gflow-cli 0.87.0__tar.gz → 0.88.0__tar.gz

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.87.0",
+  "version": "0.88.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/.env.template

@@ -116,11 +116,8 @@
 # Runtime tuning
 # -----------------------------------------------------------------------------
 
-# Per-request HTTP timeout (seconds). Veo videos can take 60-180s each.
-# GFLOW_CLI_TIMEOUT_SECONDS=600
-
-# Logging level — DEBUG | INFO | WARNING | ERROR
-# GFLOW_CLI_LOG_LEVEL=INFO
+# Logging level — DEBUG | INFO | WARNING | ERROR (default WARNING; INFO shows progress events)
+# GFLOW_CLI_LOG_LEVEL=WARNING
 
 # Log format — auto | text | json
 #   auto = text on TTY, json when piped (default)
@@ -173,6 +170,14 @@
 # `gflow auth login --profile <name>` rather than making this window visible.
 # GFLOW_CLI_BROWSER_WINDOW_POSITION=-30000,-30000
 
+# Proxy for every browser gflow launches (generation, auth login/renew/status), #1036.
+# Opt-in; unset, the browser connects as before (on Windows, via the system proxy).
+# Accepts http://host:port, https://host:port or socks5://host:port. No user:pass@:
+# Flow does not load through proxy credentials, so let a local client (Clash, v2ray)
+# hold them. gflow's own HTTP calls follow HTTPS_PROXY instead, never this: point both
+# at the same proxy, and sign in through it. Validated at startup (exit 11).
+# GFLOW_CLI_BROWSER_PROXY=http://127.0.0.1:7897
+
 # Browser automation engine — playwright (default) | patchright
 # patchright is an OPT-IN, drop-in patched Playwright (Chromium) that avoids the
 # Runtime.enable CDP leak for stronger reCAPTCHA-Enterprise evasion on the HEADED

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/AGENTS.md

@@ -47,7 +47,7 @@ by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code
 - Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image with `@Character` mentions by name, and a single-segment `video extend`, today — an agent-only composer, #799, takes text-to-image and text-to-video only; `GFLOW_CLI_FLOW_HOST`).
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
 - Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_credits.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `cli_docs.py`, `docs_catalog.py`, `cli_update.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
-- Command surface: `gflow auth` (login/status/renew/list/use/logout — `renew` refreshes saved sessions headlessly, no sign-in), `gflow credits` (user/list — Veo balance; read-only unless `--refresh`, which renews expired sessions first; since 2026-10-22 it cannot read a balance on any account, #795), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
+- Command surface: `gflow auth` (login/status/renew/list/use/logout — `renew` refreshes saved sessions headlessly, no sign-in), `gflow credits` (user/list — Veo balance; read from flow.google.com's own balance reply in the profile's browser, #795; read-only unless `--refresh`, which renews signed-out sessions first), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
 - Works with any Google account that has Flow access. All generations bill against the user's own Google account.
 
 ## Headed-browser dependency (architectural reality)
@@ -102,7 +102,7 @@ the five other mirror axes), which no command here can check and no CI gate can
 - Documentation is a first-class deliverable. Every behavior, workflow, config, or operator-facing change must update the relevant docs or state why no docs changed in the PR/checklist. `scripts/ci/check_doc_links.py` is a merge gate.
 - **A PR is not done until its SonarCloud gate is green (zero new issues).** The nine gates above are local/pre-commit; SonarCloud is server-side and runs in CI (`sonar.qualitygate.wait=true` → a red gate turns the `SonarCloud analysis` check red). Before calling a PR merge-ready, verify it with `/gflow:sonar <N>` (it is skipped on fork PRs — maintainer-checked there).
 - **E2E is the decisive layer, and it is required for every behavior change that touches a Flow surface.** Run the `tests/e2e/` test that covers the change, or write one — offline-green proves only that *our* code does what we think, never that Flow still behaves as captured. `/gflow:live-verify` does **not** satisfy this: it drives CLI commands by hand into a gitignored note and never runs `pytest -m e2e`. The two are complementary — an e2e test is a re-runnable regression, a live-verify ledger is a narrative record. A change touching no Flow surface at all (docs, help text, exit-code plumbing) is out of scope — say so explicitly rather than leaving it blank. Anything else follows the **Iron Law** above: run it, or name the external blocker that stops you. "A maintainer will run it" is a handoff, not a verification, and is only available once the blocker is named.
-- E2E tests require `GFLOW_CLI_E2E_PROFILE` and `-m e2e` (excluded from the default `addopts`, so they never run by accident). Cost sub-markers: `e2e_auth` (zero credits, browser only), `e2e_image` (zero credits, daily cap), `e2e_scene`, `e2e_data`, `e2e_batch`, `e2e_character` (opt in with `GFLOW_CLI_E2E_RUN_CHARACTER=1`), the migrated refusal e2e (`e2e_image`, opt in with `GFLOW_CLI_E2E_RUN_REFUSAL=1` — it sends one corrupted reCAPTCHA token, so run it on a probe profile), `e2e_video` (spends Veo credits — opt in with `GFLOW_CLI_E2E_RUN_VIDEO=1`). Redact account identifiers and any token or cookie value before pasting output into a PR.
+- E2E tests require `GFLOW_CLI_E2E_PROFILE` and `-m e2e` (excluded from the default `addopts`, so they never run by accident). Cost sub-markers: `e2e_auth` (zero credits, browser only), `e2e_image` (zero credits, daily cap), `e2e_scene`, `e2e_data`, `e2e_batch`, `e2e_character` (opt in with `GFLOW_CLI_E2E_RUN_CHARACTER=1`), the migrated refusal e2e (`e2e_image`, opt in with `GFLOW_CLI_E2E_RUN_REFUSAL=1` — it sends one corrupted reCAPTCHA token, so run it on a probe profile), the slow-link project create (`e2e_auth`, opt in with `GFLOW_CLI_E2E_RUN_SLOW_LINK=1` — each test leaves an empty project), `e2e_video` (spends Veo credits — opt in with `GFLOW_CLI_E2E_RUN_VIDEO=1`). Redact account identifiers and any token or cookie value before pasting output into a PR.
 - Live tests (`@pytest.mark.live`) opt in via `GFLOW_LIVE=1`.
 
 ## Code style

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/CHANGELOG.md

@@ -7,6 +7,143 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.88.0] — 2026-10-22
+
+### Added
+
+- **`GFLOW_CLI_BROWSER_PROXY` routes the browser through a proxy**
+  ([#1036](https://github.com/ffroliva/gflow-cli/issues/1036), reported by @error-Sench).
+  On a network where Google is reachable only through a local proxy (Clash on
+  `127.0.0.1:7897`, say), gflow's HTTP calls followed `HTTPS_PROXY` but the browser it
+  launches did not, so every page step timed out. The new setting takes
+  `http://`, `https://` or `socks5://host:port` and applies to every browser launch:
+  generation over the CLI and MCP, `auth login`, `auth renew` and the `auth status`
+  check. Opt-in: unset changes nothing, and it is never derived from `HTTPS_PROXY`. A bad
+  value fails at startup (exit 11), and so do proxy credentials (`user:pass@`): measured,
+  Flow never loads through Playwright's proxy authentication, so a local client such as
+  Clash should hold them. A dead proxy stops a generation run at its first page load with
+  a hint naming the setting (exit 11). `gflow doctor` reports the proxy, and credentials
+  inside any URL are now redacted from error details.
+  `docs/ACCOUNT_SAFETY.md` now says: no IP rotation, no proxy unless you set one, and sign
+  in through the proxy you generate through.
+
+### Fixed
+
+- **A project create on a slow link no longer fails while Flow makes the project, and
+  never invites the retry that duplicates it**
+  ([#1037](https://github.com/ffroliva/gflow-cli/issues/1037)). On flow.google.com a create
+  whose reply took over 30 s (measured: 40 s through a slow proxy) ended as exit 9
+  `TransportTimeoutError`, flagged retryable, while Flow went on to create the project, so
+  a retry made a second one. The create and rename replies now wait up to 120 s. Selector
+  waits stay at 30 s, so a moved frontend still fails fast. If the reply is still late or
+  lost, gflow takes the id from Flow's navigation to the new project and checks it. If it
+  cannot prove the outcome, it now ends with exit 7 (`RpcResponseUnavailableError`,
+  `retryable: false` in `--json` and on the MCP queue) and tells you to look for the
+  project and pass `--project <id>`, instead of a retryable timeout. A rename whose reply
+  is lost is settled by reading the saved title back. Builds on #992's lost-body recovery.
+
+- **Commands no longer print about ten info log lines before their result, and
+  `GFLOW_CLI_LOG_LEVEL` works** ([#1041](https://github.com/ffroliva/gflow-cli/issues/1041)).
+  Every command logged at `INFO` to stderr regardless of `GFLOW_CLI_LOG_LEVEL`, which was
+  documented but read by nothing. The default is now `WARNING`, so a command prints its
+  result plus warnings and errors. `GFLOW_CLI_LOG_LEVEL=INFO` restores the old output, and
+  `-v` still shows everything. A long-running `gflow mcp run` / `gflow serve` now also logs
+  only warnings by default (uvicorn's own startup and access lines under `serve` are
+  separate); set `INFO` there to keep progress events. `gflow data sync` now echoes its
+  per-project progress itself unless INFO text logs already narrate it. `--json` stdout is
+  unchanged (it was already only the result).
+- **A generated image whose download fails is no longer lost**
+  ([#1035](https://github.com/ffroliva/gflow-cli/issues/1035), reported by @error-Sench).
+  Flow generated the image and spent the quota, then a failed local write (for example an
+  `--out` directory gflow cannot write to) left only a FAILED row with no project and no
+  asset, and the media id went with the traceback. `image t2i`, `image i2i`, `image batch`,
+  `gflow run` and the MCP `gflow_generate_image` tool now keep the media id in the catalog,
+  with no local copy, under one FAILED operation in its project. `image t2i` and `image i2i`
+  also print the media id(s) and the project URL on stderr; `image batch` and `gflow run`
+  only log them (the row is marked failed in their summary). The MCP failed reply carries
+  `flow_media_id` and `flow_project_id`. Exit codes are unchanged (a write refused by the OS
+  is still exit 1). A download interrupted with Ctrl-C leaves the operation STARTED, which
+  `gflow doctor` reports as stuck after 24 h. `gflow data download` stays video-only, so the
+  image is recovered from the Flow project.
+
+- **`gflow auth login --browser internal` no longer waits until its timeout**
+  ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)). With labs.google's session
+  URL answering 410 (#1023), a bundled-Chromium login (`--browser internal`, or
+  `--browser auto` on a machine without Chrome) never saw a signed-in session and waited
+  until its timeout. It now ends the wait once the flow.google.com session cookies appear,
+  then verifies the saved profile with the same server-attested check `--browser chrome`
+  and `auth status` use, so a sign-in that did not complete says why instead of timing
+  out. Generation still needs a `--browser chrome` profile. Verified live on Windows
+  (2026-10-22: a fresh bundled-Chromium sign-in finished on its own and `auth status`
+  reported the session verified). Not measured on macOS, where the saved-cookie read is
+  expected to fail; the login then ends with "re-run with `--browser chrome`".
+- **flow.google.com: a write whose reply Chrome lost is read back, not called a failure**
+  ([#1009](https://github.com/ffroliva/gflow-cli/issues/1009), PR
+  [#992](https://github.com/ffroliva/gflow-cli/pull/992) by @L1meSn0w). Chrome sometimes
+  cannot hand over a reply body (`Network.getResponseBody: No data found`, 2 of 45 real
+  uploads in our spike) although Flow saved the write. A local upload was reported as a
+  rejected file, and a project create or rename as a timeout. gflow now opens the project
+  in a second tab and checks it: the new project's id from the page it navigated to, the
+  saved title, or exactly one tile with the run's unique file name and a media id. Nothing
+  is submitted twice. If that check cannot prove the outcome, the command exits 7 with
+  `RpcResponseUnavailableError`, which is not retryable. Renaming a project to the title it
+  already has no longer waits for a reply Flow never sends.
+
+### Changed
+
+- **A lost upload reply now exits 7 (`RpcResponseUnavailableError`) instead of 27**
+  ([#1009](https://github.com/ffroliva/gflow-cli/issues/1009)). Exit 27 still means Flow
+  answered and refused the file. Exit 7 here means the outcome is unknown: the upload may
+  have saved, so check the project before re-running. Scripts that branch on 27 for a lost
+  upload should branch on 7.
+
+### Removed
+
+- **`GFLOW_CLI_TIMEOUT_SECONDS`** ([#1037](https://github.com/ffroliva/gflow-cli/issues/1037)).
+  It was documented as a per-request HTTP timeout and elsewhere as a chain link ceiling, but
+  nothing read it. An `.env` file or environment that still sets it keeps loading; the
+  value is ignored, as it always was.
+
+## [0.87.1] — 2026-10-22
+
+### Security
+
+- **Locked `opentelemetry-api` 1.45.1 (CVE-2026-114603).** Transitive only, via `fastapi`
+  and `mcp`; no gflow code imports it. The advisory turned the `pip-audit` gate red on every
+  open PR.
+
+### Fixed
+
+- **`gflow credits` reads a balance again** ([#795](https://github.com/ffroliva/gflow-cli/issues/795)).
+  Since 2026-10-22 it failed on every account, because its token came from labs.google's session
+  URL, which now answers HTTP 410. `credits user`, `credits list` and the MCP tool
+  `gflow_get_credits` now open flow.google.com in the profile's browser and read the balance from
+  the app's own `nzlxg` reply. That is the number in Flow's account menu: it matched in 5/5 reads,
+  one of them after a 10-credit spend. It costs one browser launch per profile, nothing is
+  clicked or spent, and a profile in use by another gflow process reports `ProfileLockedError`.
+  The JSON keys are unchanged, but `sku`, `service_tier`, `user_paygate_tier` and
+  `subscription_credits` are now always `null`, because flow.google.com does not report them.
+  A sign-in landing is exit 3 (`--refresh` renews it). An app that never fetches the balance is
+  exit 31 (`FlowAppError`), never an auth error. Measured on two accounts, neither on a paid plan; a paid plan may shape
+  the reply differently.
+
+- **A video run into an existing `--project` no longer rewrites that project's title in
+  the local catalog** ([#1022](https://github.com/ffroliva/gflow-cli/issues/1022)).
+  `video t2v`/`i2v`/`r2v`/`extend` replaced the stored title with their `gflow-cli video`
+  placeholder, so `gflow data list projects` showed that for a project titled `my-project`
+  in Flow, and every run (images included) overwrote a project's `gflow-cli` source. Only
+  `gflow project create` and `rename` change a stored title now, and an empty title is no
+  longer kept as a real one. CLI and MCP share the fix. A title already overwritten is not
+  recoverable locally: run `gflow project rename <id> <title>` to restore it. Reported, with
+  the fix, by @error-Sench.
+- **2K image upscale on flow.google.com no longer fails when Chrome loses Flow's reply**
+  ([#1027](https://github.com/ffroliva/gflow-cli/issues/1027)). `gflow image upscale` and
+  the MCP upscale tool failed with `WireFormatError: Failed to parse SPrCad response ...
+  No data found for resource with given identifier` although Flow had upscaled the image.
+  Chrome dropped DevTools' copy of that reply on 6 of 12 measured upscales. The image is
+  now also taken from the file Flow's page builds for its own download, which held the same
+  bytes on 12 of 12. A refusal Flow does send still fails the run.
+
 ## [0.87.0] — 2026-10-22
 
 ### Security
@@ -6268,7 +6405,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.87.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.88.0...HEAD
+[0.88.0]: https://github.com/ffroliva/gflow-cli/compare/v0.87.1...v0.88.0
+[0.87.1]: https://github.com/ffroliva/gflow-cli/compare/v0.87.0...v0.87.1
 [0.87.0]: https://github.com/ffroliva/gflow-cli/compare/v0.86.0...v0.87.0
 [0.86.0]: https://github.com/ffroliva/gflow-cli/compare/v0.85.0...v0.86.0
 [0.85.0]: https://github.com/ffroliva/gflow-cli/compare/v0.84.0...v0.85.0

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/KNOWN_ISSUES.md

@@ -130,7 +130,7 @@ is a per-account setting the labs.google app applies on every load (measured
 once the account is flagged, re-running will not land the old frontend. Earlier text here said the rollout
 "flaps" and told you to retry; that observation straddled the account's one-time
 switch and is withdrawn. The REST surface (`gflow project list`, `gflow data …`)
-is unaffected; `gflow credits` is **not** — its token comes from `labs.google`, which mints none for a moved account ([#795](https://github.com/ffroliva/gflow-cli/issues/795), open; see the quota entry below). Automated callers now receive `retryable: false` so retry loops
+is unaffected, and so is `gflow credits` since [#795](https://github.com/ffroliva/gflow-cli/issues/795): it reads the balance from flow.google.com, not from a `labs.google` token (see the quota entry below). Automated callers now receive `retryable: false` so retry loops
 stop instead of burning a doomed attempt each time.
 
 **What gflow does today for the rest of the matrix:** recognises the migrated
@@ -751,8 +751,9 @@ A profile that has just sat unused usually has rotated-out cookies, not a dead G
 `auth renew` loads Flow in a headless browser, which rotates them with no prompt, then verifies
 the result like `auth status`. Its labs.google step (measured 2026-10-14: 7 of 10 stale profiles
 recovered a credits token) is a no-op since 2026-10-22, when labs' session URL started answering
-HTTP 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so `credits --refresh`
-cannot bring a balance back either ([#795](https://github.com/ffroliva/gflow-cli/issues/795)).
+HTTP 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)). `credits --refresh` no
+longer depends on it: since [#795](https://github.com/ffroliva/gflow-cli/issues/795) the balance
+is read from flow.google.com, so a renewal that gets the profile back into Flow brings it back.
 
 **Workaround, revoked session:**
 ```bash
@@ -842,6 +843,18 @@ The contrasting message, **`no upload request ever left the page`**, means somet
 
 **What is known.** A healthy upload window issues **4** POSTs; a failing one issued **24** — the full project-load rpcid inventory, firing ~2.6 s after the request went out, which is just before the ~2.8 s successful uploads take to answer. That has the shape of the page re-initialising underneath the in-flight upload, but no navigation event was captured, so the cause is unconfirmed. Measured 2026-09-08, 1 failure in 4 runs on one funded account — enough for "intermittent", not enough for a rate.
 
+### Chrome loses a reply body although Flow saved the write (migrated host)
+
+- **Status:** Mitigated · **Severity:** Medium (intermittent; the write usually saved) · **Affects:** the migrated `flow.google.com` host, local uploads (`--initial-frame`, `--ref`, `i2i` files), project create and rename · **Tracked:** [#1009](https://github.com/ffroliva/gflow-cli/issues/1009)
+
+Distinct from #719 above, where no reply arrives at all. Here the reply arrives, but Chrome cannot hand its body over: `Network.getResponseBody: No data found for resource with given identifier`. Our spike saw it on 2 of 45 real `maseQ` uploads, and a fresh reload found both uploads saved ([spike](docs/superpowers/spikes/2026-10-20-migrated-upload-reply-body-eviction.md)). Before the fix, gflow reported the upload as a refused file (exit 27).
+
+A project create or rename whose reply is late, not lost, takes the same path: on a slow link a 40 s create used to end as a retryable exit 9 while Flow made the project, so a retry made a second one ([#1037](https://github.com/ffroliva/gflow-cli/issues/1037)). The reply wait is now 120 s, and past it gflow reads the new project's id from Flow's navigation to it.
+
+**Mitigation:** gflow now opens the project in a second tab and reads the outcome back: the new project's id, the saved title, or exactly one tile with the run's unique file name and a media id. Nothing is submitted twice. The readback can take up to about two minutes on a slow page.
+
+**If it cannot confirm the outcome**, the command exits **7** with `RpcResponseUnavailableError` (`retryable: false`). The write may have saved. Open the project on flow.google.com and look for the title or the file name in the error before you re-run, or you may get a duplicate project or upload. `gflow run` does not re-upload a reference file after this error in the same run.
+
 ### Flow's release-notes ("What's new") changelog popup blocks first-run UI automation
 
 - **Status:** Mitigated · **Severity:** Medium · **Tracked:** [#26](https://github.com/ffroliva/gflow-cli/issues/26)
@@ -871,25 +884,33 @@ A block that survives dismissal now aborts pre-submit with exit 23 (probe `overl
 
 ---
 
-### No in-CLI quota visibility — open on every account since 2026-10-22
+### No in-CLI quota visibility — resolved (balance read from flow.google.com)
+
+- **Status:** **Resolved** in v0.87.1 ([#795](https://github.com/ffroliva/gflow-cli/issues/795)); open on every account from 2026-10-22 until then
 
-- **Status:** **Open** on every account since 2026-10-22 (resolved 2026-09-05 for `labs.google` accounts, until labs' session URL went) · **Tracked:** [#795](https://github.com/ffroliva/gflow-cli/issues/795)
+**Fixed.** `gflow credits` now opens flow.google.com in the profile's browser and reads the
+balance from the app's own `nzlxg` reply, the number Flow's account menu shows (measured 5/5,
+including after a spend:
+[spike](docs/superpowers/spikes/2026-10-22-credits-balance-on-nzlxg.md)). It no longer needs a
+labs.google token. It costs one browser launch per profile, and the tier fields (`sku`,
+`service_tier`, `user_paygate_tier`, `subscription_credits`) are always `null`, because
+flow.google.com does not report them. It was verified on two accounts, neither on a paid plan; a paid plan may put a different
+balance in the field gflow reads, which would show a wrong number without an error. A page that never sends the reply fails with exit 31
+(`FlowAppError`), never an auth error. The rest of this section is the history.
 
-**Since 2026-10-22 no account can read a balance.** labs.google's session URL, which minted
-the token below, answers HTTP 410 Gone for everyone
-([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so every account now fails the
-first way listed below. The rest of this section is the history of how it got there.
+From 2026-10-22, labs.google's session URL, which minted the token below, answered HTTP 410
+Gone for everyone ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so every
+account failed the first way listed below until this fix.
 
 Use `gflow credits user` for the selected profile or `gflow credits list` for all saved
-profiles. Both commands query Flow's current read-only credits endpoint with the saved browser
-session; `--json` provides a stable automation contract. The equivalent MCP surface is
+profiles; `--json` provides a stable automation contract. The equivalent MCP surface is
 `gflow_get_credits`. The reported balance funds Veo video generation; image generation consumes
 separate per-model daily quotas.
 
-**On accounts served from `flow.google.com` there is still no in-CLI quota visibility.** The
-credits endpoint is reached with a token minted by `labs.google`, and the move takes that
-away in **two stages**, so `gflow credits user` / `list` and `gflow_get_credits` fail in one
-of two ways:
+**History: before the fix, accounts served from `flow.google.com` had no in-CLI quota
+visibility.** The credits endpoint was reached with a token minted by `labs.google`, and the
+move took that away in **two stages**, so `gflow credits user` / `list` and
+`gflow_get_credits` failed in one of two ways:
 
 - labs answers `200` with no `access_token` — it never mints one → *"the labs.google session
   returned no access token"*.
@@ -910,8 +931,8 @@ hint. Fixed in v0.79.0 ([#803](https://github.com/ffroliva/gflow-cli/issues/803)
 three remaining raise sites now states what was actually rejected, the 401 site names the route
 that refused, and the class default no longer asserts a SAPISID failure at all.
 
-Reading a balance on the migrated host is **not** implemented
-([#795](https://github.com/ffroliva/gflow-cli/issues/795), open). Generation is unaffected.
+Reading a balance on the migrated host is implemented since the #795 fix, from flow.google.com's
+own `nzlxg` reply (see the top of this entry).
 
 ---
 
@@ -1512,7 +1533,7 @@ here, because the run gives up within 30 s (see [CONFIGURATION](docs/CONFIGURATI
 
 ### Auth verification depends on Google's NextAuth session endpoint
 
-- **Status:** Mitigated for real-Chrome profiles; **open** for `gflow credits` and for logins with `--browser internal` · **Severity:** Medium since 2026-10-22 · **Affects:** issue #15 fix onward · **Tracked:** issue #15, [#1023](https://github.com/ffroliva/gflow-cli/issues/1023), [#795](https://github.com/ffroliva/gflow-cli/issues/795)
+- **Status:** Mitigated for real-Chrome profiles and for `gflow credits` (#795); `--browser internal` logins fixed and live-verified on Windows (#1026) · **Severity:** Medium since 2026-10-22 · **Affects:** issue #15 fix onward · **Tracked:** issue #15, [#1023](https://github.com/ffroliva/gflow-cli/issues/1023), [#795](https://github.com/ffroliva/gflow-cli/issues/795)
 
 `gflow auth login` verifies a real Flow sign-in by calling
 `https://labs.google/fx/api/auth/session` (see `src/gflow_cli/auth/verification.py`)
@@ -1531,10 +1552,13 @@ without cookies ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023),
 read as "no labs session": a profile without Google cookies is `NO_SESSION`, and one with
 them is checked by the server-attested migrated-host probe (#791), which needs the Google
 SSO and flow.google.com session cookies, then reads `myaccount.google.com`. **Still open:**
-the access-token consumers that read the same URL are not ported, so `gflow credits`
-cannot read a balance on any account (#795). And a login with `--browser internal` (bundled
-Chromium, also what `--browser auto` picks when Chrome is missing) cannot finish: it has no
-on-disk check to hand the verdict to, so it waits until its timeout. Use `--browser chrome`.
+some access-token consumers that read the same URL are not ported. `gflow credits` is
+(#795: it reads flow.google.com's own balance reply). A login with `--browser internal` (bundled
+Chromium, also what `--browser auto` picks when Chrome is missing) runs the same on-disk
+check after the window closes ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026));
+before that fix it waited until its timeout. A fresh bundled-Chromium sign-in passed that check
+on Windows (2026-10-22). On macOS the cookie read is expected to fail and is not measured, so
+use `--browser chrome` there.
 
 Since PR #168 the production entry point is `verify_flow_profile`, which reads
 the session cookie **directly from Chrome's SQLite store** via `browser_cookie3`

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.87.0
+Version: 0.88.0
 Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
@@ -140,11 +140,12 @@ uv tool run --from gflow-cli playwright install chromium     # one-time, ~150 MB
 # later: `gflow update` upgrades in place (every command shows a banner when a newer release is out)
 
 # 2 · Authenticate (one-time, opens a real Chrome window)
+# Behind a proxy (e.g. Clash)? Set GFLOW_CLI_BROWSER_PROXY=http://127.0.0.1:7897 first (docs/CONFIGURATION.md)
 gflow auth login --browser chrome
 
-# Check the session (no browser, no credits)
+# Check the session (spends nothing)
 gflow auth status
-# `gflow credits user` cannot read a balance at the moment (#795)
+gflow credits user          # Veo credit balance (opens Flow in the browser; spends nothing)
 
 # 3 · Generate
 gflow image t2i "a hot air balloon over Tokyo at sunrise"

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/PLAN.md

@@ -115,7 +115,7 @@ src/gflow_cli/
 
 Documented in [docs/CONFIGURATION.md](docs/CONFIGURATION.md) and [.env.template](.env.template). Variables:
 
-`GFLOW_CLI_HOME`, `GFLOW_CLI_OUTPUT_DIR`, `GFLOW_CLI_PROFILE`, `GFLOW_CLI_PROVIDER`, `GFLOW_CLI_LLM_BASE_URL`, `GFLOW_CLI_LLM_API_KEY`, `GFLOW_CLI_LLM_MODEL`, `GFLOW_CLI_TIMEOUT_SECONDS`, `GFLOW_CLI_LOG_LEVEL`, `GFLOW_CLI_LOG_FORMAT`, `GFLOW_CLI_CONCURRENCY`, `GFLOW_CLI_DB_PATH`, `GFLOW_CLI_HISTORY_PROMPTS`.
+`GFLOW_CLI_HOME`, `GFLOW_CLI_OUTPUT_DIR`, `GFLOW_CLI_PROFILE`, `GFLOW_CLI_PROVIDER`, `GFLOW_CLI_LLM_BASE_URL`, `GFLOW_CLI_LLM_API_KEY`, `GFLOW_CLI_LLM_MODEL`, `GFLOW_CLI_LOG_LEVEL`, `GFLOW_CLI_LOG_FORMAT`, `GFLOW_CLI_CONCURRENCY`, `GFLOW_CLI_DB_PATH`, `GFLOW_CLI_HISTORY_PROMPTS`.
 
 Default paths via `platformdirs`:
 

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/README.md

@@ -52,11 +52,12 @@ uv tool run --from gflow-cli playwright install chromium     # one-time, ~150 MB
 # later: `gflow update` upgrades in place (every command shows a banner when a newer release is out)
 
 # 2 · Authenticate (one-time, opens a real Chrome window)
+# Behind a proxy (e.g. Clash)? Set GFLOW_CLI_BROWSER_PROXY=http://127.0.0.1:7897 first (docs/CONFIGURATION.md)
 gflow auth login --browser chrome
 
-# Check the session (no browser, no credits)
+# Check the session (spends nothing)
 gflow auth status
-# `gflow credits user` cannot read a balance at the moment (#795)
+gflow credits user          # Veo credit balance (opens Flow in the browser; spends nothing)
 
 # 3 · Generate
 gflow image t2i "a hot air balloon over Tokyo at sunrise"

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/docker/Dockerfile

@@ -45,7 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Deliberately NOT pinned: google-chrome-stable. Chrome's apt repo keeps only the current
 # build, so a pinned version stops resolving within weeks. The trade-off is that this
 # layer caches indefinitely and a rebuild is what picks up a newer Chrome.
-ARG GFLOW_VERSION=0.87.0
+ARG GFLOW_VERSION=0.88.0
 RUN pip install --no-cache-dir "gflow-cli==${GFLOW_VERSION}"
 
 VOLUME ["/data"]

{gflow_cli-0.87.0/website → gflow_cli-0.88.0}/docs/ACCOUNT_SAFETY.md

@@ -73,7 +73,14 @@ auto-retry, because retrying only inflates per-profile heat.**
 
 ## What it deliberately does not do
 
-- **No proxy or IP rotation.** Your requests come from your connection.
+- **No IP rotation, and no proxy unless you set one.** By default your requests come from
+  your connection. [`GFLOW_CLI_BROWSER_PROXY`](CONFIGURATION.md#gflow_cli_browser_proxy)
+  routes the browser through **one** proxy you choose, for networks where Google is
+  reachable only that way. Google watches where a session comes from, so: sign in, renew
+  and generate through the **same** proxy; point `HTTPS_PROXY` at the same exit, so
+  gflow's own HTTP calls do not leave from a second IP; and remember that a shared or
+  commercial proxy IP carries other people's reputation, which can trigger "Confirm it's
+  you" checks or reCAPTCHA refusals on your account.
 - **No fingerprint spoofing**, beyond the opt-in patched engine below. No canvas
   noise, no UA lying, no timezone games.
 - **No headless "unlock".** The patchright option is explicitly *not* one.

{gflow_cli-0.87.0 → gflow_cli-0.88.0}/docs/AUTHENTICATION.md

@@ -146,11 +146,13 @@ gflow auth login --profile work    # named profile (creates if missing)
 gflow auth login --browser chrome  # force the chrome strategy (real Chrome + its profile marker)
 ```
 
-> **Use `--browser chrome` for now.** Since 2026-10-22 labs.google's session URL answers HTTP
-> 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)). A real-Chrome login is
-> verified against Google's account page instead; a bundled-Chromium login (`--browser
-> internal`, or `auto` on a machine without Chrome) has no such check yet, so it waits until
-> its timeout ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)).
+> **Prefer `--browser chrome`.** Since 2026-10-22 labs.google's session URL answers HTTP
+> 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so every login is
+> verified against Google's account page with the profile's saved cookies. A
+> bundled-Chromium login (`--browser internal`, or `auto` on a machine without Chrome) runs
+> that check too ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)). It is verified
+> on Windows; on macOS it is expected to fail (not measured), and generation needs a
+> chrome-strategy profile.
 
 Re-running this command refreshes an expired session: it reuses the existing profile dir,
 so you typically just have to click "Continue as <you>" on the Google account chooser.
@@ -247,6 +249,12 @@ launched as a plain process with no automation flags and no debugging port, wher
 the window once the Flow editor has loaded and `gflow` extracts the verified session from the
 profile. There is no flag and no prompt for this — the fallback simply happens.
 
+**Behind a proxy.** Set [`GFLOW_CLI_BROWSER_PROXY`](CONFIGURATION.md#gflow_cli_browser_proxy)
+before `gflow auth login`, so you sign in from the same IP you will generate from. Both
+login paths use it, including the Passive Capture fallback (as Chrome's
+`--proxy-server` switch). Use a proxy without credentials, such as a local Clash on
+`http://127.0.0.1:7897`.
+
 **Privacy guard:** The `chrome` strategy strictly refuses to use any profile directory
 outside `GFLOW_CLI_HOME`. This protects your primary system Chrome profile from
 accidental interference or data corruption.
@@ -279,7 +287,8 @@ session reports `ACCESS_TOKEN_REFRESH_NEEDED`, and the page renews it through Go
 prompt. This step mattered because `gflow credits` read its token from that labs session; since
 2026-10-22 labs' session URL answers HTTP 410 for every account
 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so the step finds nothing to
-renew and `gflow credits` cannot read a balance ([#795](https://github.com/ffroliva/gflow-cli/issues/795)).
+renew. `gflow credits` no longer needs it: it reads the balance from flow.google.com
+([#795](https://github.com/ffroliva/gflow-cli/issues/795)).
 The browser saves whatever cookies were rotated, and the
 result is verified exactly like `gflow auth status`. It spends no credits.
 

{gflow_cli-0.87.0/website → gflow_cli-0.88.0}/docs/CONFIGURATION.md

@@ -250,12 +250,6 @@ Both generate tools are gated, not just video: image generation is only *empiric
 GFLOW_CLI_AUTH_LOGIN_TIMEOUT=120 gflow auth login   # abort after 2 minutes
 ```
 
-### `GFLOW_CLI_TIMEOUT_SECONDS`
-
-**What:** Per-request HTTP timeout. Veo videos can take 60–180 s each.
-**Default:** `600`
-**Note:** This is a single-request ceiling; the *batch* timeout you experience is sum of all per-clip waits.
-
 ### `GFLOW_CLI_JITTER_RANGE`
 
 **What:** Anti-bot pause between prompt submissions in multi-prompt image runs (`gflow image batch`, `gflow image t2i --prompts-file` / `--stdin` / multiple positional prompts, and `gflow run` image batches). Spaces out the *submission clicks* only — generations still run in parallel inside Flow.
@@ -267,16 +261,19 @@ GFLOW_CLI_AUTH_LOGIN_TIMEOUT=120 gflow auth login   # abort after 2 minutes
 
 ### `GFLOW_CLI_LOG_LEVEL`
 
-**What:** Logging verbosity.
+**What:** Logging verbosity. Logs go to stderr; stdout carries only the command's output.
 **Values:** `DEBUG` | `INFO` | `WARNING` | `ERROR`
-**Default:** `INFO`
+**Default:** `WARNING` — a command prints its result plus any warnings and errors. Set `INFO`
+to see progress events (engine, cookies, locale, page setup), for example on a long-running
+`gflow mcp run` / `gflow serve`.
 **CLI override:** `-v` / `--verbose` flag flips to `DEBUG`.
+Until the #1041 fix this setting was ignored and every command logged at `INFO` ([#1041](https://github.com/ffroliva/gflow-cli/issues/1041)).
 
 ### `GFLOW_CLI_LOG_FORMAT`
 
 **What:** Output format for log lines.
 **Values:**
-- `auto` (default) — text on TTY, JSON when stdout is piped/redirected
+- `auto` (default) — text when stderr is a terminal, JSON when stderr is piped/redirected
 - `text` — always pretty (Rich-styled, colours)
 - `json` — always machine-readable (one JSON object per line)
 
@@ -399,6 +396,49 @@ Measurement script: `scripts/dev/spike_offscreen_window.py`.
 
 **Malformed values** (`100`, `1,2,3`, `a,b`) fail at startup with a validation error.
 
+### `GFLOW_CLI_BROWSER_PROXY`
+
+**What:** A proxy for every browser gflow launches: generation (CLI and MCP),
+`gflow auth login`, `auth renew` and the session check behind `auth status`
+([#1036](https://github.com/ffroliva/gflow-cli/issues/1036)).
+**Values:** `http://host:port` | `https://host:port` | `socks5://host:port`; the port is
+required, and credentials (`user:pass@`) are refused, see below
+**Default:** unset. The browser then connects as it always has: on Windows that means
+through the system proxy (Settings → Network → Proxy), if one is on.
+
+Use it when Google is reachable only through a proxy, for example a local Clash or
+v2ray client on `http://127.0.0.1:7897` with its *System Proxy* switch off.
+
+**Two proxies, one exit.** gflow's own HTTP calls (httpx, the LLM client) follow
+`HTTPS_PROXY`; the browser follows this setting and ignores `HTTPS_PROXY` (Chromium reads
+proxy env vars only on Linux). gflow never copies one into the other. Point both at the
+same proxy so Google sees one IP per session, and sign in through it. See
+[ACCOUNT_SAFETY](ACCOUNT_SAFETY.md#what-it-deliberately-does-not-do).
+
+| Situation | What happens |
+|---|---|
+| unset | no change from earlier versions |
+| set | every browser launch routes through it; `gflow doctor` shows it |
+| credentials (`user:pass@`), a missing host or port, a path or an unknown scheme | refused at startup, exit 11, naming the setting and never repeating the value |
+| the proxy is down or refuses the tunnel | a generation run stops at its first page load, exit 11, with a hint naming this setting. `auth status` and `auth renew` report an unverified session instead (the usual "check your connection" wording), so check the proxy first |
+
+**Why no credentials.** Through a proxy that asks for a password, the Flow page never
+finishes loading: measured 2026-10-22 on Playwright 1.61 with bundled Chromium and
+Chrome alike, the labs → flow.google.com navigation timed out at 45 s, while the same
+proxy without a password loaded it in about a second (and plain sites loaded either way).
+Run your proxy client locally and let it hold the upstream credentials; that is how
+Clash and v2ray work by default. `tests/e2e/test_browser_proxy_e2e.py` re-measures this,
+so the restriction can be lifted once Playwright handles it.
+
+**Long-running servers** (`gflow mcp run`, `gflow serve`) read it once at start; restart
+them after changing it. For MCP, set it in `$GFLOW_CLI_HOME/.env` or the client's `env`
+block, since a client does not load a `.env` from your shell's directory
+([MCP setup](MCP.md#4-setup-instructions)).
+
+**Not supported:** a bypass list (Chromium already sends loopback addresses direct),
+per-command `--proxy` flags (the setting covers one-off runs:
+`GFLOW_CLI_BROWSER_PROXY=... gflow ...`), and the opt-in experimental transports.
+
 ### `GFLOW_CLI_BROWSER_ENGINE`
 
 **What:** Selects the browser-automation engine backing the Playwright API.
@@ -534,10 +574,9 @@ For images, `--out DIR` writes flat as `<DIR>/<media_name>_<n>.png` — file pat
 `gflow video chain` (last-frame I2V chaining — see
 [USAGE § gflow video chain](USAGE.md#gflow-video-chain)) is configured entirely
 by command-line flags; it adds **no new environment variables**. It reuses
-`GFLOW_CLI_OUTPUT_DIR` (default output root), `GFLOW_CLI_PROFILE`,
-`GFLOW_CLI_DB_PATH` (chain links are recorded for `--resume-from`), and
-`GFLOW_CLI_TIMEOUT_SECONDS` (per-link generation ceiling — the chain waits for
-each link in turn, so total wallclock is the sum of all link waits).
+`GFLOW_CLI_OUTPUT_DIR` (default output root), `GFLOW_CLI_PROFILE`
+and `GFLOW_CLI_DB_PATH` (chain links are recorded for `--resume-from`). The chain
+waits for each link in turn, so total wallclock is the sum of all link waits.
 
 | Flag | Default | Notes |
 |---|---|---|
@@ -601,12 +640,10 @@ gflow image t2i "product photo on a white sweep"
 
 See [EXTERNAL_STORAGE.md](EXTERNAL_STORAGE.md) for MinIO and GCS examples.
 
-### "I'm running in CI — I want JSON logs and a strict timeout"
+### "I'm running in CI — I want JSON logs"
 
 ```bash
-GFLOW_CLI_LOG_FORMAT=json \
-GFLOW_CLI_TIMEOUT_SECONDS=300 \
-gflow image batch ./manifest.tsv
+GFLOW_CLI_LOG_FORMAT=json gflow image batch ./manifest.tsv
 ```
 
 ### "I want to test against the official Veo SDK"
@@ -631,10 +668,10 @@ gflow image t2i "test idea" --profile experiments
 
 | Symptom | Likely cause | Fix |
 |---|---|---|
-| `ValidationError: GFLOW_CLI_TIMEOUT_SECONDS must be a positive integer` | Bad `.env` value | Set to a number ≥ 1 |
 | `FileNotFoundError: $GFLOW_CLI_HOME/profile_default not found` | First run, no auth yet | `gflow auth login` |
 | `AuthExpiredError` | Cookies expired or revoked | `gflow auth login --profile <name>` |
 | A run stops on an account chooser, consent or verification screen (`FlowAccountChooserError`, exit 38) | Google wants a person to answer that screen | `gflow auth login --profile <name>` and clear it there; the login window is always visible. Making the generation window visible does not help: the run gives up within 30 s. See [`GFLOW_CLI_BROWSER_WINDOW_POSITION`](#gflow_cli_browser_window_position) |
+| Every browser step times out, while `curl` and `HTTPS_PROXY` work | Google is reachable only through a proxy, and the browser ignores `HTTPS_PROXY` | Set [`GFLOW_CLI_BROWSER_PROXY`](#gflow_cli_browser_proxy) to the same proxy, then `gflow auth renew` |
 | `ProfileAccessError` (exit code 11) | Chrome cannot write the profile directory (Windows access denied) | Grant write access to the whole profile directory, or use a writable profile. See [Profile-directory permissions](#profile-directory-permissions-at-browser-launch) |
 | Output files don't appear where I expect | Flag > env > .env > default — check actual resolved path | `gflow image t2i ... --verbose` shows the resolved output path |
 | `ProfileLockedError` (exit code 11) | Two concurrent calls against the same profile — the cross-process `ProfileLease` fails fast (never waits) on same-profile contention, whether the second holder is another `gflow` process, the `gflow serve` daemon, or an MCP call | Wait for the first call to finish, or use `--profile other` — different profiles run fully in parallel, each with its own lease |