gflow-cli 0.87.1__tar.gz → 0.88.0__tar.gz

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.87.1",
+  "version": "0.88.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/.env.template

@@ -116,11 +116,8 @@
 # Runtime tuning
 # -----------------------------------------------------------------------------
 
-# Per-request HTTP timeout (seconds). Veo videos can take 60-180s each.
-# GFLOW_CLI_TIMEOUT_SECONDS=600
-
-# Logging level — DEBUG | INFO | WARNING | ERROR
-# GFLOW_CLI_LOG_LEVEL=INFO
+# Logging level — DEBUG | INFO | WARNING | ERROR (default WARNING; INFO shows progress events)
+# GFLOW_CLI_LOG_LEVEL=WARNING
 
 # Log format — auto | text | json
 #   auto = text on TTY, json when piped (default)
@@ -173,6 +170,14 @@
 # `gflow auth login --profile <name>` rather than making this window visible.
 # GFLOW_CLI_BROWSER_WINDOW_POSITION=-30000,-30000
 
+# Proxy for every browser gflow launches (generation, auth login/renew/status), #1036.
+# Opt-in; unset, the browser connects as before (on Windows, via the system proxy).
+# Accepts http://host:port, https://host:port or socks5://host:port. No user:pass@:
+# Flow does not load through proxy credentials, so let a local client (Clash, v2ray)
+# hold them. gflow's own HTTP calls follow HTTPS_PROXY instead, never this: point both
+# at the same proxy, and sign in through it. Validated at startup (exit 11).
+# GFLOW_CLI_BROWSER_PROXY=http://127.0.0.1:7897
+
 # Browser automation engine — playwright (default) | patchright
 # patchright is an OPT-IN, drop-in patched Playwright (Chromium) that avoids the
 # Runtime.enable CDP leak for stronger reCAPTCHA-Enterprise evasion on the HEADED

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/AGENTS.md

@@ -102,7 +102,7 @@ the five other mirror axes), which no command here can check and no CI gate can
 - Documentation is a first-class deliverable. Every behavior, workflow, config, or operator-facing change must update the relevant docs or state why no docs changed in the PR/checklist. `scripts/ci/check_doc_links.py` is a merge gate.
 - **A PR is not done until its SonarCloud gate is green (zero new issues).** The nine gates above are local/pre-commit; SonarCloud is server-side and runs in CI (`sonar.qualitygate.wait=true` → a red gate turns the `SonarCloud analysis` check red). Before calling a PR merge-ready, verify it with `/gflow:sonar <N>` (it is skipped on fork PRs — maintainer-checked there).
 - **E2E is the decisive layer, and it is required for every behavior change that touches a Flow surface.** Run the `tests/e2e/` test that covers the change, or write one — offline-green proves only that *our* code does what we think, never that Flow still behaves as captured. `/gflow:live-verify` does **not** satisfy this: it drives CLI commands by hand into a gitignored note and never runs `pytest -m e2e`. The two are complementary — an e2e test is a re-runnable regression, a live-verify ledger is a narrative record. A change touching no Flow surface at all (docs, help text, exit-code plumbing) is out of scope — say so explicitly rather than leaving it blank. Anything else follows the **Iron Law** above: run it, or name the external blocker that stops you. "A maintainer will run it" is a handoff, not a verification, and is only available once the blocker is named.
-- E2E tests require `GFLOW_CLI_E2E_PROFILE` and `-m e2e` (excluded from the default `addopts`, so they never run by accident). Cost sub-markers: `e2e_auth` (zero credits, browser only), `e2e_image` (zero credits, daily cap), `e2e_scene`, `e2e_data`, `e2e_batch`, `e2e_character` (opt in with `GFLOW_CLI_E2E_RUN_CHARACTER=1`), the migrated refusal e2e (`e2e_image`, opt in with `GFLOW_CLI_E2E_RUN_REFUSAL=1` — it sends one corrupted reCAPTCHA token, so run it on a probe profile), `e2e_video` (spends Veo credits — opt in with `GFLOW_CLI_E2E_RUN_VIDEO=1`). Redact account identifiers and any token or cookie value before pasting output into a PR.
+- E2E tests require `GFLOW_CLI_E2E_PROFILE` and `-m e2e` (excluded from the default `addopts`, so they never run by accident). Cost sub-markers: `e2e_auth` (zero credits, browser only), `e2e_image` (zero credits, daily cap), `e2e_scene`, `e2e_data`, `e2e_batch`, `e2e_character` (opt in with `GFLOW_CLI_E2E_RUN_CHARACTER=1`), the migrated refusal e2e (`e2e_image`, opt in with `GFLOW_CLI_E2E_RUN_REFUSAL=1` — it sends one corrupted reCAPTCHA token, so run it on a probe profile), the slow-link project create (`e2e_auth`, opt in with `GFLOW_CLI_E2E_RUN_SLOW_LINK=1` — each test leaves an empty project), `e2e_video` (spends Veo credits — opt in with `GFLOW_CLI_E2E_RUN_VIDEO=1`). Redact account identifiers and any token or cookie value before pasting output into a PR.
 - Live tests (`@pytest.mark.live`) opt in via `GFLOW_LIVE=1`.
 
 ## Code style

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/CHANGELOG.md

@@ -7,6 +7,103 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.88.0] — 2026-10-22
+
+### Added
+
+- **`GFLOW_CLI_BROWSER_PROXY` routes the browser through a proxy**
+  ([#1036](https://github.com/ffroliva/gflow-cli/issues/1036), reported by @error-Sench).
+  On a network where Google is reachable only through a local proxy (Clash on
+  `127.0.0.1:7897`, say), gflow's HTTP calls followed `HTTPS_PROXY` but the browser it
+  launches did not, so every page step timed out. The new setting takes
+  `http://`, `https://` or `socks5://host:port` and applies to every browser launch:
+  generation over the CLI and MCP, `auth login`, `auth renew` and the `auth status`
+  check. Opt-in: unset changes nothing, and it is never derived from `HTTPS_PROXY`. A bad
+  value fails at startup (exit 11), and so do proxy credentials (`user:pass@`): measured,
+  Flow never loads through Playwright's proxy authentication, so a local client such as
+  Clash should hold them. A dead proxy stops a generation run at its first page load with
+  a hint naming the setting (exit 11). `gflow doctor` reports the proxy, and credentials
+  inside any URL are now redacted from error details.
+  `docs/ACCOUNT_SAFETY.md` now says: no IP rotation, no proxy unless you set one, and sign
+  in through the proxy you generate through.
+
+### Fixed
+
+- **A project create on a slow link no longer fails while Flow makes the project, and
+  never invites the retry that duplicates it**
+  ([#1037](https://github.com/ffroliva/gflow-cli/issues/1037)). On flow.google.com a create
+  whose reply took over 30 s (measured: 40 s through a slow proxy) ended as exit 9
+  `TransportTimeoutError`, flagged retryable, while Flow went on to create the project, so
+  a retry made a second one. The create and rename replies now wait up to 120 s. Selector
+  waits stay at 30 s, so a moved frontend still fails fast. If the reply is still late or
+  lost, gflow takes the id from Flow's navigation to the new project and checks it. If it
+  cannot prove the outcome, it now ends with exit 7 (`RpcResponseUnavailableError`,
+  `retryable: false` in `--json` and on the MCP queue) and tells you to look for the
+  project and pass `--project <id>`, instead of a retryable timeout. A rename whose reply
+  is lost is settled by reading the saved title back. Builds on #992's lost-body recovery.
+
+- **Commands no longer print about ten info log lines before their result, and
+  `GFLOW_CLI_LOG_LEVEL` works** ([#1041](https://github.com/ffroliva/gflow-cli/issues/1041)).
+  Every command logged at `INFO` to stderr regardless of `GFLOW_CLI_LOG_LEVEL`, which was
+  documented but read by nothing. The default is now `WARNING`, so a command prints its
+  result plus warnings and errors. `GFLOW_CLI_LOG_LEVEL=INFO` restores the old output, and
+  `-v` still shows everything. A long-running `gflow mcp run` / `gflow serve` now also logs
+  only warnings by default (uvicorn's own startup and access lines under `serve` are
+  separate); set `INFO` there to keep progress events. `gflow data sync` now echoes its
+  per-project progress itself unless INFO text logs already narrate it. `--json` stdout is
+  unchanged (it was already only the result).
+- **A generated image whose download fails is no longer lost**
+  ([#1035](https://github.com/ffroliva/gflow-cli/issues/1035), reported by @error-Sench).
+  Flow generated the image and spent the quota, then a failed local write (for example an
+  `--out` directory gflow cannot write to) left only a FAILED row with no project and no
+  asset, and the media id went with the traceback. `image t2i`, `image i2i`, `image batch`,
+  `gflow run` and the MCP `gflow_generate_image` tool now keep the media id in the catalog,
+  with no local copy, under one FAILED operation in its project. `image t2i` and `image i2i`
+  also print the media id(s) and the project URL on stderr; `image batch` and `gflow run`
+  only log them (the row is marked failed in their summary). The MCP failed reply carries
+  `flow_media_id` and `flow_project_id`. Exit codes are unchanged (a write refused by the OS
+  is still exit 1). A download interrupted with Ctrl-C leaves the operation STARTED, which
+  `gflow doctor` reports as stuck after 24 h. `gflow data download` stays video-only, so the
+  image is recovered from the Flow project.
+
+- **`gflow auth login --browser internal` no longer waits until its timeout**
+  ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)). With labs.google's session
+  URL answering 410 (#1023), a bundled-Chromium login (`--browser internal`, or
+  `--browser auto` on a machine without Chrome) never saw a signed-in session and waited
+  until its timeout. It now ends the wait once the flow.google.com session cookies appear,
+  then verifies the saved profile with the same server-attested check `--browser chrome`
+  and `auth status` use, so a sign-in that did not complete says why instead of timing
+  out. Generation still needs a `--browser chrome` profile. Verified live on Windows
+  (2026-10-22: a fresh bundled-Chromium sign-in finished on its own and `auth status`
+  reported the session verified). Not measured on macOS, where the saved-cookie read is
+  expected to fail; the login then ends with "re-run with `--browser chrome`".
+- **flow.google.com: a write whose reply Chrome lost is read back, not called a failure**
+  ([#1009](https://github.com/ffroliva/gflow-cli/issues/1009), PR
+  [#992](https://github.com/ffroliva/gflow-cli/pull/992) by @L1meSn0w). Chrome sometimes
+  cannot hand over a reply body (`Network.getResponseBody: No data found`, 2 of 45 real
+  uploads in our spike) although Flow saved the write. A local upload was reported as a
+  rejected file, and a project create or rename as a timeout. gflow now opens the project
+  in a second tab and checks it: the new project's id from the page it navigated to, the
+  saved title, or exactly one tile with the run's unique file name and a media id. Nothing
+  is submitted twice. If that check cannot prove the outcome, the command exits 7 with
+  `RpcResponseUnavailableError`, which is not retryable. Renaming a project to the title it
+  already has no longer waits for a reply Flow never sends.
+
+### Changed
+
+- **A lost upload reply now exits 7 (`RpcResponseUnavailableError`) instead of 27**
+  ([#1009](https://github.com/ffroliva/gflow-cli/issues/1009)). Exit 27 still means Flow
+  answered and refused the file. Exit 7 here means the outcome is unknown: the upload may
+  have saved, so check the project before re-running. Scripts that branch on 27 for a lost
+  upload should branch on 7.
+
+### Removed
+
+- **`GFLOW_CLI_TIMEOUT_SECONDS`** ([#1037](https://github.com/ffroliva/gflow-cli/issues/1037)).
+  It was documented as a per-request HTTP timeout and elsewhere as a chain link ceiling, but
+  nothing read it. An `.env` file or environment that still sets it keeps loading; the
+  value is ignored, as it always was.
+
 ## [0.87.1] — 2026-10-22
 
 ### Security
@@ -6308,7 +6405,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.87.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.88.0...HEAD
+[0.88.0]: https://github.com/ffroliva/gflow-cli/compare/v0.87.1...v0.88.0
 [0.87.1]: https://github.com/ffroliva/gflow-cli/compare/v0.87.0...v0.87.1
 [0.87.0]: https://github.com/ffroliva/gflow-cli/compare/v0.86.0...v0.87.0
 [0.86.0]: https://github.com/ffroliva/gflow-cli/compare/v0.85.0...v0.86.0

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/KNOWN_ISSUES.md

@@ -843,6 +843,18 @@ The contrasting message, **`no upload request ever left the page`**, means somet
 
 **What is known.** A healthy upload window issues **4** POSTs; a failing one issued **24** — the full project-load rpcid inventory, firing ~2.6 s after the request went out, which is just before the ~2.8 s successful uploads take to answer. That has the shape of the page re-initialising underneath the in-flight upload, but no navigation event was captured, so the cause is unconfirmed. Measured 2026-09-08, 1 failure in 4 runs on one funded account — enough for "intermittent", not enough for a rate.
 
+### Chrome loses a reply body although Flow saved the write (migrated host)
+
+- **Status:** Mitigated · **Severity:** Medium (intermittent; the write usually saved) · **Affects:** the migrated `flow.google.com` host, local uploads (`--initial-frame`, `--ref`, `i2i` files), project create and rename · **Tracked:** [#1009](https://github.com/ffroliva/gflow-cli/issues/1009)
+
+Distinct from #719 above, where no reply arrives at all. Here the reply arrives, but Chrome cannot hand its body over: `Network.getResponseBody: No data found for resource with given identifier`. Our spike saw it on 2 of 45 real `maseQ` uploads, and a fresh reload found both uploads saved ([spike](docs/superpowers/spikes/2026-10-20-migrated-upload-reply-body-eviction.md)). Before the fix, gflow reported the upload as a refused file (exit 27).
+
+A project create or rename whose reply is late, not lost, takes the same path: on a slow link a 40 s create used to end as a retryable exit 9 while Flow made the project, so a retry made a second one ([#1037](https://github.com/ffroliva/gflow-cli/issues/1037)). The reply wait is now 120 s, and past it gflow reads the new project's id from Flow's navigation to it.
+
+**Mitigation:** gflow now opens the project in a second tab and reads the outcome back: the new project's id, the saved title, or exactly one tile with the run's unique file name and a media id. Nothing is submitted twice. The readback can take up to about two minutes on a slow page.
+
+**If it cannot confirm the outcome**, the command exits **7** with `RpcResponseUnavailableError` (`retryable: false`). The write may have saved. Open the project on flow.google.com and look for the title or the file name in the error before you re-run, or you may get a duplicate project or upload. `gflow run` does not re-upload a reference file after this error in the same run.
+
 ### Flow's release-notes ("What's new") changelog popup blocks first-run UI automation
 
 - **Status:** Mitigated · **Severity:** Medium · **Tracked:** [#26](https://github.com/ffroliva/gflow-cli/issues/26)
@@ -1521,7 +1533,7 @@ here, because the run gives up within 30 s (see [CONFIGURATION](docs/CONFIGURATI
 
 ### Auth verification depends on Google's NextAuth session endpoint
 
-- **Status:** Mitigated for real-Chrome profiles and for `gflow credits` (#795); **open** for logins with `--browser internal` · **Severity:** Medium since 2026-10-22 · **Affects:** issue #15 fix onward · **Tracked:** issue #15, [#1023](https://github.com/ffroliva/gflow-cli/issues/1023), [#795](https://github.com/ffroliva/gflow-cli/issues/795)
+- **Status:** Mitigated for real-Chrome profiles and for `gflow credits` (#795); `--browser internal` logins fixed and live-verified on Windows (#1026) · **Severity:** Medium since 2026-10-22 · **Affects:** issue #15 fix onward · **Tracked:** issue #15, [#1023](https://github.com/ffroliva/gflow-cli/issues/1023), [#795](https://github.com/ffroliva/gflow-cli/issues/795)
 
 `gflow auth login` verifies a real Flow sign-in by calling
 `https://labs.google/fx/api/auth/session` (see `src/gflow_cli/auth/verification.py`)
@@ -1541,9 +1553,12 @@ read as "no labs session": a profile without Google cookies is `NO_SESSION`, and
 them is checked by the server-attested migrated-host probe (#791), which needs the Google
 SSO and flow.google.com session cookies, then reads `myaccount.google.com`. **Still open:**
 some access-token consumers that read the same URL are not ported. `gflow credits` is
-(#795: it reads flow.google.com's own balance reply). And a login with `--browser internal` (bundled
-Chromium, also what `--browser auto` picks when Chrome is missing) cannot finish: it has no
-on-disk check to hand the verdict to, so it waits until its timeout. Use `--browser chrome`.
+(#795: it reads flow.google.com's own balance reply). A login with `--browser internal` (bundled
+Chromium, also what `--browser auto` picks when Chrome is missing) runs the same on-disk
+check after the window closes ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026));
+before that fix it waited until its timeout. A fresh bundled-Chromium sign-in passed that check
+on Windows (2026-10-22). On macOS the cookie read is expected to fail and is not measured, so
+use `--browser chrome` there.
 
 Since PR #168 the production entry point is `verify_flow_profile`, which reads
 the session cookie **directly from Chrome's SQLite store** via `browser_cookie3`

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.87.1
+Version: 0.88.0
 Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
@@ -140,6 +140,7 @@ uv tool run --from gflow-cli playwright install chromium     # one-time, ~150 MB
 # later: `gflow update` upgrades in place (every command shows a banner when a newer release is out)
 
 # 2 · Authenticate (one-time, opens a real Chrome window)
+# Behind a proxy (e.g. Clash)? Set GFLOW_CLI_BROWSER_PROXY=http://127.0.0.1:7897 first (docs/CONFIGURATION.md)
 gflow auth login --browser chrome
 
 # Check the session (spends nothing)

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/PLAN.md

@@ -115,7 +115,7 @@ src/gflow_cli/
 
 Documented in [docs/CONFIGURATION.md](docs/CONFIGURATION.md) and [.env.template](.env.template). Variables:
 
-`GFLOW_CLI_HOME`, `GFLOW_CLI_OUTPUT_DIR`, `GFLOW_CLI_PROFILE`, `GFLOW_CLI_PROVIDER`, `GFLOW_CLI_LLM_BASE_URL`, `GFLOW_CLI_LLM_API_KEY`, `GFLOW_CLI_LLM_MODEL`, `GFLOW_CLI_TIMEOUT_SECONDS`, `GFLOW_CLI_LOG_LEVEL`, `GFLOW_CLI_LOG_FORMAT`, `GFLOW_CLI_CONCURRENCY`, `GFLOW_CLI_DB_PATH`, `GFLOW_CLI_HISTORY_PROMPTS`.
+`GFLOW_CLI_HOME`, `GFLOW_CLI_OUTPUT_DIR`, `GFLOW_CLI_PROFILE`, `GFLOW_CLI_PROVIDER`, `GFLOW_CLI_LLM_BASE_URL`, `GFLOW_CLI_LLM_API_KEY`, `GFLOW_CLI_LLM_MODEL`, `GFLOW_CLI_LOG_LEVEL`, `GFLOW_CLI_LOG_FORMAT`, `GFLOW_CLI_CONCURRENCY`, `GFLOW_CLI_DB_PATH`, `GFLOW_CLI_HISTORY_PROMPTS`.
 
 Default paths via `platformdirs`:
 

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/README.md

@@ -52,6 +52,7 @@ uv tool run --from gflow-cli playwright install chromium     # one-time, ~150 MB
 # later: `gflow update` upgrades in place (every command shows a banner when a newer release is out)
 
 # 2 · Authenticate (one-time, opens a real Chrome window)
+# Behind a proxy (e.g. Clash)? Set GFLOW_CLI_BROWSER_PROXY=http://127.0.0.1:7897 first (docs/CONFIGURATION.md)
 gflow auth login --browser chrome
 
 # Check the session (spends nothing)

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/docker/Dockerfile

@@ -45,7 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Deliberately NOT pinned: google-chrome-stable. Chrome's apt repo keeps only the current
 # build, so a pinned version stops resolving within weeks. The trade-off is that this
 # layer caches indefinitely and a rebuild is what picks up a newer Chrome.
-ARG GFLOW_VERSION=0.87.1
+ARG GFLOW_VERSION=0.88.0
 RUN pip install --no-cache-dir "gflow-cli==${GFLOW_VERSION}"
 
 VOLUME ["/data"]

{gflow_cli-0.87.1/website → gflow_cli-0.88.0}/docs/ACCOUNT_SAFETY.md

@@ -73,7 +73,14 @@ auto-retry, because retrying only inflates per-profile heat.**
 
 ## What it deliberately does not do
 
-- **No proxy or IP rotation.** Your requests come from your connection.
+- **No IP rotation, and no proxy unless you set one.** By default your requests come from
+  your connection. [`GFLOW_CLI_BROWSER_PROXY`](CONFIGURATION.md#gflow_cli_browser_proxy)
+  routes the browser through **one** proxy you choose, for networks where Google is
+  reachable only that way. Google watches where a session comes from, so: sign in, renew
+  and generate through the **same** proxy; point `HTTPS_PROXY` at the same exit, so
+  gflow's own HTTP calls do not leave from a second IP; and remember that a shared or
+  commercial proxy IP carries other people's reputation, which can trigger "Confirm it's
+  you" checks or reCAPTCHA refusals on your account.
 - **No fingerprint spoofing**, beyond the opt-in patched engine below. No canvas
   noise, no UA lying, no timezone games.
 - **No headless "unlock".** The patchright option is explicitly *not* one.

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/docs/AUTHENTICATION.md

@@ -146,11 +146,13 @@ gflow auth login --profile work    # named profile (creates if missing)
 gflow auth login --browser chrome  # force the chrome strategy (real Chrome + its profile marker)
 ```
 
-> **Use `--browser chrome` for now.** Since 2026-10-22 labs.google's session URL answers HTTP
-> 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)). A real-Chrome login is
-> verified against Google's account page instead; a bundled-Chromium login (`--browser
-> internal`, or `auto` on a machine without Chrome) has no such check yet, so it waits until
-> its timeout ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)).
+> **Prefer `--browser chrome`.** Since 2026-10-22 labs.google's session URL answers HTTP
+> 410 ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023)), so every login is
+> verified against Google's account page with the profile's saved cookies. A
+> bundled-Chromium login (`--browser internal`, or `auto` on a machine without Chrome) runs
+> that check too ([#1026](https://github.com/ffroliva/gflow-cli/issues/1026)). It is verified
+> on Windows; on macOS it is expected to fail (not measured), and generation needs a
+> chrome-strategy profile.
 
 Re-running this command refreshes an expired session: it reuses the existing profile dir,
 so you typically just have to click "Continue as <you>" on the Google account chooser.
@@ -247,6 +249,12 @@ launched as a plain process with no automation flags and no debugging port, wher
 the window once the Flow editor has loaded and `gflow` extracts the verified session from the
 profile. There is no flag and no prompt for this — the fallback simply happens.
 
+**Behind a proxy.** Set [`GFLOW_CLI_BROWSER_PROXY`](CONFIGURATION.md#gflow_cli_browser_proxy)
+before `gflow auth login`, so you sign in from the same IP you will generate from. Both
+login paths use it, including the Passive Capture fallback (as Chrome's
+`--proxy-server` switch). Use a proxy without credentials, such as a local Clash on
+`http://127.0.0.1:7897`.
+
 **Privacy guard:** The `chrome` strategy strictly refuses to use any profile directory
 outside `GFLOW_CLI_HOME`. This protects your primary system Chrome profile from
 accidental interference or data corruption.

{gflow_cli-0.87.1/website → gflow_cli-0.88.0}/docs/CONFIGURATION.md

@@ -250,12 +250,6 @@ Both generate tools are gated, not just video: image generation is only *empiric
 GFLOW_CLI_AUTH_LOGIN_TIMEOUT=120 gflow auth login   # abort after 2 minutes
 ```
 
-### `GFLOW_CLI_TIMEOUT_SECONDS`
-
-**What:** Per-request HTTP timeout. Veo videos can take 60–180 s each.
-**Default:** `600`
-**Note:** This is a single-request ceiling; the *batch* timeout you experience is sum of all per-clip waits.
-
 ### `GFLOW_CLI_JITTER_RANGE`
 
 **What:** Anti-bot pause between prompt submissions in multi-prompt image runs (`gflow image batch`, `gflow image t2i --prompts-file` / `--stdin` / multiple positional prompts, and `gflow run` image batches). Spaces out the *submission clicks* only — generations still run in parallel inside Flow.
@@ -267,16 +261,19 @@ GFLOW_CLI_AUTH_LOGIN_TIMEOUT=120 gflow auth login   # abort after 2 minutes
 
 ### `GFLOW_CLI_LOG_LEVEL`
 
-**What:** Logging verbosity.
+**What:** Logging verbosity. Logs go to stderr; stdout carries only the command's output.
 **Values:** `DEBUG` | `INFO` | `WARNING` | `ERROR`
-**Default:** `INFO`
+**Default:** `WARNING` — a command prints its result plus any warnings and errors. Set `INFO`
+to see progress events (engine, cookies, locale, page setup), for example on a long-running
+`gflow mcp run` / `gflow serve`.
 **CLI override:** `-v` / `--verbose` flag flips to `DEBUG`.
+Until the #1041 fix this setting was ignored and every command logged at `INFO` ([#1041](https://github.com/ffroliva/gflow-cli/issues/1041)).
 
 ### `GFLOW_CLI_LOG_FORMAT`
 
 **What:** Output format for log lines.
 **Values:**
-- `auto` (default) — text on TTY, JSON when stdout is piped/redirected
+- `auto` (default) — text when stderr is a terminal, JSON when stderr is piped/redirected
 - `text` — always pretty (Rich-styled, colours)
 - `json` — always machine-readable (one JSON object per line)
 
@@ -399,6 +396,49 @@ Measurement script: `scripts/dev/spike_offscreen_window.py`.
 
 **Malformed values** (`100`, `1,2,3`, `a,b`) fail at startup with a validation error.
 
+### `GFLOW_CLI_BROWSER_PROXY`
+
+**What:** A proxy for every browser gflow launches: generation (CLI and MCP),
+`gflow auth login`, `auth renew` and the session check behind `auth status`
+([#1036](https://github.com/ffroliva/gflow-cli/issues/1036)).
+**Values:** `http://host:port` | `https://host:port` | `socks5://host:port`; the port is
+required, and credentials (`user:pass@`) are refused, see below
+**Default:** unset. The browser then connects as it always has: on Windows that means
+through the system proxy (Settings → Network → Proxy), if one is on.
+
+Use it when Google is reachable only through a proxy, for example a local Clash or
+v2ray client on `http://127.0.0.1:7897` with its *System Proxy* switch off.
+
+**Two proxies, one exit.** gflow's own HTTP calls (httpx, the LLM client) follow
+`HTTPS_PROXY`; the browser follows this setting and ignores `HTTPS_PROXY` (Chromium reads
+proxy env vars only on Linux). gflow never copies one into the other. Point both at the
+same proxy so Google sees one IP per session, and sign in through it. See
+[ACCOUNT_SAFETY](ACCOUNT_SAFETY.md#what-it-deliberately-does-not-do).
+
+| Situation | What happens |
+|---|---|
+| unset | no change from earlier versions |
+| set | every browser launch routes through it; `gflow doctor` shows it |
+| credentials (`user:pass@`), a missing host or port, a path or an unknown scheme | refused at startup, exit 11, naming the setting and never repeating the value |
+| the proxy is down or refuses the tunnel | a generation run stops at its first page load, exit 11, with a hint naming this setting. `auth status` and `auth renew` report an unverified session instead (the usual "check your connection" wording), so check the proxy first |
+
+**Why no credentials.** Through a proxy that asks for a password, the Flow page never
+finishes loading: measured 2026-10-22 on Playwright 1.61 with bundled Chromium and
+Chrome alike, the labs → flow.google.com navigation timed out at 45 s, while the same
+proxy without a password loaded it in about a second (and plain sites loaded either way).
+Run your proxy client locally and let it hold the upstream credentials; that is how
+Clash and v2ray work by default. `tests/e2e/test_browser_proxy_e2e.py` re-measures this,
+so the restriction can be lifted once Playwright handles it.
+
+**Long-running servers** (`gflow mcp run`, `gflow serve`) read it once at start; restart
+them after changing it. For MCP, set it in `$GFLOW_CLI_HOME/.env` or the client's `env`
+block, since a client does not load a `.env` from your shell's directory
+([MCP setup](MCP.md#4-setup-instructions)).
+
+**Not supported:** a bypass list (Chromium already sends loopback addresses direct),
+per-command `--proxy` flags (the setting covers one-off runs:
+`GFLOW_CLI_BROWSER_PROXY=... gflow ...`), and the opt-in experimental transports.
+
 ### `GFLOW_CLI_BROWSER_ENGINE`
 
 **What:** Selects the browser-automation engine backing the Playwright API.
@@ -534,10 +574,9 @@ For images, `--out DIR` writes flat as `<DIR>/<media_name>_<n>.png` — file pat
 `gflow video chain` (last-frame I2V chaining — see
 [USAGE § gflow video chain](USAGE.md#gflow-video-chain)) is configured entirely
 by command-line flags; it adds **no new environment variables**. It reuses
-`GFLOW_CLI_OUTPUT_DIR` (default output root), `GFLOW_CLI_PROFILE`,
-`GFLOW_CLI_DB_PATH` (chain links are recorded for `--resume-from`), and
-`GFLOW_CLI_TIMEOUT_SECONDS` (per-link generation ceiling — the chain waits for
-each link in turn, so total wallclock is the sum of all link waits).
+`GFLOW_CLI_OUTPUT_DIR` (default output root), `GFLOW_CLI_PROFILE`
+and `GFLOW_CLI_DB_PATH` (chain links are recorded for `--resume-from`). The chain
+waits for each link in turn, so total wallclock is the sum of all link waits.
 
 | Flag | Default | Notes |
 |---|---|---|
@@ -601,12 +640,10 @@ gflow image t2i "product photo on a white sweep"
 
 See [EXTERNAL_STORAGE.md](EXTERNAL_STORAGE.md) for MinIO and GCS examples.
 
-### "I'm running in CI — I want JSON logs and a strict timeout"
+### "I'm running in CI — I want JSON logs"
 
 ```bash
-GFLOW_CLI_LOG_FORMAT=json \
-GFLOW_CLI_TIMEOUT_SECONDS=300 \
-gflow image batch ./manifest.tsv
+GFLOW_CLI_LOG_FORMAT=json gflow image batch ./manifest.tsv
 ```
 
 ### "I want to test against the official Veo SDK"
@@ -631,10 +668,10 @@ gflow image t2i "test idea" --profile experiments
 
 | Symptom | Likely cause | Fix |
 |---|---|---|
-| `ValidationError: GFLOW_CLI_TIMEOUT_SECONDS must be a positive integer` | Bad `.env` value | Set to a number ≥ 1 |
 | `FileNotFoundError: $GFLOW_CLI_HOME/profile_default not found` | First run, no auth yet | `gflow auth login` |
 | `AuthExpiredError` | Cookies expired or revoked | `gflow auth login --profile <name>` |
 | A run stops on an account chooser, consent or verification screen (`FlowAccountChooserError`, exit 38) | Google wants a person to answer that screen | `gflow auth login --profile <name>` and clear it there; the login window is always visible. Making the generation window visible does not help: the run gives up within 30 s. See [`GFLOW_CLI_BROWSER_WINDOW_POSITION`](#gflow_cli_browser_window_position) |
+| Every browser step times out, while `curl` and `HTTPS_PROXY` work | Google is reachable only through a proxy, and the browser ignores `HTTPS_PROXY` | Set [`GFLOW_CLI_BROWSER_PROXY`](#gflow_cli_browser_proxy) to the same proxy, then `gflow auth renew` |
 | `ProfileAccessError` (exit code 11) | Chrome cannot write the profile directory (Windows access denied) | Grant write access to the whole profile directory, or use a writable profile. See [Profile-directory permissions](#profile-directory-permissions-at-browser-launch) |
 | Output files don't appear where I expect | Flag > env > .env > default — check actual resolved path | `gflow image t2i ... --verbose` shows the resolved output path |
 | `ProfileLockedError` (exit code 11) | Two concurrent calls against the same profile — the cross-process `ProfileLease` fails fast (never waits) on same-profile contention, whether the second holder is another `gflow` process, the `gflow serve` daemon, or an MCP call | Wait for the first call to finish, or use `--profile other` — different profiles run fully in parallel, each with its own lease |

{gflow_cli-0.87.1 → gflow_cli-0.88.0}/docs/E2E_TESTING.md

@@ -156,9 +156,11 @@ test, not a mocked proxy — the Bug Lane's step 5.
 | `GFLOW_CLI_E2E_VIDEO_MODEL` | `"omni-flash"` | Veo model for i2v tests: `omni-flash` or `veo-fast`. |
 | `GFLOW_CLI_E2E_VIDEO_DURATION` | `"4"` | Seconds of video to generate in i2v tests (minimum credit unit). |
 | `GFLOW_CLI_E2E_RUN_REFUSAL` | `"0"` | Set to `"1"` to run the migrated refusal e2e (`e2e_image`): one image submit goes out with its reCAPTCHA token corrupted so Flow refuses it, proving the refusal is reported as `WafRejectionError`. Zero credits, but a refused token can raise the profile's WAF score for hours, so run it **alone** and on a probe profile, never before other image tests in the same session. |
+| `GFLOW_CLI_E2E_RUN_SLOW_LINK` | `"0"` | Set to `"1"` to run the slow-link project-create e2e (#1037, `e2e_auth`, `tests/e2e/test_project_create_slow_link_e2e.py`): it holds back Flow's create reply and checks that gflow returns the project it made, or exits 7 (not retryable) when it cannot tell. Zero credits; opt-in because each test leaves one empty project (`e2e-1037-*`, one untitled) and there is no delete route. |
 | `GFLOW_CLI_E2E_RUN_ENTITY_PROV` | `"0"` | Set to `"1"` to run the entity-provenance e2e (#402) — asserts a generation Flow actually accepted records its `entity_ids` / `entity_names` in `operations.metadata_json`. Opt-in because it drives a real browser generation (no credit cost — images are free). |
 | `GFLOW_CLI_E2E_BATCH_MANIFEST` | `test_assets/sample_batch.tsv` | TSV manifest for the batch image e2e. |
 | `GFLOW_CLI_E2E_BATCH_JITTER` | `"1"` | Set to `"0"` to disable inter-request jitter in batch tests. |
+| `GFLOW_CLI_E2E_RPC_IMAGE` | *(unset)* | Path to an image you own, for `tests/e2e/test_migrated_rpc_readback_bdd.py` (#1009: a lost reply body is read back). Unset, that test **skips**. It creates one project, renames it and uploads this file; it spends no credits and no quota. |
 | `GFLOW_CLI_E2E_PROMPT` | *(safe default)* | Prompt override for the smoke test. |
 | `GFLOW_CLI_E2E_STALE_PROFILES` | *(unset)* | Comma-separated profiles whose session has **lapsed** (the credits read lands on a Google sign-in page, exit 3). Used by the session-renewal e2e (`e2e_auth`): index 0 drives `gflow_get_credits(refresh=true)`, index 1 drives `gflow credits user --refresh`, and index 2 drives `gflow auth renew`. Each is consumed by its first successful renewal, because a renewed session stays fresh for a while. A test whose profile is fresh **skips**; it never passes on a read that needed no renewal. `GFLOW_CLI_E2E_PROFILE` must also be set. |
 | `GFLOW_CLI_E2E_ABOUT_PROFILE` | *(unset)* | A profile Flow holds at its public `/about` page (see [KNOWN_ISSUES](../KNOWN_ISSUES.md)). `tests/e2e/test_auth_renew_e2e.py` asserts that `gflow auth renew` does **not** report it renewed. It skips if the profile reads a balance. |