[github-actions]

Closes #1229. Submitted by @JasprW.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1229.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Flowly v1.7.0 is approved, @JasprW. I updated the existing Git pin and review date, preserved your listing and original publication date, and removed the intake file. No action is needed for this update.

For the next release, add the new Skills, storage and telemetry behavior to your OVERVIEW.md, especially that usage/error reporting is on by default, goes to PostHog US, and can be disabled in Settings or with DO_NOT_TRACK=1. The README already explains these changes; bringing them into the listing page helps people decide before installing. Listing-page guidance.

Review data

• Policy: main REVIEW.md blob 8da1286fd8870c87ff53767e8644858627b7371f. Reviewed PR head 58ed32be66a825e9d599400ee9e321b4b405397c; original intake head fb9e69c373d63e9e4aa9cef824a0344a1311832d. Submission issue #1229 and its update request identify the repository owner as the submitter.
• Artifact: Git https://github.com/JasprW/flowly.git, root plugin, v1.7.0 resolves to requested commit 4f8d3d823a043f9233c12bd9be8c9aa79c68745b. Independently fetched the previously listed commit 05d189695c170c2458399cb5086ec308ae0aecfc and compared both trees. Git archive SHA-256 old/new: d6af73edd7a19ccb60feb7efbce48809587f623818940dfcbc55a531db3865a6 / eb11bf209a5dbef5b53cdef7f7e54e3dddad23883dfc2e7ba064fcb3f480c876. Paths/types checked before confined extraction; no submodules or hooks run.
• Inspection focused on changed server entry integration, SQLite migration/backups/restore/export, skill material and project writes, telemetry/error reporting, RPC schemas and affected controls. Compared the remaining runtime changes for added access/execution paths. Read the displayed English author overview and README, manifest, package metadata and lock. Reviewed the refreshed Insights screenshot; existing manifest media remains suitable. No listing translations are declared.
• Preparation remains npm ci --omit=dev --ignore-scripts --no-audit --no-fund --legacy-peer-deps. Runtime dependencies are unchanged. The 389 non-root lock entries pin npm registry sources and integrity; root dependencies match the manifest. The only install-script flag is a development-only fsevents entry, and scripts are suppressed. No package installation lifecycle script or new runtime software downloader found.
• After activation, telemetry checks first at five minutes, then hourly, sends a heartbeat no sooner than 20 hours after the previous successful one, and rate-limits filtered error reports. A random persistent installation ID accompanies version/platform/language/feature metadata, usage counts and model names. Requests go to https://us.i.posthog.com/i/v0/e/; no daemon credential is attached. Error payloads exclude the message and external paths, retaining type/code and filtered function/file/line metadata. Settings and environment off switches gate both paths. README and Settings disclose reporting. The daemon-version lookup uses the existing local authenticated connection; only the validated version is retained for the error payload.
• Skills analysis sends bounded card summaries, acceptance criteria, memory/corrections, skill metadata and command material to the selected agent provider. It is enabled by default unless a stored setting disables it; scheduled first analysis waits a full interval. Project files are written only through Add/Update in project: validated skill names, revision/open-draft checks and plugin-created ownership for updates; no Git commit or shell execution. Model suggestions remain text until accepted.
• SQLite writes use serialized transactions, parameterized values, migration snapshots and integrity/readback checks. Unsupported hosts retain JSON; divergent/missing data is refused. Restore accepts only recognized backup basenames, preserves the previous database and advances revisions; backup pruning stays within the plugin backup directory. No unrelated destructive action identified in these paths.
• Registry edits are limited to the existing record pin/review timestamp and intake removal. Author description, overview and media retained; no unused registry override created. Trusted current-main online validation passed: 389 well-formed records, one changed record matches its artifact. Exact-head registry CI passed before approval.
• Static inspection only: no plugin or dependency was installed, built, imported or executed. Author release CI succeeded on the requested artifact commit, with additional source tests/manual evidence supplied, but I did not independently exercise live UI, migration/crash behavior, external providers/connectors or dependency internals. No serious safety hold or factory-policy incompatibility identified.