gflow-cli 0.97.0__tar.gz → 0.98.0__tar.gz

gflow_cli-0.98.0/.claude/commands/gflow/optimize.md

@@ -0,0 +1,9 @@
+---
+description: Make gflow-cli's tests and CI fast without weakening them - measure, find what dominates, apply the lever that fits (per-test cost, -n, shards, rebalancing, profile clones for e2e). Targets CI 3-5 min.
+---
+
+# `/gflow:optimize [ci | local | e2e]` — test and CI speed
+
+**Read `skills/optimize/SKILL.md` and follow the protocol**, passing `$ARGUMENTS` if given.
+
+> Do **not** call `Skill(skill="optimize")` — read the file directly.

gflow_cli-0.98.0/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "gflow",
+  "version": "0.98.0",
+  "description": "Reusable development and operations workflows for gflow-cli",
+  "author": {
+    "name": "Flavio Oliva",
+    "url": "https://github.com/ffroliva"
+  },
+  "homepage": "https://github.com/ffroliva/gflow-cli",
+  "repository": "https://github.com/ffroliva/gflow-cli",
+  "license": "MIT",
+  "keywords": [
+    "gflow-cli",
+    "codex",
+    "google-flow"
+  ],
+  "skills": "./plugins/gflow/skills/",
+  "interface": {
+    "displayName": "gflow-cli",
+    "shortDescription": "Develop, validate, review, and operate gflow-cli.",
+    "longDescription": "Project workflows for planning, validation, issue handling, reviews, releases, and Google Flow CLI operations.",
+    "developerName": "Flavio Oliva",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Interactive",
+      "Write"
+    ],
+    "websiteURL": "https://github.com/ffroliva/gflow-cli",
+    "defaultPrompt": [
+      "Show the current gflow-cli task with $gflow:status.",
+      "Run the gflow-cli quality gates with $gflow:check."
+    ]
+  }
+}

gflow_cli-0.98.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,94 @@
+name: Bug report
+description: A gflow command or MCP tool did something wrong.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. Before you file: if Flow itself seems to have changed (a selector or wire stopped working), use the **Flow surface change** form instead. Auth or reCAPTCHA trouble? Check [KNOWN_ISSUES.md](https://github.com/ffroliva/gflow-cli/blob/develop/KNOWN_ISSUES.md) first.
+  - type: input
+    id: version
+    attributes:
+      label: gflow version
+      description: Output of `gflow --version`.
+      placeholder: gflow-cli 0.97.0
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: Windows 11 / macOS 15 / Ubuntu 24.04
+    validations:
+      required: true
+  - type: dropdown
+    id: install
+    attributes:
+      label: Install method
+      options:
+        - uv tool
+        - pipx
+        - pip
+        - source checkout
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Which surface reproduces it?
+      description: The CLI and the MCP server are separate adapters over one service. If you only tried one, say so.
+      options:
+        - CLI
+        - MCP
+        - Both
+        - Only tried one of them
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Exact command or MCP tool call
+      description: The full `gflow ...` command line, or the MCP tool name and its arguments.
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: host
+    attributes:
+      label: Host Flow served
+      description: The address in the browser gflow drove. This records what was served, not what your account can or cannot do.
+      options:
+        - flow.google.com
+        - labs.google
+        - Not observed
+    validations:
+      required: true
+  - type: textarea
+    id: expected_actual
+    attributes:
+      label: Expected vs actual
+      placeholder: |
+        Expected: ...
+        Actual: ...
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Exit code and problem details
+      description: Paste the exit code (3-39) and the RFC 9457 problem-details JSON, including `charged` and `next_action`, from the `--json` output you already have. Do not re-run a paid generation to collect it. If `charged` is `yes` or `maybe`, follow `next_action` first; a billed clip that failed to download is recovered with `gflow data download <media-id>`.
+      render: json
+  - type: textarea
+    id: doctor
+    attributes:
+      label: "`gflow doctor` output"
+      description: Read-only, spends nothing. Exit 33 just means it found something.
+      render: text
+  - type: checkboxes
+    id: redaction
+    attributes:
+      label: Redaction
+      description: gflow redacts tokens and cookies in its own error output by default, but logs, screenshots and pasted text may still carry them.
+      options:
+        - label: I removed tokens, cookies, signed media URLs and account emails from everything above.
+          required: true

gflow_cli-0.98.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability (private)
+    url: https://github.com/ffroliva/gflow-cli/security/advisories/new
+    about: Secret leaks, auth bypass, supply-chain concerns. Never open a public issue — see docs/SECURITY.md § Reporting.
+  - name: Documentation
+    url: https://ffroliva.github.io/gflow-cli/docs/
+    about: The docs site. Offline, `gflow docs --search TERM` searches the same docs bundled with your install.
+  - name: Questions and ideas
+    url: https://github.com/ffroliva/gflow-cli/discussions
+    about: How-to questions and open-ended ideas belong in Discussions.

gflow_cli-0.98.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Something gflow should do that it does not.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do, and what stops you today? Start here, not with the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: The behaviour you would like. Example commands welcome.
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Where should it live?
+      description: Every user-facing CLI capability has an MCP twin, or a recorded reason it does not. Say which door you would use.
+      options:
+        - CLI and MCP
+        - CLI only (say why below)
+        - MCP only (say why below)
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: flow
+    attributes:
+      label: Does Flow already do this in the web app?
+      description: If yes, which host served it (flow.google.com / labs.google) and how you reach it there. A feature gflow cannot drive yet is usually "not ported yet", not missing from Flow.
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Workarounds you use now

gflow_cli-0.98.0/.github/ISSUE_TEMPLATE/flow_surface_change.yml

@@ -0,0 +1,64 @@
+name: Flow surface change
+description: Flow changed — a selector, menu or wire call gflow relies on stopped working.
+labels: ["bug", "investigation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        gflow drives a product it does not control, so the most useful thing here is what Flow actually rendered or called on your machine.
+
+        **A timeout is not proof of absence.** A selector that misses is evidence about the selector, never about the feature. Please describe what you *observed*, and if you can, capture it with the $0 spike tools: [skills/spike](https://github.com/ffroliva/gflow-cli/blob/develop/skills/spike/SKILL.md) and [docs/E2E_TESTING.md](https://github.com/ffroliva/gflow-cli/blob/develop/docs/E2E_TESTING.md).
+  - type: input
+    id: version
+    attributes:
+      label: gflow version
+      description: Output of `gflow --version`.
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command or MCP tool call
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: host
+    attributes:
+      label: Host Flow served
+      options:
+        - flow.google.com
+        - labs.google
+        - Not observed
+    validations:
+      required: true
+  - type: input
+    id: locale
+    attributes:
+      label: Account / UI locale
+      description: Flow's UI language for this account (gflow's selectors must not depend on it).
+      placeholder: en, pt-BR, vi ...
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: What Flow did vs what gflow expected
+      description: What you saw in the web app at that step (button, menu, dialog, request), and the exit code / problem details gflow returned (`--json`).
+    validations:
+      required: true
+  - type: textarea
+    id: har
+    attributes:
+      label: Redacted HAR summary (optional)
+      description: |
+        Only the output of `python scripts/dev/har-spike/extract_har_summary.py <capture>.har`. Keep its default `--host aisandbox-pa.googleapis.com` (the API host); passing the served host drops the API requests. **Never attach a raw HAR** — it carries cookies, Bearer tokens and prompts.
+        The summary replaces every free-text value with its length (#1269); still read it before posting.
+      render: text
+  - type: checkboxes
+    id: redaction
+    attributes:
+      label: Redaction
+      options:
+        - label: I attached no raw HAR or incident bundle, and removed tokens, cookies, signed URLs, account emails and prompt text.
+          required: true

gflow_cli-0.98.0/.github/dependabot.yml

@@ -0,0 +1,150 @@
+# Dependabot configuration
+# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Python dependencies.
+  #
+  # This MUST be "uv", not "pip". The "pip" ecosystem reads pyproject.toml only
+  # and has no visibility into uv.lock — but every install path in this repo
+  # (`uv sync`, CI, the release build) resolves from the LOCKFILE. The result
+  # was a repo where no transitive dependency had ever received an update PR:
+  # scan the Dependabot history before 2026-08 and every single PR is a direct
+  # dev dep (ruff, patchright) or a GitHub Action. `cryptography` is pulled in
+  # via browser-cookie3, appears nowhere in pyproject.toml, and so sat on a
+  # version with a published CVE until the v0.50.0 release PR tripped pip-audit.
+  # The "uv" ecosystem reads pyproject.toml AND uv.lock, so transitive pins
+  # finally get bumped. See docs.astral.sh/uv/guides/integration/dependabot/.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 5
+    # These labels must EXIST before Dependabot can apply them. When they did
+    # not, every bump PR opened with a bot comment reading "The following labels
+    # could not be found: dependencies, python" and landed unlabelled, so
+    # `label:dependencies` matched nothing. `.github/workflows/labels.yml` is
+    # the source of truth that keeps them created — edit both together.
+    labels:
+      - "dependencies"
+      - "python"
+    groups:
+      # Since the ecosystem became "uv", a bump PR is opened per LOCKED package
+      # -- transitives included -- so a routine week resolves ~38 updates into a
+      # queue five PRs wide. On 2026-08-04 that queue ate itself: #441/#442 were
+      # opened, then closed unmerged by Dependabot ("Looks like aiohttp is
+      # up-to-date now") because the CVE bumps they carried had already been
+      # applied by hand in #443 while they waited behind the cap. Grouping makes
+      # the week arrive as ONE reviewable PR that cannot be overtaken.
+      #
+      # Majors stay ungrouped deliberately: this cycle alone offered protobuf
+      # 6 -> 7 and structlog 25 -> 26, and a breaking transitive must be able to
+      # fail on its own rather than red-lighting the whole batch.
+      python-minor-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    # NOTE: security updates are intentionally NOT grouped. They are exempt from
+    # `groups` unless a group sets `applies-to: security-updates`, so an advisory
+    # fix still opens immediately on its own instead of waiting for Monday.
+    ignore:
+      # playwright MINORS must be ignored here. They are NOT gated by the
+      # `<1.62.0` upper bound in pyproject.toml -- that was the assumption this
+      # rule used to state, and PR #465 falsified it. The "uv" ecosystem does
+      # not respect a constraint standing in an update's way, it REWRITES it:
+      # #465 widened `playwright>=1.61.0,<1.62.0` to `<1.63.0` and locked
+      # 1.62.0 -- the exact version observed hanging every `video i2v` right
+      # after the frame upload (see the bound's comment in pyproject.toml).
+      # Only tests/test_playwright_pin.py stopped it, and on its way out it
+      # red-lighted the whole grouped weekly batch.
+      #
+      # PATCH bumps stay allowed on purpose: the 1.61.x headroom exists so a
+      # driver CVE fix does not require a gflow release. Raising a MINOR is a
+      # deliberate, live-verified act (AGENTS.md "verify before you act") and
+      # also means hand-editing SUPPORTED_PLAYWRIGHT_RANGE in
+      # src/gflow_cli/api/transports/_video_common.py, which no bot can
+      # do -- so a bot-authored minor bump can never be mergeable here anyway.
+      # The weekly `deps-watch` workflow reports how far behind the pin has
+      # drifted so it does not freeze unnoticed.
+      - dependency-name: "playwright"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+      # patchright is the SAME hazard with a bigger blast radius, and the exact
+      # `==` pin protects it no better than playwright's upper bound protected
+      # playwright -- an exact pin is just another constraint for the "uv"
+      # ecosystem to rewrite. It ships a PATCHED Chromium driver that loads the
+      # real Google session (cookies, OAuth Bearer, SAPISID), so docs/SECURITY.md
+      # requires every bump to get a security review and explicitly says it is
+      # "NOT a routine dependabot auto-merge". That was prose with nothing
+      # enforcing it; this is the enforcement. ALL update-types, patch included:
+      # any version change moves the browser binary underneath the user.
+      - dependency-name: "patchright"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+
+  # Docker — the base image in docker/Dockerfile (python:3.14-slim).
+  #
+  # This covers the FROM line and nothing else. Dependabot has no view into packages
+  # installed by a RUN, so `google-chrome-stable` is NOT tracked here: it is pulled
+  # unpinned from Google's apt repo, which keeps only the current build, and a rebuild
+  # is what picks up a newer Chrome. The gflow-cli version is pinned separately via
+  # `ARG GFLOW_VERSION` and gated by tests/test_dockerfile_version_pin.py, so between
+  # the three of them every input to the image has a named owner.
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 3
+    # Kept in sync with .github/workflows/labels.yml — see the note above.
+    labels:
+      - "dependencies"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 5
+    # Kept in sync with .github/workflows/labels.yml — see the note above.
+    labels:
+      - "dependencies"
+      - "github-actions"
+    groups:
+      # Actions majors are grouped too. Unlike Python transitives they are few,
+      # uniform, and already reviewed as a batch in practice -- 2026-07-20 alone
+      # opened four separate PRs (#352-#355) for what is one "bump the actions"
+      # decision, including checkout 4 -> 7 on a workflow the earlier #196 had
+      # already moved to 6.
+      github-actions:
+        applies-to: version-updates
+        patterns: ["*"]
+
+  # uv — the hash-pinned MkDocs set for the Pages build
+  # (website/requirements.txt, compiled from website/requirements.in).
+  # "uv", NOT "pip", for the same reason as the root entry: the pip ecosystem
+  # would regenerate the file with pip-compile, clobbering the uv-authored
+  # header/format; dependabot's uv ecosystem recompiles .in → .txt via
+  # `uv pip compile` and keeps the hashes.
+  - package-ecosystem: "uv"
+    directory: "/website"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Lisbon"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+      - "python"