[0.74.0]: https://github.com/ffroliva/gflow-cli/compare/v0.73.2...v0.74.0
+[0.73.2]: https://github.com/ffroliva/gflow-cli/compare/v0.73.1...v0.73.2
 [0.73.1]: https://github.com/ffroliva/gflow-cli/compare/v0.73.0...v0.73.1
 [0.73.0]: https://github.com/ffroliva/gflow-cli/compare/v0.72.0...v0.73.0
 [0.72.0]: https://github.com/ffroliva/gflow-cli/compare/v0.71.1...v0.72.0

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/KNOWN_ISSUES.md

@@ -58,7 +58,7 @@ command on every account — moved or not; `flow.google.com` forces it for
 everything, and `labs.google` switches the migrated composer off. Limits today: `--project` is required (project creation from the
 migrated editor is not ported), and `t2v`, `i2v` from a local `--initial-frame` (no end frame,
 no UUID/`@Name` frame — the migrated Frames picker exposes no media id in its DOM, so a frame is
-found by file name after gflow uploads it through the editor), and `r2v` from local `--ref` files
+found by the run-unique name gflow uploads it under, #792), and `r2v` from local `--ref` files
 (see the next paragraph), plus `image t2i` and local-file `image i2i` — unsupported
 forms still exit 36.
 
@@ -98,7 +98,7 @@ is a per-account setting the labs.google app applies on every load (measured
 once the account is flagged, re-running will not land the old frontend. Earlier text here said the rollout
 "flaps" and told you to retry; that observation straddled the account's one-time
 switch and is withdrawn. The REST surface (`gflow project list`, `gflow data …`)
-is unaffected. Automated callers now receive `retryable: false` so retry loops
+is unaffected; `gflow credits` is **not** — its token comes from `labs.google`, which mints none for a moved account ([#795](https://github.com/ffroliva/gflow-cli/issues/795), open; see the quota entry below). Automated callers now receive `retryable: false` so retry loops
 stop instead of burning a doomed attempt each time.
 
 **What gflow does today for the rest of the matrix:** recognises the migrated
@@ -220,11 +220,19 @@ at `z-index: 1000`, and Flow's composer is bottom-anchored in the same band. The
 therefore lands **on** the settings trigger *and* on the image submit button.
 Measured 2026-09-11 on the `ci-probe` profile: `elementFromPoint` over each returned
 the bar's label span in 5/5 rendered samples, on the same profile and project where
-the click had landed 3/3 the day before. **How widely it fires is unmeasured** — one
-account observed blocked, one observed already-consented — so treat the recurrence
-pattern as unknown rather than as once-per-profile. The labs driver survives it by
-accident; `_bypass_onboarding` carries a text match on "Agree". The migrated driver
-had no equivalent.
+the click had landed 3/3 the day before.
+
+**Who gets it:** anyone who has not yet dismissed it on that origin. The gate is a
+single key, `localStorage["glue.CookieNotificationBar"]` on `flow.google.com` — not a
+cookie, which is why no profile here carries `SOCS`. A clean browser profile reads the
+bar visible 4/4, and removing that key on a consented profile brings it straight back
+with both controls covered again. So it is the **default state**, and a stored
+dismissal is what removes it: every new gflow profile meets it on its first Flow load,
+and any profile whose stored dismissal Google resets meets it again — as `ci-probe` did
+within seventeen hours.
+
+The labs driver survives it by accident; `_bypass_onboarding` carries a text match on
+"Agree". The migrated driver had no equivalent.
 
 Through 0.73.0 the run fails at exit 23 with `it is covered by span` — the element on
 top is the bar's label, whose identity lives in an `id` the occluder allowlist drops,
@@ -800,9 +808,9 @@ A block that survives dismissal now aborts pre-submit with exit 23 (probe `overl
 
 ---
 
-### No in-CLI quota visibility — resolved
+### No in-CLI quota visibility — resolved on labs, still open on the migrated host
 
-- **Status:** Resolved 2026-09-05
+- **Status:** Resolved 2026-09-05 for `labs.google` accounts · **Open** on accounts Google has migrated to `flow.google.com` · **Tracked:** [#795](https://github.com/ffroliva/gflow-cli/issues/795)
 
 Use `gflow credits user` for the selected profile or `gflow credits list` for all saved
 profiles. Both commands query Flow's current read-only credits endpoint with the saved browser
@@ -810,6 +818,26 @@ session; `--json` provides a stable automation contract. The equivalent MCP surf
 `gflow_get_credits`. The reported balance funds Veo video generation; image generation consumes
 separate per-model daily quotas.
 
+**On accounts served from `flow.google.com` there is still no in-CLI quota visibility.** The
+credits endpoint is reached with a token minted by `labs.google`, and the move takes that
+away in **two stages**, so `gflow credits user` / `list` and `gflow_get_credits` fail in one
+of two ways:
+
+- labs answers `200` with no `access_token` — it never mints one → *"the labs.google session
+  returned no access token"*.
+- labs still mints one and **aisandbox-pa rejects it** → *"credits endpoint returned 401"*.
+  An account can move into either with no other visible change.
+
+Since v0.74.0 both name the real cause. Through 0.73.1 the first was reported as "aisandbox-pa
+authentication failed … SAPISID cookie missing, expired, or unreadable", and through 0.73.2
+the second still was — which sent migrated users into a re-login loop that cannot terminate:
+aisandbox-pa had either not been contacted or had answered, and SAPISID was present and fine.
+On a profile with no browser-strategy marker that advice is worse than useless, since a failed
+*first* login rolls the marker back ([#791](https://github.com/ffroliva/gflow-cli/issues/791)).
+
+Reading a balance on the migrated host is **not** implemented
+([#795](https://github.com/ffroliva/gflow-cli/issues/795), open). Generation is unaffected.
+
 ---
 
 ### `gflow serve` / MCP worker queue: interrupted post-submit tasks need manual reconciliation
@@ -1219,6 +1247,40 @@ continue as a seeded I2V generation — tracked as backlog.
 
 ## Mitigated
 
+### Some accounts get an agent-only composer on flow.google.com, which gflow cannot drive
+
+Some accounts on `flow.google.com` are served a composer with **no classic arm at all**:
+the only prompt box is the agent panel, there is no `agent-mode-chip` to turn off, and
+aspect / model / count are Agent-settings **defaults** rather than per-request controls.
+Every control the migrated driver reaches for is structurally absent, so `gflow video`
+and `gflow image` cannot run there at all.
+
+**Mitigation (v0.74.0):** the state is named before submit — `FlowAgentUiError`, exit 25,
+`retryable: false`, $0 spent — instead of the generic `UiSelectorDriftError` (exit 23)
+that reads as a gflow frontend bug and invites a doomed retry. The discriminator is the
+chip, because the DOM is otherwise identical to the *recoverable* agent mode of
+[#749](https://github.com/ffroliva/gflow-cli/issues/749): a hidden settings trigger **with**
+a chip is recoverable and gflow turns it back itself; a hidden trigger with **no chip
+anywhere** is this cohort.
+
+**No workaround inside gflow.** No flag, `--ui-mode`, or profile change reaches it — the
+composer is a property of the Google account. Generating from the Flow web UI still works.
+A driver for the agent panel is not implemented;
+[#799](https://github.com/ffroliva/gflow-cli/issues/799) stays open for it.
+
+**Prevalence is unmeasured.** One reporter, one account (Windows 11, ru locale), whose DOM
+capture is what made this diagnosable. No account available to the maintainers is in this
+cohort, so the **positive** case is verified against the reporter's captured markup driven
+by a real Chromium (`tests/api/transports/test_agent_only_composer.py`) and **not** against
+live Flow — that needs an account in the cohort and is the named blocker on #799.
+
+The **negative** controls were measured live at $0 on 2026-09-13, which is what makes the
+discriminator more than a guess: a healthy migrated composer carries
+`button.agent-mode-chip` **present and un-pressed** with its settings trigger visible. So a
+migrated account normally has a chip, and having none is the anomaly this keys on.
+
+---
+
 ### Flow can pin the agentic cohort server-side for hours
 
 The classic↔agentic editor arm is server-assigned per page load and normally

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/PKG-INFO

@@ -1,9 +1,10 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.73.1
+Version: 0.74.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
+Project-URL: Funding, https://github.com/sponsors/ffroliva
 Author-email: Flavio Oliva <ffroliva@gmail.com>
 License: MIT License
         
@@ -58,7 +59,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.6; extra == 'dev'
+Requires-Dist: ruff==0.16.7; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'
@@ -86,6 +87,11 @@ Description-Content-Type: text/markdown
 [![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
 
+<!-- Gold sponsors appear here: filled by scripts/ci/update_sponsors.py, empty until there is one. -->
+<!-- sponsors-gold:start -->
+
+<!-- sponsors-gold:end -->
+
 > ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
 >
 > 🛡️ **"Will this get my account flagged?"** The honest, specific answer — what the tool does to stay unremarkable (headed real Chrome, randomised interaction timing, paced submissions), what it deliberately does **not** do (no proxies, no fingerprint spoofing, no pretending it isn't automation), what you can tune, and what we cannot promise — is in [docs/ACCOUNT_SAFETY.md](docs/ACCOUNT_SAFETY.md).
@@ -210,6 +216,23 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project is heading: [ROADMAP.md](ROADMAP.md).
 
+## Support gflow-cli
+
+gflow-cli is built and maintained by one person. Every release is verified against real Google Flow, which spends real AI credits, and breakages get fixed fast because people run it in their pipelines. Sponsorship pays for both.
+
+[![Sponsor $5 one-time](https://img.shields.io/badge/☕_sponsor-$5_one--time-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ffroliva/sponsorships?frequency=one-time&amount=5)
+[![Sponsor $5 a month](https://img.shields.io/badge/💖_sponsor-$5_a_month-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ffroliva/sponsorships?frequency=monthly&amount=5)
+
+Relying on gflow-cli at work? The monthly company tiers put your logo here, and Silver and above also get priority issues. All tiers and what each one gets: [docs/SPONSORS.md](docs/SPONSORS.md).
+
+Patched gflow-cli in your fork? Please [open an issue](https://github.com/ffroliva/gflow-cli/issues) or a pull request — a fix that lands upstream helps everyone.
+
+### Hall of fame
+
+<!-- sponsors:start -->
+No sponsors yet. <a href="https://github.com/sponsors/ffroliva/sponsorships?frequency=one-time&amp;amount=5">Be the first</a> — every public sponsor is listed here.
+<!-- sponsors:end -->
+
 ## License & legal
 
 [MIT License](LICENSE) © 2026 Flavio Oliva (`ffroliva`). The MIT license covers `gflow-cli`'s code only. It grants no rights to Flow, Veo model output, or any Google service. Google's own terms (Labs Additional Terms and any plan-specific subscription terms) govern your generations. See the [DISCLAIMER](DISCLAIMER.md).

{gflow_cli-0.73.1 → gflow_cli-0.74.0}/README.md

@@ -15,6 +15,11 @@
 [![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
 
+<!-- Gold sponsors appear here: filled by scripts/ci/update_sponsors.py, empty until there is one. -->
+<!-- sponsors-gold:start -->
+
+<!-- sponsors-gold:end -->
+
 > ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
 >
 > 🛡️ **"Will this get my account flagged?"** The honest, specific answer — what the tool does to stay unremarkable (headed real Chrome, randomised interaction timing, paced submissions), what it deliberately does **not** do (no proxies, no fingerprint spoofing, no pretending it isn't automation), what you can tune, and what we cannot promise — is in [docs/ACCOUNT_SAFETY.md](docs/ACCOUNT_SAFETY.md).
@@ -139,6 +144,23 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project is heading: [ROADMAP.md](ROADMAP.md).
 
+## Support gflow-cli
+
+gflow-cli is built and maintained by one person. Every release is verified against real Google Flow, which spends real AI credits, and breakages get fixed fast because people run it in their pipelines. Sponsorship pays for both.
+
+[![Sponsor $5 one-time](https://img.shields.io/badge/☕_sponsor-$5_one--time-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ffroliva/sponsorships?frequency=one-time&amount=5)
+[![Sponsor $5 a month](https://img.shields.io/badge/💖_sponsor-$5_a_month-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ffroliva/sponsorships?frequency=monthly&amount=5)
+
+Relying on gflow-cli at work? The monthly company tiers put your logo here, and Silver and above also get priority issues. All tiers and what each one gets: [docs/SPONSORS.md](docs/SPONSORS.md).
+
+Patched gflow-cli in your fork? Please [open an issue](https://github.com/ffroliva/gflow-cli/issues) or a pull request — a fix that lands upstream helps everyone.
+
+### Hall of fame
+
+<!-- sponsors:start -->
+No sponsors yet. <a href="https://github.com/sponsors/ffroliva/sponsorships?frequency=one-time&amp;amount=5">Be the first</a> — every public sponsor is listed here.
+<!-- sponsors:end -->
+
 ## License & legal
 
 [MIT License](LICENSE) © 2026 Flavio Oliva (`ffroliva`). The MIT license covers `gflow-cli`'s code only. It grants no rights to Flow, Veo model output, or any Google service. Google's own terms (Labs Additional Terms and any plan-specific subscription terms) govern your generations. See the [DISCLAIMER](DISCLAIMER.md).