gflow-cli 0.90.0__tar.gz → 0.91.0__tar.gz

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.90.0",
+  "version": "0.91.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/.env.template

@@ -208,11 +208,11 @@
 # GFLOW_CLI_FLOW_HOST=auto
 
 # Agent-only composer (#799): "Confirm before generating" applied before a run.
-# account (default): leave the Flow account's setting; gflow approves one
-# confirmation its own submit produced and stops on a second. Only that second
-# one is stopped before billing: one confirmation can cover several clips, and an
-# over-count under it is caught after the fact.
-# always: set Always. never: set Never — no approval step, so an agent that
+# account (default): leave the Flow account's setting. A confirmation its own
+# submit produced is read first: one that quotes more than requested is rejected
+# (#988), a video one whose count cannot be read is not approved, any other is
+# approved; a second one is never approved.
+# always: set Always. never: set Never — no confirmation and no count check, so an agent that
 # queues more than asked is only caught after credits are spent.
 # Saved to the Flow account and not restored after the run.
 # GFLOW_CLI_AGENT_CONFIRM=account

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/AGENTS.md

@@ -44,7 +44,7 @@ by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code
 
 ## Project at a glance
 
-- Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files, and text-to-image/local-file image-to-image with `@Character` mentions by name, and a single-segment `video extend`, today — an agent-only composer, #799, takes text-to-image and text-to-video only; `GFLOW_CLI_FLOW_HOST`).
+- Python CLI and MCP server for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com` — and, for accounts Google has moved to `flow.google.com`, that frontend's `batchexecute` wire (text-to-video, image-to-video from a local `--initial-frame`, reference-to-video from local `--ref` files and/or a named character, and text-to-image/local-file image-to-image with `@Character` mentions by name, and a single-segment `video extend`, today — an agent-only composer, #799, takes text-to-image and text-to-video only; `GFLOW_CLI_FLOW_HOST`).
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
 - Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_credits.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `cli_docs.py`, `docs_catalog.py`, `cli_update.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
 - Command surface: `gflow auth` (login/status/renew/list/use/logout — `renew` refreshes saved sessions headlessly, no sign-in), `gflow credits` (user/list — Veo balance; read from flow.google.com's own balance reply in the profile's browser, #795; read-only unless `--refresh`, which renews signed-out sessions first), `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend/upscale — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; `upscale` exports to 1080p, 720p, or 270p GIF; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow docs` (browse the bundled documentation — bare lists every topic, `gflow docs <topic>` prints one as Markdown, `gflow docs --search TERM` searches all of them; there are **no** `list`/`print`/`search` subcommands — read-only, offline, deliberately no MCP twin), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow update` (self-update through the installer that put it here — uv tool / pipx / pip; `--check` only reports; source installs refused, exit 11; deliberately no MCP twin), `gflow project`, `gflow models`, `gflow run` (JSON image-batch config; a row may generate from an earlier row with `"ref": "batch:N"`, referenced in place, no upload, or from a local image file, uploaded once per run), `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
@@ -81,6 +81,7 @@ uv run python scripts/ci/check_doc_links.py
 uv run python scripts/ci/check_website_docs_pii.py
 uv run python scripts/ci/generate_website_docs.py --check
 uv run python scripts/ci/check_council_memory.py
+uv run python scripts/ci/generate_plugin_skills.py --check
 uv run ruff check src tests
 uv run ruff format --check src tests
 uv run pyright src
@@ -94,13 +95,17 @@ the five other mirror axes), which no command here can check and no CI gate can
 > **Do not trim this list again.** It previously omitted
 > `generate_website_docs.py --check`, so an agent following AGENTS.md instead of the skill
 > shipped a stale `website/docs/` mirror to a green local run and a red CI (#626 session,
-> 2026-09-02). Two lists that disagree means the shorter one is silently wrong.
+> 2026-09-02). Two lists that disagree means the shorter one is silently wrong. It
+> happened again with `generate_plugin_skills.py --check`: an edit to
+> `skills/gflow-cli/SKILL.md` passed every gate here and failed CI, because the plugin
+> ships a byte copy of that file (#988, 2026-10-26). The CI workflow is the source; this
+> list follows it.
 
 - Use `pytest -m "not live and not e2e and not smoke"` locally; full suite OOMs on small dev machines. Scope to changed dirs; trust CI for the full sweep.
 - **Parallel runs (`pytest-xdist`):** add `-n 8` (or `-n auto`) to cut the offline suite from ~390 s to ~200 s. Every worker is a full process, so cap `-n` on a small machine. CI runs `-n auto`. A test that passes alone but fails under `-n` shares state with another test: **fix the shared state** (two measured cases: `tests/mcp/conftest.py` and `test_every_shipped_skill_is_byte_identical_to_its_source`). If two tests genuinely need the same exclusive resource (a fixed port, a file lock), mark both `@pytest.mark.xdist_group("<resource>")` so they run on one worker, one after another, while the rest stays parallel.
 - TDD is non-negotiable. Coverage floor: 80% overall.
 - Documentation is a first-class deliverable. Every behavior, workflow, config, or operator-facing change must update the relevant docs or state why no docs changed in the PR/checklist. `scripts/ci/check_doc_links.py` is a merge gate.
-- **A PR is not done until its SonarCloud gate is green (zero new issues).** The nine gates above are local/pre-commit; SonarCloud is server-side and runs in CI (`sonar.qualitygate.wait=true` → a red gate turns the `SonarCloud analysis` check red). Before calling a PR merge-ready, verify it with `/gflow:sonar <N>` (it is skipped on fork PRs — maintainer-checked there).
+- **A PR is not done until its SonarCloud gate is green (zero new issues).** The ten gates above are local/pre-commit; SonarCloud is server-side and runs in CI (`sonar.qualitygate.wait=true` → a red gate turns the `SonarCloud analysis` check red). Before calling a PR merge-ready, verify it with `/gflow:sonar <N>` (it is skipped on fork PRs — maintainer-checked there).
 - **E2E is the decisive layer, and it is required for every behavior change that touches a Flow surface.** Run the `tests/e2e/` test that covers the change, or write one — offline-green proves only that *our* code does what we think, never that Flow still behaves as captured. `/gflow:live-verify` does **not** satisfy this: it drives CLI commands by hand into a gitignored note and never runs `pytest -m e2e`. The two are complementary — an e2e test is a re-runnable regression, a live-verify ledger is a narrative record. A change touching no Flow surface at all (docs, help text, exit-code plumbing) is out of scope — say so explicitly rather than leaving it blank. Anything else follows the **Iron Law** above: run it, or name the external blocker that stops you. "A maintainer will run it" is a handoff, not a verification, and is only available once the blocker is named.
 - E2E tests require `GFLOW_CLI_E2E_PROFILE` and `-m e2e` (excluded from the default `addopts`, so they never run by accident). Cost sub-markers: `e2e_auth` (zero credits, browser only), `e2e_image` (zero credits, daily cap), `e2e_scene`, `e2e_data`, `e2e_batch`, `e2e_character` (opt in with `GFLOW_CLI_E2E_RUN_CHARACTER=1`), the migrated refusal e2e (`e2e_image`, opt in with `GFLOW_CLI_E2E_RUN_REFUSAL=1` — it sends one corrupted reCAPTCHA token, so run it on a probe profile), the slow-link project create (`e2e_auth`, opt in with `GFLOW_CLI_E2E_RUN_SLOW_LINK=1` — each test leaves an empty project), `e2e_video` (spends Veo credits — opt in with `GFLOW_CLI_E2E_RUN_VIDEO=1`). Redact account identifiers and any token or cookie value before pasting output into a PR.
 - Live tests (`@pytest.mark.live`) opt in via `GFLOW_LIVE=1`.

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/CHANGELOG.md

@@ -7,6 +7,72 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.91.0] — 2026-10-28
+
+### Fixed
+
+- **A video whose submit reply Chrome lost now finishes with its clip on flow.google.com**
+  ([#1112](https://github.com/ffroliva/gflow-cli/issues/1112)). About 1 in 7 r2v submits
+  lost the reply body while Flow made and billed the clip, and gflow ended with exit 9. A
+  run that uploaded a file (`--ref`, `--initial-frame`, `--end-frame`) now picks its clip
+  out of Flow's status replies by that upload's id, or out of the project listing in a
+  second tab, and downloads it, without submitting again. Text-to-video and character-only
+  r2v runs upload nothing unique, so they still exit 9 (`retryable: false`).
+
+- **Reference-to-video with a character now runs on flow.google.com**
+  ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). Local-file `video r2v` with
+  `--reference-entity` paired with `--reference-entity-name` is served on the migrated host:
+  the character is attached through the composer's `@` picker, its chip is verified before
+  the billed click, and the submit body must carry its entity id beside every uploaded
+  image, or the run is refused before Flow acts on it. An MCP r2v whose only reference is a
+  character had no submit-body check at all before. The refusal rested on a null submit reply measured on
+  2026-09-07; on 2026-10-26 an entity-bound r2v run completed end to end through the stock
+  observer. An entity id without a name now exits 36 with that reason instead of failing
+  later on a chip-count mismatch. Text-to-video with a character stays refused (exit 36,
+  [#716](https://github.com/ffroliva/gflow-cli/issues/716)); image-to-video with a character is refused the same way.
+
+- **MCP `wait=false` generations now run**
+  ([#1097](https://github.com/ffroliva/gflow-cli/issues/1097)). Before, `gflow_generate_image`
+  and `gflow_generate_video` with `wait=false` saved the job and returned a `task_id`, but no
+  gflow command ever ran it: `tasks/get` said `working` forever. The job now runs in the
+  background of the server that accepted it, one job at a time per profile within that
+  server, sharing the
+  profile with `wait=true` calls. Once it has finished, `tasks/get` carries the same reply
+  `wait=true` would (files, project id, seed). `tasks/cancel` now stops the job instead of only
+  relabelling its row, and a job cancelled after its submit fired is recorded as
+  `indeterminate` (a credit may be spent), not `failed`; `tasks/get` then answers
+  `cancelled`. When the client closes a stdio
+  server or `gflow serve` stops, running jobs are cancelled and recorded the same way.
+  Jobs queued by older releases are never picked up. See [MCP](docs/MCP.md).
+
+### Changed
+
+- **MCP `tasks/get` and `tasks/cancel` now speak SEP-2663**, the Tasks extension the server
+  declares ([#1102](https://github.com/ffroliva/gflow-cli/issues/1102)). They used the shapes
+  of the older 2025-11-25 tasks spec. `tasks/get` now sends `ttlMs` (null: rows do not
+  expire) instead of `ttl: 3600`, and carries the finished tool result in a `result` field. A
+  generation that failed now reads `completed` with `result.isError: true` instead of
+  `failed`, because SEP-2663 keeps `failed` for protocol errors: **check `isError`**.
+  `tasks/cancel` answers with an empty acknowledgement instead of a task; read the outcome
+  from `tasks/get`. There is no `tasks/result`; the server answers it `-32601`.
+
+- **Dependencies:** `pydantic-settings` 2.16.0 → 2.16.1, `platformdirs` 4.13.3 → 4.13.5,
+  `fastapi` 0.143.2 → 0.161.1, and the dev tool `ruff` 0.17.1 → 0.17.2
+  ([#1104](https://github.com/ffroliva/gflow-cli/pull/1104)).
+
+### Security
+
+- **The agent-only composer reads a credit confirmation before approving it**
+  ([#988](https://github.com/ffroliva/gflow-cli/issues/988)). On an account Flow serves the
+  agent-only composer, one confirmation can bill several generations, and gflow used to
+  approve the first one without reading it, so an agent that queued too much was caught only
+  after the credits were spent. gflow now reads the numbers in the confirmation's title and
+  **rejects** one that quotes more than requested (exit 25, nothing approved). A video
+  confirmation whose count cannot be read is not approved either. This matters most over MCP,
+  where the prompt may come from an untrusted source. Measured on English and Russian titles
+  from a contributor's account; not yet run on a maintainer account, because none is served
+  this composer.
+
 ## [0.90.0] — 2026-10-25
 
 ### Added
@@ -6667,7 +6733,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.90.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.91.0...HEAD
+[0.91.0]: https://github.com/ffroliva/gflow-cli/compare/v0.90.0...v0.91.0
 [0.90.0]: https://github.com/ffroliva/gflow-cli/compare/v0.89.1...v0.90.0
 [0.89.1]: https://github.com/ffroliva/gflow-cli/compare/v0.89.0...v0.89.1
 [0.89.0]: https://github.com/ffroliva/gflow-cli/compare/v0.88.0...v0.89.0

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/CONTRIBUTING.md

@@ -208,6 +208,7 @@ uv run python scripts/ci/check_doc_links.py           # internal Markdown links
 uv run python scripts/ci/check_website_docs_pii.py    # no private identifiers in website/docs
 uv run python scripts/ci/generate_website_docs.py --check  # website mirror in sync
 uv run python scripts/ci/check_council_memory.py      # council memory slugs resolve both ways
+uv run python scripts/ci/generate_plugin_skills.py --check  # shipped plugin skills match skills/
 uv run ruff check src tests          # lint
 uv run ruff format --check src tests # formatting
 uv run pyright src                   # type-check (strict on src/gflow_cli/)
@@ -243,7 +244,7 @@ contributor is blocked for lacking the plugin.
 
 ### SonarCloud quality gate
 
-On top of the six gates, CI runs a **SonarCloud** analysis whose quality gate must be
+On top of the ten gates, CI runs a **SonarCloud** analysis whose quality gate must be
 **green** before a PR is merge-ready — the target is **zero new issues** on changed code
 (new bugs, vulnerabilities, and code smells = 0; coverage of new lines ≥ 80%; security
 hotspots reviewed = 100%). The local `--cov-fail-under=80` gate already pre-empts the

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/KNOWN_ISSUES.md

@@ -48,7 +48,7 @@ close Chrome yourself. On the measured account, `/about` was gone on the next ru
 
 ### Flow is migrating to `flow.google.com`; generation coverage is partial but includes images
 
-- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, local-file `gflow image i2i`, and a **single-segment** `gflow video extend` (#882: Flow's own Extend control, driven from the clip editor) now run on the migrated host. Image mode supports Nano Banana 2.1 (`nano2`, which replaced Nano Banana 2 there, #958) / 2 Lite / Pro, all five aspect ratios its radiogroup renders (16:9, 4:3, 1:1, 3:4, 9:16 — 3:4 appeared by 2026-09-17, #864), and count 1–4. Image prompts can tag a **character** with `@Name` / `--reference-entity` + `--reference-entity-name` since #723 (attached through the composer's `@` picker; an id without a name exits 36; video is unchanged). That matrix is the **classic** migrated composer's. On an **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gflow drives `image t2i` (all five aspects; count 1–4) and `video t2v` (one 9:16 or 16:9 clip) only — i2i, i2v, r2v and character references are refused there before anything is clicked. Image refs by UUID (except one the local catalog records in the same `--project`, referenced in place since #995), video `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, chained extend (`-n > 1`, `--scene`/`--resume-from`, `--seed`, an `--aspect` other than the source clip's), instructions and tools are not ported yet and fail before submit. **`character create` worked on the migrated host until its labs `createEntity` route was retired:** measured 2026-10-14 on a profile served flow.google.com, it exits 7 with "Flow RPCs have been deprecated" (404). `character list` does NOT: it reads the retired labs `projectInitialData` route and exits 7, measured 2026-09-20 both on `auto` and with `GFLOW_CLI_FLOW_HOST=flow.google.com` (#875). Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, multi-segment `extend` (`-n > 1`, `--scene`/`--resume-from`, `--seed`), `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
+- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, local-file `gflow image i2i`, and a **single-segment** `gflow video extend` (#882: Flow's own Extend control, driven from the clip editor) now run on the migrated host. Image mode supports Nano Banana 2.1 (`nano2`, which replaced Nano Banana 2 there, #958) / 2 Lite / Pro, all five aspect ratios its radiogroup renders (16:9, 4:3, 1:1, 3:4, 9:16 — 3:4 appeared by 2026-09-17, #864), and count 1–4. Image prompts can tag a **character** with `@Name` / `--reference-entity` + `--reference-entity-name` since #723 (attached through the composer's `@` picker; an id without a name exits 36). Local-file `video r2v` takes a character the same way, by `--reference-entity` + `--reference-entity-name` (#723). That matrix is the **classic** migrated composer's. On an **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gflow drives `image t2i` (all five aspects; count 1–4) and `video t2v` (one 9:16 or 16:9 clip) only — i2i, i2v, r2v and character references are refused there before anything is clicked. Image refs by UUID (except one the local catalog records in the same `--project`, referenced in place since #995), video `@Name`, `--reference-entity` on t2v/i2v, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, chained extend (`-n > 1`, `--scene`/`--resume-from`, `--seed`, an `--aspect` other than the source clip's), instructions and tools are not ported yet and fail before submit. **`character create` worked on the migrated host until its labs `createEntity` route was retired:** measured 2026-10-14 on a profile served flow.google.com, it exits 7 with "Flow RPCs have been deprecated" (404). `character list` does NOT: it reads the retired labs `projectInitialData` route and exits 7, measured 2026-09-20 both on `auto` and with `GFLOW_CLI_FLOW_HOST=flow.google.com` (#875). Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, multi-segment `extend` (`-n > 1`, `--scene`/`--resume-from`, `--seed`), `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
 - **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
 - **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
 - **`--reference-entity` was refused on `r2v` but not on `t2v`** ([#716](https://github.com/ffroliva/gflow-cli/issues/716), fixed in v0.71.0): the "not ported, exit 36" refusal above sat inside the r2v branch of the routing gate, so a `t2v` request carrying a character entity returned from that gate without its entities ever being inspected — and nothing downstream attaches one on this host. The generation was **submitted and billed** with the entity silently dropped, returning a plausible clip of the wrong person. The check is now mode-independent and ahead of every early return. If you ran `gflow video t2v @Name …` or `--reference-entity` on a moved account before this fix, the identity in those clips was never bound.
@@ -850,7 +850,7 @@ The contrasting message, **`no upload request ever left the page`**, means somet
 
 ### Chrome loses a reply body although Flow saved the write (migrated host)
 
-- **Status:** Mitigated · **Severity:** Medium (intermittent; the write usually saved) · **Affects:** the migrated `flow.google.com` host, local uploads (`--initial-frame`, `--ref`, `i2i` files), project create and rename, image submits · **Tracked:** [#1009](https://github.com/ffroliva/gflow-cli/issues/1009), [#1075](https://github.com/ffroliva/gflow-cli/issues/1075)
+- **Status:** Mitigated · **Severity:** Medium (intermittent; the write usually saved) · **Affects:** the migrated `flow.google.com` host, local uploads (`--initial-frame`, `--ref`, `i2i` files), project create and rename, image submits, video submits · **Tracked:** [#1009](https://github.com/ffroliva/gflow-cli/issues/1009), [#1075](https://github.com/ffroliva/gflow-cli/issues/1075), [#1112](https://github.com/ffroliva/gflow-cli/issues/1112)
 
 Distinct from #719 above, where no reply arrives at all. Here the reply arrives, but Chrome cannot hand its body over: `Network.getResponseBody: No data found for resource with given identifier`. Our spike saw it on 2 of 45 real `maseQ` uploads, and a fresh reload found both uploads saved ([spike](docs/superpowers/spikes/2026-10-20-migrated-upload-reply-body-eviction.md)). Before the fix, gflow reported the upload as a refused file (exit 27).
 
@@ -858,7 +858,9 @@ A project create or rename whose reply is late, not lost, takes the same path: o
 
 **Mitigation:** gflow now opens the project in a second tab and reads the outcome back: the new project's id, the saved title, or exactly one tile with the run's unique file name and a media id. Nothing is submitted twice. The readback can take up to about two minutes on a slow page.
 
-**Image submits (since v0.89.1, [#1075](https://github.com/ffroliva/gflow-cli/issues/1075)).** Flow had made the image every reported time. gflow now reads the run's new tile(s) off the project grid and downloads them, taking exactly the requested count once it holds still for a few seconds; an i2i reference is never counted. Any other count, or a grid it cannot read, still ends in exit **9** (`retryable: false`) naming the project page, and so does a lost **video** submit reply: check the project before re-running.
+**Image submits (since v0.89.1, [#1075](https://github.com/ffroliva/gflow-cli/issues/1075)).** Flow had made the image every reported time. gflow now reads the run's new tile(s) off the project grid and downloads them, taking exactly the requested count once it holds still for a few seconds; an i2i reference is never counted. Any other count, or a grid it cannot read, still ends in exit **9** (`retryable: false`) naming the project page: check the project before re-running.
+
+**Video submits ([#1112](https://github.com/ffroliva/gflow-cli/issues/1112)).** About 1 in 7 r2v submits lost this reply in a 21-clip run, and Flow made and billed every one. A video run that uploaded a file (`--ref`, `--initial-frame`, `--end-frame`) is now followed to its clip: Flow's own status replies name the clip by the id of that upload, and if none does within a minute, gflow reads the project listing in a second tab. The run then finishes and downloads as usual, with one `migrated.video_submit_reply_lost` warning and no second submit ([spike](docs/superpowers/spikes/2026-10-27-lost-video-submit-recovery.md)). A text-to-video run, or an r2v run with characters only, uploads nothing that tells its clip apart from the project's other clips, so it still ends in exit **9** (`retryable: false`) naming the project. So does a run where two clips carry the upload, or none appears in time. Check the project before re-running.
 
 **If it cannot confirm the outcome**, the command exits **7** with `RpcResponseUnavailableError` (`retryable: false`). The write may have saved. Open the project on flow.google.com and look for the title or the file name in the error before you re-run, or you may get a duplicate project or upload. `gflow run` does not re-upload a reference file after this error in the same run.
 
@@ -953,6 +955,18 @@ The worker queue (`generation_queue`, used by the `gflow serve` daemon and MCP t
 
 **Decision (2026-07-21):** keep the safe stub — `recover_processing` marks post-submit interruptions `indeterminate` and never auto-resubmits, which is already correct. Building the auto-reconciler is deferred until **F1** (credit-free project-page re-entry) is confirmed against live Flow; until then a blind reconciler would be speculative code against unverified blackbox behavior. The `client` reconcile-hook seam and the live-gated `tests/e2e/test_crash_recovery_e2e.py` are already in place for when F1 lands.
 
+**A server that is killed, not stopped (#1097).** An MCP `wait=false` job runs inside the
+`gflow mcp run` / `gflow serve` process that accepted it. Closing the client, or stopping
+`gflow serve`, cancels it and records the truthful state above. A process killed outright
+(`taskkill /F`, `kill -9`, a crashed client host) records nothing, so its row stays
+`processing` and `tasks/get` keeps answering `working`. A job killed before it was picked
+up stays `pending` the same way; `tasks/cancel` clears that one. Two narrower cases end the
+same way: a job whose browser takes longer than 10 s to close during shutdown, and a
+`tasks/cancel` sent to a server other than the one running the job (each server can stop
+only its own jobs; it reports the row's real status instead). Reconcile it by hand as below.
+Nothing resets such rows on its own: a startup sweep would also fail a job that another
+live `gflow mcp run` (one per client session) is still running.
+
 **Manual reconciliation:** an `indeterminate` row's checkpoint retains whatever handle/project info was captured before interruption. To resolve one by hand: open the relevant Flow project in the browser and check whether the expected asset appears.
 - **Found** — the generation completed; no action needed (the credit was spent as intended, just not auto-recorded locally).
 - **Not found after a few minutes** — it likely never completed; safe to resubmit the same prompt manually.
@@ -1402,8 +1416,9 @@ aspect / model / count are Agent-settings **defaults** rather than per-request c
 Agent settings, saves, sends a natural-language request to the agent, and **restores those
 three defaults afterwards**. "Confirm before generating" follows
 [`GFLOW_CLI_AGENT_CONFIRM`](docs/CONFIGURATION.md#gflow_cli_agent_confirm) and is not restored.
-With a confirmation step, gflow approves exactly one that its own submit produced and stops
-without approving a second. Live-verified 2026-09-15 on a Google AI Pro account (`en`):
+With a confirmation step, gflow reads the count of the one its own submit produced, approves
+it only when that count is within the request, and stops without approving a second (see
+the confirmation bullet below, #988). Live-verified 2026-09-15 on a Google AI Pro account (`en`):
 t2i 3:4 × 2 (896×1200 each), t2v 4 s 9:16 (ready 69 s after submit, MP4 downloaded).
 
 **Not driven yet on this composer** (exit 36, before anything is clicked): image-to-image,
@@ -1421,12 +1436,17 @@ video per request.
   `img[data-media-id]`; gflow downloads the original size by rewriting the size spec to `=s0`.
 - The request text is English. Whether the agent honours it on a non-English account is
   unmeasured (the original reporter's account is `ru`).
-- **The confirmation step does not bound the spend of the first ask.** gflow approves the
-  first confirmation without reading the count it names, and one confirmation can cover
-  several generations. Only a *second* confirmation is stopped before billing; an agent that
-  queues more than requested under the first is detected after the fact (more clips pending,
-  or more images on the grid, than requested), with the credits already spent — even with
-  `GFLOW_CLI_AGENT_CONFIRM=always`.
+- **The confirmation is read before it is approved
+  ([#988](https://github.com/ffroliva/gflow-cli/issues/988)).** One confirmation can cover
+  several generations, so gflow reads the numbers in its title (count first, credits last,
+  measured on English and Russian) and **rejects** it when it quotes more than requested:
+  nothing is approved, exit 25. A video confirmation whose numbers cannot be read is not
+  approved either (exit 25; it stays open in Flow — reject it there). Not yet measured: the
+  wording of a confirmation for several clips, and of an image confirmation; an image one
+  that cannot be read is approved, and more images than requested still fail the run after
+  the fact. Only a confirmation is checked: with `GFLOW_CLI_AGENT_CONFIRM=never`, or an
+  account set to Never under `account`, Flow asks nothing, and an over-count is detected
+  only after the credits are spent.
 - An image whose orientation does not match the requested aspect is kept (the run is
   billed and the file is valid) and logged as `migrated.agent_only.aspect_mismatch`.
 

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.90.0
+Version: 0.91.0
 Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
@@ -75,7 +75,7 @@ Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest-xdist>=3.6; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.17.1; extra == 'dev'
+Requires-Dist: ruff==0.17.2; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'
@@ -245,7 +245,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
-**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. An image `--ref <uuid>` is referenced in place when the catalog records it in the same `--project` ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). Other UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name`, and reference-to-video takes a named character with `--reference-entity` + `--reference-entity-name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. An image `--ref <uuid>` is referenced in place when the catalog records it in the same `--project` ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). Other UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
 
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/README.md

@@ -157,7 +157,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 **Current transport:** `ui_automation` drives Flow through a persistent Playwright Chromium profile. It is production-stable and verified end-to-end every release (see the per-release `LIVE_VERIFICATION_*` evidence files).
 
-**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. An image `--ref <uuid>` is referenced in place when the catalog records it in the same `--project` ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). Other UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
+**Two Flow frontends:** Google is moving accounts from `labs.google` onto `flow.google.com` ([#639](https://github.com/ffroliva/gflow-cli/issues/639)) — same product, different widget toolkit and wire protocol (`batchexecute` instead of `aisandbox-pa`). The migrated driver covers text-to-video, image-to-video from a local start frame, reference-to-video from local files, text-to-image, image-to-image from local files, and a single-segment `video extend`. Image generation supports Nano Banana 2.1 (`nano2`, [#958](https://github.com/ffroliva/gflow-cli/issues/958)) / 2 Lite / Pro, the five aspect ratios measured on that host (16:9, 4:3, 1:1, 3:4, 9:16), and counts 1–4; an existing project is required at the transport boundary. Images can tag a character by `@Name`, and reference-to-video takes a named character with `--reference-entity` + `--reference-entity-name` ([#723](https://github.com/ffroliva/gflow-cli/issues/723)). An account served the **agent-only** composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)) gets text-to-image and text-to-video only. An image `--ref <uuid>` is referenced in place when the catalog records it in the same `--project` ([#995](https://github.com/ffroliva/gflow-cli/issues/995)). Other UUID media references, an entity id without a name, instructions, Imagen 4, and the rest of the matrix keep the labs driver until ported (`GFLOW_CLI_FLOW_HOST`, see [CONFIGURATION](docs/CONFIGURATION.md#gflow_cli_flow_host)).
 
 **What's blocked:** a pure HTTP transport for video generation. The video upload endpoint returns HTTP 401 under non-Chrome browsers plus a reCAPTCHA mint we cannot reproduce headlessly. Three earlier HTTP strategies (`evaluate_fetch`, `bearer`, `sapisidhash`) live under `src/gflow_cli/api/transports/experimental/` for research, off the production path.
 

{gflow_cli-0.90.0 → gflow_cli-0.91.0}/docker/Dockerfile

@@ -45,7 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Deliberately NOT pinned: google-chrome-stable. Chrome's apt repo keeps only the current
 # build, so a pinned version stops resolving within weeks. The trade-off is that this
 # layer caches indefinitely and a rebuild is what picks up a newer Chrome.
-ARG GFLOW_VERSION=0.90.0
+ARG GFLOW_VERSION=0.91.0
 RUN pip install --no-cache-dir "gflow-cli==${GFLOW_VERSION}"
 
 VOLUME ["/data"]

{gflow_cli-0.90.0/website → gflow_cli-0.91.0}/docs/CONFIGURATION.md

@@ -493,14 +493,14 @@ per-command `--proxy` flags (the setting covers one-off runs:
 - `flow.google.com` — force the migrated composer for everything, including what it cannot serve yet (those requests then exit 36/11 instead of falling back).
 - `labs.google` — never use the migrated composer; where Flow serves `flow.google.com`, requests fail with exit 36 (kill switch).
 **Default:** `auto`
-**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2.1 (`nano2`, #958) / 2 Lite / Pro, all five aspect ratios (16:9, 4:3, 1:1, 3:4, 9:16 — `3:4` was added to that host's radiogroup by 2026-09-17, #864) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Image prompts may tag a character with `@Name` (or `--reference-entity` paired with `--reference-entity-name`; an id alone exits 36), attached through the composer's `@` picker (#723). `video extend` is ported for a single segment from a clip (one PROMPT; `-n` > 1, `--scene`/`--resume-from`, `--seed` and an `--aspect` other than the source's exit 36, and `-o` saves the new extension clip only, #882). Frames given by UUID/`@Name`, media references by UUID/`@Name` (except an image `--ref <uuid>` the catalog records in the same `--project`, #995), character entities on video, Agent instructions, Imagen 4, scenes, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
+**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2.1 (`nano2`, #958) / 2 Lite / Pro, all five aspect ratios (16:9, 4:3, 1:1, 3:4, 9:16 — `3:4` was added to that host's radiogroup by 2026-09-17, #864) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Image prompts may tag a character with `@Name` (or `--reference-entity` paired with `--reference-entity-name`; an id alone exits 36), attached through the composer's `@` picker (#723). `video extend` is ported for a single segment from a clip (one PROMPT; `-n` > 1, `--scene`/`--resume-from`, `--seed` and an `--aspect` other than the source's exit 36, and `-o` saves the new extension clip only, #882). Frames given by UUID/`@Name`, media references by UUID/`@Name` (except an image `--ref <uuid>` the catalog records in the same `--project`, #995), character entities on text-to-video and image-to-video, Agent instructions, Imagen 4, scenes, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call. Local-file `video r2v` takes a character with `--reference-entity` paired with `--reference-entity-name` (#723); an id alone exits 36.
 
 ### `GFLOW_CLI_AGENT_CONFIRM`
 
 **What:** On an account Flow serves the agent-only composer ([#799](https://github.com/ffroliva/gflow-cli/issues/799)), Agent settings carries a **Confirm before generating** choice. This sets it before a run.
 **Values:**
-- `account` (default) — leave the account's setting as it is. If Flow asks for confirmation, gflow approves exactly one request its own submit produced, and stops without approving if a second one appears. As with `always`, only that second confirmation is stopped before credits are spent: one confirmation can cover several generations, and an over-count under it is caught after the fact.
-- `always` — set **Always**. gflow approves the **first** confirmation without reading the count it names, and one confirmation can cover several generations. What this stops before credits are spent is a **second** confirmation in the same run; an agent that queues more than requested under the first one is caught only after the fact (gflow fails the run when more clips are pending, or more images appear, than were requested — the credits are already spent).
+- `account` (default) — leave the account's setting as it is. If Flow asks for confirmation, gflow handles it as under `always`.
+- `always` — set **Always**. Before approving, gflow reads the count the confirmation names: one confirmation can cover several generations, so one that quotes more than requested is **rejected** (nothing approved, exit 25), and a video confirmation whose count cannot be read is not approved either (exit 25; it stays open in Flow for you to reject) ([#988](https://github.com/ffroliva/gflow-cli/issues/988)). A **second** confirmation in the same run is never approved. Anything the agent makes beyond the request without asking is still caught only after the fact (more clips pending, or more images, than requested).
 - `never` — set **Never**. No approval step; a result count that differs from the request is detected only after the credits are spent.
 **Default:** `account`
 **Persistence:** unlike model / aspect / count (applied per run and restored afterwards), this value is saved to the Flow account and **not** restored — it is your standing choice, and it also applies when you use Flow in the browser.

{gflow_cli-0.90.0/website → gflow_cli-0.91.0}/docs/DEVELOPMENT.md

@@ -67,13 +67,14 @@ uv run python scripts/ci/check_doc_links.py
 uv run python scripts/ci/check_website_docs_pii.py
 uv run python scripts/ci/generate_website_docs.py --check
 uv run python scripts/ci/check_council_memory.py
+uv run python scripts/ci/generate_plugin_skills.py --check
 uv run ruff check src tests
 uv run ruff format --check src tests
 uv run pyright src
 uv run python -m pytest -q --cov=gflow_cli
 ```
 
-CI runs the same nine on every push (this list is kept identical to AGENTS.md's —
+CI runs the same ten on every push (this list is kept identical to AGENTS.md's —
 `/gflow:check` runs it plus the CLI↔MCP mirror sweep). Do not bypass with `--no-verify`.
 Project pytest defaults exclude `e2e` and `live`; run those credit-spending
 tests only with an explicit marker expression and profile/env setup.