gflow-cli 0.74.0__tar.gz → 0.76.0__tar.gz

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/.agents/plugins/marketplace.json

@@ -8,7 +8,7 @@
       "name": "gflow",
       "source": {
         "source": "local",
-        "path": "./"
+        "path": "./plugins/gflow"
       },
       "policy": {
         "installation": "AVAILABLE",

gflow_cli-0.76.0/.claude-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "name": "gflow-cli",
+  "owner": {
+    "name": "Flavio Oliva",
+    "url": "https://github.com/ffroliva"
+  },
+  "description": "Drive Google Flow (Veo video, Imagen images) from Claude Code.",
+  "plugins": [
+    {
+      "name": "gflow",
+      "source": "./plugins/gflow",
+      "category": "Developer Tools",
+      "tags": ["video", "image", "google-flow", "veo", "imagen", "mcp"],
+      "defaultEnabled": false
+    }
+  ]
+}

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.74.0",
+  "version": "0.76.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",
@@ -14,7 +14,7 @@
     "codex",
     "google-flow"
   ],
-  "skills": "./skills/",
+  "skills": "./plugins/gflow/skills/",
   "interface": {
     "displayName": "gflow-cli",
     "shortDescription": "Develop, validate, review, and operate gflow-cli.",

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/.github/dependabot.yml

@@ -88,6 +88,26 @@ updates:
           - "version-update:semver-minor"
           - "version-update:semver-patch"
 
+  # Docker — the base image in docker/Dockerfile (python:3.14-slim).
+  #
+  # This covers the FROM line and nothing else. Dependabot has no view into packages
+  # installed by a RUN, so `google-chrome-stable` is NOT tracked here: it is pulled
+  # unpinned from Google's apt repo, which keeps only the current build, and a rebuild
+  # is what picks up a newer Chrome. The gflow-cli version is pinned separately via
+  # `ARG GFLOW_VERSION` and gated by tests/test_dockerfile_version_pin.py, so between
+  # the three of them every input to the image has a named owner.
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 3
+    # Kept in sync with .github/workflows/labels.yml — see the note above.
+    labels:
+      - "dependencies"
+
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/.github/workflows/ci.yml

@@ -199,6 +199,9 @@ jobs:
       - name: Council memory (every cited slug resolves, every file is cited)
         run: uv run python scripts/ci/check_council_memory.py
 
+      - name: Plugin skills in sync (curated payload, no maintainer-only skill shipped)
+        run: uv run python scripts/ci/generate_plugin_skills.py --check
+
       - name: Lint
         run: uv run ruff check src tests
 

gflow_cli-0.76.0/.github/workflows/mcp-registry.yml

@@ -0,0 +1,70 @@
+name: MCP Registry
+
+# Publishes server.json to the Official MCP Registry — the listing that feeds the
+# downstream directories (PulseMCP ingests it; GitHub's MCP gallery is built on it).
+#
+# Ordering matters and is why this hangs off `release: published` rather than the
+# tag push. `mcp-publisher` proves namespace ownership by reading the `mcp-name:`
+# token out of the PUBLISHED PyPI README, and PyPI metadata is frozen per release —
+# so the wheel has to be up first. `release.yml` publishes to PyPI and only then
+# creates the GitHub Release, so by the time this fires the token is live.
+#
+# Auth is GitHub Actions OIDC. There is no PAT and no device-code flow: the runner
+# exchanges its own short-lived identity token for registry credentials, which is
+# why this needs `id-token: write` and nothing else.
+
+on:
+  release:
+    types: [published]
+  # Manual re-run, e.g. a release whose registry publish failed after PyPI
+  # succeeded. `validate` runs first either way, so a bad server.json stops
+  # before anything is sent.
+  workflow_dispatch:
+
+# Write scopes live at JOB level (Scorecard Token-Permissions: a workflow-level
+# write grant reaches every job, current and future).
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC exchange with registry.modelcontextprotocol.io
+    env:
+      # Pinned by version AND digest: this step runs in a job holding id-token
+      # write and publishes publicly under io.github.ffroliva, so a moved tag
+      # must not silently change the binary that does it.
+      MCP_PUBLISHER_VERSION: "1.8.1"
+      MCP_PUBLISHER_SHA256: "a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install mcp-publisher
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          archive="${RUNNER_TEMP}/mcp-publisher_linux_amd64.tar.gz"
+          gh release download "v${MCP_PUBLISHER_VERSION}" \
+            --repo modelcontextprotocol/registry \
+            --pattern 'mcp-publisher_linux_amd64.tar.gz' \
+            --output "${archive}" --clobber
+          echo "${MCP_PUBLISHER_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "${archive}" -C "${RUNNER_TEMP}" mcp-publisher
+          "${RUNNER_TEMP}/mcp-publisher" --version
+          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
+
+      - name: Validate server.json
+        # Never `init` here: it only writes a TEMPLATE server.json, refuses when a
+        # real one exists, and exits 1 — which would abort the run before login.
+        run: mcp-publisher validate
+
+      - name: Authenticate with the registry (GitHub Actions OIDC)
+        run: mcp-publisher login github-oidc
+
+      - name: Publish
+        run: mcp-publisher publish

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/AGENTS.md

@@ -44,7 +44,7 @@ by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code
 
 ## Project at a glance
 
-- Unofficial Python CLI for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image, today; `GFLOW_CLI_FLOW_HOST`).
+- Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image, today; `GFLOW_CLI_FLOW_HOST`).
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
 - Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_credits.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `cli_update.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
 - Command surface: `gflow auth`, `gflow credits` (user/list — read-only Veo balance), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run`, `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
@@ -74,8 +74,8 @@ If you can help unblock a pure HTTP transport (especially for video generation,
 
 Run these gates in order before every commit:
 
-```powershell
-$env:PYTHONUTF8=1
+```bash
+export PYTHONUTF8=1          # Windows PowerShell: $env:PYTHONUTF8 = "1"
 uv run python scripts/ci/check_repo_hygiene.py
 uv run python scripts/ci/check_doc_links.py
 uv run python scripts/ci/check_website_docs_pii.py
@@ -108,7 +108,7 @@ the five other mirror axes), which no command here can check and no CI gate can
 
 - Type hints everywhere; `pyright` strict on `src/gflow_cli`.
 - Structured logging only (`structlog`) — **never** raw `print()` or `import logging` in `src/`.
-- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–38, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`, 37 `InsufficientCreditsError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
+- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–39, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`, 37 `InsufficientCreditsError`, 39 `FlowAccessUnavailableError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
 - 100-char line length, `ruff` configured. Imports sorted by `ruff` (isort rules).
 - **YAGNI / least-code**: prefer the smallest change that works. No speculative abstractions (interface/factory with one implementation), no config or flags nobody sets, no dead constants/helpers, no reinventing the stdlib. Review carries this as its own lens — the **D14 over-engineering** dimension of [`pr-council-review`](skills/pr-council-review/SKILL.md) (baseline, always runs). Its rubric is portable; the `ponytail` plugin (see CONTRIBUTING) is an optional accelerant, not a dependency.
 - **MCP & CLI Schema Symmetry**: Any updates or additions to user-facing CLI command parameters (e.g., `gflow image t2i`, `gflow video`) must be mirrored in the corresponding MCP tool definitions. Never add option/argument fields to Click commands without updating the MCP server implementation. This symmetry is enforced programmatically in CI via `tests/mcp/test_cli_parity.py` (every CLI leaf command needs a mapped MCP tool or an explicit, reasoned exemption) plus the schema checks in `tests/mcp/test_server.py`.
@@ -339,7 +339,7 @@ content in a vendor directory.
 **Codex CLI / desktop app:** install the repo's skills-only plugin from the repository root,
 then start a new session:
 
-```powershell
+```bash
 codex plugin marketplace add .
 codex plugin add gflow@gflow-cli
 ```

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/CHANGELOG.md

@@ -7,6 +7,193 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.76.0] — 2026-09-16
+
+### Fixed
+
+- **The containerised sign-in now works on Windows, and no longer points at a service that
+  does not exist.** `docker/docker-compose.yml` hard-coded the X11 socket at
+  `/tmp/.X11-unix` and told non-Linux users to "use the VNC service below instead" — there
+  is no VNC service; the file defines `login`, `gflow` and `serve`. On Windows 11 + WSL2 the
+  display is real but lives elsewhere: WSLg publishes a live `X0` socket at
+  `/mnt/wslg/.X11-unix` with `DISPLAY=:0`, while `/tmp/.X11-unix` inside that distro is an
+  empty directory, so the default mounted nothing and Chrome exited against a display that
+  was not there. The mount is now `${X11_SOCKET:-/tmp/.X11-unix}`, unchanged for Linux, and
+  `docker/README.md` documents the WSL invocation plus the two prerequisites that actually
+  bite (run it from inside WSL, and enable Docker's WSL integration for that distro).
+- **The container image no longer silently installs a stale gflow.** `docker/Dockerfile`
+  hardcoded `pip install gflow-cli==0.75.0` with nothing tying it to `pyproject.toml`, so
+  the next release would have left the image on the old version while
+  `docker/README.md`'s verification table went on quoting the new one. The version is now
+  an `ARG` gated by `tests/test_dockerfile_version_pin.py`. That gate also asserts the
+  ARG's **position**: declared above the Chrome layer it would invalidate ~1.6 GB of apt
+  cache on every version bump, so the ordering is a cache contract, not style. The base
+  image is now tracked by Dependabot (`docker` ecosystem); Chrome stays unpinned, with the
+  reason and the refresh command written down rather than left implicit.
+- **An account with no Flow access was told gflow's selectors had drifted, and asked to
+  file a frontend bug.** Google Flow needs an age-verified account in a supported region
+  on a Google AI Plus, Pro or Ultra plan (or a qualifying Workspace plan). An account
+  without one is served Flow's own "you don't have access" screen instead of the app, and
+  gflow had no route for that state, so the editor sweep reported the only thing it could
+  see: the settings trigger never appeared. Measured on a newly created free Google
+  account, 2026-09-15, as an **A/B through the same command** — the probe neutered, then
+  restored, on live Flow:
+
+  | | exit | class | what the user is told |
+  |---|---|---|---|
+  | before | 23 | `UiSelectorDriftError` | *"Google may have updated their frontend … file a bug at github.com/ffroliva/gflow-cli/issues"* — on `https://flow.google.com/unavailable`, after a 30 s wait, **with an incident bundle containing a screenshot of the account's own page** for the user to attach |
+  | after | 39 | `FlowAccessUnavailableError` | *"This Google account cannot reach Flow"*, naming the subscription and linking Google's eligibility page |
+
+  The guard goes in `raise_if_known_landing()`, already the single chokepoint for "we
+  landed somewhere unexpected" and shared by all three raise sites (the labs gallery
+  sweep, the labs prompt-box sweep, and the migrated composer's `ensure_editor`), so every
+  command that drives the Flow editor is covered by the one change. It now probes the DOM
+  before it reads the URL. Verified live at $0 on that account: `ui_driver.known_landing
+  kind=unavailable at=migrated.ensure_editor`, exit 39, nothing submitted.
+
+  Detection is by Angular component, not by path or status code, because the spike
+  ([`2026-09-15-unentitled-account-signal`](docs/superpowers/spikes/2026-09-15-unentitled-account-signal.md))
+  pre-registered four candidate signals and refuted all four. There is no entitlement field
+  on the session wire; `flow.google.com/` answers **HTTP 200** and performs the hop
+  client-side, so there is no 3xx to key on; and the path is not stable — `/unavailable`
+  and `/u/8/unavailable` were both observed, the second carrying Google's account-index
+  segment, which gflow does not parse anywhere. What is stable is Flow's own
+  `<flow-pinhole-unavailable-screen>`, rendered inside `aisandbox-root`, and unlike the
+  screen's prose it is locale-invariant by construction (AGENTS.md Tier 1). The probe is
+  total: a page that cannot be queried, or a locator that raises, reports "not seen" rather
+  than displacing the caller's own diagnosis.
+
+  **What this does not fix, and why — measured, not assumed.** The same account run
+  *without* `--project` never reaches the editor at all: it takes the labs REST arm and
+  dies at `labs.google/fx/api/trpc/project.createProject` with **HTTP 401**, which is still
+  reported as `AuthExpiredError` (exit 3) telling the user to log in again. `gflow auth
+  login` (exit 8) and `gflow auth status` (exit 1) are wrong in the same way. All three read
+  an oracle that cannot answer the question: `labs.google/fx/api/auth/session` returns 200
+  with an empty `user` for an abandoned sign-in *and* for an account with no entitlement,
+  and a REST 401 looks identical to an expired session. The discriminator exists only in
+  the DOM, and on the login path Chrome has already closed by the time the verdict runs, so
+  there is no page left to ask. Routing those means a browser probe on the auth path — a
+  separate change, on a surface `AGENTS.md` gates behind its own spike. (`gflow credits
+  user` exit 3 on that account is [#795](https://github.com/ffroliva/gflow-cli/issues/795),
+  a different real bug. `gflow project list` returning `{"projects": [], "total": 0}` was
+  never wrong — it lists the local SQLite catalog and never contacts Flow.)
+
+- **An MCP agent's `project_name` is finally used.** `gflow_generate_image` and
+  `gflow_generate_video` accept a `project_name` and document it as the title for a freshly
+  created Flow project, but the worker read a different key (`project_title`) that nothing in
+  the repository has ever written. Every supplied name was silently dropped and each new
+  project was created as the hardcoded fallback `gflow-cli images` instead. Dead since the
+  parameter shipped on 2026-07-26 — the daemon's read predated it by four days, and the
+  feature wired up a new key rather than the one already being read. The CLI was unaffected.
+
+### Added
+
+- **The Official MCP Registry listing now publishes itself.** A new `MCP Registry` workflow runs
+  on `release: published` — after `release.yml` has uploaded the wheel, which matters because
+  `mcp-publisher` proves namespace ownership by reading the `mcp-name:` token out of the
+  *published* PyPI README. It authenticates with **GitHub Actions OIDC**, so no personal access
+  token is created, stored or handed to the registry, and the `mcp-publisher` download is pinned
+  by version *and* sha256 since that job holds `id-token: write`. `workflow_dispatch` is there
+  for a re-run when a release's PyPI upload succeeded but the registry publish did not. Registry
+  listings feed the downstream directories: PulseMCP ingests it and GitHub's MCP gallery is built
+  on it.
+- **A gate for the MCP→worker payload-key round trip (#628).** `tests/mcp/test_cli_parity.py`
+  checks parity at the command and option level; neither can see the queue payload, where a
+  key written under one name and read under another type-checks, lints, passes every test and
+  does nothing at runtime. The new `tests/mcp/test_payload_key_round_trip.py` extracts the keys
+  `mcp/tools.py` writes and the keys anything under `worker/` reads, and fails on any written
+  key the worker never reads. It found the `project_name` defect above on its first run. The
+  extractors carry their own tests against synthetic sources, so the gate is proven able to go
+  red rather than merely observed green (precedent: a dead `output` param the queue never read,
+  found by hand in a v0.48.0 pre-release audit, #495).
+
+## [0.75.0] — 2026-09-15
+
+### Added
+
+- **Installable as a Claude Code plugin.** `/plugin marketplace add ffroliva/gflow-cli` then
+  `/plugin install gflow@gflow-cli` installs the `gflow-cli` and `video-production` skills and
+  registers the MCP server in one step. The plugin ships **disabled**: Claude Code starts a
+  plugin's MCP servers automatically on enable with no prompt of its own, and this one drives your
+  own Google account where video generation bills your credits, so enabling it is a deliberate act.
+  For a hard guarantee, register the server yourself with `gflow mcp run --no-spend`.
+- **`docs/DISTRIBUTION.md`** — an operational catalog of every channel people install or discover
+  gflow-cli through: audience, how to submit, requirements, status and a last-verified date per
+  row. Every row was checked live. It also records the channels that listed us without being asked
+  (MCP Market, skills.sh with 21 installs, two auto-generated catalogs) and the ones we are not
+  eligible for, with the reason.
+- **Listed on [cursor.directory](https://cursor.directory/plugins/gflow-cli)**, and submitted to
+  seven more channels: Glama, mcpservers.org, and PRs or issues on `punkpeye/awesome-mcp-servers`,
+  `ComposioHQ/awesome-claude-skills`, `hesreallyhim/awesome-claude-code`,
+  `travisvn/awesome-claude-skills` and `Arnon-hs/open-source`. `DISTRIBUTION.md` carries the
+  status and reference for each, and — equally deliberately — why four channels are closed to a
+  local-stdio server that spends the user's own credits, including a section on why there is no
+  hosted "connector" and what one would actually cost.
+- **`server.json`** — metadata for the official MCP Registry, with `tests/test_server_json.py`
+  pinning version lockstep, the schema's 100-character description cap, the name pattern, the
+  `mcp-name:` ownership token in the README, and that the command it advertises really exists.
+- **A `gflow-cli` console script.** `uvx gflow-cli mcp run` previously failed with uv's own
+  *"Use `uvx --from gflow-cli <EXECUTABLE-NAME>` instead"*, because the console scripts were named
+  `gflow` and `flow`. The MCP Registry builds exactly that `uvx <identifier>` command from the
+  PyPI identifier and has no field for a differing executable name, so a listing would have been
+  broken on arrival.
+
+### Changed
+
+- **PyPI metadata.** The summary described only image-to-video and never mentioned MCP; it now
+  says what the package is. Added `Documentation`, `Repository` and `Changelog` sidebar links,
+  ten trove classifiers (all checked against the official list) and MCP-related keywords.
+- **Dropped "unofficial" as a label** from the PyPI summary, `README.md`, `index.html`, the docs
+  site, `llms.txt`, `ROADMAP.md`, `DISCLAIMER.md`, `AGENTS.md`, `CLAUDE.md`,
+  `skills/gflow-cli/SKILL.md` and `src/gflow_cli/__init__.py`. The substance is unchanged and
+  still prominent: the README warning block reads "alpha and reverse-engineered — not affiliated
+  with Google", and `DISCLAIMER.md` still opens "not affiliated with, endorsed by, sponsored by,
+  or otherwise connected to Google LLC" — only the word "unofficial" left its first sentence.
+  It was leading with a negative in the one line PyPI shows in search results.
+
+### Fixed
+
+- **The Codex and ChatGPT-desktop plugin manifests shipped every skill in `skills/`**, including
+  maintainer-only ones (`release`, `check`, `pr-council-review`, `sonar`, `doc-review`). All three
+  channels now point at the same curated two-skill payload under `plugins/gflow/`, generated from
+  `skills/` by `scripts/ci/generate_plugin_skills.py` with a `--check` drift gate in CI.
+
+- **Remediation hints naming an extra rendered without the extra.** Rich reads `[chain]` in an
+  interpolated value as a style tag and silently drops it, so `pip install 'gflow-cli[chain]'`
+  printed as `pip install 'gflow-cli'` — advice that reinstalls what you already have. The same
+  applied to `gflow-cli[patchright]`. Only brackets whose first character is `[a-z#/@]` are
+  affected, which is exactly the shape of a package extra. Every site that renders error text
+  through Rich now escapes it, and `tests/test_rich_markup_safety.py` fails the build if a new one
+  appears. `--json` was never affected.
+
+- **`gflow video chain` was unusable on a clean `gflow-cli[chain]` install (#813).** The extra
+  installed `av` but not Pillow, while `media.py` imports `PIL` at module level — so
+  `uvx --from 'gflow-cli[chain]==0.74.0' gflow video chain one.jsonl --dry-run` died on
+  `No module named 'PIL'`, surfaced as a generic exit `1` *"Unexpected error… file a bug"*,
+  immediately after the user installed the documented extra. `pillow>=12.3.0` now ships in the
+  `chain` extra alongside `av`.
+- **A missing `av` used to fail only AFTER a paid clip.** `import av` sat inside
+  `media._decode_frame`, which runs between links — so the missing extra surfaced once link 0
+  had already been generated and billed. It is now a module-level import beside `PIL`, and the
+  import block at the top of `video chain` is guarded: either missing package is a typed
+  `FrameExtractionError` (exit `20`) raised *before* the manifest is read, before `--dry-run`
+  prints a plan, and before the cost prompt. Nothing is submitted and no browser is launched.
+  `FrameExtractionError`'s remediation now names the extra **and both** packages (`av`,
+  `pillow`); it previously said only "PyAV", which left a missing Pillow undiagnosable.
+- **Error text containing `[...]` was silently truncated on the console.** `detail` and
+  `remediation_hint` were interpolated into Rich markup unescaped, so Rich read `[chain]` as an
+  unknown style tag and dropped it — turning every `install gflow-cli[chain]` hint into
+  `install gflow-cli`, advice that reinstalls what the user already has. Both error render
+  paths now escape. `--json` was never affected.
+### Security
+
+- **`gflow serve` now requires the configured daemon token on every HTTP request.**
+  `GFLOW_CLI_DAEMON_TOKEN` / `GFLOW_DAEMON_TOKEN` previously gated startup only. It is now verified
+  on every request, on both the Streamable HTTP and the deprecated SSE transport, with a
+  constant-time comparison; a missing, malformed or wrong token gets `401` plus a
+  `WWW-Authenticate: Bearer` header and never reaches a tool. Set a token and upgrade if you run
+  `gflow serve` on anything other than the default loopback bind.
+
 ## [0.74.0] — 2026-09-14
 
 ### Added
@@ -5014,7 +5201,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.74.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.76.0...HEAD
+[0.76.0]: https://github.com/ffroliva/gflow-cli/compare/v0.75.0...v0.76.0
+[0.75.0]: https://github.com/ffroliva/gflow-cli/compare/v0.74.0...v0.75.0
 [0.74.0]: https://github.com/ffroliva/gflow-cli/compare/v0.73.2...v0.74.0
 [0.73.2]: https://github.com/ffroliva/gflow-cli/compare/v0.73.1...v0.73.2
 [0.73.1]: https://github.com/ffroliva/gflow-cli/compare/v0.73.0...v0.73.1

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/CLAUDE.md

@@ -4,7 +4,7 @@
 
 ## What this project is
 
-`gflow-cli` is an unofficial Python CLI that drives [Google Flow](https://labs.google/fx/tools/flow) (Veo image-to-video, Imagen text-to-image) from the terminal by reverse-engineering Flow's private REST API. See [README.md](README.md) for the user-facing overview.
+`gflow-cli` is a Python CLI that drives [Google Flow](https://labs.google/fx/tools/flow) (Veo image-to-video, Imagen text-to-image) from the terminal by reverse-engineering Flow's private REST API. See [README.md](README.md) for the user-facing overview.
 
 ## System rules — loaded, not requested
 

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/DISCLAIMER.md

@@ -2,7 +2,7 @@
 
 ## Not affiliated with Google
 
-`gflow-cli` is an **independent, unofficial** project. It is **not affiliated with, endorsed by, sponsored by, or otherwise connected to Google LLC, Alphabet Inc., DeepMind, or any of their subsidiaries.** All trademarks (Google, Flow, Veo, Gemini, Imagen, AI Ultra, AI Pro) are the property of their respective owners. The use of these names here is purely descriptive — to identify the service this tool integrates with — and does not imply endorsement.
+`gflow-cli` is an **independent** project. It is **not affiliated with, endorsed by, sponsored by, or otherwise connected to Google LLC, Alphabet Inc., DeepMind, or any of their subsidiaries.** All trademarks (Google, Flow, Veo, Gemini, Imagen, AI Ultra, AI Pro) are the property of their respective owners. The use of these names here is purely descriptive — to identify the service this tool integrates with — and does not imply endorsement.
 
 ## Reverse-engineered surface
 

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/KNOWN_ISSUES.md

@@ -1203,6 +1203,42 @@ your prompts.
 
 ---
 
+### `gflow-cli[chain]` ≤ 0.74.0 does not install Pillow — `video chain` fails with exit 1
+
+- **Status:** **Fixed in v0.75.0** · affects `gflow-cli` ≤ 0.74.0 · **Severity:** High (the command was unusable) · **Affects:** `gflow video chain` · **Tracked:** [#813](https://github.com/ffroliva/gflow-cli/issues/813)
+
+Through 0.74.0 the `chain` extra declared `av` alone, but `gflow_cli/media.py`
+imports `PIL` at module level. So the documented install produced a CLI that
+could not run the command it was installed for:
+
+```console
+$ uvx --isolated --from 'gflow-cli[chain]==0.74.0' gflow video chain one.jsonl --dry-run
+Unexpected error ... file a bug          # exit 1; the real cause is No module named 'PIL'
+```
+
+A missing **`av`** was worse than it looked: `import av` was deferred into the
+decode helper, which only runs *between* links — so it surfaced after link 0 had
+already been generated and **paid for**.
+
+**Workaround on ≤ 0.74.0** — install Pillow alongside the extra:
+
+```bash
+pip install 'gflow-cli[chain]' pillow
+# or:  uv tool install 'gflow-cli[chain]' --with pillow
+```
+
+**Fixed in v0.75.0:** `pillow` ships in the `chain` extra, `av` moved to
+a module-level import so both fail at the same point, and `video chain` now
+raises `FrameExtractionError` (**exit 20**) naming the extra and both packages —
+before the manifest is read, before `--dry-run` prints a plan, and before the
+cost prompt. Verified against a real wheel installed without extras: a
+**nonexistent** manifest still exits 20 on the dependency error rather than
+file-not-found, which is what shows the guard precedes the manifest read.
+The advice is also legible now — Rich used to eat `[chain]` out of it and print
+`pip install 'gflow-cli'`, i.e. reinstall what you already have.
+
+---
+
 ### `gflow video chain` outputs N clips, not one file — auto-concat is deferred
 
 - **Status:** Open (by design) · **Severity:** Low · **Affects:** `gflow video chain` (v0.12.0)

{gflow_cli-0.74.0 → gflow_cli-0.76.0}/PKG-INFO

@@ -1,8 +1,11 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.74.0
-Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
+Version: 0.76.0
+Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
+Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
+Project-URL: Repository, https://github.com/ffroliva/gflow-cli
+Project-URL: Changelog, https://github.com/ffroliva/gflow-cli/blob/main/CHANGELOG.md
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
 Project-URL: Funding, https://github.com/sponsors/ffroliva
 Author-email: Flavio Oliva <ffroliva@gmail.com>
@@ -28,15 +31,25 @@ License: MIT License
         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
         SOFTWARE.
 License-File: LICENSE
-Keywords: ai,cli,flow,google,veo,video
+Keywords: ai,ai-video,cli,flow,generative-ai,google,google-flow,image-to-video,imagen,mcp,mcp-server,model-context-protocol,playwright,text-to-video,veo,video,video-generation
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
+Classifier: Framework :: AsyncIO
+Classifier: Framework :: Pydantic :: 2
 Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: End Users/Desktop
 Classifier: License :: OSI Approved :: MIT License
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Multimedia :: Graphics
 Classifier: Topic :: Multimedia :: Video
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Utilities
+Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: browser-cookie3>=0.20.1
 Requires-Dist: click>=8.1.0
@@ -53,6 +66,7 @@ Requires-Dist: tenacity>=8.2
 Requires-Dist: uvicorn[standard]>=0.34.0
 Provides-Extra: chain
 Requires-Dist: av>=12; extra == 'chain'
+Requires-Dist: pillow>=12.3.0; extra == 'chain'
 Provides-Extra: dev
 Requires-Dist: av>=12; extra == 'dev'
 Requires-Dist: numpy>=1.24; extra == 'dev'
@@ -70,9 +84,11 @@ Requires-Dist: s3fs>=2024.2.0; extra == 's3'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 's3'
 Description-Content-Type: text/markdown
 
+<!-- mcp-name: io.github.ffroliva/gflow-cli -->
+
 # gflow-cli
 
-> Unofficial Python CLI for Google Flow. Drive [Veo](https://labs.google/fx/tools/flow) (image-to-video, text-to-video) and Imagen (text-to-image) from your terminal: scripted, batched, pipeline-ready.
+> Python CLI and MCP server for Google Flow. Drive [Veo](https://labs.google/fx/tools/flow) (image-to-video, text-to-video) and Imagen (text-to-image) from your terminal: scripted, batched, pipeline-ready.
 
 [![PyPI version](https://img.shields.io/pypi/v/gflow-cli.svg)](https://pypi.org/project/gflow-cli/)
 [![CI](https://github.com/ffroliva/gflow-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/ffroliva/gflow-cli/actions/workflows/ci.yml)
@@ -86,13 +102,14 @@ Description-Content-Type: text/markdown
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ffroliva_gflow-cli)
 [![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
+[![Listed on mcpservers.org](https://mcpservers.org/badge.svg)](https://mcpservers.org/servers/ffroliva/gflow-cli)
 
 <!-- Gold sponsors appear here: filled by scripts/ci/update_sponsors.py, empty until there is one. -->
 <!-- sponsors-gold:start -->
 
 <!-- sponsors-gold:end -->
 
-> ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
+> ⚠️ **Read this before you install.** gflow-cli is **alpha and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
 >
 > 🛡️ **"Will this get my account flagged?"** The honest, specific answer — what the tool does to stay unremarkable (headed real Chrome, randomised interaction timing, paced submissions), what it deliberately does **not** do (no proxies, no fingerprint spoofing, no pretending it isn't automation), what you can tune, and what we cannot promise — is in [docs/ACCOUNT_SAFETY.md](docs/ACCOUNT_SAFETY.md).
 >
@@ -173,6 +190,7 @@ Reproduce the recording with [`scripts/record_demo.ps1`](scripts/record_demo.ps1
 | 🎭 **Characters** | [Characters](docs/CHARACTER.md), reusable subjects (`gflow character`) |
 | 🤖 **Agentic & automation** | [Instructions](docs/INSTRUCTIONS.md) (`gflow instructions`, persistent brief cards) · [Movie](docs/MOVIE.md) (`gflow movie`, multi-scene manifests) · [Tools](docs/TOOLS.md) (`--tool`, prompt rewriting) · [MCP server](docs/MCP.md) (`gflow mcp run` / `gflow serve`) |
 | 🔐 **Auth & sessions** | [Authentication](docs/AUTHENTICATION.md) · [Known issues](KNOWN_ISSUES.md) |
+| 📣 **Where to install from** | [Marketplaces](docs/MARKETPLACES.md) (every channel and what each actually delivers) · [Container](docs/CONTAINER.md) (why the image introspects but cannot generate) |
 | 🏗️ **Internals** | [Architecture](docs/ARCHITECTURE.md) · [Security](docs/SECURITY.md) · [Debugging](docs/DEBUGGING.md) |
 | 📦 **Releases** | [Changelog](CHANGELOG.md) · [Roadmap](ROADMAP.md) · [Release protocol](RELEASE.md) · [Project status](docs/PROJECT_STATUS.md) |
 | 🤝 **Contributing** | [Contributing](CONTRIBUTING.md) · [Development](docs/DEVELOPMENT.md) · [GitHub workflow](docs/GITHUB.md) |
@@ -188,6 +206,25 @@ gflow-cli ships four agent entry points. Pick the one your tool reads first.
 | [**llms.txt**](llms.txt) | LLM-readable summary (llmstxt.org format) | Paste into ChatGPT, Claude, or Gemini to onboard the model |
 | [`skills/gflow-cli/SKILL.md`](skills/gflow-cli/SKILL.md) | Claude Code Skill | Symlink into `~/.claude/skills/` |
 
+### Install the plugin (Claude Code)
+
+One step, and you get the `gflow-cli` and `video-production` skills plus the MCP server:
+
+```
+/plugin marketplace add ffroliva/gflow-cli
+/plugin install gflow@gflow-cli
+```
+
+The plugin ships **disabled**. Claude Code starts a plugin's MCP servers automatically once a
+plugin is enabled, with no prompt of its own — and this server drives your own Google account,
+where Veo video generation bills your credits. So installing it starts nothing, and enabling it
+is a deliberate act. Images and composition are free; only video spends. For a hard guarantee,
+register the server yourself with `gflow mcp run --no-spend`, which never registers the
+credit-spending tools at all. See [docs/MCP.md](docs/MCP.md) for the details, including which
+revision `/plugin marketplace add` gives you.
+
+Codex users: `codex plugin marketplace add .` then `codex plugin add gflow@gflow-cli`.
+
 Onboard any agent in one line. Paste this into your agent of choice:
 
 > *"Read [AGENTS.md](https://github.com/ffroliva/gflow-cli/blob/main/AGENTS.md) and [docs/INDEX.md](https://github.com/ffroliva/gflow-cli/blob/main/docs/INDEX.md), then help me with my Flow batch."*