gflow-cli 0.85.0__tar.gz → 0.86.0__tar.gz

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.85.0",
+  "version": "0.86.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/.env.template

@@ -202,6 +202,16 @@
 # with exit 36 (kill switch).
 # GFLOW_CLI_FLOW_HOST=auto
 
+# Agent-only composer (#799): "Confirm before generating" applied before a run.
+# account (default): leave the Flow account's setting; gflow approves one
+# confirmation its own submit produced and stops on a second. Only that second
+# one is stopped before billing: one confirmation can cover several clips, and an
+# over-count under it is caught after the fact.
+# always: set Always. never: set Never — no approval step, so an agent that
+# queues more than asked is only caught after credits are spent.
+# Saved to the Flow account and not restored after the run.
+# GFLOW_CLI_AGENT_CONFIRM=account
+
 # DEPRECATED — use GFLOW_CLI_UI_MODE=classic. true maps to ui_mode=classic, but the
 # old silent agentic fallback is gone: a classic-required run now aborts (exit 28).
 # GFLOW_CLI_PREFER_CLASSIC=false

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/.github/workflows/ci.yml

@@ -256,9 +256,12 @@ jobs:
         # (bad marker/-k filter, broken conftest), never routine deletions.
         run: uv run python scripts/ci/check_test_count.py pytest-report.xml 2000
 
-      # Upload coverage XML so the sonar job can consume it
+      # Upload coverage XML so the sonar job can consume it. It must come from the job
+      # that installs Chromium: the real-DOM fixture tests skip everywhere else, so a
+      # 3.11 upload counted every browser-tested module as uncovered (#989's
+      # agent_only_composer.py measured 39% new coverage with its tests green).
       - name: Upload coverage report
-        if: matrix.python-version == '3.11'
+        if: matrix.python-version == '3.13'
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-xml

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/AGENTS.md

@@ -44,10 +44,10 @@ by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code
 
 ## Project at a glance
 
-- Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image with `@Character` mentions by name, today; `GFLOW_CLI_FLOW_HOST`).
+- Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image with `@Character` mentions by name, and a single-segment `video extend`, today — an agent-only composer, #799, takes text-to-image and text-to-video only; `GFLOW_CLI_FLOW_HOST`).
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
 - Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_credits.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `cli_docs.py`, `docs_catalog.py`, `cli_update.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
-- Command surface: `gflow auth`, `gflow credits` (user/list — read-only Veo balance), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
+- Command surface: `gflow auth` (login/status/renew/list/use/logout — `renew` refreshes saved sessions headlessly, no sign-in), `gflow credits` (user/list — Veo balance; read-only unless `--refresh`, which renews expired sessions first), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
 - Works with any Google account that has Flow access. All generations bill against the user's own Google account.
 
 ## Headed-browser dependency (architectural reality)

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/CHANGELOG.md

@@ -7,6 +7,82 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.86.0] — 2026-10-18
+
+### Added
+
+- **`gflow video extend` runs on flow.google.com, one segment at a time.** gflow opens the
+  clip's editor and drives Flow's own Extend control, so the page builds and mints the
+  `fZytfe` submit itself, the way every other flow.google.com port works. Before any click,
+  Flow's own project read must list the clip as a video in `--project` (exit 11 otherwise).
+  Every scene/extend request passes a route guard that aborts it, before Flow sees it, if
+  it names another clip. The new segment is downloaded to `--output` (or the output
+  directory). On that host `--segments > 1`, `--scene`/`--resume-from`, `--seed` and an
+  `--aspect` other than the source's exit 36 before anything is billed; `--aspect` now
+  defaults to the source's aspect there (9:16 on labs.google, as before). Each run leaves a
+  new scene in the project, and the plan shows no price, because flow.google.com does not
+  report one before submitting. Thanks to @stgmt, whose wire research in #882 (the
+  workflow-id slot, the frame window, the `as29s` record) mapped this surface.
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639), [#882](https://github.com/ffroliva/gflow-cli/pull/882))
+- **Text-to-image and text-to-video on Flow's agent-only composer
+  ([#799](https://github.com/ffroliva/gflow-cli/issues/799)).** Accounts `flow.google.com` serves
+  with no classic composer exited 25; `gflow image t2i` and `gflow video t2v` (and their MCP
+  twins) now run there. gflow sets aspect, count and model in Agent settings, saves, asks the
+  agent in plain language, and restores those defaults afterwards — also when the run fails
+  with an error. A run killed between Save and restore leaves the run's defaults in place; the
+  `migrated.agent_only.defaults_restore_failed` log names the originals (KNOWN_ISSUES).
+  Completion is read from the page: images from new grid tiles, named by their
+  `img[data-media-id]` and downloaded at original size from the tile's opaque `/asb/` URL
+  (`=s0`; the tile itself shows a 512-px preview), videos once no pending tile is left, with the clip id taken from the agent's reply when the grid tile has
+  none. Live-verified on an AI Pro account: 3:4 × 2 images, and a 4 s 9:16 clip downloaded.
+  Other forms on that composer exit 36 before anything is clicked.
+- **`GFLOW_CLI_AGENT_CONFIRM=account|always|never`** — the agent-only composer's "Confirm before
+  generating" choice, applied before a run and kept. `account` (default) leaves the account's
+  setting alone. With a confirmation step gflow approves exactly one that its own submit
+  produced, and stops without approving a second. Only that second confirmation is stopped
+  before billing: one confirmation can cover several clips, and an over-count under it is caught
+  after the fact. A video run also refuses to start while another clip is still generating in the project, and stops if more clips are queued than were requested.
+- **`gflow auth renew` refreshes saved sessions without signing in again.** It opens each
+  profile (`--profile`, or `--all`) in a headless browser and loads Flow, so Google and Flow
+  rotate the saved cookies. It then verifies the session like `gflow auth status`. No credits
+  are spent. A revoked session still needs `gflow auth login`, and a profile in use by another
+  gflow process is skipped. It reports a profile as renewed only when it saw it renewed: an
+  account Flow holds at its public `/about` page is `public_landing`; a labs.google session that
+  stayed expired, or never answered readably, is `labs_stale` / `labs_unverified`; a browser
+  that cannot start (the profile is open in your own Chrome) is a `launch_error` row, and the
+  rest of an `--all` run carries on. `--json` prints JSON on every path, including errors.
+- **`gflow credits user|list --refresh` renews expired sessions again.** Since #802, an expired
+  session fails the credits read without opening a browser. That is the right default, because
+  re-asking aisandbox-pa with the same Bearer cannot change its answer. It also removed the only
+  automatic renewal that `credits list` used to give stale profiles. `--refresh` brings it back as
+  an opt-in. A profile whose fast path raises an expired-session error is renewed through
+  `auth renew` and asked again, while the others are untouched. A failed renewal keeps the
+  original diagnosis. The MCP twin is `gflow_get_credits(refresh=true)`. The credits 401 hint
+  now points at `--refresh` / `gflow auth renew` instead of "check your balance in Flow"; an
+  account whose labs session issues no token at all is not helped by renewal, and says so.
+
+### Changed
+
+- **The agent-only composer is recognised after 5 s**, not after the full 30 s readiness wait.
+- **Image downloads accept `flow.google.com` URLs, and now check where redirects end.** The
+  agent-only composer's `/asb/` image URLs redirect to `lh3.google.com`; a download whose
+  redirects end on a host outside Google's allowlist (or on plain `http`) is refused before
+  anything is written.
+- **A run on the agent-only composer that times out after submit is `retryable: false`.** The
+  request was already sent, so an automatic retry would submit (and for a video, bill) again.
+- **Refusals before the page opens now require that neither composer supports the request.**
+  `--aspect 3:4` was refused up front because the classic settings pane has no 3:4 option; the
+  agent-only pane does.
+
+### Fixed
+
+- **`gflow video extend --json` prints one JSON document.** The human plan preamble no
+  longer precedes it on stdout, and the payload now carries the same `video_result` fields
+  as `t2v`/`i2v` (`status`, `succeeded`, `media_id`, `local_path`, `request.mode`). On
+  flow.google.com `--output` saves the new extension clip; on labs.google it still renders
+  the whole scene.
+  (#882, @stgmt)
+
 ## [0.85.0] — 2026-10-14
 
 ### Added
@@ -6058,7 +6134,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.85.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.86.0...HEAD
+[0.86.0]: https://github.com/ffroliva/gflow-cli/compare/v0.85.0...v0.86.0
 [0.85.0]: https://github.com/ffroliva/gflow-cli/compare/v0.84.0...v0.85.0
 [0.84.0]: https://github.com/ffroliva/gflow-cli/compare/v0.83.2...v0.84.0
 [0.83.2]: https://github.com/ffroliva/gflow-cli/compare/v0.83.1...v0.83.2

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/KNOWN_ISSUES.md

@@ -47,7 +47,7 @@ close Chrome yourself. On the measured account, `/about` was gone on the next ru
 
 ### Flow is migrating to `flow.google.com`; generation coverage is partial but includes images
 
-- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i` now run on the migrated host. Image mode supports Nano Banana 2.1 (`nano2`, which replaced Nano Banana 2 there, #958) / 2 Lite / Pro, all five aspect ratios its radiogroup renders (16:9, 4:3, 1:1, 3:4, 9:16 — 3:4 appeared by 2026-09-17, #864), and count 1–4. Image prompts can tag a **character** with `@Name` / `--reference-entity` + `--reference-entity-name` since #723 (attached through the composer's `@` picker; an id without a name exits 36; video is unchanged). Image refs by UUID, video `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, extend, instructions and tools are not ported yet and fail before submit. **`character create` worked on the migrated host until its labs `createEntity` route was retired:** measured 2026-10-14 on a profile served flow.google.com, it exits 7 with "Flow RPCs have been deprecated" (404). `character list` does NOT: it reads the retired labs `projectInitialData` route and exits 7, measured 2026-09-20 both on `auto` and with `GFLOW_CLI_FLOW_HOST=flow.google.com` (#875). Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, `extend`, `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
+- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, local-file `gflow image i2i`, and a **single-segment** `gflow video extend` (#882: Flow's own Extend control, driven from the clip editor) now run on the migrated host. Image mode supports Nano Banana 2.1 (`nano2`, which replaced Nano Banana 2 there, #958) / 2 Lite / Pro, all five aspect ratios its radiogroup renders (16:9, 4:3, 1:1, 3:4, 9:16 — 3:4 appeared by 2026-09-17, #864), and count 1–4. Image prompts can tag a **character** with `@Name` / `--reference-entity` + `--reference-entity-name` since #723 (attached through the composer's `@` picker; an id without a name exits 36; video is unchanged). That matrix is the **classic** migrated composer's. On an **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gflow drives `image t2i` (all five aspects; count 1–4) and `video t2v` (one 9:16 or 16:9 clip) only — i2i, i2v, r2v and character references are refused there before anything is clicked. Image refs by UUID, video `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, chained extend (`-n > 1`, `--scene`/`--resume-from`, `--seed`, an `--aspect` other than the source clip's), instructions and tools are not ported yet and fail before submit. **`character create` worked on the migrated host until its labs `createEntity` route was retired:** measured 2026-10-14 on a profile served flow.google.com, it exits 7 with "Flow RPCs have been deprecated" (404). `character list` does NOT: it reads the retired labs `projectInitialData` route and exits 7, measured 2026-09-20 both on `auto` and with `GFLOW_CLI_FLOW_HOST=flow.google.com` (#875). Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, multi-segment `extend` (`-n > 1`, `--scene`/`--resume-from`, `--seed`), `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
 - **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
 - **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
 - **`--reference-entity` was refused on `r2v` but not on `t2v`** ([#716](https://github.com/ffroliva/gflow-cli/issues/716), fixed in v0.71.0): the "not ported, exit 36" refusal above sat inside the r2v branch of the routing gate, so a `t2v` request carrying a character entity returned from that gate without its entities ever being inspected — and nothing downstream attaches one on this host. The generation was **submitted and billed** with the entity silently dropped, returning a plausible clip of the wrong person. The check is now mode-independent and ahead of every early return. If you ran `gflow video t2v @Name …` or `--reference-entity` on a moved account before this fix, the identity in those clips was never bound.
@@ -140,7 +140,7 @@ with the distinct, non-retryable exit 36 instead of the misleading
 `UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
 accepts the migrated host, so a migrated load is no longer misread as a
 logged-out session. The generation forms listed above and characters are driven;
-scenes, extend, instructions, tools, and the named reference/model
+scenes, chained extend, instructions, tools, and the named reference/model
 variants are the remaining work
 tracked here — no retry helps for those until each is ported.
 
@@ -742,16 +742,27 @@ Google's web session cookies aren't permanent. They expire when:
 
 When this happens, the next API call returns 401/403 and `gflow-cli` raises `AuthExpiredError`.
 
-**Workaround:**
+**Workaround, stale session (the common case):**
+```bash
+gflow auth renew --profile <name>        # or: gflow auth renew --all
+gflow credits list --refresh             # renews only the expired profiles, then reads them
+```
+
+A profile that has just sat unused has a lapsed labs.google token, not a dead Google session.
+`auth renew` loads Flow and labs.google in a headless browser and waits for labs to sign in
+again on its own, with no prompt. Measured 2026-10-14: 7 of 10 stale profiles recovered.
+
+**Workaround, revoked session:**
 ```bash
 gflow auth login --profile <name>
 ```
 
 Re-running `auth login` reuses the existing profile dir (you typically just click "Continue as <you>" on the Google account chooser). No data is lost; only the cookie jar is refreshed.
 
-**Why we don't auto-refresh:** Google's session-refresh flow can include CAPTCHA / device verification that only a human can complete. A community SDK can't reliably automate that step. See [docs/AUTHENTICATION.md § Refresh / expiry](docs/AUTHENTICATION.md#refresh--expiry).
-
-**Roadmap:** not scheduled. The Phase 4 hardening pass (v0.4.0a2) added typed `AuthExpiredError` + exit code `3` so scripts can branch on auth expiry deterministically. A periodic "session liveness" check + a `gflow auth refresh` command are still candidates for a later phase, but not committed to a version yet.
+**What renewal cannot do:** complete a step only a human can, such as CAPTCHA, device
+verification, or "Confirm it's you". The 3 profiles that did not recover on 2026-10-14 were held
+at Flow's public `/about` page ([entry above](#every-command-lands-on-flowgooglecomabout-exit-31-while-gflow-auth-status-says-the-session-is-fine)),
+and `auth renew` reports them as not renewed. See [docs/AUTHENTICATION.md § Refresh / expiry](docs/AUTHENTICATION.md#refresh--expiry).
 
 ---
 
@@ -1345,32 +1356,49 @@ continue as a seeded I2V generation — tracked as backlog.
 
 ## Mitigated
 
-### Some accounts get an agent-only composer on flow.google.com, which gflow cannot drive
+### Some accounts get an agent-only composer on flow.google.com — text-to-image and text-to-video are driven; other forms are not
 
 Some accounts on `flow.google.com` are served a composer with **no classic arm at all**:
 the only prompt box is the agent panel, there is no `agent-mode-chip` to turn off, and
 aspect / model / count are Agent-settings **defaults** rather than per-request controls.
-Every control the migrated driver reaches for is structurally absent, so `gflow video`
-and `gflow image` cannot run there at all.
-
-**Mitigation (v0.74.0):** the state is named before submit — `FlowAgentUiError`, exit 25,
-`retryable: false`, $0 spent — instead of the generic `UiSelectorDriftError` (exit 23)
-that reads as a gflow frontend bug and invites a doomed retry. The discriminator is the
-chip, because the DOM is otherwise identical to the *recoverable* agent mode of
-[#749](https://github.com/ffroliva/gflow-cli/issues/749): a hidden settings trigger **with**
-a chip is recoverable and gflow turns it back itself; a hidden trigger with **no chip
-anywhere** is this cohort.
-
-**No workaround inside gflow.** No flag, `--ui-mode`, or profile change reaches it — the
-composer is a property of the Google account. Generating from the Flow web UI still works.
-A driver for the agent panel is not implemented;
-[#799](https://github.com/ffroliva/gflow-cli/issues/799) stays open for it.
-
-**Prevalence is unmeasured.** One reporter, one account (Windows 11, ru locale), whose DOM
-capture is what made this diagnosable. No account available to the maintainers is in this
-cohort, so the **positive** case is verified against the reporter's captured markup driven
-by a real Chromium (`tests/api/transports/test_agent_only_composer.py`) and **not** against
-live Flow — that needs an account in the cohort and is the named blocker on #799.
+
+**Driven ([#799](https://github.com/ffroliva/gflow-cli/issues/799)):** `gflow image t2i` and
+`gflow video t2v` (and their MCP twins). gflow sets the request's aspect, count and model in
+Agent settings, saves, sends a natural-language request to the agent, and **restores those
+three defaults afterwards**. "Confirm before generating" follows
+[`GFLOW_CLI_AGENT_CONFIRM`](docs/CONFIGURATION.md#gflow_cli_agent_confirm) and is not restored.
+With a confirmation step, gflow approves exactly one that its own submit produced and stops
+without approving a second. Live-verified 2026-09-15 on a Google AI Pro account (`en`):
+t2i 3:4 × 2 (896×1200 each), t2v 4 s 9:16 (ready 69 s after submit, MP4 downloaded).
+
+**Not driven yet on this composer** (exit 36, before anything is clicked): image-to-image,
+image-to-video, reference-to-video, character references, Agent instructions, an explicit
+video `--resolution` (the Agent settings pane has no resolution control), and more than one
+video per request.
+
+**Rough edges, measured:**
+- A run that dies between Save and restore can leave the account on the run's defaults; the
+  `migrated.agent_only.defaults_restore_failed` log line names the originals.
+- Editing Agent settings in the browser *during* a run is overwritten by the restore.
+- Finished **video** tiles re-render to opaque `/asb/` media with no media id; the id comes
+  from the agent's reply instead, and the clip is fetched from the tile's hover player.
+  **Image** tiles also load an opaque `/asb/` src (a 512-px preview) but carry the media id on
+  `img[data-media-id]`; gflow downloads the original size by rewriting the size spec to `=s0`.
+- The request text is English. Whether the agent honours it on a non-English account is
+  unmeasured (the original reporter's account is `ru`).
+- **The confirmation step does not bound the spend of the first ask.** gflow approves the
+  first confirmation without reading the count it names, and one confirmation can cover
+  several generations. Only a *second* confirmation is stopped before billing; an agent that
+  queues more than requested under the first is detected after the fact (more clips pending,
+  or more images on the grid, than requested), with the credits already spent — even with
+  `GFLOW_CLI_AGENT_CONFIRM=always`.
+- An image whose orientation does not match the requested aspect is kept (the run is
+  billed and the file is valid) and logged as `migrated.agent_only.aspect_mismatch`.
+
+**Detection** is unchanged from v0.74.0: a hidden settings trigger with **no chip anywhere**
+is this composer; with a chip it is the recoverable agent mode of
+[#749](https://github.com/ffroliva/gflow-cli/issues/749). It is now reported after a 5 s
+early wait instead of the full 30 s readiness gate.
 
 The **negative** controls were measured live at $0 on 2026-09-13, which is what makes the
 discriminator more than a guess: a healthy migrated composer carries

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.85.0
+Version: 0.86.0
 Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
@@ -127,7 +127,7 @@ You have a Google account with Flow access, you have Veo credits, and you run re
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
-- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs.
+- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs. A stale session renews headlessly with `gflow auth renew` (or `gflow credits user|list --refresh`).
 
 Same Veo and Imagen models, same quality, same billing against your own Google account, now programmatic.
 
@@ -243,7 +243,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
-**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, and image-to-image from local files. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
 
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/README.md

@@ -39,7 +39,7 @@ You have a Google account with Flow access, you have Veo credits, and you run re
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
-- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs.
+- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs. A stale session renews headlessly with `gflow auth renew` (or `gflow credits user|list --refresh`).
 
 Same Veo and Imagen models, same quality, same billing against your own Google account, now programmatic.
 
@@ -155,7 +155,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
-**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, and image-to-image from local files. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
 
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/docker/Dockerfile

@@ -45,7 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Deliberately NOT pinned: google-chrome-stable. Chrome's apt repo keeps only the current
 # build, so a pinned version stops resolving within weeks. The trade-off is that this
 # layer caches indefinitely and a rebuild is what picks up a newer Chrome.
-ARG GFLOW_VERSION=0.85.0
+ARG GFLOW_VERSION=0.86.0
 RUN pip install --no-cache-dir "gflow-cli==${GFLOW_VERSION}"
 
 VOLUME ["/data"]

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/docs/AUTHENTICATION.md

@@ -262,6 +262,35 @@ Flow session verified as you@example.com.
 
 > Note: `cookies_present: True` only confirms the file exists. The final verdict line is the live probe result, and it has three failing shapes — all exit 1, each with a different hint. A **dead session** prints a `gflow auth login` remediation hint. A probe that **cannot reach the endpoint** (offline, 5xx) suggests checking connectivity instead of re-logging in. And a profile **missing its `.gflow_browser_strategy` marker** — the state a failed *first* login leaves behind, since that rolls the marker back — says so and points at `gflow auth login --browser chrome --profile <name>`; it is local profile state, not a network fault, and "check connectivity" would send you to the wrong place ([#796](https://github.com/ffroliva/gflow-cli/issues/796), 0.73.2). The MCP twin `gflow_auth_status` reports the same three as HTTP 401, 503 (`retryable: true`) and 409 (`retryable: false`) — see [MCP.md](MCP.md).
 
+### `gflow auth renew`
+
+Refreshes saved sessions **without signing in again**. Google rotates its session cookies, and
+Flow re-mints its own session, only when a real browser visits the app. A profile left unused for
+weeks therefore drifts towards an expired session even though nothing about the account changed.
+`auth renew` opens the profile in a hidden browser and loads Flow. It then loads
+`labs.google/fx/` and waits up to 20 s for the labs app to sign in again on its own: a stale labs
+session reports `ACCESS_TOKEN_REFRESH_NEEDED`, and the page renews it through Google without a
+prompt. This step matters because `gflow credits` reads its token from that labs session, and the
+Flow visit alone never refreshes it. The browser saves whatever cookies were rotated, and the
+result is verified exactly like `gflow auth status`. It spends no credits.
+
+```bash
+gflow auth renew                    # the default profile
+gflow auth renew --profile work     # one named profile
+gflow auth renew --all --json       # every profile with a saved session
+```
+
+It exits `0` when every renewed profile verifies and `1` otherwise. An account that Flow sends to
+its public `/about` page (see [KNOWN_ISSUES](../KNOWN_ISSUES.md)) never finishes the labs sign-in,
+so it needs `gflow auth login`. A profile counts as renewed only when labs.google was seen to
+refresh it: if labs is unreachable or answers unreadably (a network that blocks `labs.google`,
+say), the row is `labs_unverified` and the command exits `1` even though the Flow session
+verifies. A profile another gflow process is using is skipped, not failed. It cannot bring back a session Google has **revoked**
+(a password change, "sign out of all devices", an identity re-check). That still needs
+`gflow auth login`. `gflow credits user|list --refresh` runs the same renewal automatically for
+a profile whose credits read fails with an expired session. Over MCP, that case is reached
+through `gflow_get_credits(refresh=true)`; `auth renew` itself has no MCP tool.
+
 ### `gflow auth list`
 
 Same output as bare `gflow auth` when profiles exist — useful when you want the table even from a script (no auto-login fallback).
@@ -417,7 +446,24 @@ ERROR: Auth expired for profile 'default'.
 Run: gflow auth login --profile default
 ```
 
-Re-running `auth login` refreshes the cookies in place — no other state is lost.
+Two cases look the same at that point and are fixed differently:
+
+- **Stale, not revoked.** This is the common one: the profile has simply not been opened for a
+  while. Google's cookies are still good, but labs' NextAuth token has lapsed
+  (`ACCESS_TOKEN_REFRESH_NEEDED`), and labs only renews it when a browser visits. Run
+  [`gflow auth renew`](#gflow-auth-renew), or add `--refresh` to `gflow credits user|list`. It
+  renews the session headlessly with no sign-in.
+- **Revoked.** A password change, a removed device, or Google asking to "Confirm it's you" cannot
+  be renewed from cookies. `auth renew` reports "could not be renewed" (or names Flow's public
+  `/about` page). Re-running `gflow auth login` refreshes the cookies in place, and no other state
+  is lost.
+
+> **Renewal signs in headlessly.** The labs re-sign-in runs Google's OAuth hop in a headless
+> browser, which identifies itself as `HeadlessChrome` (only `navigator.webdriver` is hidden).
+> Generation runs headed by default, so this is the one Google sign-in gflow does headless.
+> It worked on 7 of 7 recoverable profiles on 2026-10-14. If Google ever starts challenging it,
+> fall back to `gflow auth login`. Note that `gflow_get_credits(refresh=true)` lets an agent
+> trigger a renewal on every expired profile.
 
 ## Chromium downgrade guard
 

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/docs/CONFIGURATION.md

@@ -420,7 +420,7 @@ Measurement script: `scripts/dev/spike_offscreen_window.py`.
 **How it works:** before each generation, gflow determines the required arm, clicks the classic↔agentic toggle as a **prerequisite**, **verifies** with a DOM re-probe, then binds — or fails fast. The required arm is also **inferred**: `-i` instructions are agentic-only, so they force `agentic` automatically (and `--ui-mode classic` + `-i` is a hard conflict, not a silent drop).
 **Why `classic`:** the agentic cohort treats aspect ratio as a soft prompt hint (portrait 9:16 can come back landscape). `classic` enforces it or fails fast instead of silently degrading.
 **Retry note:** the cohort flaps per load, so an exit-28 abort is **retryable** — a re-run often lands the wanted arm. A server experiment can pin the arm, in which case it's unreachable from the client (the abort still saves the credits).
-**Video commands:** `gflow video t2v`/`i2v` joined the policy in [#299](https://github.com/ffroliva/gflow-cli/issues/299) PR-A. The video pipeline only has a classic driver, so `auto` ≡ `classic` there: both verify the classic editor pre-submit and abort with exit 28 if it is unreachable. An env-sourced `agentic` **degrades to classic with a logged warning** (so a value set for image workflows can't hard-fail your video runs); only an explicit agentic *request* errors — the `--ui-mode agentic` flag immediately at the CLI edge (exit 2), or the MCP `ui_mode="agentic"` param with a 400 envelope — because no agentic video driver exists yet. `video r2v` and `video chain` have no flag and follow the env-only path.
+**Video commands:** `gflow video t2v`/`i2v` joined the policy in [#299](https://github.com/ffroliva/gflow-cli/issues/299) PR-A. The video pipeline only has a classic driver, so `auto` ≡ `classic` there: both verify the classic editor pre-submit and abort with exit 28 if it is unreachable. An env-sourced `agentic` **degrades to classic with a logged warning** (so a value set for image workflows can't hard-fail your video runs); only an explicit agentic *request* errors — the `--ui-mode agentic` flag immediately at the CLI edge (exit 2), or the MCP `ui_mode="agentic"` param with a 400 envelope — because no agentic video driver exists yet. `video r2v` and `video chain` have no flag and follow the env-only path. This policy is the labs and classic-migrated one: an account whose `flow.google.com` project is served an **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) is routed to its driver before it, so supported `image t2i` / `video t2v` requests run there whatever this is set to.
 **Supersedes:** `GFLOW_CLI_PREFER_CLASSIC` and `GFLOW_CLI_FORCE_AGENT_UI` (below).
 
 ### `GFLOW_CLI_FLOW_HOST`
@@ -431,7 +431,18 @@ Measurement script: `scripts/dev/spike_offscreen_window.py`.
 - `flow.google.com` — force the migrated composer for everything, including what it cannot serve yet (those requests then exit 36/11 instead of falling back).
 - `labs.google` — never use the migrated composer; where Flow serves `flow.google.com`, requests fail with exit 36 (kill switch).
 **Default:** `auto`
-**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2.1 (`nano2`, #958) / 2 Lite / Pro, all five aspect ratios (16:9, 4:3, 1:1, 3:4, 9:16 — `3:4` was added to that host's radiogroup by 2026-09-17, #864) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Image prompts may tag a character with `@Name` (or `--reference-entity` paired with `--reference-entity-name`; an id alone exits 36), attached through the composer's `@` picker (#723). Frames given by UUID/`@Name`, media references by UUID/`@Name`, character entities on video, Agent instructions, Imagen 4, scenes, extend, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
+**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2.1 (`nano2`, #958) / 2 Lite / Pro, all five aspect ratios (16:9, 4:3, 1:1, 3:4, 9:16 — `3:4` was added to that host's radiogroup by 2026-09-17, #864) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Image prompts may tag a character with `@Name` (or `--reference-entity` paired with `--reference-entity-name`; an id alone exits 36), attached through the composer's `@` picker (#723). `video extend` is ported for a single segment from a clip (one PROMPT; `-n` > 1, `--scene`/`--resume-from`, `--seed` and an `--aspect` other than the source's exit 36, and `-o` saves the new extension clip only, #882). Frames given by UUID/`@Name`, media references by UUID/`@Name`, character entities on video, Agent instructions, Imagen 4, scenes, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
+
+### `GFLOW_CLI_AGENT_CONFIRM`
+
+**What:** On an account Flow serves the agent-only composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)), Agent settings carries a **Confirm before generating** choice. This sets it before a run.
+**Values:**
+- `account` (default) — leave the account's setting as it is. If Flow asks for confirmation, gflow approves exactly one request its own submit produced, and stops without approving if a second one appears. As with `always`, only that second confirmation is stopped before credits are spent: one confirmation can cover several generations, and an over-count under it is caught after the fact.
+- `always` — set **Always**. gflow approves the **first** confirmation without reading the count it names, and one confirmation can cover several generations. What this stops before credits are spent is a **second** confirmation in the same run; an agent that queues more than requested under the first one is caught only after the fact (gflow fails the run when more clips are pending, or more images appear, than were requested — the credits are already spent).
+- `never` — set **Never**. No approval step; a result count that differs from the request is detected only after the credits are spent.
+**Default:** `account`
+**Persistence:** unlike model / aspect / count (applied per run and restored afterwards), this value is saved to the Flow account and **not** restored — it is your standing choice, and it also applies when you use Flow in the browser.
+**MCP:** inherited from the server/daemon environment, not per call.
 
 ### `GFLOW_CLI_PREFER_CLASSIC` *(deprecated — use `GFLOW_CLI_UI_MODE=classic`)*
 

{gflow_cli-0.85.0 → gflow_cli-0.86.0}/docs/E2E_TESTING.md

@@ -160,6 +160,8 @@ test, not a mocked proxy — the Bug Lane's step 5.
 | `GFLOW_CLI_E2E_BATCH_MANIFEST` | `test_assets/sample_batch.tsv` | TSV manifest for the batch image e2e. |
 | `GFLOW_CLI_E2E_BATCH_JITTER` | `"1"` | Set to `"0"` to disable inter-request jitter in batch tests. |
 | `GFLOW_CLI_E2E_PROMPT` | *(safe default)* | Prompt override for the smoke test. |
+| `GFLOW_CLI_E2E_STALE_PROFILES` | *(unset)* | Comma-separated profiles whose labs session has **lapsed** (the credits fast path fails with an expired session). Used by the session-renewal e2e (`e2e_auth`): index 0 drives `gflow_get_credits(refresh=true)`, index 1 drives `gflow credits user --refresh`, and index 2 drives `gflow auth renew`. Each is consumed by its first successful renewal, because a renewed labs token lasts about 24 h. A test whose profile is fresh **skips**; it never passes on a read that needed no renewal. `GFLOW_CLI_E2E_PROFILE` must also be set. |
+| `GFLOW_CLI_E2E_ABOUT_PROFILE` | *(unset)* | A profile Flow holds at its public `/about` page (see [KNOWN_ISSUES](../KNOWN_ISSUES.md)). `tests/e2e/test_auth_renew_e2e.py` asserts that `gflow auth renew` does **not** report it renewed. It skips if the profile reads a balance. |
 
 ---
 
@@ -399,6 +401,8 @@ tests/
     ├── conftest.py                       # e2e_profile_dir, e2e_nosession_profile,
     │                                     #   e2e_env (shared fixtures)
     ├── test_auth_verification_e2e.py     # [e2e, e2e_auth]
+    ├── test_auth_renew_e2e.py            # [e2e, e2e_auth] `gflow auth renew` leaf — 0 credits
+    ├── test_credits_refresh_e2e.py       # [e2e, e2e_auth] `--refresh` on CLI + MCP — 0 credits
     ├── test_transports_e2e.py            # [e2e, e2e_{auth,image,batch,video}]
     ├── test_image_batch_e2e.py           # [e2e, e2e_batch]
     ├── test_video_t2v_e2e.py             # [e2e, e2e_video]