@m13v/s4l 1.6.197-rc.7

package/skill/audit.sh

@@ -0,0 +1,287 @@
+#!/usr/bin/env bash
+# audit.sh — Post audit pipeline.
+#
+# Per-platform mode (preferred, driven by launchd via per-platform wrappers):
+#   --platform reddit    Reddit API audit via stats.py --reddit-only
+#   --platform moltbook  Moltbook API audit via stats.py --moltbook-only
+#   --platform twitter   Twitter API audit via stats.py --twitter-audit
+#   --platform linkedin  Retired 2026-04-17 (flagged CDP pattern). Engagement
+#                        stats now collected via stats.sh Step 4 (linkedin-agent
+#                        MCP, headed Chrome). Branch kept as no-op so the
+#                        audit-linkedin launchd job doesn't error.
+#
+# Every run also executes the orphan/summary step at the end (DB-only, cheap).
+# With no --platform, runs all four sequentially (legacy manual path).
+
+
+set -uo pipefail
+
+# Parse args.
+PLATFORM=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --platform)    PLATFORM="${2:-}"; shift 2 ;;
+        --platform=*)  PLATFORM="${1#--platform=}"; shift ;;
+        *)             shift ;;
+    esac
+done
+
+case "$PLATFORM" in
+    ""|reddit|twitter|linkedin|moltbook) ;;
+    *)
+        echo "audit.sh: invalid --platform '$PLATFORM' (expected reddit, twitter, linkedin, or moltbook)" >&2
+        exit 2
+        ;;
+esac
+
+# Per-platform lock name so all four can run concurrently, but a second
+# invocation of the same platform waits. Legacy no-platform run keeps the
+# original "audit" lock name.
+LOCK_NAME="audit${PLATFORM:+-$PLATFORM}"
+
+# Browser-profile lock first (shared across pipelines using the same browser),
+# then the pipeline-specific lock. moltbook has no shared browser profile.
+#
+# Reddit uses the unified Python lease (2026-05-10) — TTL-aware, auto-decays
+# during Claude idle gaps so peer pipelines can use the profile. The MCP
+# proxy heartbeats expires_at on every reddit-agent call. LinkedIn/Twitter
+# still use the bash lock (no MCP-proxy heartbeat wiring yet).
+source "$(dirname "$0")/lock.sh"
+REPO_DIR_FOR_LOCK="$HOME/social-autoposter"
+_release_reddit_lease() {
+    timeout 3 python3 "$REPO_DIR_FOR_LOCK/scripts/reddit_browser_lock.py" release 2>/dev/null || true
+}
+case "${PLATFORM:-all}" in
+    linkedin) acquire_lock "linkedin-browser" 3600 ;;
+    reddit)
+        python3 "$REPO_DIR_FOR_LOCK/scripts/reddit_browser_lock.py" acquire --timeout 3600 --ttl 90 2>&1 || \
+            echo "WARNING: reddit_browser_lock.py acquire failed; proceeding without lease."
+        trap '_release_reddit_lease; _sa_release_locks' EXIT INT TERM HUP
+        ;;
+    twitter|x) acquire_lock "twitter-browser" 3600 ;;
+    moltbook) ;;
+    all)
+        acquire_lock "linkedin-browser" 3600
+        python3 "$REPO_DIR_FOR_LOCK/scripts/reddit_browser_lock.py" acquire --timeout 3600 --ttl 90 2>&1 || \
+            echo "WARNING: reddit_browser_lock.py acquire failed; proceeding without lease."
+        trap '_release_reddit_lease; _sa_release_locks' EXIT INT TERM HUP
+        acquire_lock "twitter-browser" 3600
+        ;;
+esac
+acquire_lock "$LOCK_NAME" 3600
+
+# Load secrets
+# shellcheck source=/dev/null
+[ -f "$HOME/social-autoposter/.env" ] && source "$HOME/social-autoposter/.env"
+
+REPO_DIR="$HOME/social-autoposter"
+SKILL_FILE="$REPO_DIR/SKILL.md"
+LOG_DIR="$REPO_DIR/skill/logs"
+# HTTP-only lane (2026-06-01): all reads go through the s4l.ai API via
+# scripts/audit_helper.py. No DATABASE_URL, no psql, no fallback.
+AUDIT_HELPER="$REPO_DIR/scripts/audit_helper.py"
+
+mkdir -p "$LOG_DIR"
+LOG_TAG="${PLATFORM:-all}"
+LOG_FILE="$LOG_DIR/audit-${LOG_TAG}-$(date +%Y-%m-%d_%H%M%S).log"
+
+log() { echo "[$(date +%H:%M:%S)] $*" >> "$LOG_FILE"; echo "[$(date +%H:%M:%S)] $*"; }
+
+RUN_START=$(date +%s)
+log "=== Audit Pipeline Run (${LOG_TAG}): $(date) ==="
+
+# Decide which steps run for this invocation.
+if [ -z "$PLATFORM" ]; then
+    RUN_REDDIT=1; RUN_MOLTBOOK=1; RUN_TWITTER=1; RUN_LINKEDIN=1
+else
+    RUN_REDDIT=0; RUN_MOLTBOOK=0; RUN_TWITTER=0; RUN_LINKEDIN=0
+    case "$PLATFORM" in
+        reddit)   RUN_REDDIT=1 ;;
+        moltbook) RUN_MOLTBOOK=1 ;;
+        twitter)  RUN_TWITTER=1 ;;
+        linkedin) RUN_LINKEDIN=1 ;;
+    esac
+fi
+
+STEP1_EXIT=0
+STEP2_EXIT=0
+STEP3_EXIT=0
+
+# ═══════════════════════════════════════════════════════
+# Reddit API audit
+# ═══════════════════════════════════════════════════════
+if [ "$RUN_REDDIT" -eq 1 ]; then
+    log "Reddit: API audit (stats.py --reddit-only)"
+    if [ -z "$PLATFORM" ]; then
+        # Legacy all-platform path uses the combined default pass which also
+        # covers Moltbook + Twitter, so we don't duplicate them below.
+        python3 "$REPO_DIR/scripts/stats.py" >> "$LOG_FILE" 2>&1
+    else
+        python3 "$REPO_DIR/scripts/stats.py" --reddit-only >> "$LOG_FILE" 2>&1
+    fi
+    STEP1_EXIT=$?
+    if [ "$STEP1_EXIT" -ne 0 ]; then
+        log "Reddit: FAILED (exit $STEP1_EXIT)"
+    else
+        log "Reddit: Done"
+    fi
+fi
+
+# ═══════════════════════════════════════════════════════
+# Moltbook API audit
+# ═══════════════════════════════════════════════════════
+# Skip in legacy mode — already covered by the combined pass above.
+if [ "$RUN_MOLTBOOK" -eq 1 ] && [ -n "$PLATFORM" ]; then
+    log "Moltbook: API audit (stats.py --moltbook-only)"
+    python3 "$REPO_DIR/scripts/stats.py" --moltbook-only >> "$LOG_FILE" 2>&1
+    MOLTBOOK_EXIT=$?
+    if [ "$MOLTBOOK_EXIT" -ne 0 ]; then
+        log "Moltbook: FAILED (exit $MOLTBOOK_EXIT)"
+    else
+        log "Moltbook: Done"
+    fi
+fi
+
+# ═══════════════════════════════════════════════════════
+# Twitter API audit (fxtwitter — no browser)
+# ═══════════════════════════════════════════════════════
+if [ "$RUN_TWITTER" -eq 1 ]; then
+    TWITTER_COUNT=$(python3 "$AUDIT_HELPER" twitter-active-count 2>/dev/null || echo "0")
+
+    if [ "$TWITTER_COUNT" -gt 0 ]; then
+        log "Twitter: API audit — $TWITTER_COUNT active tweets"
+        python3 "$REPO_DIR/scripts/stats.py" --twitter-audit >> "$LOG_FILE" 2>&1
+        STEP2_EXIT=$?
+        if [ "$STEP2_EXIT" -ne 0 ]; then
+            log "Twitter: FAILED (exit $STEP2_EXIT)"
+        else
+            log "Twitter: Done"
+        fi
+    else
+        log "Twitter: SKIPPED — no active Twitter posts to audit"
+    fi
+fi
+
+# ═══════════════════════════════════════════════════════
+# LinkedIn audit — retired 2026-04-17 (flagged CDP fingerprint).
+# Post-engagement stats are now collected in stats.sh Step 4 via the
+# linkedin-agent MCP (headed Chrome). Deletion detection is not currently
+# covered; if needed, extend stats.sh Step 4 to parse 404 / "This post
+# isn't available" screens.
+# ═══════════════════════════════════════════════════════
+if [ "$RUN_LINKEDIN" -eq 1 ]; then
+    log "LinkedIn: SKIPPED — CDP audit retired (see stats.sh Step 4 for engagement stats via MCP)"
+fi
+
+# ═══════════════════════════════════════════════════════
+# Orphan / stale post detection + summary (DB-only, every run)
+# ═══════════════════════════════════════════════════════
+log "Orphan/stale detection"
+
+ORPHAN_REPORT=$(python3 "$AUDIT_HELPER" orphan-report 2>/dev/null || echo "")
+
+BROKEN_URL_COUNT=$(python3 "$AUDIT_HELPER" broken-url-count 2>/dev/null || echo "0")
+
+if [ -n "$ORPHAN_REPORT" ]; then
+    log "WARNING: Posts with non-standard status:"
+    echo "$ORPHAN_REPORT" | while IFS='|' read -r plat stat cnt; do
+        log "  $plat $stat: $cnt"
+    done
+fi
+if [ "$BROKEN_URL_COUNT" -gt 0 ]; then
+    log "WARNING: $BROKEN_URL_COUNT active posts with missing/invalid our_url"
+fi
+if [ -z "$ORPHAN_REPORT" ] && [ "$BROKEN_URL_COUNT" = "0" ]; then
+    log "Orphan/stale: Clean (no orphans, no broken URLs)"
+fi
+
+log "Summary"
+
+ACTIVE=$(python3 "$AUDIT_HELPER" status-count --status active 2>/dev/null || echo "?")
+DELETED=$(python3 "$AUDIT_HELPER" status-count --status deleted 2>/dev/null || echo "?")
+REMOVED=$(python3 "$AUDIT_HELPER" status-count --status removed 2>/dev/null || echo "?")
+
+log "Post status: active=$ACTIVE deleted=$DELETED removed=$REMOVED"
+
+# Log run to persistent monitor.
+RUN_ELAPSED=$(( $(date +%s) - RUN_START ))
+AUDIT_FAILED=$(( (STEP1_EXIT != 0 ? 1 : 0) + (STEP2_EXIT != 0 ? 1 : 0) + (STEP3_EXIT != 0 ? 1 : 0) ))
+SCRIPT_TAG="audit${PLATFORM:+-$PLATFORM}"
+
+# Sum per-platform STATS_JSON lines emitted by stats.py into log_run.py flags so
+# the dashboard Job History row shows real counters (scanned/checked/changed/
+# replies-refreshed/removed) instead of the legacy posted=<active_count> mush.
+# Each platform's stats.py print is followed by one `STATS_JSON: {...}` line;
+# we read them all from $LOG_FILE and aggregate by kind. Missing keys default to
+# 0 so the existing log_run.py flag surface stays unchanged.
+read -r SCANNED CHECKED CHANGED DELETED ERRORS REPLIES_REFRESHED REPLIES_FRESH THREADS_SCANNED THREADS_WRITTEN <<<"$(
+    python3 - "$LOG_FILE" <<'PY'
+import json, sys, re
+log_path = sys.argv[1]
+agg = dict(scanned=0, checked=0, changed=0, deleted=0, errors=0,
+           replies_refreshed=0, replies_fresh=0,
+           threads_scanned=0, threads_written=0)
+try:
+    with open(log_path) as f:
+        for line in f:
+            m = re.search(r"STATS_JSON:\s*(\{.*\})\s*$", line)
+            if not m:
+                continue
+            try:
+                d = json.loads(m.group(1))
+            except Exception:
+                continue
+            kind = d.get("kind")
+            if kind == "posts":
+                agg["scanned"] += int(d.get("total", 0) or 0)
+                agg["checked"] += int(d.get("checked", 0) or 0)
+                agg["changed"] += int(d.get("changed", 0) or 0)
+                agg["deleted"] += int(d.get("deleted", 0) or 0) + int(d.get("removed", 0) or 0)
+                agg["errors"]  += int(d.get("errors", 0) or 0)
+            elif kind == "replies":
+                agg["replies_refreshed"] += int(d.get("updated", 0) or 0)
+                agg["replies_fresh"]     += int(d.get("fresh", 0) or 0)
+            elif kind == "thread_snapshots":
+                agg["threads_scanned"] += int(d.get("scanned", 0) or 0)
+                agg["threads_written"] += int(d.get("written", 0) or 0)
+except FileNotFoundError:
+    pass
+print(agg["scanned"], agg["checked"], agg["changed"], agg["deleted"],
+      agg["errors"], agg["replies_refreshed"], agg["replies_fresh"],
+      agg["threads_scanned"], agg["threads_written"])
+PY
+)"
+SCANNED="${SCANNED:-0}"
+CHECKED="${CHECKED:-0}"
+CHANGED="${CHANGED:-0}"
+DELETED="${DELETED:-0}"
+ERRORS="${ERRORS:-0}"
+REPLIES_REFRESHED="${REPLIES_REFRESHED:-0}"
+REPLIES_FRESH="${REPLIES_FRESH:-0}"
+THREADS_SCANNED="${THREADS_SCANNED:-0}"
+THREADS_WRITTEN="${THREADS_WRITTEN:-0}"
+
+# Roll API errors from stats.py into the dashboard `failed` pill alongside
+# step-exit counts (same convention stats.sh uses).
+AUDIT_FAILED=$(( AUDIT_FAILED + ERRORS ))
+
+log "Per-run counters: scanned=$SCANNED checked=$CHECKED changed=$CHANGED removed=$DELETED errors=$ERRORS replies_refreshed=$REPLIES_REFRESHED replies_fresh=$REPLIES_FRESH thread_snapshots_written=$THREADS_WRITTEN"
+
+python3 "$REPO_DIR/scripts/log_run.py" \
+    --script "$SCRIPT_TAG" \
+    --posted 0 \
+    --skipped 0 \
+    --failed "$AUDIT_FAILED" \
+    --replies-refreshed "$REPLIES_REFRESHED" \
+    --checked "$CHECKED" \
+    --updated "$CHANGED" \
+    --removed "$DELETED" \
+    --scanned "$SCANNED" \
+    --changed "$CHANGED" \
+    --cost 0 \
+    --elapsed "$RUN_ELAPSED"
+
+log "=== Audit Pipeline complete (${LOG_TAG}): $(date) ==="
+
+# Clean up old logs (keep last 14 days) — covers both audit-all-* and audit-<platform>-*.
+find "$LOG_DIR" -name "audit-*.log" -mtime +14 -delete 2>/dev/null || true

package/skill/backfill-twitter-attempts-topic.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Periodic backfill of twitter_search_attempts.search_topic from
+# twitter_candidates (Pass A) + (batch_id, project_name) fanout (Pass B).
+# Runs every 5 minutes via com.m13v.social-twitter-attempt-topic-backfill.
+# Idempotent: each pass only touches rows where search_topic IS NULL, so
+# repeated runs converge to zero work once the topics are populated.
+#
+# Why this exists: skill/run-twitter-cycle.sh and score_twitter_candidates.py
+# are both chflags-locked. The picker (pick_search_topic.py) stamps
+# twitter_candidates.search_topic when it scores tweets, but the attempt row
+# stays NULL because the SCAN_SCHEMA in the locked shell doesn't carry the
+# topic through queries_used. This script closes that gap.
+set -euo pipefail
+
+REPO_DIR="${REPO_DIR:-/Users/matthewdi/social-autoposter}"
+PYTHON_BIN="${PYTHON_BIN:-/opt/homebrew/bin/python3.11}"
+
+cd "$REPO_DIR"
+exec "$PYTHON_BIN" scripts/backfill_twitter_attempts_topic.py --days 14

package/skill/backfill-twitter-ghost-posts.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Periodic recovery of "ghost" Twitter posts: replies that landed on x.com but
+# whose POST /api/v1/posts log call failed (rate-limit cap, transient 500, or
+# timeout), so twitter_post_plan.py marked the candidate 'skipped' and reported
+# log_post_no_id. The tweet is live; the DB forgot it.
+#
+# scripts/backfill_twitter_log_post_no_id.py reconstructs the missing posts rows
+# from skill/logs/twitter-cycle-*.log. It is idempotent: the API dedups on
+# (platform, thread_url), so already-recovered posts no-op.
+#
+# Runs every 30 min via com.m13v.social-twitter-ghost-backfill. We only scan the
+# last 3 days of cycle logs (rolling window) to keep each run fast; the original
+# 64 KB generation_trace outage (2026-05-12..13) was already backfilled once and
+# the cap is now 1 MB, so the steady-state cause is rate-limit / transient only.
+set -euo pipefail
+
+REPO_DIR="${REPO_DIR:-/Users/matthewdi/social-autoposter}"
+PYTHON_BIN="${PYTHON_BIN:-/opt/homebrew/bin/python3.11}"
+
+# macOS date: 3 days ago, YYYY-MM-DD. (date -v is macOS-only; this job is Aqua.)
+SINCE="$(date -v-3d +%Y-%m-%d)"
+
+cd "$REPO_DIR"
+exec "$PYTHON_BIN" scripts/backfill_twitter_log_post_no_id.py --since "$SINCE"

package/skill/check-external-pool-depth.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Wraps scripts/check_external_pool_depth.py for launchd. Fires at most one
+# email per (project, platform, severity) per 24h via DB-side cooldown.
+set -eu
+REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_DIR"
+exec /opt/homebrew/bin/python3.11 "$REPO_DIR/scripts/check_external_pool_depth.py"

package/skill/check-web-chats.sh

@@ -0,0 +1,203 @@
+#!/usr/bin/env bash
+# check-web-chats.sh, poll Postgres for unread web-chat messages and spawn one
+# Claude session per visitor. Called by launchd every 15 seconds.
+#
+# Mirror of ~/fazm/inbox/skill/check-founder-chat.sh: same lock pattern, same
+# claim/cooldown/retry/rate-limit guardrails, same email-summary escalation.
+# The only difference is the data layer: Postgres web_chat_threads /
+# web_chat_messages instead of Firestore founder_chats.
+
+set -euo pipefail
+
+# Ensure Homebrew bins (gtimeout, jq) AND the user's npm-global bin (claude)
+# are findable regardless of how the script is invoked. Launchd has these via
+# the plist's PATH; manual / sandboxed shells may not.
+export PATH="/Users/matthewdi/.nvm/versions/node/v20.19.4/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+source "$(dirname "$0")/lock.sh"
+acquire_lock "check-web-chats" 60
+
+# DB access is HTTP-only via scripts/http_api.py -> s4l.ai /api/v1/web-chat/*.
+# No DATABASE_URL needed here any more.
+
+# send-email.js needs RESEND_API_KEY + the analytics node_modules.
+ANALYTICS_ENV="$HOME/analytics/.env.production.local"
+if [ -f "$ANALYTICS_ENV" ]; then
+    export RESEND_API_KEY=$(grep '^RESEND_API_KEY=' "$ANALYTICS_ENV" | sed 's/^RESEND_API_KEY=//' | tr -d '"' | tr -d '\\n')
+fi
+export NODE_PATH="$HOME/analytics/node_modules"
+
+REPO_DIR="$HOME/social-autoposter"
+SCRIPTS_DIR="$REPO_DIR/scripts"
+LOG_DIR="$REPO_DIR/skill/logs"
+mkdir -p "$LOG_DIR"
+
+PYTHON_BIN="${PYTHON_BIN:-/opt/homebrew/bin/python3.11}"
+[ -x "$PYTHON_BIN" ] || PYTHON_BIN="/usr/bin/python3"
+
+log() { echo "[$(date +%H:%M:%S)] $*" >> "$LOG_DIR/web-chat.log"; }
+
+# Step 1: query Postgres for unread threads.
+CHATS=$("$PYTHON_BIN" "$SCRIPTS_DIR/check_unread_web_chats.py" 2>>"$LOG_DIR/web-chat.log")
+if [ "$CHATS" = "[]" ] || [ -z "$CHATS" ]; then
+    exit 0
+fi
+
+NUM=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; print(len(json.load(sys.stdin)))")
+
+for i in $(seq 0 $((NUM - 1))); do
+    THREAD_ID=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; print(json.load(sys.stdin)[$i]['thread_id'])")
+    PROJECT=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; print(json.load(sys.stdin)[$i]['project'])")
+    EMAIL=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; print(json.load(sys.stdin)[$i].get('visitor_email',''))")
+    NAME=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; d=json.load(sys.stdin)[$i]; print(d.get('visitor_name') or d.get('visitor_email') or 'visitor')")
+    UNREAD=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; print(json.load(sys.stdin)[$i]['unread'])")
+    PAGE_URL=$(echo "$CHATS" | "$PYTHON_BIN" -c "import json,sys; print(json.load(sys.stdin)[$i].get('page_url',''))")
+
+    PID_FILE="/tmp/web-chat-${THREAD_ID}.pid"
+
+    # Rate-limit circuit breaker (mirror Fazm /tmp/fazm-chat-ratelimit).
+    if [ -f "/tmp/web-chat-ratelimit" ]; then
+        RL_TS=$(awk '{print $2}' /tmp/web-chat-ratelimit 2>/dev/null || echo "0")
+        NOW_TS=$(date +%s)
+        if [ $((NOW_TS - RL_TS)) -lt 3600 ]; then
+            continue
+        else
+            rm -f /tmp/web-chat-ratelimit
+        fi
+    fi
+
+    # Skip if a Claude session is already alive for this thread.
+    if [ -f "$PID_FILE" ]; then
+        EXISTING_PID=$(cat "$PID_FILE" 2>/dev/null || echo "")
+        if [ -n "$EXISTING_PID" ] && kill -0 "$EXISTING_PID" 2>/dev/null; then
+            log "Session already active for $PROJECT/$THREAD_ID (pid $EXISTING_PID), skipping"
+            continue
+        fi
+        rm -f "$PID_FILE"
+    fi
+
+    log "Spawning session for $PROJECT/$THREAD_ID ($EMAIL, $UNREAD unread)"
+
+    # Cooldown check (mirror claim-chat --check-only).
+    if ! "$PYTHON_BIN" "$SCRIPTS_DIR/claim_web_chat.py" "$THREAD_ID" --check-only 2>>"$LOG_DIR/web-chat.log"; then
+        log "Thread $THREAD_ID in cooldown, skipping"
+        continue
+    fi
+
+    # Claim (resets unread, sets 5-min cooldown).
+    "$PYTHON_BIN" "$SCRIPTS_DIR/claim_web_chat.py" "$THREAD_ID" 2>>"$LOG_DIR/web-chat.log" \
+        || log "WARNING: claim failed for $THREAD_ID"
+
+    # Build prompt (history is dumped from Postgres for freshness).
+    HISTORY_JSON=$("$PYTHON_BIN" "$SCRIPTS_DIR/dump_web_chat_history.py" --thread "$THREAD_ID")
+
+    # Pull this project's config block to give Claude context.
+    PROJECT_CFG=$(/opt/homebrew/bin/jq --arg n "$PROJECT" '.projects[] | select(.name==$n)' "$REPO_DIR/config.json" 2>/dev/null || echo "{}")
+
+    PROMPT_FILE=$(mktemp)
+    cat > "$PROMPT_FILE" <<PROMPT_EOF
+Read ~/social-autoposter/skill/WEB-CHAT-SKILL.md for the workflow.
+Read ~/social-autoposter/skill/WEB-CHAT-VOICE.md for tone rules.
+
+## Web chat to handle
+
+PROJECT: $PROJECT
+THREAD_ID: $THREAD_ID
+VISITOR_EMAIL: $EMAIL
+VISITOR_NAME: $NAME
+PAGE_URL: $PAGE_URL
+UNREAD MESSAGES: $UNREAD
+
+## Project config (config.json)
+\`\`\`json
+$PROJECT_CFG
+\`\`\`
+
+## Full conversation history (from Postgres)
+\`\`\`json
+$HISTORY_JSON
+\`\`\`
+
+Process this chat now. Follow WEB-CHAT-SKILL.md exactly.
+Remember to remove the PID file /tmp/web-chat-${THREAD_ID}.pid when done.
+PROMPT_EOF
+
+    SESSION_LOG="$LOG_DIR/web-chat-session-${THREAD_ID}-$(date +%Y%m%d_%H%M%S).log"
+    FAIL_COUNT_FILE="/tmp/web-chat-fail-${THREAD_ID}"
+
+    (
+        set +e
+        cd "$REPO_DIR"
+        echo "[$(date)] Starting Claude session for $PROJECT/$THREAD_ID ($EMAIL)" >> "$SESSION_LOG"
+        gtimeout 1200 claude \
+            -p "$(cat "$PROMPT_FILE")" \
+            --dangerously-skip-permissions \
+            >> "$SESSION_LOG" 2>&1
+        EXIT_CODE=$?
+        echo "[$(date)] Claude exited with code $EXIT_CODE" >> "$SESSION_LOG"
+
+        if [ $EXIT_CODE -ne 0 ]; then
+            echo "[$(date)] WARN: session for $THREAD_ID exited with $EXIT_CODE" >> "$LOG_DIR/web-chat.log"
+
+            # Detect persistent-error states that won't recover with quick retry:
+            # rate limits, credit/billing, auth/quota, account-level issues.
+            # All trip the same 1h pause; the next cycle re-tries automatically.
+            # Pending threads stay in Postgres (unread_by_founder>0) so nothing is
+            # ever lost; the launchd poller picks them up the moment the 1h
+            # marker expires. No human notification — the log line is enough.
+            PAUSE_PATTERNS='hit your limit|rate limit|rate.limited|too many requests|usage limit|weekly limit|5.hour limit|credit balance|out of credit|insufficient (credit|funds|balance)|payment required|billing|quota exceeded|api[- ]?key|unauthori[sz]ed|forbidden|account.{0,30}(suspend|disabled)|HTTP 401|HTTP 403|HTTP 429|invalid.*x.api.key'
+            if grep -qiE "$PAUSE_PATTERNS" "$SESSION_LOG" 2>/dev/null; then
+                echo "[$(date)] PERSISTENT ERROR on $THREAD_ID (rate limit / credits / auth), pausing all spawns for 1h" >> "$LOG_DIR/web-chat.log"
+                echo "rate_limited $(date +%s)" > "/tmp/web-chat-ratelimit"
+                rm -f "$PROMPT_FILE" "$PID_FILE" "$FAIL_COUNT_FILE"
+                exit 0
+            fi
+
+            FAILS=0
+            [ -f "$FAIL_COUNT_FILE" ] && FAILS=$(cat "$FAIL_COUNT_FILE" 2>/dev/null || echo "0")
+            FAILS=$((FAILS + 1))
+            echo "$FAILS" > "$FAIL_COUNT_FILE"
+
+            if [ "$FAILS" -ge 3 ]; then
+                echo "[$(date)] GIVING UP on $THREAD_ID after $FAILS fails" >> "$LOG_DIR/web-chat.log"
+                rm -f "$FAIL_COUNT_FILE"
+                # Leave claimed so it stops retrying.
+            else
+                "$PYTHON_BIN" "$SCRIPTS_DIR/unclaim_web_chat.py" "$THREAD_ID" >> "$LOG_DIR/web-chat.log" 2>&1
+                echo "[$(date)] Unclaimed $THREAD_ID (retry $FAILS/3)" >> "$LOG_DIR/web-chat.log"
+            fi
+        else
+            # Claude finished cleanly (replied OR explicitly skipped). Stamp
+            # processed_at so the recovery query in check_unread_web_chats.py
+            # won't re-flag this thread next cycle. Without this, threads where
+            # Claude legitimately skipped (smoke test, off-topic, no useful
+            # answer) loop every 5min for 24h, since last_message_sender stays
+            # 'visitor' (no agent message inserted on skip).
+            "$PYTHON_BIN" "$SCRIPTS_DIR/mark_web_chat_processed.py" "$THREAD_ID" >> "$LOG_DIR/web-chat.log" 2>&1
+            rm -f "$FAIL_COUNT_FILE"
+        fi
+
+        # No-output guard (silent rate limits sometimes). If Claude exited 0
+        # but produced almost no output, treat as a silent failure: unclaim
+        # so the next cycle retries via the main unread>0 path. The
+        # processed_at stamp above is harmless here because the main SELECT
+        # gates on unread_by_founder>0, not on processed_at.
+        LINE_COUNT=$(wc -l < "$SESSION_LOG" 2>/dev/null || echo "0")
+        if [ "$LINE_COUNT" -le 2 ] && [ "$EXIT_CODE" -eq 0 ]; then
+            echo "[$(date)] WARN: $THREAD_ID produced no output, unclaiming" >> "$LOG_DIR/web-chat.log"
+            "$PYTHON_BIN" "$SCRIPTS_DIR/unclaim_web_chat.py" "$THREAD_ID" >> "$LOG_DIR/web-chat.log" 2>&1
+        fi
+
+        rm -f "$PROMPT_FILE" "$PID_FILE"
+    ) &
+
+    CLAUDE_PID=$!
+    echo "$CLAUDE_PID" > "$PID_FILE"
+    log "Started session for $PROJECT/$THREAD_ID (pid $CLAUDE_PID)"
+done
+
+# Trim log to last 2000 lines.
+if [ -f "$LOG_DIR/web-chat.log" ]; then
+    tail -2000 "$LOG_DIR/web-chat.log" > "$LOG_DIR/web-chat.log.tmp" 2>/dev/null && \
+        mv "$LOG_DIR/web-chat.log.tmp" "$LOG_DIR/web-chat.log" || true
+fi