18790a7e4e
Three bugs, all found standing up a second rig on m3ultra:
1. SECURITY: HTTPServer(("", 8017)) bound 0.0.0.0 with no auth, and POST /save
base64-writes bytes to an absolute `dest` taken straight from the request body.
Anyone on the same wifi could write arbitrary files as this user — drop a
~/Library/LaunchAgents plist and you have code execution. It was live on ultra
(verified: `TCP *:8017 (LISTEN)`, 204 from 192.168.1.249). Now binds 127.0.0.1;
FLOW_BIND overrides for a tailnet IP (utun-routed, LAN still can't reach it).
2. The launchd "self-heal" never healed anything. launch.sh backgrounds the queue
server and exits; without AbandonProcessGroup launchd SIGKILLs the process group
on exit, so every 10-min tick started a server that died a second later. The
server that was actually up had been started by a manual ./launch.sh.
Verified after the fix: kill -> 000 -> kickstart -> 204 on a fresh pid.
3. launch.sh hard-coded "Brave Browser" in the osascript. The extension is loaded
into Chrome on m3ultra. FLOW_BROWSER now names it (default Brave, unchanged
for ultra); m3ultra's plist sets "Google Chrome".
Also chmod +x install.sh launch.sh (both had lost the bit).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|---|---|---|
| banks | ||
| .gitignore | ||
| background.js | ||
| content.js | ||
| flowclient.py | ||
| games.monsterrobot.flowrinse.plist | ||
| install.sh | ||
| launch.sh | ||
| local_server_example.py | ||
| manifest.json | ||
| popup.css | ||
| popup.html | ||
| popup.js | ||
| queue.jsonl | ||
| README.md | ||
| requeue.py | ||
| test_prompt_echo.mjs | ||
Flow Auto-Pilot
A Brave extension + local queue that drains a prompt bank through Google Labs Flow (Nano Banana 2 images, Veo videos) on the webui-only credits you can't reach via API. The extension types prompts into the Flow agent box with trusted CDP input (Flow ignores synthetic DOM events), waits for the media grid to grow, harvests the new asset URLs, and downloads them with the page's session cookies.
Not headless: Brave must be running and logged into the Flow account. But once the tab is open with Auto-start ticked, it runs unattended.
Parts
| File | Role |
|---|---|
manifest.json, background.js, content.js, popup.* |
the Brave MV3 extension |
local_server_example.py |
queue server on :8017 — queue.jsonl in, results.jsonl out |
queue.jsonl |
the prompt bank (one task per line) |
flowclient.py |
enqueue() / wait_for() so a game project can request assets |
launch.sh |
start server + keep Mac awake + open/focus one Flow tab |
install.sh + games.monsterrobot.flowrinse.plist |
self-healing launchd agent |
Run it by hand
./launch.sh https://labs.google/fx/tools/flow/project/<PROJECT_ID>
Server comes up (under caffeinate), Brave focuses the Flow tab, and with
Auto-start ticked the rinse begins. Files land in
~/Downloads/flowrinse/<category>/.
Run it unattended (launchd)
./install.sh
Fires launch.sh at login and every 10 min. Because launch.sh is idempotent
(port check + tab reuse), the repeat runs are no-ops that self-heal a dead
server or a closed tab.
macOS TCC gotcha (same as the vault-backup job): launchd can't execute
scripts inside ~/Documents, so install.sh runs a copy at
~/Library/Application Support/flowrinse/. That copy owns the live
queue.jsonl / results.jsonl / downloads/ once the agent is running.
Re-run ./install.sh after editing launch.sh or local_server_example.py
to resync the copy. First run pops one Automation prompt (allow control of
Brave) — click Allow on the rig's screen.
launchctl kickstart -k gui/$(id -u)/games.monsterrobot.flowrinse # run now
launchctl bootout gui/$(id -u)/games.monsterrobot.flowrinse # stop it
Enqueue from another project
from flowclient import enqueue
enqueue("Sierra EGA record-store back room, 160x168, 16-color",
kind="image", category="morp2_bg")
Or over the wire: POST http://localhost:8017/enqueue with
{"prompt","kind","model","category","dest"}.