gflow-cli 0.86.0__tar.gz → 0.87.0__tar.gz

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/.env.template

@@ -91,17 +91,17 @@
 # Upload generated assets directly to a cloud bucket instead of saving local
 # asset copies. Supported schemes:
 #   gs://   – Google Cloud Storage (requires: pip install 'gflow-cli[gcs]')
-#   s3://   – Amazon S3 or any S3-compatible store, e.g. MinIO
+#   s3://   – Amazon S3 or any S3-compatible store (RustFS, MinIO, ...)
 #             (requires: pip install 'gflow-cli[s3]')
 #
 # Examples:
 #   GFLOW_CLI_STORAGE_URI=gs://my-gcs-bucket/gflow/
 #   GFLOW_CLI_STORAGE_URI=s3://my-s3-bucket/gflow/
-#   GFLOW_CLI_STORAGE_URI=s3://gflow-test/gflow/   # MinIO local dev
+#   GFLOW_CLI_STORAGE_URI=s3://gflow-test/gflow/   # local docker-compose stack (RustFS)
 #
-# For S3 / MinIO you also need the standard AWS SDK env vars:
-#   AWS_ACCESS_KEY_ID=minioadmin
-#   AWS_SECRET_ACCESS_KEY=minioadmin
+# For S3-compatible stores you also need the standard AWS SDK env vars:
+#   AWS_ACCESS_KEY_ID=rustfsadmin
+#   AWS_SECRET_ACCESS_KEY=rustfsadmin
 #   AWS_ENDPOINT_URL=http://localhost:9000   # omit for real AWS
 #   AWS_DEFAULT_REGION=us-east-1
 #

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/.github/workflows/ci.yml

@@ -306,6 +306,40 @@ jobs:
         # routine test consolidation.
         run: uv run python scripts/ci/check_test_count.py pytest-lease.xml 10
 
+  # ── Storage container tests (S3 via RustFS, GCS via fake-gcs-server) ───────
+  # Nothing ran `-m containers` before this job, so the pinned MinIO image was
+  # deleted from Docker Hub and the S3 tests rotted unnoticed. A registry
+  # deletion or a broken backend now turns CI red. The count guard catches the
+  # other silent failure: every fixture `importorskip`s, so a missing dependency
+  # would skip all 12 tests and still exit 0.
+  storage-containers:
+    name: Storage container tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      PYTHONUTF8: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install deps
+        run: uv sync --frozen --group containers
+
+      - name: Container tests
+        run: uv run --no-sync python -m pytest -m containers tests/integration/ -q --junitxml=pytest-containers.xml
+
+      # 9 S3 (incl. the #1003 migrated-clip upload) + 4 GCS. The expander-gateway
+      # tests share the marker but skip without an LLM endpoint; skips do not count.
+      - name: Test-count guard (all storage tests executed, none skipped)
+        run: uv run --no-sync python scripts/ci/check_test_count.py pytest-containers.xml 13
+
   # ── SonarCloud analysis ───────────────────────────────────────────────────
   sonar:
     name: SonarCloud analysis

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/.github/workflows/scorecard.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           sarif_file: results.sarif

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/AGENTS.md

@@ -47,7 +47,7 @@ by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code
 - Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image with `@Character` mentions by name, and a single-segment `video extend`, today — an agent-only composer, #799, takes text-to-image and text-to-video only; `GFLOW_CLI_FLOW_HOST`).
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
 - Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_credits.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `cli_docs.py`, `docs_catalog.py`, `cli_update.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
-- Command surface: `gflow auth` (login/status/renew/list/use/logout — `renew` refreshes saved sessions headlessly, no sign-in), `gflow credits` (user/list — Veo balance; read-only unless `--refresh`, which renews expired sessions first), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
+- Command surface: `gflow auth` (login/status/renew/list/use/logout — `renew` refreshes saved sessions headlessly, no sign-in), `gflow credits` (user/list — Veo balance; read-only unless `--refresh`, which renews expired sessions first; since 2026-10-22 it cannot read a balance on any account, #795), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
 - Works with any Google account that has Flow access. All generations bill against the user's own Google account.
 
 ## Headed-browser dependency (architectural reality)

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/CHANGELOG.md

@@ -7,6 +7,140 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.87.0] — 2026-10-22
+
+### Security
+
+- **Locked `aiohttp` 3.14.5 (CVE-2026-111063, CVE-2026-111064, GHSA-2g87-pp6c-29x5).**
+  Transitive only, via the `gcs` (`gcsfs`) and `s3` (`s3fs`/`aiobotocore`) extras; no gflow
+  code imports it. `yarl` moved to 1.25.1 with it. The advisories landed after the last
+  green CI and turned the `pip-audit` gate red on every open PR.
+- **Pillow 13.0.0 (eight CVEs, CVE-2026-112395 … CVE-2026-112899) and `certifi`
+  2026.10.19 (PYSEC-2026-4320).** Pillow is a direct dependency (it writes the seed frame of
+  `gflow video chain` and reads image dimensions); its floor is now `>=13.0.0`. `certifi` is
+  transitive. Both advisories landed on 2026-10-21 and turned `pip-audit` red on every open PR.
+
+### Added
+
+- **flow.google.com: `image i2i --ref <uuid>` references an earlier image of the same
+  project in place** ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). When the
+  local catalog records the image in the `--project` being generated in (and kept its Flow
+  caption), the ref is marked `in_project` and goes through the existing #913 picker path:
+  no upload, so a t2i → review → i2i pipeline split across invocations no longer needs
+  Flow's upload-terms confirmation. MCP image tasks behave the same (`ref_meta` now carries
+  the catalog's `flow_project_id`). Refs from another project, or without a recorded
+  caption, still exit 36. Behaviour change: a same-project image deleted in Flow since it
+  was catalogued now costs up to ~90 s of grid reloads and exits 32, instead of exiting 36
+  at once.
+
+- `scripts/dev/cleanup.py` — sweeps what a release or takeover session leaves behind:
+  merged worktrees and branches, done `pr-<N>` fetch branches, merged same-repo origin
+  branches (`--remote`), stray `.env` copies, old `bt*` pytest basetemps, and dead agentctl
+  agents (reported only). Dry run unless `--apply`; never touches the main checkout, a dirty
+  worktree, an unmerged branch, `develop` or `main`. The release skill's final report runs it.
+
+- **MCP generation results report the catalogued seed** ([#1013](https://github.com/ffroliva/gflow-cli/issues/1013)).
+  A completed `gflow_generate_image` / `gflow_generate_video` result now carries `seed`:
+  the value catalogued for its `flow_media_id` (`null` when none was recorded) — the MCP
+  twin of `gflow image t2i --json`'s `images[].seed`. On the classic image paths that is
+  the seed Flow chose; the agentic and agent-only arms observe no seed and record `0`;
+  for video it is whatever the CLI recorded from `--seed` (the MCP video tool takes no
+  seed, so over MCP it is `null`), never one read back from Flow. Reported by
+  @Chapax.
+
+### Removed
+
+- **Breaking for MCP callers: `gflow_generate_image` no longer takes `seed`**
+  ([#1013](https://github.com/ffroliva/gflow-cli/issues/1013)). The image request never
+  carried it — Flow picks its own seed — yet the tool advertised it "for reproducibility"
+  and echoed it back in `params.seed`, so a caller could not tell it was dropped. The CLI's
+  `--seed` went from `image t2i` in v0.8.0 for the same reason. The parameter is gone from
+  the tool schema; a call that still passes `seed` is not rejected (the MCP server ignores
+  unknown arguments) and it is no longer echoed back — read the result's `seed` for the
+  value Flow chose (classic image paths). Reported by @Chapax.
+
+### Fixed
+
+- **`gflow auth login --browser chrome` and `auth status` work again now that labs.google's
+  session URL answers HTTP 410 Gone** ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)).
+  Since 2026-10-22 every session check reported "Could not verify the Flow session",
+  and a first login rolled back its `chrome` marker. On a 410 gflow now verifies the
+  session against Google's account page with the profile's own cookies, the check it
+  already used for accounts labs never signed in (#791), and a profile with no Google
+  sign-in is reported as signed out rather than as a network problem. `auth renew` and
+  MCP `gflow_auth_status` use the same check. `gflow credits` still cannot read a balance:
+  it needs the labs token that URL no longer issues (#795). A login with bundled Chromium
+  (`--browser internal`, or `--browser auto` on a machine without Chrome) still cannot
+  finish and waits until its timeout ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)):
+  use `--browser chrome`.
+- **flow.google.com: a run that fails after the submit click no longer invites a second
+  billed generation** ([#1010](https://github.com/ffroliva/gflow-cli/issues/1010)).
+  When Chrome lost the image submit reply's body, gflow silently submitted the image
+  again: one `--count 1` run left two images in the project and reported one. A lost
+  video submit reply, or any timeout after the click, was reported as a retryable exit 9
+  while Flow had already made and billed the clip. A failure after the click now makes no
+  second submit and reports exit 9 with `retryable: false`, a detail that names an
+  unreadable reply as unreadable, and a hint to check the project before re-running.
+  The image call now runs once on the labs.google composer too, since there gflow drives
+  the same browser page: a hiccup before the click is reported instead of retried.
+- On Flow's agent-only composer, an image result's `model_name_type` echoed the requested
+  `--model`, so a `--model nano-pro` run that Flow rendered with Nano Banana 2.1 still
+  reported `GEM_PIX_2`. Nothing on that composer observes which model rendered, so it is
+  now `null`, as on the classic flow.google.com arm since #789. This fixes the attribution
+  half of [#1012](https://github.com/ffroliva/gflow-cli/issues/1012) only: the agent can
+  still render a model other than the requested one; that is not proven fixed (no
+  agent-only profile to test on). Reported by
+  @dev1abz.
+
+- On flow.google.com, `gflow video upscale` (and its MCP twin) no longer reports a working
+  export as failed with `Failed to read a video export response: ... Network.getResponseBody
+  ... No data found`. The export watcher read every `batchexecute` reply during the export
+  and treated any body Chrome had already evicted, usually an unrelated `as29s` poll, as a
+  failed export, while the 1080p file was being delivered. An unreadable reply is now
+  skipped; a real refusal of the export RPC still fails fast, and an export that never
+  arrives still times out. Fixes [#1014](https://github.com/ffroliva/gflow-cli/issues/1014).
+  Diagnosed and measured by @buiminhhieu-svg. Live-verified on flow.google.com: 3 of 3
+  exports passed, against 2 of 2 failing on the previous `develop`.
+- On flow.google.com, a configured cloud `GFLOW_CLI_STORAGE_URI` (`s3://`, `gs://`) was
+  ignored for generated video: both composer arms wrote the clip to local disk while labs
+  uploaded it. Fixes [#1003](https://github.com/ffroliva/gflow-cli/issues/1003). Both hosts now
+  store a clip through the transport's one writer, so it lands at
+  `videos/<YYYY-MM-DD>/<media_id>.mp4` in the bucket on either host, and the result's
+  `local_path` is that cloud URI. The `gflow video` commands and MCP video tasks (through
+  the worker) share this transport path. Images, `video extend` and upscale already
+  honoured the setting on both hosts. A failed store (bad credentials, missing bucket)
+  now exits 6 with the media id and the free `gflow data download <media_id>` recovery,
+  and the catalog marks the billed clip generated, instead of surfacing a raw storage
+  exception. Proven offline and against a RustFS bucket. The paid live run has not been
+  done yet.
+
+- On flow.google.com, `gflow video t2v`/`i2v`/`r2v` without `--out-dir` saved the clip to
+  the root of the working directory instead of the documented `tmp/`, and `gflow video chain`
+  saved its links to the working directory instead of `--out-dir` (or the configured output
+  directory). Both hosts now share one rule — per-call directory, then the client's output
+  directory, then `tmp/` — and the classic and
+  agent-only composers no longer fall back to the working directory. Reported by @ziyedbe.
+  Fixes #986.
+- **On flow.google.com, the 4th `@` reference no longer lands between the 2nd and 3rd.**
+  Before each mention gflow clicked the centre of the prompt box; with three chips on the
+  line that centre is chip 2, so reference 4 was inserted behind it and the prompt read
+  1, 2, 4, 3 (measured 3/3 at 1280×720). gflow now moves the caret to the end of the prompt
+  before every `@` (image references in place, uploaded `--ref` files, and `@Character`
+  mentions alike), and a mention that does not land after the chips already there now
+  fails with exit 32 before anything is submitted, instead of passing silently. Thanks to
+  @Ltwoz for the diagnosis and the fix. Their other symptom — the 4th picker not opening at
+  all, on macOS — did not reproduce here and is not claimed fixed.
+  ([#997](https://github.com/ffroliva/gflow-cli/issues/997))
+- The S3 storage container tests and the `docker-compose.yml` local stack now run
+  **RustFS 1.0.3** (pinned by tag and digest) instead of MinIO. MinIO removed its community
+  images from Docker Hub in Sep 2026, so the old pin no longer pulled and the S3 tests could
+  not start. Nothing ran them, so nobody noticed. A new `Storage container tests` CI job runs
+  `pytest -m containers tests/integration/` (S3 via RustFS, GCS via fake-gcs-server) and
+  fails if fewer than all 12 storage tests execute. The local-stack credentials are now
+  `rustfsadmin`/`rustfsadmin`. Any S3-compatible store, MinIO included, still works as a
+  `GFLOW_CLI_STORAGE_URI` target. See
+  `docs/superpowers/spikes/2026-10-19-minio-replacement.md`.
+
 ## [0.86.0] — 2026-10-18
 
 ### Added
@@ -6134,7 +6268,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.86.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.87.0...HEAD
+[0.87.0]: https://github.com/ffroliva/gflow-cli/compare/v0.86.0...v0.87.0
 [0.86.0]: https://github.com/ffroliva/gflow-cli/compare/v0.85.0...v0.86.0
 [0.85.0]: https://github.com/ffroliva/gflow-cli/compare/v0.84.0...v0.85.0
 [0.84.0]: https://github.com/ffroliva/gflow-cli/compare/v0.83.2...v0.84.0

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/KNOWN_ISSUES.md

@@ -47,7 +47,7 @@ close Chrome yourself. On the measured account, `/about` was gone on the next ru
 
 ### Flow is migrating to `flow.google.com`; generation coverage is partial but includes images
 
-- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, local-file `gflow image i2i`, and a **single-segment** `gflow video extend` (#882: Flow's own Extend control, driven from the clip editor) now run on the migrated host. Image mode supports Nano Banana 2.1 (`nano2`, which replaced Nano Banana 2 there, #958) / 2 Lite / Pro, all five aspect ratios its radiogroup renders (16:9, 4:3, 1:1, 3:4, 9:16 — 3:4 appeared by 2026-09-17, #864), and count 1–4. Image prompts can tag a **character** with `@Name` / `--reference-entity` + `--reference-entity-name` since #723 (attached through the composer's `@` picker; an id without a name exits 36; video is unchanged). That matrix is the **classic** migrated composer's. On an **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gflow drives `image t2i` (all five aspects; count 1–4) and `video t2v` (one 9:16 or 16:9 clip) only — i2i, i2v, r2v and character references are refused there before anything is clicked. Image refs by UUID, video `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, chained extend (`-n > 1`, `--scene`/`--resume-from`, `--seed`, an `--aspect` other than the source clip's), instructions and tools are not ported yet and fail before submit. **`character create` worked on the migrated host until its labs `createEntity` route was retired:** measured 2026-10-14 on a profile served flow.google.com, it exits 7 with "Flow RPCs have been deprecated" (404). `character list` does NOT: it reads the retired labs `projectInitialData` route and exits 7, measured 2026-09-20 both on `auto` and with `GFLOW_CLI_FLOW_HOST=flow.google.com` (#875). Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, multi-segment `extend` (`-n > 1`, `--scene`/`--resume-from`, `--seed`), `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
+- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, local-file `gflow image i2i`, and a **single-segment** `gflow video extend` (#882: Flow's own Extend control, driven from the clip editor) now run on the migrated host. Image mode supports Nano Banana 2.1 (`nano2`, which replaced Nano Banana 2 there, #958) / 2 Lite / Pro, all five aspect ratios its radiogroup renders (16:9, 4:3, 1:1, 3:4, 9:16 — 3:4 appeared by 2026-09-17, #864), and count 1–4. Image prompts can tag a **character** with `@Name` / `--reference-entity` + `--reference-entity-name` since #723 (attached through the composer's `@` picker; an id without a name exits 36; video is unchanged). That matrix is the **classic** migrated composer's. On an **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gflow drives `image t2i` (all five aspects; count 1–4) and `video t2v` (one 9:16 or 16:9 clip) only — i2i, i2v, r2v and character references are refused there before anything is clicked. Image refs by UUID (except one the local catalog records in the same `--project`, referenced in place since #995), video `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, chained extend (`-n > 1`, `--scene`/`--resume-from`, `--seed`, an `--aspect` other than the source clip's), instructions and tools are not ported yet and fail before submit. **`character create` worked on the migrated host until its labs `createEntity` route was retired:** measured 2026-10-14 on a profile served flow.google.com, it exits 7 with "Flow RPCs have been deprecated" (404). `character list` does NOT: it reads the retired labs `projectInitialData` route and exits 7, measured 2026-09-20 both on `auto` and with `GFLOW_CLI_FLOW_HOST=flow.google.com` (#875). Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, multi-segment `extend` (`-n > 1`, `--scene`/`--resume-from`, `--seed`), `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
 - **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
 - **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
 - **`--reference-entity` was refused on `r2v` but not on `t2v`** ([#716](https://github.com/ffroliva/gflow-cli/issues/716), fixed in v0.71.0): the "not ported, exit 36" refusal above sat inside the r2v branch of the routing gate, so a `t2v` request carrying a character entity returned from that gate without its entities ever being inspected — and nothing downstream attaches one on this host. The generation was **submitted and billed** with the entity silently dropped, returning a plausible clip of the wrong person. The check is now mode-independent and ahead of every early return. If you ran `gflow video t2v @Name …` or `--reference-entity` on a moved account before this fix, the identity in those clips was never bound.
@@ -745,12 +745,14 @@ When this happens, the next API call returns 401/403 and `gflow-cli` raises `Aut
 **Workaround, stale session (the common case):**
 ```bash
 gflow auth renew --profile <name>        # or: gflow auth renew --all
-gflow credits list --refresh             # renews only the expired profiles, then reads them
 ```
 
-A profile that has just sat unused has a lapsed labs.google token, not a dead Google session.
-`auth renew` loads Flow and labs.google in a headless browser and waits for labs to sign in
-again on its own, with no prompt. Measured 2026-10-14: 7 of 10 stale profiles recovered.
+A profile that has just sat unused usually has rotated-out cookies, not a dead Google session.
+`auth renew` loads Flow in a headless browser, which rotates them with no prompt, then verifies
+the result like `auth status`. Its labs.google step (measured 2026-10-14: 7 of 10 stale profiles
+recovered a credits token) is a no-op since 2026-10-22, when labs' session URL started answering
+HTTP 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so `credits --refresh`
+cannot bring a balance back either ([#795](https://github.com/ffroliva/gflow-cli/issues/795)).
 
 **Workaround, revoked session:**
 ```bash
@@ -869,9 +871,14 @@ A block that survives dismissal now aborts pre-submit with exit 23 (probe `overl
 
 ---
 
-### No in-CLI quota visibility — resolved on labs, still open on the migrated host
+### No in-CLI quota visibility — open on every account since 2026-10-22
 
-- **Status:** Resolved 2026-09-05 for `labs.google` accounts · **Open** on accounts Google has migrated to `flow.google.com` · **Tracked:** [#795](https://github.com/ffroliva/gflow-cli/issues/795)
+- **Status:** **Open** on every account since 2026-10-22 (resolved 2026-09-05 for `labs.google` accounts, until labs' session URL went) · **Tracked:** [#795](https://github.com/ffroliva/gflow-cli/issues/795)
+
+**Since 2026-10-22 no account can read a balance.** labs.google's session URL, which minted
+the token below, answers HTTP 410 Gone for everyone
+([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so every account now fails the
+first way listed below. The rest of this section is the history of how it got there.
 
 Use `gflow credits user` for the selected profile or `gflow credits list` for all saved
 profiles. Both commands query Flow's current read-only credits endpoint with the saved browser
@@ -1505,7 +1512,7 @@ here, because the run gives up within 30 s (see [CONFIGURATION](docs/CONFIGURATI
 
 ### Auth verification depends on Google's NextAuth session endpoint
 
-- **Status:** Mitigated · **Severity:** Low (degrades fail-closed) · **Affects:** issue #15 fix onward · **Tracked:** issue #15
+- **Status:** Mitigated for real-Chrome profiles; **open** for `gflow credits` and for logins with `--browser internal` · **Severity:** Medium since 2026-10-22 · **Affects:** issue #15 fix onward · **Tracked:** issue #15, [#1023](https://github.com/ffroliva/gflow-cli/issues/1023), [#795](https://github.com/ffroliva/gflow-cli/issues/795)
 
 `gflow auth login` verifies a real Flow sign-in by calling
 `https://labs.google/fx/api/auth/session` (see `src/gflow_cli/auth/verification.py`)
@@ -1518,6 +1525,17 @@ success. The expected authenticated response shape is pinned by the
 change surfaces there as a failing test. Start any investigation of a sudden
 `gflow auth login` verification failure at that fixture and `verification.py`.
 
+**Since 2026-10-22 that endpoint answers HTTP 410 Gone** for every account, with or
+without cookies ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023),
+[spike](docs/superpowers/spikes/2026-10-22-labs-session-oracle-gone.md)). A 410 is now
+read as "no labs session": a profile without Google cookies is `NO_SESSION`, and one with
+them is checked by the server-attested migrated-host probe (#791), which needs the Google
+SSO and flow.google.com session cookies, then reads `myaccount.google.com`. **Still open:**
+the access-token consumers that read the same URL are not ported, so `gflow credits`
+cannot read a balance on any account (#795). And a login with `--browser internal` (bundled
+Chromium, also what `--browser auto` picks when Chrome is missing) cannot finish: it has no
+on-disk check to hand the verdict to, so it waits until its timeout. Use `--browser chrome`.
+
 Since PR #168 the production entry point is `verify_flow_profile`, which reads
 the session cookie **directly from Chrome's SQLite store** via `browser_cookie3`
 (a no-browser fast path) and only falls back to launching Playwright when that

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.86.0
+Version: 0.87.0
 Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
@@ -67,7 +67,7 @@ Requires-Dist: tenacity>=8.2
 Requires-Dist: uvicorn[standard]>=0.34.0
 Provides-Extra: chain
 Requires-Dist: av>=12; extra == 'chain'
-Requires-Dist: pillow>=12.3.0; extra == 'chain'
+Requires-Dist: pillow>=13.0.0; extra == 'chain'
 Provides-Extra: dev
 Requires-Dist: av>=12; extra == 'dev'
 Requires-Dist: numpy>=1.24; extra == 'dev'
@@ -75,7 +75,7 @@ Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest-xdist>=3.6; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.17.0; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'
@@ -127,7 +127,7 @@ You have a Google account with Flow access, you have Veo credits, and you run re
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
-- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs. A stale session renews headlessly with `gflow auth renew` (or `gflow credits user|list --refresh`).
+- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs. A stale session renews headlessly with `gflow auth renew`.
 
 Same Veo and Imagen models, same quality, same billing against your own Google account, now programmatic.
 
@@ -142,8 +142,9 @@ uv tool run --from gflow-cli playwright install chromium     # one-time, ~150 MB
 # 2 · Authenticate (one-time, opens a real Chrome window)
 gflow auth login --browser chrome
 
-# Check the current balance (or use `credits list` for every saved profile)
-gflow credits user
+# Check the session (no browser, no credits)
+gflow auth status
+# `gflow credits user` cannot read a balance at the moment (#795)
 
 # 3 · Generate
 gflow image t2i "a hot air balloon over Tokyo at sunrise"
@@ -243,7 +244,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
-**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. An image `--ref <uuid>` is referenced in place when the catalog records it in the same `--project` ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). Other UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
 
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/README.md

@@ -39,7 +39,7 @@ You have a Google account with Flow access, you have Veo credits, and you run re
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
-- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs. A stale session renews headlessly with `gflow auth renew` (or `gflow credits user|list --refresh`).
+- **Terminal-native.** After one `gflow auth login`, you stay in the shell. No clicking through dialogs. A stale session renews headlessly with `gflow auth renew`.
 
 Same Veo and Imagen models, same quality, same billing against your own Google account, now programmatic.
 
@@ -54,8 +54,9 @@ uv tool run --from gflow-cli playwright install chromium     # one-time, ~150 MB
 # 2 · Authenticate (one-time, opens a real Chrome window)
 gflow auth login --browser chrome
 
-# Check the current balance (or use `credits list` for every saved profile)
-gflow credits user
+# Check the session (no browser, no credits)
+gflow auth status
+# `gflow credits user` cannot read a balance at the moment (#795)
 
 # 3 · Generate
 gflow image t2i "a hot air balloon over Tokyo at sunrise"
@@ -155,7 +156,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
-**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. An image `--ref <uuid>` is referenced in place when the catalog records it in the same `--project` ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). Other UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
 
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/docker/Dockerfile

@@ -45,7 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Deliberately NOT pinned: google-chrome-stable. Chrome's apt repo keeps only the current
 # build, so a pinned version stops resolving within weeks. The trade-off is that this
 # layer caches indefinitely and a rebuild is what picks up a newer Chrome.
-ARG GFLOW_VERSION=0.86.0
+ARG GFLOW_VERSION=0.87.0
 RUN pip install --no-cache-dir "gflow-cli==${GFLOW_VERSION}"
 
 VOLUME ["/data"]

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/docker-compose.yml

@@ -3,26 +3,27 @@
 # Start:  docker compose up -d
 # Stop:   docker compose down
 #
-# S3 credentials/bucket:  minioadmin / minioadmin  →  bucket "gflow-test"
+# S3 credentials/bucket:  rustfsadmin / rustfsadmin  →  bucket "gflow-test"
 # GCS emulator:           set STORAGE_EMULATOR_HOST=http://localhost:4443
 
 services:
-  # S3-compatible local storage — for testing the [s3] extra without real AWS.
+  # S3-compatible local storage (RustFS) — for testing the [s3] extra without real AWS.
+  # Replaces MinIO, whose community images were removed from Docker Hub in Sep 2026.
   # Endpoint: http://localhost:9000
   # Console:  http://localhost:9001
-  minio:
-    image: minio/minio:RELEASE.2024-06-13T22-53-53Z
-    command: server /data --console-address ":9001"
+  rustfs:
+    image: rustfs/rustfs:1.0.3@sha256:9ca9559533b537d10482fe923288b676ad08f92a7069d9a17327fbae3cab688b
     ports:
       - "9000:9000"
       - "9001:9001"
     environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
+      RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-rustfsadmin}
+      RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-rustfsadmin}
+      RUSTFS_CONSOLE_ENABLE: "true"
     volumes:
-      - minio_data:/data
+      - rustfs_data:/data
     healthcheck:
-      test: ["CMD-SHELL", "mc ready local || exit 1"]
+      test: ["CMD-SHELL", "curl -fs http://localhost:9000/health || exit 1"]
       interval: 5s
       timeout: 5s
       retries: 5
@@ -43,5 +44,5 @@ services:
       retries: 5
 
 volumes:
-  minio_data:
+  rustfs_data:
   fake_gcs_data:

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/docs/AUTHENTICATION.md

@@ -146,6 +146,12 @@ gflow auth login --profile work    # named profile (creates if missing)
 gflow auth login --browser chrome  # force the chrome strategy (real Chrome + its profile marker)
 ```
 
+> **Use `--browser chrome` for now.** Since 2026-10-22 labs.google's session URL answers HTTP
+> 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)). A real-Chrome login is
+> verified against Google's account page instead; a bundled-Chromium login (`--browser
+> internal`, or `auto` on a machine without Chrome) has no such check yet, so it waits until
+> its timeout ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)).
+
 Re-running this command refreshes an expired session: it reuses the existing profile dir,
 so you typically just have to click "Continue as <you>" on the Google account chooser.
 
@@ -270,8 +276,11 @@ weeks therefore drifts towards an expired session even though nothing about the
 `auth renew` opens the profile in a hidden browser and loads Flow. It then loads
 `labs.google/fx/` and waits up to 20 s for the labs app to sign in again on its own: a stale labs
 session reports `ACCESS_TOKEN_REFRESH_NEEDED`, and the page renews it through Google without a
-prompt. This step matters because `gflow credits` reads its token from that labs session, and the
-Flow visit alone never refreshes it. The browser saves whatever cookies were rotated, and the
+prompt. This step mattered because `gflow credits` read its token from that labs session; since
+2026-10-22 labs' session URL answers HTTP 410 for every account
+([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so the step finds nothing to
+renew and `gflow credits` cannot read a balance ([#795](https://github.com/ffroliva/gflow-cli/issues/795)).
+The browser saves whatever cookies were rotated, and the
 result is verified exactly like `gflow auth status`. It spends no credits.
 
 ```bash
@@ -449,16 +458,17 @@ Run: gflow auth login --profile default
 Two cases look the same at that point and are fixed differently:
 
 - **Stale, not revoked.** This is the common one: the profile has simply not been opened for a
-  while. Google's cookies are still good, but labs' NextAuth token has lapsed
-  (`ACCESS_TOKEN_REFRESH_NEEDED`), and labs only renews it when a browser visits. Run
-  [`gflow auth renew`](#gflow-auth-renew), or add `--refresh` to `gflow credits user|list`. It
-  renews the session headlessly with no sign-in.
+  while. Google's cookies are still good but have not been rotated, and only a browser visit
+  rotates them. Run [`gflow auth renew`](#gflow-auth-renew). It renews the session headlessly
+  with no sign-in. (Until 2026-10-22 this case was labs' lapsed NextAuth token, and
+  `gflow credits --refresh` renewed it; labs' session URL is gone now, see #1023.)
 - **Revoked.** A password change, a removed device, or Google asking to "Confirm it's you" cannot
   be renewed from cookies. `auth renew` reports "could not be renewed" (or names Flow's public
   `/about` page). Re-running `gflow auth login` refreshes the cookies in place, and no other state
   is lost.
 
-> **Renewal signs in headlessly.** The labs re-sign-in runs Google's OAuth hop in a headless
+> **Renewal signs in headlessly** (until 2026-10-22; labs' session URL now answers 410, so
+> this step finds nothing to renew). The labs re-sign-in runs Google's OAuth hop in a headless
 > browser, which identifies itself as `HeadlessChrome` (only `navigator.webdriver` is hidden).
 > Generation runs headed by default, so this is the one Google sign-in gflow does headless.
 > It worked on 7 of 7 recoverable profiles on 2026-10-14. If Google ever starts challenging it,

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/docs/CONFIGURATION.md

@@ -103,14 +103,14 @@ Examples:
 # Choose one:
 export GFLOW_CLI_STORAGE_URI=gs://my-gcs-bucket/gflow/
 export GFLOW_CLI_STORAGE_URI=s3://my-s3-bucket/gflow/
-export GFLOW_CLI_STORAGE_URI=s3://gflow-test/dev/   # MinIO local dev
+export GFLOW_CLI_STORAGE_URI=s3://gflow-test/dev/   # local docker-compose stack (RustFS)
 ```
 
-S3 and MinIO use the standard AWS SDK environment variables:
+S3 and S3-compatible stores use the standard AWS SDK environment variables:
 
 ```bash
-export AWS_ACCESS_KEY_ID=minioadmin
-export AWS_SECRET_ACCESS_KEY=minioadmin
+export AWS_ACCESS_KEY_ID=rustfsadmin
+export AWS_SECRET_ACCESS_KEY=rustfsadmin
 export AWS_ENDPOINT_URL=http://localhost:9000   # omit for real AWS
 export AWS_DEFAULT_REGION=us-east-1
 ```
@@ -431,7 +431,7 @@ Measurement script: `scripts/dev/spike_offscreen_window.py`.
 - `flow.google.com` — force the migrated composer for everything, including what it cannot serve yet (those requests then exit 36/11 instead of falling back).
 - `labs.google` — never use the migrated composer; where Flow serves `flow.google.com`, requests fail with exit 36 (kill switch).
 **Default:** `auto`
-**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2.1 (`nano2`, #958) / 2 Lite / Pro, all five aspect ratios (16:9, 4:3, 1:1, 3:4, 9:16 — `3:4` was added to that host's radiogroup by 2026-09-17, #864) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Image prompts may tag a character with `@Name` (or `--reference-entity` paired with `--reference-entity-name`; an id alone exits 36), attached through the composer's `@` picker (#723). `video extend` is ported for a single segment from a clip (one PROMPT; `-n` > 1, `--scene`/`--resume-from`, `--seed` and an `--aspect` other than the source's exit 36, and `-o` saves the new extension clip only, #882). Frames given by UUID/`@Name`, media references by UUID/`@Name`, character entities on video, Agent instructions, Imagen 4, scenes, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
+**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2.1 (`nano2`, #958) / 2 Lite / Pro, all five aspect ratios (16:9, 4:3, 1:1, 3:4, 9:16 — `3:4` was added to that host's radiogroup by 2026-09-17, #864) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Image prompts may tag a character with `@Name` (or `--reference-entity` paired with `--reference-entity-name`; an id alone exits 36), attached through the composer's `@` picker (#723). `video extend` is ported for a single segment from a clip (one PROMPT; `-n` > 1, `--scene`/`--resume-from`, `--seed` and an `--aspect` other than the source's exit 36, and `-o` saves the new extension clip only, #882). Frames given by UUID/`@Name`, media references by UUID/`@Name` (except an image `--ref <uuid>` the catalog records in the same `--project`, #995), character entities on video, Agent instructions, Imagen 4, scenes, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
 
 ### `GFLOW_CLI_AGENT_CONFIRM`
 

{gflow_cli-0.86.0/website → gflow_cli-0.87.0}/docs/DEBUGGING.md

@@ -258,7 +258,7 @@ First visible-and-clickable wins. Log:
 | `AuthBrowserRejectedError` | 14 | Google's sign-in rejected the browser for advertising automation; only the `internal` strategy surfaces it | Re-run `gflow auth login` (default `auto` picks the `chrome` strategy, which retries on a no-automation path) |
 | `AuthLoginTimeoutError` | 12 | User did not finish the OAuth flow in time | Run `gflow auth login` again; raise `GFLOW_CLI_AUTH_LOGIN_TIMEOUT` |
 | `IdentityRecheckPendingError` | 12 | Login ended while Flow was still sending the account to `/about` because Google wants it to "Confirm it's you" (#902) | Run `gflow auth login` again, press the page's main button, and finish Google's check until the Flow app loads |
-| `TransportTimeoutError` | 9 | A single API call exceeded its timeout | Retry; check Flow status |
+| `TransportTimeoutError` | 9 | A single API call exceeded its timeout | Retry; check Flow status. When `retryable` is `false` the submit was already clicked (#1010): check the project in Flow before re-running |
 | `WafRejectionError` | 10 | reCAPTCHA / WAF blocked the request (`PUBLIC_ERROR_UNUSUAL_ACTIVITY`) | Stop on that profile — each rejected request can raise its score. Wait hours or switch profile; see [ACCOUNT_SAFETY § When Google does push back](ACCOUNT_SAFETY.md#when-google-does-push-back) |
 
 For health probes from a worker process, use

{gflow_cli-0.86.0 → gflow_cli-0.87.0}/docs/E2E_TESTING.md

@@ -601,6 +601,13 @@ but on the migrated t2v and i2v tests an unset value sends **no** duration, so t
 keeps the length it currently holds. Cohorts whose settings pane shows no duration row for the default model
 refuse a forced length with a $0 exit 11 (#650, #948).
 
+`tests/e2e/test_video_t2v_e2e.py::test_t2v_on_flow_google_com_uploads_to_the_configured_storage_uri`
+(`e2e_video`, 1 clip, `GFLOW_CLI_E2E_RUN_VIDEO=1`) also needs
+`GFLOW_CLI_E2E_STORAGE_URI`. Point it at a bucket you control, for example
+`s3://gflow-test/gflow/` on the local RustFS stack with `AWS_ENDPOINT_URL`,
+`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` exported. The test checks that a
+flow.google.com clip lands in that bucket (#1003).
+
 ## See also
 
 - [CONTRIBUTING.md § Test categories](../CONTRIBUTING.md#test-categories)