@m13v/s4l 1.6.197-rc.7

package/mcp/dist/version.js

@@ -0,0 +1,271 @@
+// Version resolution + update checks for the social-autoposter MCP.
+//
+// The "real" version is the top-level `social-autoposter` npm package version
+// (e.g. 1.6.x) — that is what actually bundles this MCP's prebuilt dist/. The
+// MCP's own package.json and manifest are stamped to the same version at release
+// time (scripts/release-mcpb.sh step 3b), but historically they were frozen at
+// 0.0.1, so this module still resolves the true version from the most
+// authoritative source available at runtime (and tolerates a stale co-located
+// package.json on an old bundle). It can also check npm for a newer published
+// release so we can deliver updates on demand.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { repoDir, run } from "./repo.js";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+function readJsonVersion(p) {
+    try {
+        const v = JSON.parse(fs.readFileSync(p, "utf-8")).version;
+        return typeof v === "string" && v.length > 0 ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Resolve the REAL shipped version. Priority, most authoritative first:
+//   1. dist/version.json  — stamped by the CLI installer (bin/cli.js installMcp)
+//      from the npm package version at every init/update. Authoritative on a
+//      real user install, where the top-level package.json is NOT copied.
+//   2. <repo>/package.json — git checkout / dev machine: the meaningful 1.6.x.
+//   3. mcp/package.json    — co-located last resort (release-stamped to match,
+//      but may be stale on an older bundle).
+export function resolveVersion() {
+    return (readJsonVersion(path.join(__dirname, "version.json")) ||
+        readJsonVersion(path.join(repoDir(), "package.json")) ||
+        readJsonVersion(path.join(__dirname, "..", "package.json")) ||
+        "0.0.0-unknown");
+}
+export const VERSION = resolveVersion();
+// Best-effort latest released version, cached per-process with a TTL. Never throws.
+//
+// SOURCE = GitHub releases/latest, NOT npm. This is deliberate and load-bearing:
+//   • The .mcpb boxes that run the menu-bar have NO npm/npx on PATH (PATH is just
+//     /usr/bin:/bin:/usr/sbin:/sbin). The old `npm view` probe threw there, so
+//     `latest` was always null, `update_available` was always false, and the
+//     "⬆ Update available" banner could NEVER fire on a box — even when a new
+//     release was live. (That is exactly the bug this replaced: box stuck on
+//     1.6.177 while 1.6.181 was out, banner silent.)
+//   • GitHub releases/latest is the SAME source the box updater installs from
+//     (scripts/s4l_box_update.sh + menu-bar `_mcpb_update_work` pull the .mcpb
+//     from releases/latest/download). Detecting from the same place the update
+//     comes from means "update available" and "what an update installs" can
+//     never disagree (npm publish and the GitHub release step could otherwise
+//     drift). curl lives at /usr/bin/curl, present in every PATH, so this works
+//     with zero npm dependency.
+// npm stays as a fallback only for the rare case GitHub is unreachable (and for
+// dev machines checking a version that is on npm but not yet released).
+//
+// TTL is ~1 minute (a new release must surface within a minute — mirrored in
+// scripts/snapshot.py, the copy the menu bar actually renders from; keep the two
+// in lockstep). Probe order (measured 2026-07-01 releasing v1.6.188):
+//   1. api.github.com releases/latest with a CONDITIONAL request (If-None-Match).
+//      The API reflects a new release near-instantly, and GitHub does NOT count
+//      304 responses against the unauthenticated 60/h-per-IP quota, so a 1-min
+//      cadence is quota-free between releases (each release costs one 200). A
+//      plain (unconditional) 1-min API poll would burn the whole quota.
+//   2. The website redirect (302 to /releases/tag/vX.Y.Z): un-rate-limited
+//      fallback, but GitHub's web tier lagged the API by ~2 minutes, so not primary.
+//   3. npm (dev machines only; boxes have no npm).
+let cache = null;
+const TTL_MS = 55 * 1000;
+const RELEASES_LATEST_URL = "https://github.com/m13v/s4l/releases/latest";
+const RELEASES_LATEST_API = "https://api.github.com/repos/m13v/s4l/releases/latest";
+// Staging channel resolves the newest release OVERALL (prereleases included)
+// from the releases LIST, since releases/latest excludes prereleases. Keep this
+// and verKey/isNewer in lockstep with scripts/snapshot.py.
+const RELEASES_LIST_API = "https://api.github.com/repos/m13v/s4l/releases?per_page=30";
+// Per-box release channel. `staging` boxes track the newest release overall
+// (RCs first); everything else is `stable` (releases/latest, the historical
+// default). Single source of truth shared with snapshot.py / s4l_channel.py:
+// <state dir>/channel.json. Read fresh each call (cheap file read) so a channel
+// flip takes effect on the next probe with no restart.
+const STATE_DIR = process.env.S4L_STATE_DIR || process.env.SAPS_STATE_DIR || path.join(os.homedir(), ".social-autoposter-mcp");
+export function releaseChannel() {
+    try {
+        const raw = fs.readFileSync(path.join(STATE_DIR, "channel.json"), "utf-8");
+        const v = (JSON.parse(raw) || {}).channel;
+        if (v === "staging" || v === "stable")
+            return v;
+    }
+    catch {
+        /* absent/corrupt -> stable (fail-safe: never silently push a box to prerelease) */
+    }
+    return "stable";
+}
+function parseSemverish(v) {
+    return /^\d+\.\d+\.\d+/.test(v) ? v : null;
+}
+// Precedence key for an rc-aware compare: a full release outranks any prerelease
+// of the SAME core version (1.6.193 > 1.6.193-rc.2 > 1.6.193-rc.1). For stable
+// (no prereleases compared) this reduces to a plain numeric core compare, so
+// behavior there is unchanged. Mirrors snapshot.py::_ver_key.
+function verKey(v) {
+    const s = String(v).trim().replace(/^v/, "");
+    const [coreRaw, pre = ""] = s.split("-", 2);
+    const core = coreRaw.split("+")[0];
+    const nums = core.split(".").map((n) => parseInt(n, 10) || 0);
+    while (nums.length < 3)
+        nums.push(0);
+    if (!pre)
+        return [nums[0], nums[1], nums[2], 1, 0];
+    const m = pre.match(/\d+/g);
+    return [nums[0], nums[1], nums[2], 0, m ? parseInt(m[m.length - 1], 10) : 0];
+}
+async function latestFromGithubRedirect() {
+    try {
+        // releases/latest already excludes drafts and prereleases, so a `--draft`
+        // release correctly does NOT trigger the update banner. No -L: read the
+        // first response's Location via %{redirect_url} and stop.
+        const res = await run("curl", ["-fsS", "-m", "10", "-o", "/dev/null", "-w", "%{redirect_url}", RELEASES_LATEST_URL], { timeoutMs: 12000, noTee: true });
+        const loc = (res.stdout || "").trim();
+        if (!loc.includes("/releases/tag/"))
+            return null;
+        return parseSemverish(loc.split("/").pop().replace(/^v/, "").trim());
+    }
+    catch {
+        return null;
+    }
+}
+// In-process conditional-request state: long-lived processes send If-None-Match
+// on every probe and get free 304s; each new release costs a single 200.
+const apiState = { etag: null, latest: null };
+async function latestFromGithubApi() {
+    try {
+        const args = ["-sS", "-m", "10", "-H", "Accept: application/vnd.github+json"];
+        if (apiState.etag)
+            args.push("-H", `If-None-Match: ${apiState.etag}`);
+        args.push("-w", "\n__CURL_STATUS__:%{http_code}\n__CURL_ETAG__:%header{etag}", RELEASES_LATEST_API);
+        const res = await run("curl", args, { timeoutMs: 12000, noTee: true });
+        let status = 0;
+        let etag = null;
+        const body = [];
+        for (const line of (res.stdout || "").split("\n")) {
+            if (line.startsWith("__CURL_STATUS__:"))
+                status = parseInt(line.slice(16).trim(), 10) || 0;
+            else if (line.startsWith("__CURL_ETAG__:"))
+                etag = line.slice(14).trim() || null;
+            else
+                body.push(line);
+        }
+        if (status === 304)
+            return apiState.latest;
+        if (status !== 200)
+            return null;
+        const tag = JSON.parse(body.join("\n")).tag_name;
+        const v = typeof tag === "string" ? parseSemverish(tag.replace(/^v/, "").trim()) : null;
+        if (v) {
+            apiState.etag = etag;
+            apiState.latest = v;
+        }
+        return v;
+    }
+    catch {
+        return null;
+    }
+}
+async function latestFromNpm() {
+    try {
+        const res = await run("npm", ["view", "social-autoposter", "version"], { timeoutMs: 8000 });
+        const line = res.stdout.trim().split("\n").pop()?.trim() ?? "";
+        return /^\d+\.\d+\.\d+/.test(line) ? line : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Staging channel: newest release OVERALL (prereleases included) from the
+// releases LIST, since releases/latest excludes prereleases. Drafts are skipped;
+// "newest" is by the rc-aware verKey. Returns {version, tag} or null.
+async function latestFromGithubListStaging() {
+    try {
+        const res = await run("curl", ["-sS", "-m", "10", "-H", "Accept: application/vnd.github+json", RELEASES_LIST_API], { timeoutMs: 12000, noTee: true });
+        const rels = JSON.parse(res.stdout || "[]");
+        if (!Array.isArray(rels))
+            return null;
+        let best = null;
+        for (const r of rels) {
+            if (!r || typeof r !== "object" || r.draft)
+                continue;
+            const tag = r.tag_name;
+            if (typeof tag !== "string")
+                continue;
+            const v = parseSemverish(tag.replace(/^v/, "").trim());
+            if (!v)
+                continue;
+            const key = verKey(v);
+            if (best == null || cmpKey(key, best.key) > 0)
+                best = { version: v, tag, key };
+        }
+        return best ? { version: best.version, tag: best.tag } : null;
+    }
+    catch {
+        return null;
+    }
+}
+function cmpKey(a, b) {
+    for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const x = a[i] ?? 0;
+        const y = b[i] ?? 0;
+        if (x !== y)
+            return x > y ? 1 : -1;
+    }
+    return 0;
+}
+// Resolve the newest release for this box's channel, cached (with the channel,
+// so a mid-process flip re-probes). Returns the version AND the release tag: the
+// staging download URL is built from the tag, stable uses releases/latest.
+async function resolveLatest() {
+    const channel = releaseChannel();
+    const now = Date.now();
+    if (cache && cache.channel === channel && now - cache.at < TTL_MS)
+        return { version: cache.latest, tag: cache.tag, channel };
+    let version = null;
+    let tag = null;
+    if (channel === "staging") {
+        const s = await latestFromGithubListStaging();
+        if (s) {
+            version = s.version;
+            tag = s.tag;
+        }
+        else {
+            // Degrade to the stable probes so a staging box tracks at least stable
+            // rather than going blind when the list endpoint fails.
+            version = (await latestFromGithubApi()) ?? (await latestFromGithubRedirect());
+            tag = version ? `v${version}` : null;
+        }
+    }
+    else {
+        version = await latestFromGithubApi();
+        if (version == null)
+            version = await latestFromGithubRedirect();
+        if (version == null)
+            version = await latestFromNpm();
+        tag = version ? `v${version}` : null;
+    }
+    cache = { at: now, latest: version, tag, channel };
+    return { version, tag, channel };
+}
+export async function latestPublishedVersion() {
+    return (await resolveLatest()).version;
+}
+// rc-aware compare: true when `latest` is strictly newer than `current`. A full
+// release outranks any prerelease of the same core version, so on the staging
+// channel one RC correctly supersedes another (1.6.193-rc.2 > 1.6.193-rc.1) and
+// the promoted full release supersedes its RCs. Mirrors snapshot.py::_is_newer.
+export function isNewer(latest, current) {
+    return cmpKey(verKey(latest), verKey(current)) > 0;
+}
+// One-shot convenience: installed + latest + whether an update is available,
+// plus the resolved channel and release tag (the staging updater needs the tag).
+export async function versionStatus() {
+    const { version: latest, tag, channel } = await resolveLatest();
+    return {
+        installed: VERSION,
+        latest,
+        latest_tag: tag,
+        channel,
+        update_available: !!latest && isNewer(latest, VERSION),
+    };
+}

package/mcp/dist/version.json

@@ -0,0 +1,4 @@
+{
+  "version": "1.6.197-rc.7",
+  "installedAt": "2026-07-03T04:57:11.965Z"
+}

package/mcp/install-runtime.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+// CLI entry for provisioning the owned Python/Chromium runtime.
+//
+// This is the terminal-side twin of the panel's "Install runtime" button and
+// the `install_runtime` MCP tool: all three call the SAME provisioning logic in
+// dist/runtime.js, so there is one implementation and one source of truth. The
+// panel polls install_status; this script polls readProgress() and prints each
+// step transition to stdout so an agent (or a human) can install head-less when
+// the UI panel isn't available (Claude Code/Cowork, CI, a bare VM).
+//
+// Exit code: 0 when the runtime is ready, 1 on any step failure.
+
+import {
+  startProvisioning,
+  readProgress,
+  runtimeReady,
+  readRuntime,
+} from "./dist/runtime.js";
+
+const GLYPH = { pending: "·", running: "…", done: "✓", error: "×" };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function main() {
+  if (runtimeReady()) {
+    const rt = readRuntime();
+    console.log(`Runtime already installed; nothing to do.`);
+    console.log(`  python: ${rt?.python}`);
+    console.log(`  uv:     ${rt?.uv}`);
+    return 0;
+  }
+
+  console.log("Installing the social-autoposter runtime (uv, Python, Chromium).");
+  console.log("This is a one-time download; nothing touches your system Python.\n");
+
+  startProvisioning();
+
+  // Print each step the first time it leaves "pending", and again when it
+  // finishes, so the terminal shows live forward motion instead of going dark.
+  const printed = new Map(); // step id -> last status printed
+  for (;;) {
+    const p = readProgress();
+    if (p) {
+      for (const s of p.steps) {
+        if (printed.get(s.id) !== s.status && s.status !== "pending") {
+          const detail = s.status === "error" && s.detail ? `  ${s.detail}` : "";
+          console.log(`  ${GLYPH[s.status] || "·"} ${s.label}${detail}`);
+          printed.set(s.id, s.status);
+        }
+      }
+      if (p.done) {
+        if (p.ok) {
+          const rt = readRuntime();
+          console.log(`\nRuntime ready.`);
+          console.log(`  python: ${rt?.python}`);
+          return 0;
+        }
+        console.log(`\nInstall failed: ${p.error || "see the step marked × above."}`);
+        return 1;
+      }
+    }
+    await sleep(1000);
+  }
+}
+
+main()
+  .then((code) => process.exit(code))
+  .catch((err) => {
+    console.error(`install-runtime crashed: ${err?.stack || err}`);
+    process.exit(1);
+  });

package/mcp/install.mjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+// Installs the social-autoposter MCP server into BOTH Claude Desktop and Claude Code.
+//
+//   node install.mjs            # install into both clients
+//   node install.mjs --uninstall  # remove from both clients
+//
+// Idempotent: re-running overwrites the existing entry. Each config file is
+// backed up (timestamped) before it is touched, and missing files/dirs are created.
+
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const SERVER_KEY = "social-autoposter";
+const UNINSTALL = process.argv.includes("--uninstall");
+
+// ---- resolve the absolute paths we want pinned into the spawn env ----------
+const here = path.dirname(new URL(import.meta.url).pathname);
+const repoDir = path.resolve(here, "..");
+const distEntry = path.join(here, "dist", "index.js");
+
+function whichNode() {
+  // Prefer the stable symlink over a versioned Cellar path so a `brew upgrade
+  // node` doesn't break the pinned command.
+  for (const p of ["/opt/homebrew/bin/node", "/usr/local/bin/node"]) {
+    if (fs.existsSync(p)) return p;
+  }
+  return process.execPath; // the node running this installer
+}
+
+const nodeBin = whichNode();
+
+function whichPython() {
+  // Prefer a real Homebrew python (has the pipeline's deps) over the macOS
+  // /usr/bin/python3 stub, which can trigger an Xcode CLT install prompt and
+  // often lacks the pipeline deps.
+  const candidates = ["/opt/homebrew/bin/python3", "/usr/local/bin/python3"];
+  try {
+    const found = execSync("command -v python3 2>/dev/null", { shell: "/bin/bash" })
+      .toString()
+      .trim();
+    if (found) candidates.push(found);
+  } catch {}
+  candidates.push("/usr/bin/python3");
+  for (const p of candidates) {
+    if (p && fs.existsSync(p)) return p;
+  }
+  return "python3"; // last resort: rely on PATH
+}
+
+const pythonBin = whichPython();
+
+const serverEntry = {
+  command: nodeBin,
+  args: [distEntry],
+  env: {
+    SAPS_PYTHON: pythonBin,
+    SAPS_REPO_DIR: repoDir,
+    PATH: `${path.dirname(nodeBin)}:${path.dirname(pythonBin)}:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin`,
+  },
+};
+
+// ---- the two client config targets ----------------------------------------
+const home = os.homedir();
+const targets = [
+  {
+    name: "Claude Desktop",
+    file: path.join(
+      home,
+      "Library",
+      "Application Support",
+      "Claude",
+      "claude_desktop_config.json",
+    ),
+  },
+  {
+    name: "Claude Code",
+    file: path.join(home, ".claude.json"),
+  },
+];
+
+function readJson(file) {
+  if (!fs.existsSync(file)) return {};
+  const raw = fs.readFileSync(file, "utf8").trim();
+  if (!raw) return {};
+  return JSON.parse(raw);
+}
+
+function backup(file) {
+  if (!fs.existsSync(file)) return null;
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const bak = `${file}.bak-${stamp}`;
+  fs.copyFileSync(file, bak);
+  return bak;
+}
+
+function writeJson(file, obj) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(obj, null, 2) + "\n", "utf8");
+}
+
+let ok = 0;
+for (const t of targets) {
+  try {
+    const config = readJson(t.file);
+    config.mcpServers = config.mcpServers || {};
+
+    if (UNINSTALL) {
+      if (!(SERVER_KEY in config.mcpServers)) {
+        console.log(`• ${t.name}: not present, nothing to remove`);
+        ok++;
+        continue;
+      }
+      const bak = backup(t.file);
+      delete config.mcpServers[SERVER_KEY];
+      writeJson(t.file, config);
+      console.log(`✓ ${t.name}: removed "${SERVER_KEY}"  (backup: ${bak})`);
+      ok++;
+      continue;
+    }
+
+    const existed = SERVER_KEY in config.mcpServers;
+    const bak = backup(t.file);
+    config.mcpServers[SERVER_KEY] = serverEntry;
+    writeJson(t.file, config);
+    console.log(
+      `✓ ${t.name}: ${existed ? "updated" : "added"} "${SERVER_KEY}"` +
+        (bak ? `  (backup: ${bak})` : "  (created new file)"),
+    );
+    console.log(`    -> ${t.file}`);
+    ok++;
+  } catch (err) {
+    console.error(`✗ ${t.name}: ${err.message}`);
+  }
+}
+
+console.log("");
+if (ok === targets.length) {
+  if (UNINSTALL) {
+    console.log("Done. Removed from both clients.");
+    console.log("");
+    console.log(
+      "Fully QUIT and relaunch each client (Cmd+Q for Claude Desktop; restart any open",
+    );
+    console.log(
+      "Claude Code session) so the removal takes effect. MCP servers load at launch.",
+    );
+  } else {
+    console.log("Done. Registered in both clients.");
+    console.log("node:   " + nodeBin);
+    console.log("python: " + pythonBin);
+    console.log("server: " + distEntry);
+    console.log("");
+    console.log(
+      "The MCP server is registered but not yet loaded (MCP servers load at launch,",
+    );
+    console.log("not per-tab). To finish setup:");
+    console.log("");
+    console.log("  1. Fully quit Claude (Cmd+Q; closing the window is not enough).");
+    console.log("  2. Reopen Claude.");
+    console.log('  3. Send: "Set me up on social-autoposter."');
+  }
+} else {
+  console.error(
+    `Partial: ${ok}/${targets.length} clients updated. See errors above.`,
+  );
+  process.exit(1);
+}

package/mcp/manifest.json

@@ -0,0 +1,80 @@
+{
+  "dxt_version": "0.1",
+  "name": "social-autoposter",
+  "display_name": "S4L",
+  "version": "1.6.197-rc.7",
+  "description": "Draft, review, approve, and autopilot X/Twitter posts.",
+  "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
+  "author": {
+    "name": "S4L.ai",
+    "email": "i@m13v.com",
+    "url": "https://s4l.ai"
+  },
+  "server": {
+    "type": "node",
+    "entry_point": "dist/index.js",
+    "mcp_config": {
+      "command": "node",
+      "args": [
+        "${__dirname}/dist/index.js"
+      ],
+      "env": {
+        "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+      }
+    }
+  },
+  "tools": [
+    {
+      "name": "engagement_mode",
+      "description": "Choose engagement lanes (personal brand + optional product promotion)"
+    },
+    {
+      "name": "project_config",
+      "description": "Configure or edit a project"
+    },
+    {
+      "name": "post_drafts",
+      "description": "Post chosen drafts"
+    },
+    {
+      "name": "get_stats",
+      "description": "Get X/Twitter stats"
+    },
+    {
+      "name": "runtime",
+      "description": "Runtime: status, update & diagnostics"
+    },
+    {
+      "name": "restart_menubar",
+      "description": "Restart the S4L menu bar app"
+    },
+    {
+      "name": "queue_setup",
+      "description": "Get autopilot scheduled-task specs"
+    },
+    {
+      "name": "dashboard",
+      "description": "S4L dashboard"
+    },
+    {
+      "name": "connect_product",
+      "description": "Add your product"
+    },
+    {
+      "name": "show_browser_to_user",
+      "description": "Show browser to user"
+    }
+  ],
+  "keywords": [
+    "twitter",
+    "x",
+    "social",
+    "autoposter",
+    "marketing"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/m13v/s4l"
+  }
+}