gflow-cli 0.92.1__tar.gz → 0.93.0__tar.gz

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.92.1",
+  "version": "0.93.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Audit locked dependencies for known CVEs
         # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
         #
@@ -80,7 +80,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Audit workflows (zizmor)
         # --offline: the online audits need a GH token and reach the network, so
@@ -116,7 +116,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install 3.13
@@ -175,7 +175,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}
@@ -250,7 +250,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install 3.13
@@ -347,7 +347,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install 3.13
@@ -418,7 +418,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install 3.13
@@ -452,7 +452,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install 3.13
@@ -524,8 +524,42 @@ jobs:
         # archived actions, so its pin would rot silently); sonarqube-scan-action
         # is SonarSource's maintained successor and serves SonarCloud when
         # SONAR_HOST_URL points at it.
-        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # PR decoration
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}    # set in repo → Settings → Secrets
           SONAR_HOST_URL: https://sonarcloud.io
+
+  # Fails on N+1 queries and swallowed programming errors (see dev/sharpit_app.py). sharpit is pinned: a new release
+  # can add findings, so upgrading it is a change of its own.
+  sharpit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install deps
+        run: uv sync --frozen --extra dev
+
+      # --with adds sharpit to this run only; uv.lock and the wheel never depend on it.
+      - name: Test suite under pytest --sharpit
+        run: >-
+          uv run --no-sync --with "sharpit==0.4.0" python -m pytest -q -n auto
+          --sharpit --sharpit-no-advisors
+          --sharpit-report=sharpit-report.json --sharpit-junit=sharpit-junit.xml
+
+      - name: Upload the sharpit reports
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: sharpit-report
+          path: |
+            sharpit-report.json
+            sharpit-junit.xml

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/deps-watch.yml

@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Set up Python
         run: uv python install 3.13

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/governance-advisory.yml

@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0 # full history so `git diff origin/<base>..HEAD` resolves
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Classify touched paths (advisory, never blocks)
         # BASE_REF arrives through `env:`, never interpolated into the script

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/governance-benchmark.yml

@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0 # full history — the backtest replays every commit
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Run backtest (advisory; writes to job summary)
         run: uv run python scripts/dev/materiality_backtest.py >> "$GITHUB_STEP_SUMMARY"

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/pages.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install MkDocs Material

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           # This is the one workflow that publishes artefacts (PyPI + GitHub
           # Release), so it must not restore a cache any other workflow can
@@ -89,7 +89,7 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         # No api-token needed — uses OIDC Trusted Publishing.
         # Configure once at https://pypi.org/manage/account/publishing/
 

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/.github/workflows/scorecard.yml

@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           sarif_file: results.sarif

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.93.0] — 2026-11-05
+
+### Added
+
+- **`nano21` is accepted as an image model alias** for Nano Banana 2.1, alongside `nano2.1`
+  and `nano-2.1`, on the CLI, in manifests and in `gflow run` configs (#1145, thanks @L1meSn0w).
+
+### Fixed
+
+- **A one-clip text-to-video run survives a lost submit reply.** Chrome sometimes drops the
+  reply to the submit while Flow makes and bills the clip, and gflow stopped with exit 9. It now
+  finds the clip by its exact prompt and model and follows it to the end, without a second
+  submit. With `--count` above 1, or when the project listing cannot name exactly one clip, it
+  still stops with exit 9, because adopting another run's clip would be worse (#1141).
+
+- **A finished text-to-video clip is downloaded again on flow.google.com.** Flow's status replies
+  now carry the clip's thumbnail link where the clip's link used to be. gflow took it for the clip, so a
+  billed run failed with exit 6 and `HTTP 302`, leaving nothing on disk. It now reads the clip
+  through the clip's own page, the same way `gflow data download` does, and checks its size.
+  A clip already stranded this way is recovered for free with
+  `gflow data download <media_id>` (#1153).
+
+- **An `@` mention that matches nothing no longer risks submitting the run.** gflow pressed
+  Enter even when the picker offered nothing, and with no picker open Enter starts the
+  generation. It now presses Enter only on an offered match and cancels a miss with Escape,
+  so the run stops with a clean `ReferenceNotFoundError` instead of a raw timeout, attached
+  references stay in place, and a retry can find the asset (#1143, thanks @L1meSn0w).
+
+- **`gflow auth login` opens on screen on a profile that has already generated.** Chrome saves
+  the off-screen generation window's position in the profile and, on the next launch, showed
+  only a sliver of the window at the screen's edge, with no setting to change it. Login now
+  sets its own position, `0,0`, on both the Playwright and the plain Chrome path.
+
+- **`auth status` and `auth login` survive a My Account request that cannot complete.** On
+  flow.google.com, gflow now reads Flow's signed-in workspace in that case and accepts the
+  session only if the project-creation control renders. The probe can now take up to about
+  2 minutes on a slow network (#1144, thanks @L1meSn0w).
+- **`auth login` no longer crashes when no account address can be read.** A verified login
+  without one finished with an `AssertionError`. It now succeeds and removes any old recorded
+  account, so `--account` and the chooser fail closed.
+
+### Security
+
+- `oauthlib` is locked at 4.0.1 for CVE-2026-49272. It reaches installs through the `gcs` extra,
+  which `uv.lock` does not bind for pip users.
+
 ## [0.92.1] — 2026-10-30
 
 ### Fixed
@@ -6787,7 +6833,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.92.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.93.0...HEAD
+[0.93.0]: https://github.com/ffroliva/gflow-cli/compare/v0.92.1...v0.93.0
 [0.92.1]: https://github.com/ffroliva/gflow-cli/compare/v0.92.0...v0.92.1
 [0.92.0]: https://github.com/ffroliva/gflow-cli/compare/v0.91.0...v0.92.0
 [0.91.0]: https://github.com/ffroliva/gflow-cli/compare/v0.90.0...v0.91.0

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/KNOWN_ISSUES.md

@@ -850,7 +850,7 @@ The contrasting message, **`no upload request ever left the page`**, means somet
 
 ### Chrome loses a reply body although Flow saved the write (migrated host)
 
-- **Status:** Mitigated · **Severity:** Medium (intermittent; the write usually saved) · **Affects:** the migrated `flow.google.com` host, local uploads (`--initial-frame`, `--ref`, `i2i` files), project create and rename, image submits, video submits · **Tracked:** [#1009](https://github.com/ffroliva/gflow-cli/issues/1009), [#1075](https://github.com/ffroliva/gflow-cli/issues/1075), [#1112](https://github.com/ffroliva/gflow-cli/issues/1112)
+- **Status:** Mitigated · **Severity:** Medium (intermittent; the write usually saved) · **Affects:** the migrated `flow.google.com` host, local uploads (`--initial-frame`, `--ref`, `i2i` files), project create and rename, image submits, video submits · **Tracked:** [#1009](https://github.com/ffroliva/gflow-cli/issues/1009), [#1075](https://github.com/ffroliva/gflow-cli/issues/1075), [#1112](https://github.com/ffroliva/gflow-cli/issues/1112), [#1141](https://github.com/ffroliva/gflow-cli/issues/1141)
 
 Distinct from #719 above, where no reply arrives at all. Here the reply arrives, but Chrome cannot hand its body over: `Network.getResponseBody: No data found for resource with given identifier`. Our spike saw it on 2 of 45 real `maseQ` uploads, and a fresh reload found both uploads saved ([spike](docs/superpowers/spikes/2026-10-20-migrated-upload-reply-body-eviction.md)). Before the fix, gflow reported the upload as a refused file (exit 27).
 
@@ -860,7 +860,7 @@ A project create or rename whose reply is late, not lost, takes the same path: o
 
 **Image submits (since v0.89.1, [#1075](https://github.com/ffroliva/gflow-cli/issues/1075)).** Flow had made the image every reported time. gflow now reads the run's new tile(s) off the project grid and downloads them, taking exactly the requested count once it holds still for a few seconds; an i2i reference is never counted. Any other count, or a grid it cannot read, still ends in exit **9** (`retryable: false`) naming the project page: check the project before re-running.
 
-**Video submits ([#1112](https://github.com/ffroliva/gflow-cli/issues/1112)).** About 1 in 7 r2v submits lost this reply in a 21-clip run, and Flow made and billed every one. A video run that uploaded a file (`--ref`, `--initial-frame`, `--end-frame`) is now followed to its clip: Flow's own status replies name the clip by the id of that upload, and if none does within a minute, gflow reads the project listing in a second tab. The run then finishes and downloads as usual, with one `migrated.video_submit_reply_lost` warning and no second submit ([spike](docs/superpowers/spikes/2026-10-27-lost-video-submit-recovery.md)). A text-to-video run, or an r2v run with characters only, uploads nothing that tells its clip apart from the project's other clips, so it still ends in exit **9** (`retryable: false`) naming the project. So does a run where two clips carry the upload, or none appears in time. Check the project before re-running.
+**Video submits ([#1112](https://github.com/ffroliva/gflow-cli/issues/1112)).** About 1 in 7 r2v submits lost this reply in a 21-clip run, and Flow made and billed every one. A video run that uploaded a file (`--ref`, `--initial-frame`, `--end-frame`) is now followed to its clip: Flow's own status replies name the clip by the id of that upload, and if none does within a minute, gflow reads the project listing in a second tab. The run then finishes and downloads as usual, with one `migrated.video_submit_reply_lost` warning and no second submit ([spike](docs/superpowers/spikes/2026-10-27-lost-video-submit-recovery.md)). A one-clip text-to-video run uploads nothing, so since v0.93.0 it is found by its exact prompt and model, and the project listing must name exactly one such clip once it finishes ([#1141](https://github.com/ffroliva/gflow-cli/issues/1141), [spike](docs/superpowers/spikes/2026-11-04-t2v-lost-submit-reply.md)). Text-to-video with `--count` above 1, an r2v run with characters only, or a clip the listing cannot name that way still ends in exit **9** (`retryable: false`) naming the project. So does a run where two clips carry the upload, or none appears in time. Check the project before re-running.
 
 **If it cannot confirm the outcome**, the command exits **7** with `RpcResponseUnavailableError` (`retryable: false`). The write may have saved. Open the project on flow.google.com and look for the title or the file name in the error before you re-run, or you may get a duplicate project or upload. `gflow run` does not re-upload a reference file after this error in the same run.
 
@@ -1579,7 +1579,8 @@ without cookies ([#1023](https://github.com/ffroliva/gflow-cli/issues/1023),
 [spike](docs/superpowers/spikes/2026-10-22-labs-session-oracle-gone.md)). A 410 is now
 read as "no labs session": a profile without Google cookies is `NO_SESSION`, and one with
 them is checked by the server-attested migrated-host probe (#791), which needs the Google
-SSO and flow.google.com session cookies, then reads `myaccount.google.com`. **Still open:**
+SSO and flow.google.com session cookies, then reads `myaccount.google.com` (or, only if that
+request cannot complete, Flow's rendered workspace). **Still open:**
 some access-token consumers that read the same URL are not ported. `gflow credits` is
 (#795: it reads flow.google.com's own balance reply). A login with `--browser internal` (bundled
 Chromium, also what `--browser auto` picks when Chrome is missing) runs the same on-disk

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.92.1
+Version: 0.93.0
 Summary: CLI and MCP server for Google Flow — drive Veo text-to-video, image-to-video and Imagen image generation from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Documentation, https://ffroliva.github.io/gflow-cli/
@@ -75,7 +75,7 @@ Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest-xdist>=3.6; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.17.2; extra == 'dev'
+Requires-Dist: ruff==0.17.3; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'

gflow_cli-0.93.0/dev/sharpit_app.py

@@ -0,0 +1,18 @@
+"""Dev-only entry point: gflow-daemon with the sharpit developer console.
+
+Not part of the wheel (hatch packages only ``src/gflow_cli``) and never imported by
+shipped code. sharpit is a dev-only dependency. Run::
+
+    uv run --with "sharpit==0.4.0" uvicorn dev.sharpit_app:app --reload
+"""
+
+import sharpit
+
+# Patch sqlite3.connect before the app is imported, so import-time connections are traced.
+sharpit.attach_sql_sources()
+
+from gflow_cli.ui.app import app  # noqa: E402 - must come after the patch
+
+sharpit.install(app)
+
+__all__ = ["app"]

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/docker/Dockerfile

@@ -45,7 +45,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Deliberately NOT pinned: google-chrome-stable. Chrome's apt repo keeps only the current
 # build, so a pinned version stops resolving within weeks. The trade-off is that this
 # layer caches indefinitely and a rebuild is what picks up a newer Chrome.
-ARG GFLOW_VERSION=0.92.1
+ARG GFLOW_VERSION=0.93.0
 RUN pip install --no-cache-dir "gflow-cli==${GFLOW_VERSION}"
 
 VOLUME ["/data"]

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/docs/ARCHITECTURE.md

@@ -97,7 +97,7 @@ class AuthStrategy(Protocol):
 - **Default — Playwright-owned Chrome.** Launches the system's real Google Chrome via Playwright's `channel="chrome"` with `chromium_sandbox=True`, `no_viewport=True`, `--disable-blink-features=AutomationControlled`, and `ignore_default_args=["--enable-automation"]`. What Google's G12 block keys on is a browser that *advertises* automation (`navigator.webdriver`), not the Playwright connection itself; with these flags the property is `false` and sign-in proceeds normally. See the G12 entry in [KNOWN_ISSUES.md](../KNOWN_ISSUES.md) for the 2026-09-08 measurement and its N=1 caveat.
 - Because gflow owns that context, it polls the Flow session endpoint from it until the outcome is `AUTHENTICATED` and then **closes the browser itself** — the user is not asked to close anything. A user who closes the window anyway is routed to the same `verify_flow_profile` check, never to an error.
 - **Automatic fallback — Passive Capture.** `login()` falls back on four conditions — a `headless=True` caller (the CLI exposes no such flag; this guards library callers), Playwright cannot resolve a Chrome channel (`browser_manager.is_playwright_chrome_channel_available()`), `launch_persistent_context` raises, or Google rejects the owned browser (`AuthBrowserRejectedError`, swallowed here rather than surfaced as exit 14) — and then silently falls back to the older shape: system Chrome via `subprocess.Popen` with no automation flags and no remote-debugging port, the CLI blocking on `proc.wait()` until the user closes the window. There is **no user-facing flag and no choice to make** — a Chromium-only host is never locked out of onboarding.
-- Verification: both paths end in the same `verify_flow_profile` call after the browser is gone. That probe is **httpx-first** — it reads the profile's cookie store directly via `browser_cookie3` and only falls back to a headless `launch_persistent_context` when cookie decryption fails (DPAPI on Windows, keychain on macOS, libsecret on Linux). The default path additionally polls the same session contract *from the browser it owns*, which is what tells it when to close. Both write the `.gflow_browser_strategy = "chrome"` marker that `channel_for_profile()` later reads.
+- Verification: both paths end in the same `verify_flow_profile` call after the browser is gone. That probe is **httpx-first** — it reads the profile's cookie store directly via `browser_cookie3` and falls back to a headless `launch_persistent_context` when cookie decryption fails (DPAPI on Windows, keychain on macOS, libsecret on Linux). On flow.google.com a headless probe then asks My Account and, only if that request cannot complete, reads Flow's rendered workspace. The default path additionally polls the same session contract *from the browser it owns*, which is what tells it when to close. Both write the `.gflow_browser_strategy = "chrome"` marker that `channel_for_profile()` later reads.
 - Privacy guard: raises `SecurityError` if the resolved `profile_dir` is outside `GFLOW_CLI_HOME` — protects the user's primary system Chrome profile from being used as a session store.
 
 **UiAutomationTransport (UI Mimicry)**:

{gflow_cli-0.92.1 → gflow_cli-0.93.0}/docs/AUTHENTICATION.md

@@ -96,7 +96,8 @@ profile_ffroliva/
 ```
 
 `.gflow_account` contains the plain email address (`ffroliva@gmail.com`) and is
-written by `gflow auth login` immediately after the session is verified. It is the
+written by `gflow auth login` immediately after the session is verified. If no address can
+be read from a verified session, the login still succeeds and any old file is removed. It is the
 source of truth for "which Google account is this profile signed into?", surfaced by
 `gflow auth list` and `profile_store.list_profiles()`.
 
@@ -233,8 +234,9 @@ window open for the full timeout while this page promised the opposite
 ([#849](https://github.com/ffroliva/gflow-cli/issues/849)). gflow now also stops waiting when
 the jar carries both halves of a migrated session — the `.google.com` SSO cookie *and* the
 `flow.google.com` app-session cookie. That second signal ends a wait; it does not decide
-anything. Verification still runs afterwards, against a server, on what actually landed on
-disk, and it is still the only thing that can call a login successful.
+anything. Verification still runs afterwards on what actually landed on disk, and it is still
+the only thing that can call a login successful. It asks a server (My Account) and, only if
+that request cannot complete, reads Flow's own signed-in workspace.
 
 **A timeout is not a verdict either.** If neither signal fires, gflow closes the window and
 *still* reads the profile before failing — "gflow verifies what's on disk either way" is the
@@ -268,7 +270,7 @@ use another `--profile` ([#984](https://github.com/ffroliva/gflow-cli/issues/984
 
 ### `gflow auth status`
 
-Reports where the profile lives, then **proves the session**: it probes the Flow session endpoint with the profile's cookies (no browser, no credits) and exits `0` only when the session is verified — `1` otherwise. Handy for scripts: `gflow auth status && gflow run ...`.
+Reports where the profile lives, then **proves the session**: it probes the session with the profile's cookies (no credits; on flow.google.com this opens a short-lived headless browser) and exits `0` only when the session is verified — `1` otherwise. Handy for scripts: `gflow auth status && gflow run ...`.
 
 ```bash
 $ gflow auth status
@@ -277,7 +279,7 @@ $ gflow auth status
   cookies_present: True
   cookies_path: /home/you/.local/share/gflow-cli/profile_default/Default/Cookies
   browser_engine: playwright
-Probing Flow session (may take up to ~45s on a slow network)...
+Probing Flow session (may take up to ~2 min on a slow network)...
 Flow session verified as you@example.com.
 ```
 
@@ -333,7 +335,8 @@ Profiles in /home/you/.local/share/gflow-cli
 
 The **Google account** column shows the email address from `.gflow_account`. Profiles
 created before develop post-v0.9.1 (before this feature shipped) will show `unknown`
-until `gflow auth login` is re-run against them — the file is written on every login.
+until `gflow auth login` is re-run against them — every login that can read an address
+writes the file.
 
 `--json` includes `google_account` per entry:
 
@@ -569,3 +572,6 @@ A: Handled by the browser during `auth login`. You'll do the MFA challenge once;
 
 **Q: How do I rotate a session?**
 A: Sign out of your Google account from the browser (any browser), then run `gflow auth login` again. The old cookies are now invalid; new ones replace them.
+
+**Q: What happens when My Account cannot be reached during `auth status`?**
+A: On the migrated host, verification first asks My Account. If that request cannot complete, it reads `https://flow.google.com/` in the same cookie context and accepts the session only if the visible project-creation control renders on that exact origin and path. An HTML 200, saved cookies, a public landing page or an identity challenge never authenticate. The probe clicks nothing and submits nothing.

{gflow_cli-0.92.1/website → gflow_cli-0.93.0}/docs/CONFIGURATION.md

@@ -387,6 +387,9 @@ headed, so Flow and reCAPTCHA see exactly the same browser.
 | `0,0`, `1920,0`, … | the window opens there: watch a run, or park it on a second monitor |
 | empty (`GFLOW_CLI_BROWSER_WINDOW_POSITION=`) | Chrome's own placement, the behaviour before this setting existed |
 
+**Login is not affected.** `gflow auth login` always opens at `0,0`, whatever this is set
+to and whatever position the profile saved from an earlier off-screen run.
+
 **When to bring it back on-screen:** to watch a run, debug a step, or record a demo.
 
 **Not for a screen that needs a person.** If a run stops on an account chooser, a Google

{gflow_cli-0.92.1/website → gflow_cli-0.93.0}/docs/E2E_TESTING.md

@@ -263,7 +263,7 @@ drift (`RED`); session now dead ⇒ genuine rot (`AUTH-EXPIRED`). The first live
 proved why this matters: an `AuthExpiredError` on `project.createProject`
 *looked* exactly like session rot, but the session verified clean seconds later —
 so it was a real divergence between two auth surfaces, and a name-matching
-classifier would have buried it. The extra probe costs ~45s and only runs after a
+classifier would have buried it. The extra probe costs up to ~2 min and only runs after a
 failure.
 
 > The route is `labs.google/fx/api/trpc/project.createProject` — the NextAuth