@m13v/s4l 1.7.1-rc.16 → 1.7.1-rc.2

package/bin/cli.js

@@ -823,29 +823,6 @@ function installMcp() {
   } catch (e) {
     console.warn('  WARNING: could not stamp MCP version:', e && e.message);
   }
-  // Auto-opt a fresh install into the staging channel when the version being
-  // installed is itself a pre-release (-rc.N) — e.g. `npx social-autoposter@
-  // X.Y.Z-rc.N init`. Without this, channel.json stays absent, which
-  // scripts/s4l_channel.py's fail-safe default reads as "stable", so the box
-  // would install this one rc and then silently stop tracking staging (never
-  // pick up the next rc). Mirrors the same one-time write in
-  // mcp/src/runtime.ts's provision() for the .mcpb (Desktop) install path.
-  // Only writes when no channel marker exists yet — never overrides an
-  // existing preference (e.g. a user who already opted back out).
-  try {
-    const pkgVersion = require('../package.json').version;
-    if (pkgVersion.includes('-rc.')) {
-      const stateDir = process.env.S4L_STATE_DIR || path.join(os.homedir(), '.social-autoposter-mcp');
-      const channelPath = path.join(stateDir, 'channel.json');
-      if (!fs.existsSync(channelPath)) {
-        fs.mkdirSync(stateDir, { recursive: true });
-        fs.writeFileSync(channelPath, JSON.stringify({ channel: 'staging' }, null, 2) + '\n');
-        console.log('  pre-release install detected -> opted into the staging channel');
-      }
-    }
-  } catch (e) {
-    console.warn('  WARNING: could not set staging channel:', e && e.message);
-  }
   console.log('  installing MCP runtime deps (npm install --omit=dev in mcp/)');
   const npmRes = spawnSync('npm', ['install', '--omit=dev', '--no-audit', '--no-fund'], {
     cwd: mcpDest,

package/mcp/dist/index.js

@@ -22,10 +22,10 @@ import fs from "node:fs";
 import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
 import { applySetup, resolveProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, normalizeStringList, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
-import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, menubarRunning, clearMenubarStop, ensurePipelineCurrent, ensureRuntimeProvisioned, retryProvisionIfStalled, } from "./runtime.js";
+import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, menubarRunning, clearMenubarStop, ensurePipelineCurrent, ensureRuntimeProvisioned, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, sendStateSnapshot, captureError, captureMessage, flushSentry, startLogStreaming, flushLogs, logLine, checkVersionChange } from "./telemetry.js";
+import { initSentry, sendHeartbeat, sendStateSnapshot, captureError, flushSentry, startLogStreaming, flushLogs, logLine } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -1181,21 +1181,10 @@ async function postApproved(batchId, plan) {
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
-    // the run exited non-zero OR a REAL failure happened. This is the only
-    // telemetry channel that reaches a customer .mcpb install (their cycle log
-    // lives on their machine). install_id/hostname are auto-tagged.
-    //
-    // Gated on failure_reasons (not just realPosted < approved.length): the
-    // Python pipeline already reports every shortfall to Sentry itself
-    // (twitter_post_plan.py's capture_message), including benign skips like a
-    // deleted target tweet. Re-reporting the SAME benign skip here as a second,
-    // independently-fingerprinted `Error` (this capture group) doubled every
-    // such event into two distinct Sentry issues. Only add this Node-side
-    // capture when there's a real failure_reasons entry or a non-zero exit,
-    // i.e. something the Python capture wouldn't already have flagged as an
-    // actionable error on its own.
-    const hasRealFailure = res.code !== 0 || Boolean(summObj?.failure_reasons);
-    if (hasRealFailure) {
+    // the run exited non-zero OR fewer drafts posted than were approved. This is
+    // the only telemetry channel that reaches a customer .mcpb install (their cycle
+    // log lives on their machine). install_id/hostname are auto-tagged.
+    if (res.code !== 0 || realPosted < approved.length) {
         captureError(new Error(`post_drafts: ${realPosted}/${approved.length} posted (exit=${res.code})`), {
             component: "post",
             exit_code: String(res.code),
@@ -1605,10 +1594,7 @@ tool("engagement_mode", {
     // persona is seeded. (2026-06-30) Skipped when promotion-only, since the
     // product project isn't configured yet (it stays gated until project_config).
     let kickerInstall = null;
-    if (personalBrand && isPaused()) {
-        kickerInstall = { ok: false, detail: "skip (paused)" };
-    }
-    else if (personalBrand) {
+    if (personalBrand) {
         try {
             kickerInstall = await ensureQueueKickerInstalled();
             console.error(`[engagement_mode] launchd kicker: ${kickerInstall.ok ? "ok" : "skip"} (${kickerInstall.detail})`);
@@ -1849,18 +1835,6 @@ tool("project_config", {
             // as expected. Once connect_x succeeds, run the full phase immediately
             // to verify persistence, CDP, and the durable cookie mirror.
             doctorReport = await runDoctorPhase("full");
-            // Only mark x_verified once doctor confirms all X checks pass (session valid,
-            // cookies persisted, CDP responding, keychain accessible). This prevents the
-            // autopilot from starting if X connection didn't actually persist.
-            if (doctorReport?.ok) {
-                completeOnboardingMilestone("x_verified", {
-                    x_session: doctorReport.checks?.find(c => c.id === "x_session")?.status,
-                    x_cookies: doctorReport.checks?.find(c => c.id === "x_cookie_sqlite")?.status,
-                });
-            }
-            else {
-                recordOnboardingAttempt("x_verified", { doctor_ok: false });
-            }
         }
         else {
             blockOnboardingMilestone("x_connected", `x_${r.state || "not_connected"}`, r.error || r.note || summarizeXAuth(r), { state: r.state || "not_connected" });
@@ -2102,10 +2076,7 @@ tool("project_config", {
         // persona-aware, so calling it from both setup paths is safe. Best-effort:
         // a kicker hiccup never fails setup. (2026-06-30)
         let kickerInstall = null;
-        if (result.ready && isPaused()) {
-            kickerInstall = { ok: false, detail: "skip (paused)" };
-        }
-        else if (result.ready) {
+        if (result.ready) {
             try {
                 kickerInstall = await ensureQueueKickerInstalled();
                 console.error(`[project_config] launchd kicker: ${kickerInstall.ok ? "ok" : "skip"} (${kickerInstall.detail})`);
@@ -2183,16 +2154,7 @@ tool("post_drafts", {
             .optional()
             .describe("1-based draft numbers to post as drafted, e.g. [1, 3, 5]."),
         edits: z
-            .array(z.object({
-            n: z.number().int().positive(),
-            text: z.string(),
-            variant: z
-                .enum(["a", "b"])
-                .optional()
-                .describe("Two-draft cards only: which of candidate n's `drafts` entries this text came " +
-                "from, so the candidate's style/assigned_style/assigned_mode are switched to " +
-                "match (otherwise engagement_style stats would be attributed to the wrong style)."),
-        }))
+            .array(z.object({ n: z.number().int().positive(), text: z.string() }))
             .optional()
             .describe("Rewrites: each {n, text} replaces draft n's wording, then posts it."),
         post_all: z.boolean().optional().describe("Post every draft in the batch."),
@@ -2248,22 +2210,7 @@ tool("post_drafts", {
             warnings.push(`ignored empty edit for #${e.n}`);
             return;
         }
-        const c = candidates[e.n - 1];
-        c.reply_text = text;
-        // Two-draft cards: the human switched to the OTHER draft (with or
-        // without further hand-editing its text). Carry that draft's own
-        // style/assigned_style/assigned_mode onto the candidate so
-        // twitter_post_plan.py's per-candidate drift-coercion posts under (and
-        // logs) the style that's ACTUALLY posting, not whichever draft was
-        // recommended at plan-write time.
-        if (e.variant && Array.isArray(c.drafts)) {
-            const chosen = c.drafts.find((d) => d.variant === e.variant);
-            if (chosen) {
-                c.engagement_style = chosen.style ?? c.engagement_style;
-                c.assigned_style = chosen.assigned_style ?? null;
-                c.assigned_mode = chosen.assigned_mode ?? c.assigned_mode;
-            }
-        }
+        candidates[e.n - 1].reply_text = text;
         approve.add(e.n);
         editedCount++;
     });
@@ -2506,26 +2453,16 @@ tool("runtime", {
         });
     }
     // ---- status (default): runtime install snapshot -----------------------
-    let snapshot = runtimeSnapshot();
+    const snapshot = runtimeSnapshot();
     if (snapshot.runtime_ready) {
         completeOnboardingMilestone("runtime_ready");
     }
     else if (snapshot.progress?.done && !snapshot.progress.ok) {
-        // A prior provision failed. Kick a bounded auto-retry so status polling
-        // self-heals a transient failure instead of parking until the next boot;
-        // the provisioner cleans its own partial artifacts, so a retry is safe.
-        // Only surface the failure to the onboarding ledger once retries are spent.
-        if (retryProvisionIfStalled()) {
-            snapshot = runtimeSnapshot(); // reflect the restarted, in-flight run
-        }
-        else {
-            blockOnboardingMilestone("runtime_ready", "runtime_install_failed", snapshot.progress.error || "Runtime installation failed", { outcome: "failed" });
-        }
+        blockOnboardingMilestone("runtime_ready", "runtime_install_failed", snapshot.progress.error || "Runtime installation failed", { outcome: "failed" });
     }
     return jsonContent({
         ...snapshot,
         menubar_running: await menubarRunning(),
-        paused: isPaused(),
         onboarding: onboardingSnapshot(),
     });
 });
@@ -2556,37 +2493,6 @@ tool("restart_menubar", {
         menubar_running: running,
     });
 });
-// ---- pause_s4l: temporarily stop drafting/posting, reversibly --------------
-// The lighter alternative to Quit: unloads only the launchd jobs that scan,
-// draft, and post (plus their support daemons), leaving Claude Desktop, the
-// S4L tray, X connection, and the draft schedule registration untouched.
-// Fully reversible — action:'resume' reinstalls the exact same daemons via the
-// same idempotent ensure*Installed() functions boot uses. NOT "autopilot": S4L
-// is draft-first (a human approves every post), so this pauses/resumes the
-// draft pipeline itself, not some autonomous posting mode.
-tool("pause_s4l", {
-    title: "Pause or resume S4L",
-    description: "Pause temporarily stops S4L's own draft pipeline (the launchd kicker that scans/drafts/posts, " +
-        "plus its reaper/stall-watch/memory-snapshot support jobs) WITHOUT touching Claude Desktop, the " +
-        "S4L tray, your X connection, or the draft schedule registration — nothing is deleted, so it " +
-        "survives a Claude Desktop restart and Resume brings it right back. Use when the user asks to " +
-        "pause, stop, or temporarily disable S4L, or to resume/unpause it. This is NOT the same as Quit " +
-        "(which kills and restarts Claude Desktop and removes the draft schedule) — Pause is the lighter, " +
-        "fully reversible option. action:'status' (default) reports whether it's currently paused.",
-    inputSchema: {
-        action: z.enum(["status", "pause", "resume"]).optional(),
-    },
-}, async ({ action }) => {
-    if (action === "pause") {
-        const res = await pauseS4L();
-        return jsonContent({ action: "pause", paused: isPaused(), ...res });
-    }
-    if (action === "resume") {
-        const res = await resumeS4L();
-        return jsonContent({ action: "resume", paused: isPaused(), ...res });
-    }
-    return jsonContent({ action: "status", paused: isPaused() });
-});
 // ---- report_diagnosis: ship a field diagnosis to the developers -------------
 // First-class MCP wrapper over scripts/send_diagnostic_report.py (the same
 // Sentry lane the menubar "Diagnose & fix" prompt uses). Before this existed
@@ -2625,29 +2531,6 @@ tool("report_diagnosis", {
         return jsonContent({ ok: false, detail: String(e?.message || e).slice(0, 300) });
     }
 });
-// ---- client_event: lightweight UI telemetry ping from the dashboard panel --
-// The panel iframe is a browser context with no Sentry SDK and no server-side
-// telemetry access of its own. Before this, a panel button click (e.g. "Set up
-// draft schedule") had NO record anywhere — report_diagnosis needs a full
-// markdown report from an agent turn, which doesn't fit a plain click, so the
-// panel's rearm button silently had zero telemetry while its menu-bar sibling
-// did (see s4l_menubar.py _capture_msg). Not for agent use: the panel calls
-// this directly via app.callServerTool, never through chat.
-tool("client_event", {
-    title: "Log a lightweight client UI event",
-    description: "Internal telemetry hook for the dashboard panel to report a UI event (e.g. a button click). " +
-        "Not intended for the agent to call from chat.",
-    inputSchema: {
-        event: z.string().describe("Short event name, e.g. rearm_clicked"),
-        surface: z.string().optional().describe("UI surface the event came from, e.g. panel"),
-    },
-}, async ({ event, surface }) => {
-    captureMessage(`S4L client event: ${event}`, {
-        level: "info",
-        tags: { component: "panel", event, surface: surface || "panel" },
-    });
-    return jsonContent({ ok: true });
-});
 function runtimeSnapshot() {
     const rt = readRuntime();
     const progress = readProgress();
@@ -3342,18 +3225,6 @@ async function ensureQueueKickerInstalled() {
                 detail: "no ready project or active persona yet",
             };
         }
-        // Additional gate: X must be connected and verified before autopilot starts.
-        // This prevents wasted cycles against a logged-out x.com if X connection didn't
-        // persist after import/login. x_verified milestone only completes after doctor
-        // confirms X session and cookies are valid.
-        const onboardingState = onboardingSnapshot();
-        const xVerified = onboardingState?.milestones?.some((m) => m.id === "x_verified" && m.status === "complete");
-        if (!xVerified) {
-            return {
-                ok: false,
-                detail: "X not yet verified (awaiting explicit pre-flight confirmation)",
-            };
-        }
         const logDir = path.join(repoDir(), "skill", "logs");
         try {
             fs.mkdirSync(logDir, { recursive: true });
@@ -3649,76 +3520,6 @@ async function ensureMemorySnapshotInstalled() {
         return { ok: false, detail: e?.message || String(e) };
     }
 }
-// ---- pause/resume: stop drafting/posting without touching Claude Desktop ---
-// Unlike Quit (which kills + relaunches Claude Desktop and deletes the draft
-// schedule), Pause only unloads the launchd jobs that actually DO work — the
-// kicker that scans/drafts/posts (TWITTER_AUTOPILOT_LABEL) plus its reaper,
-// stall-watch, and memory-snapshot support daemons — while leaving Claude
-// Desktop, the tray, and the Claude-native s4l-worker scheduled task alone.
-// The scheduled task still fires on its own cadence; claude_job.py's `next`
-// checks the same flag file and reports "no work" instantly instead of
-// draining the queue, so nothing drafts or posts while paused even if a
-// worker session wakes up mid-pause. A flag file (nothing is deleted) is what
-// makes Resume a plain reinstall of the same 4 daemons — see resumeS4L.
-function pauseFlagPath() {
-    return path.join(s4lStateDir(), "paused.flag");
-}
-function isPaused() {
-    try {
-        return fs.existsSync(pauseFlagPath());
-    }
-    catch {
-        return false;
-    }
-}
-const PAUSE_TARGETS = [
-    { label: TWITTER_AUTOPILOT_LABEL, plist: TWITTER_AUTOPILOT_PLIST },
-    { label: REAPER_LABEL, plist: REAPER_PLIST },
-    { label: STALL_WATCH_LABEL, plist: STALL_WATCH_PLIST },
-    { label: MEMORY_SNAPSHOT_LABEL, plist: MEMORY_SNAPSHOT_PLIST },
-];
-async function pauseS4L() {
-    if (isPaused())
-        return { ok: true, detail: "already paused" };
-    try {
-        fs.mkdirSync(path.dirname(pauseFlagPath()), { recursive: true });
-        fs.writeFileSync(pauseFlagPath(), `paused at ${new Date().toISOString()}\n`, "utf-8");
-    }
-    catch (e) {
-        return { ok: false, detail: `could not write pause flag: ${e?.message || e}` };
-    }
-    const uid = process.getuid ? process.getuid() : 0;
-    const results = [];
-    for (const { label, plist } of PAUSE_TARGETS) {
-        try {
-            const res = await unloadPlist(label, plist, uid);
-            results.push(`${label}: unloaded (rc=${res.code})`);
-        }
-        catch (e) {
-            results.push(`${label}: ${e?.message || e}`);
-        }
-    }
-    return { ok: true, detail: results.join("; ") };
-}
-async function resumeS4L() {
-    try {
-        fs.rmSync(pauseFlagPath(), { force: true });
-    }
-    catch {
-        /* best-effort */
-    }
-    const kicker = await ensureQueueKickerInstalled();
-    const reaper = await ensureClaudeReaperInstalled();
-    const stall = await ensureStallWatchInstalled();
-    const mem = await ensureMemorySnapshotInstalled();
-    const detail = [
-        `kicker: ${kicker.ok ? "ok" : "skip"} (${kicker.detail})`,
-        `reaper: ${reaper.ok ? "ok" : "skip"} (${reaper.detail})`,
-        `stall-watch: ${stall.ok ? "ok" : "skip"} (${stall.detail})`,
-        `memory-snapshot: ${mem.ok ? "ok" : "skip"} (${mem.detail})`,
-    ].join("; ");
-    return { ok: true, detail };
-}
 // Install/refresh the on-screen overlay watcher launchd job. Promotes the
 // harness status overlay from a best-effort, fired-from-other-tools nicety to a
 // first-class self-healing job. We run `harness_overlay.py watch` directly in
@@ -3786,73 +3587,6 @@ async function ensureOverlayWatchInstalled() {
         return { ok: false, detail: e?.message || String(e) };
     }
 }
-// Install/refresh the daily self-updater launchd job. This used to be bundled
-// into the now-deleted `autopilot` MCP tool (removed 2026-06-19, 88bd1cb9):
-// calling `autopilot enable` installed this job as a side effect, so removing
-// the tool silently orphaned it — UPDATER_LABEL/UPDATER_PLIST and the
-// auto_update_on status check survived (buildSnapshot still reports them), but
-// nothing has installed the plist since, on ANY box provisioned after that
-// commit (auto_update_on reads false forever). Restored here as its own
-// deterministic boot-time job, same pattern as its five siblings above.
-//
-// Points at scripts/s4l_box_update.sh, NOT skill/social-autoposter-update.sh:
-// the latter is the npm-lane updater (npm view + npx update) and is a silent
-// no-op on a .mcpb box, which has no npm/npx on PATH (see version.ts). The
-// .mcpb-lane equivalent downloads the .mcpb directly from the channel-resolved
-// GitHub release and unpacks it over the extension dir — see that script's own
-// header for the channel/no-downgrade/retry guards. Default mode there
-// downloads + unpacks + restarts Claude Desktop with NO human in the loop,
-// matching the original bundled updater's intent ("keeps a headless install
-// current"); RunAtLoad so a box that boots already-behind checks promptly.
-async function ensureUpdaterInstalled() {
-    try {
-        if (process.platform !== "darwin")
-            return { ok: false, detail: "not macOS" };
-        if ((process.env.S4L_AUTO_UPDATE) === "0")
-            return { ok: false, detail: "disabled (S4L_AUTO_UPDATE=0)" };
-        const logDir = path.join(repoDir(), "skill", "logs");
-        try {
-            fs.mkdirSync(logDir, { recursive: true });
-        }
-        catch {
-            /* best-effort */
-        }
-        const xml = plistXml({
-            label: UPDATER_LABEL,
-            programArgs: ["/bin/bash", path.join(repoDir(), "scripts", "s4l_box_update.sh")],
-            intervalSecs: 86_400,
-            runAtLoad: true,
-            stdoutLog: path.join(logDir, "launchd-self-update-stdout.log"),
-            stderrLog: path.join(logDir, "launchd-self-update-stderr.log"),
-        });
-        const uid = process.getuid ? process.getuid() : 0;
-        let cur = null;
-        try {
-            cur = fs.readFileSync(UPDATER_PLIST, "utf-8");
-        }
-        catch {
-            cur = null;
-        }
-        let detail;
-        if (cur === xml) {
-            const res = await loadPlist(UPDATER_LABEL, UPDATER_PLIST, uid);
-            detail = `current (load rc=${res.code})`;
-        }
-        else {
-            if (cur !== null) {
-                await unloadPlist(UPDATER_LABEL, UPDATER_PLIST, uid);
-            }
-            fs.mkdirSync(path.dirname(UPDATER_PLIST), { recursive: true });
-            fs.writeFileSync(UPDATER_PLIST, xml, "utf-8");
-            const res = await loadPlist(UPDATER_LABEL, UPDATER_PLIST, uid);
-            detail = cur === null ? "installed + loaded" : `rewritten + reloaded (rc=${res.code})`;
-        }
-        return { ok: true, detail };
-    }
-    catch (e) {
-        return { ok: false, detail: e?.message || String(e) };
-    }
-}
 // Is the draft schedule registered AND running for the LIVE account?
 //   'ok'       — worker tasks present+enabled and FIRING (host actively running).
 //   'disabled' — present but a worker task is disabled.
@@ -3914,7 +3648,6 @@ async function buildSnapshot() {
     // (it's a launchctl check the Node side owns), so layer it on here. The panel
     // uses it to offer a one-click "restart menu bar" when the tray was quit.
     snap.menubar_running = await menubarRunning();
-    snap.paused = isPaused();
     await ensureDoctorPhase(snap.x_connected ? "full" : "pre_connect");
     if (snap.runtime_ready)
         completeOnboardingMilestone("runtime_ready");
@@ -4900,15 +4633,6 @@ async function drainApprovedBacklog() {
 }
 async function main() {
     initSentry();
-    // Detect a self-update (old_version -> new_version) as the very first thing
-    // after Sentry is up, before anything else that could restart/exit. See
-    // checkVersionChange's own docstring for why this exists.
-    try {
-        checkVersionChange();
-    }
-    catch (e) {
-        console.error("[social-autoposter-mcp] version-change check failed:", e?.message || e);
-    }
     // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
     // Cloud Run relay (-> Cloud Logging) so we can troubleshoot/rescue any user
     // scenario (silent stalls, partial onboarding) without asking them to ship a
@@ -4950,31 +4674,16 @@ async function main() {
     catch (e) {
         console.error(`[queue-worker] could not create worker folder: ${e?.message || e}`);
     }
-    // The 4 pipeline daemons (kicker, reaper, stall-watch, memory-snapshot) are
-    // skipped at boot while paused.flag is present, so a Claude Desktop restart
-    // during a Pause doesn't silently un-pause the pipeline — see pauseS4L/
-    // resumeS4L. Feedback-digest is NOT gated: it only distills past review
-    // decisions, not drafting/posting, so it's harmless to keep running.
-    if (!isPaused()) {
-        void ensureQueueKickerInstalled()
-            .then((r) => console.error(`[queue-worker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[queue-worker] kicker install failed:", e?.message || e));
-    }
-    else {
-        console.error("[queue-worker] launchd kicker: skip (paused)");
-    }
+    void ensureQueueKickerInstalled()
+        .then((r) => console.error(`[queue-worker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+        .catch((e) => console.error("[queue-worker] kicker install failed:", e?.message || e));
     // Self-healing reaper for the agent-mode session leak the queue autopilot
     // produces (finished `claude` worker sessions Desktop never tears down). A
     // standalone guardrail; install unconditionally so it caps memory even on a
     // box whose project isn't ready yet. Best-effort; must never block boot.
-    if (!isPaused()) {
-        void ensureClaudeReaperInstalled()
-            .then((r) => console.error(`[claude-reaper] launchd reaper: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[claude-reaper] reaper install failed:", e?.message || e));
-    }
-    else {
-        console.error("[claude-reaper] launchd reaper: skip (paused)");
-    }
+    void ensureClaudeReaperInstalled()
+        .then((r) => console.error(`[claude-reaper] launchd reaper: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+        .catch((e) => console.error("[claude-reaper] reaper install failed:", e?.message || e));
     // Feedback digest: hourly distillation of the user's card approve/reject
     // decisions into learned_preferences (see scripts/feedback_digest.py).
     // Best-effort; a box with no review events runs a no-op.
@@ -4984,25 +4693,15 @@ async function main() {
     // Autopilot stall watchdog: fleet-side Sentry alert when the draft routines stop
     // draining (most often an account switch orphaning them). The menu bar shows the
     // user the Re-arm action; this is the part we see. Best-effort; never blocks boot.
-    if (!isPaused()) {
-        void ensureStallWatchInstalled()
-            .then((r) => console.error(`[stall-watch] launchd watchdog: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[stall-watch] watchdog install failed:", e?.message || e));
-    }
-    else {
-        console.error("[stall-watch] launchd watchdog: skip (paused)");
-    }
+    void ensureStallWatchInstalled()
+        .then((r) => console.error(`[stall-watch] launchd watchdog: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+        .catch((e) => console.error("[stall-watch] watchdog install failed:", e?.message || e));
     // Periodic host-resource sampler (memory/process snapshot -> local JSONL). Gives
     // us per-box resource history to diagnose RAM blowups (e.g. the agent-mode
     // session leak). Best-effort; never blocks boot. Disable with S4L_MEMORY_SNAPSHOT=0.
-    if (!isPaused()) {
-        void ensureMemorySnapshotInstalled()
-            .then((r) => console.error(`[memory-snapshot] launchd sampler: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[memory-snapshot] sampler install failed:", e?.message || e));
-    }
-    else {
-        console.error("[memory-snapshot] launchd sampler: skip (paused)");
-    }
+    void ensureMemorySnapshotInstalled()
+        .then((r) => console.error(`[memory-snapshot] launchd sampler: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+        .catch((e) => console.error("[memory-snapshot] sampler install failed:", e?.message || e));
     // On-screen overlay watcher supervisor. The harness status overlay only renders
     // while the watcher process is alive, and that watcher had no supervisor — when
     // it died nothing respawned it and the overlay silently vanished. Install it as
@@ -5011,13 +4710,6 @@ async function main() {
     void ensureOverlayWatchInstalled()
         .then((r) => console.error(`[overlay-watch] launchd supervisor: ${r.ok ? "ok" : "skip"} (${r.detail})`))
         .catch((e) => console.error("[overlay-watch] supervisor install failed:", e?.message || e));
-    // Daily self-updater: restored 2026-07-08 after 88bd1cb9 ("Remove autopilot
-    // tool") silently dropped its only install path (it used to be bundled into
-    // the deleted `autopilot enable` action). Best-effort; never blocks boot.
-    // Disable with S4L_AUTO_UPDATE=0.
-    void ensureUpdaterInstalled()
-        .then((r) => console.error(`[self-update] launchd updater: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-        .catch((e) => console.error("[self-update] updater install failed:", e?.message || e));
     // Heal installs onboarded before short_links_live defaulted to false: such a
     // project wraps short links against the customer's own domain, which has no
     // /r/[code] resolver, so every minted link 404s. Re-point them at the s4l.ai

package/mcp/dist/onboarding.js

@@ -10,11 +10,18 @@ import { createRequire } from "node:module";
 import { repoDir, run } from "./repo.js";
 import { resolvePython } from "./runtime.js";
 const require = createRequire(import.meta.url);
+export const ONBOARDING_MILESTONES = [
+    "environment_checked",
+    "runtime_ready",
+    "x_connected",
+    "profile_scanned",
+    "mode_chosen",
+    "project_ready",
+    "topics_seeded",
+    "tasks_scheduled",
+];
 const ledgerApi = require("../shared/onboarding-ledger.cjs");
 const doctorApi = require("../shared/doctor.cjs");
-// Re-export of the ONE runtime array (see the comment above the imports): this
-// is not a second list, just a typed alias for ledgerApi.MILESTONES.
-export const ONBOARDING_MILESTONES = ledgerApi.MILESTONES;
 export function onboardingSnapshot() {
     return ledgerApi.publicSnapshot();
 }