@m13v/s4l 1.7.1-rc.2 → 1.7.1-rc.21

package/scripts/sentry_digest.py

@@ -1,36 +1,33 @@
 #!/usr/bin/env python3
-"""Sentry issue digest for the s4l Sentry project (org mediar-n5).
-
-Replaces the raw per-issue Sentry alert email. That alert rule
-(mediar-n5/s4l rule id 17212931) fired on every first-seen issue and every
-high-priority mark regardless of severity, so it also emailed on level=warning
-menubar operational pings ("draft_stuck", "missing", "rate_limited", "review
-card unattended"). Those still exist in Sentry, still get investigated
-on-demand via the "Debugging a customer install" playbook (see CLAUDE.md),
-they just no longer push a raw email. This script is scoped to level:error and
-level:fatal only ("critical Sentry issues" per user instruction 2026-07-07):
-real Python exceptions and pipeline failures, not the synthetic warning pings.
-
-Impact ranking uses distinct install_id count, not Sentry's built-in
-userCount, because s4l events are tagged per-install (install_id), not
-per-Sentry-user (userCount is 0 across the board for this project).
-
-Idempotency / noise control: a JSON ledger at scripts/state/sentry_digest_ledger.json
-tracks last-seen event/install counts per issue. A digest email is only sent
-when something is NEW (not in the ledger) or GROWING (event count up 20%+ and
-by at least 5 events since the ledger snapshot). First run baselines every
-open critical issue without flagging all of them as new.
+"""Sentry issue scanner for the s4l Sentry project (org mediar-n5).
+
+Pull-only step in the sentry-digest pipeline (see skill/sentry-digest.sh and
+skill/SENTRY-DIGEST-SKILL.md). This script does NOT investigate, does NOT
+email, and does NOT write the ledger. It just:
+
+1. Pulls unresolved level:error/level:fatal issues ("critical Sentry issues"
+   per user instruction 2026-07-07; level:warning menubar pings like
+   "draft_stuck" are excluded, they're a different kind of event already
+   surfaced elsewhere).
+2. Fetches distinct install_id impact per issue (Sentry's built-in userCount
+   is 0 across the board for this project; installs are tagged via
+   install_id instead).
+3. Diffs against the ledger to classify each issue as NEW / GROWING / STABLE.
+4. Writes the full scan result to a JSON file on disk and prints a one-line
+   summary for the bash wrapper to decide whether to spawn Claude for
+   investigation.
+
+The actual investigation (read the crashing code, check git log, judge
+actionability, draft a human-readable email, send it, write the ledger back)
+is done by a spawned Claude Code session per skill/SENTRY-DIGEST-SKILL.md,
+mirroring how ~/fazm/inbox/skill/check-query-insights.sh divides labor
+between a mechanical pull step and an investigative Claude step.
 
 Usage:
-    python3 scripts/sentry_digest.py                # normal run (used by launchd)
-    python3 scripts/sentry_digest.py --dry-run       # print what would happen, no email, no ledger write
-
-Patterned after strike_alert.py: same Gmail token, same dash-scrubbing,
-default recipient i@m13v.com.
+    python3 scripts/sentry_digest.py --out /path/to/scan.json
 """
 
 import argparse
-import base64
 import json
 import os
 import subprocess
@@ -39,39 +36,26 @@ import urllib.error
 import urllib.parse
 import urllib.request
 from datetime import datetime, timezone
-from email.mime.text import MIMEText
 
 SENTRY_ORG = "mediar-n5"
 SENTRY_PROJECT = "s4l"
 SENTRY_PROJECT_ID = "4511598804336640"
 SENTRY_API = "https://sentry.io/api/0"
 
-# "Critical Sentry issues" = level:error or level:fatal. Excludes level:warning
-# (the synthetic menubar/autopilot signal pings), which are a different kind
-# of event and already have their own surfacing (menubar UI, dashboard,
-# on-demand Sentry queries during customer debugging).
+# "Critical Sentry issues" = level:error or level:fatal.
 ISSUE_QUERY = "is:unresolved level:[error,fatal]"
 
 REPO_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 STATE_DIR = os.path.join(REPO_DIR, "scripts", "state")
 LEDGER_PATH = os.path.join(STATE_DIR, "sentry_digest_ledger.json")
 
-GMAIL_TOKEN_PATH = os.path.expanduser("~/gmail-api/token_i_at_m13v.com.json")
-GMAIL_SCOPES = ["https://mail.google.com/"]
-NOTIFICATION_EMAIL = os.environ.get("NOTIFICATION_EMAIL", "i@m13v.com")
-
-# Growth threshold: an issue re-alerts if event count grew by at least this
-# many events AND by at least this relative fraction since the ledger snapshot.
+# Growth threshold: an issue counts as GROWING if event count grew by at
+# least this many events AND by at least this relative fraction since the
+# ledger snapshot.
 GROWTH_MIN_DELTA = 5
 GROWTH_MIN_RATIO = 1.2
 
 
-def _scrub_dashes(s):
-    if not s:
-        return s
-    return s.replace("—", ",").replace("–", ",")
-
-
 def _sentry_token():
     env_token = os.environ.get("SENTRY_AUTH_TOKEN")
     if env_token:
@@ -103,16 +87,16 @@ def fetch_critical_issues(token):
 
 
 def fetch_install_impact(issue_id, token):
-    """Distinct install_id count + top installs for one issue. Returns (count, top)."""
+    """Distinct install_id count for one issue. Returns 0 if the tag is absent."""
     try:
         data = _sentry_get(f"/issues/{issue_id}/tags/install_id/", token)
-        return data.get("uniqueValues", 0), data.get("topValues", [])
+        return data.get("uniqueValues", 0)
     except urllib.error.HTTPError as e:
         if e.code == 404:
-            return 0, []  # tag not present on any event for this issue
+            return 0
         raise
     except Exception:
-        return 0, []
+        return 0
 
 
 def load_ledger():
@@ -125,95 +109,13 @@ def load_ledger():
         return {"version": 1, "lastUpdated": None, "issues": {}}
 
 
-def save_ledger(ledger):
-    os.makedirs(STATE_DIR, exist_ok=True)
-    tmp = LEDGER_PATH + ".tmp"
-    with open(tmp, "w") as f:
-        json.dump(ledger, f, indent=2)
-    os.replace(tmp, LEDGER_PATH)
-
-
 def issue_link(short_id):
     return f"https://mediar-n5.sentry.io/issues/?project={SENTRY_PROJECT_ID}&query={short_id}"
 
 
-def gmail_service():
-    from google.auth.transport.requests import Request
-    from google.oauth2.credentials import Credentials
-    from googleapiclient.discovery import build
-
-    creds = Credentials.from_authorized_user_file(GMAIL_TOKEN_PATH, GMAIL_SCOPES)
-    if creds.expired and creds.refresh_token:
-        creds.refresh(Request())
-        with open(GMAIL_TOKEN_PATH, "w") as f:
-            f.write(creds.to_json())
-    return build("gmail", "v1", credentials=creds)
-
-
-def send_email(service, to_addr, subject, html_body):
-    msg = MIMEText(html_body, "html")
-    msg["to"] = to_addr
-    msg["subject"] = _scrub_dashes(subject)
-    raw = base64.urlsafe_b64encode(msg.as_bytes()).decode("utf-8")
-    result = service.users().messages().send(userId="me", body={"raw": raw}).execute()
-    return result["id"]
-
-
-def build_rows_html(rows, growth=False):
-    cells = []
-    for r in rows:
-        link = issue_link(r["shortId"])
-        if growth:
-            cells.append(
-                f"<tr><td><a href='{link}'>{r['shortId']}</a>: {r['title']}</td>"
-                f"<td>{r['prevCount']} &rarr; {r['count']}</td>"
-                f"<td>{r['prevInstalls']} &rarr; {r['installs']}</td></tr>"
-            )
-        else:
-            cells.append(
-                f"<tr><td><a href='{link}'>{r['shortId']}</a>: {r['title']}</td>"
-                f"<td>{r['count']}</td><td>{r['installs']}</td></tr>"
-            )
-    return "".join(cells)
-
-
-def build_html(new_rows, growing_rows, first_run, total_open):
-    today = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
-    sections = [f"<p><b>Critical Sentry issues (level:error/fatal), s4l project.</b> "
-                f"Open total: {total_open}. Generated {today}.</p>"]
-
-    if first_run:
-        sections.append("<p>First run: baselining every open critical issue. No investigation, "
-                         "just a snapshot. Future runs only flag NEW or GROWING issues.</p>")
-
-    if new_rows and not first_run:
-        sections.append("<h3>New issues</h3><table border='1' cellpadding='6' "
-                         "style='border-collapse:collapse'><tr><th>Issue</th><th>Events</th>"
-                         "<th>Installs</th></tr>" + build_rows_html(new_rows) + "</table>")
-
-    if growing_rows:
-        sections.append("<h3>Growing issues</h3><table border='1' cellpadding='6' "
-                         "style='border-collapse:collapse'><tr><th>Issue</th>"
-                         "<th>Events (was &rarr; now)</th><th>Installs (was &rarr; now)</th></tr>"
-                         + build_rows_html(growing_rows, growth=True) + "</table>")
-
-    if first_run:
-        top = sorted(new_rows, key=lambda r: -r["installs"])[:10]
-        sections.append("<h3>Top 10 by installs affected (baseline snapshot)</h3>"
-                         "<table border='1' cellpadding='6' style='border-collapse:collapse'>"
-                         "<tr><th>Issue</th><th>Events</th><th>Installs</th></tr>"
-                         + build_rows_html(top) + "</table>")
-
-    sections.append("<p style='color:#888;font-size:12px'>Ranked by distinct install_id count, "
-                     "not Sentry's userCount (unset for this project). level:warning menubar "
-                     "signals are excluded; they're a different kind of event and still queryable "
-                     "in Sentry directly during customer debugging.</p>")
-    return "<div style='font-family:sans-serif;max-width:800px'>" + "".join(sections) + "</div>"
-
-
 def main():
     parser = argparse.ArgumentParser()
-    parser.add_argument("--dry-run", action="store_true", help="Print plan, do not send email or write ledger.")
+    parser.add_argument("--out", required=True, help="Path to write the scan result JSON.")
     args = parser.parse_args()
 
     token = _sentry_token()
@@ -229,74 +131,64 @@ def main():
     ledger = load_ledger()
     known = ledger.get("issues", {})
     first_run = len(known) == 0
-    now_iso = datetime.now(timezone.utc).isoformat()
 
-    new_rows, growing_rows = [], []
-    updated_issues = dict(known)
+    scanned = []
+    new_count = growing_count = 0
 
     for issue in issues:
         short_id = issue["shortId"]
+        numeric_id = issue["id"]
         count = int(issue.get("count", 0))
-        installs, _top = fetch_install_impact(issue["id"], token)
+        installs = fetch_install_impact(numeric_id, token)
         prev = known.get(short_id)
 
         if prev is None:
-            new_rows.append({"shortId": short_id, "title": issue["title"][:90], "count": count, "installs": installs})
+            classification = "new"
+            new_count += 1
         else:
             prev_count = int(prev.get("lastEventCount", 0))
-            if not first_run and count - prev_count >= GROWTH_MIN_DELTA and prev_count > 0 and count >= prev_count * GROWTH_MIN_RATIO:
-                growing_rows.append({
-                    "shortId": short_id, "title": issue["title"][:90],
-                    "count": count, "prevCount": prev_count,
-                    "installs": installs, "prevInstalls": prev.get("lastInstallCount", 0),
-                })
-
-        updated_issues[short_id] = {
-            "title": issue["title"][:200],
-            "lastEventCount": count,
-            "lastInstallCount": installs,
-            "firstSeenRun": (prev or {}).get("firstSeenRun", now_iso),
-            "lastSeenRun": now_iso,
-        }
-
-    print(f"firstRun={first_run} newCount={len(new_rows)} growingCount={len(growing_rows)} totalOpen={len(issues)}")
-
-    should_email = first_run or new_rows or growing_rows
-    if not should_email:
-        print("Nothing new or growing. No email.")
-        if not args.dry_run:
-            ledger["issues"] = updated_issues
-            ledger["lastUpdated"] = now_iso
-            save_ledger(ledger)
-        return
-
-    if first_run:
-        subject = f"[Sentry] s4l critical-issue digest live: {len(issues)} baselined"
-    elif new_rows and growing_rows:
-        subject = f"[Sentry] s4l: {len(new_rows)} new, {len(growing_rows)} growing critical issue(s)"
-    elif new_rows:
-        top_new = max(new_rows, key=lambda r: r["installs"])
-        subject = f"[Sentry] s4l: new critical issue, {top_new['shortId']} ({top_new['installs']} installs)"
-    else:
-        top_grow = max(growing_rows, key=lambda r: r["installs"])
-        subject = f"[Sentry] s4l: {top_grow['shortId']} growing ({top_grow['prevCount']} -> {top_grow['count']} events)"
-
-    html = build_html(new_rows, growing_rows, first_run, len(issues))
-
-    print(f"Subject: {subject}")
-    if args.dry_run:
-        print("--dry-run: not sending email, not writing ledger.")
-        print(html)
-        return
-
-    service = gmail_service()
-    msg_id = send_email(service, NOTIFICATION_EMAIL, subject, html)
-    print(f"Email sent: {msg_id}")
-
-    ledger["issues"] = updated_issues
-    ledger["lastUpdated"] = now_iso
-    save_ledger(ledger)
-    print("Ledger written.")
+            is_growing = (
+                not first_run
+                and count - prev_count >= GROWTH_MIN_DELTA
+                and prev_count > 0
+                and count >= prev_count * GROWTH_MIN_RATIO
+            )
+            if is_growing:
+                classification = "growing"
+                growing_count += 1
+            else:
+                classification = "stable"
+
+        scanned.append({
+            "shortId": short_id,
+            "numericId": numeric_id,
+            "title": issue["title"],
+            "level": issue.get("level"),
+            "count": count,
+            "prevCount": int(prev["lastEventCount"]) if prev else None,
+            "installs": installs,
+            "prevInstalls": prev.get("lastInstallCount") if prev else None,
+            "classification": classification,
+            "link": issue_link(short_id),
+            "lastSeen": issue.get("lastSeen"),
+            "firstSeen": issue.get("firstSeen"),
+        })
+
+    result = {
+        "scannedAt": datetime.now(timezone.utc).isoformat(),
+        "firstRun": first_run,
+        "totalOpen": len(issues),
+        "newCount": new_count,
+        "growingCount": growing_count,
+        "ledgerPath": LEDGER_PATH,
+        "issues": scanned,
+    }
+
+    os.makedirs(os.path.dirname(args.out), exist_ok=True)
+    with open(args.out, "w") as f:
+        json.dump(result, f, indent=2)
+
+    print(f"firstRun={first_run} newCount={new_count} growingCount={growing_count} totalOpen={len(issues)} out={args.out}")
 
 
 if __name__ == "__main__":

package/scripts/sentry_init.py

@@ -18,6 +18,24 @@ import os
 _EMBEDDED_DSN = "https://4d44ac907262c6545cf8681703528d04@o4507617161314304.ingest.us.sentry.io/4511598804336640"
 
 _initialized = False
+_install_id_cache: str | None = None
+
+
+def _install_id() -> str | None:
+    """Cached install_id lookup, used to fingerprint events per-install (see
+    capture_exception/capture_message). Best-effort: "" (not None) is cached on
+    failure so a broken identity.py doesn't re-attempt the read on every call."""
+    global _install_id_cache
+    if _install_id_cache is not None:
+        return _install_id_cache or None
+    try:
+        from identity import get_identity
+
+        ident = get_identity() or {}
+        _install_id_cache = str(ident.get("install_id") or "")
+    except Exception:
+        _install_id_cache = ""
+    return _install_id_cache or None
 
 
 def init() -> None:
@@ -79,12 +97,17 @@ def capture_exception(err, tags=None) -> None:
     except Exception:
         return
     try:
-        if tags:
-            with sentry_sdk.push_scope() as scope:
-                for k, v in tags.items():
-                    scope.set_tag(str(k), str(v))
-                sentry_sdk.capture_exception(err)
-        else:
+        with sentry_sdk.push_scope() as scope:
+            for k, v in (tags or {}).items():
+                scope.set_tag(str(k), str(v))
+            # Mix install_id into the grouping key so the SAME exception on two
+            # different customer boxes lands in two different issues, not one
+            # conflated issue whose "latest event" can silently belong to a
+            # different install than the one you filtered for (default grouping
+            # is by exception type + location, which ignores tags entirely).
+            iid = _install_id()
+            if iid:
+                scope.fingerprint = ["{{ default }}", iid]
             sentry_sdk.capture_exception(err)
     except Exception:
         return
@@ -100,7 +123,12 @@ def capture_message(message, level="error", tags=None, extra=None) -> None:
     `extra` is a dict of larger structured values (e.g. the scheduled-task
     registry summary) attached as event extras — tags are capped at 200 chars
     and would truncate them. Added 2026-07-06: the "needs attention: missing"
-    events carried no registry detail, which cost hours on the Karol case."""
+    events carried no registry detail, which cost hours on the Karol case.
+
+    Fingerprint: mixed with install_id (see capture_exception) — capture_message
+    events group by the message TEXT by default, so two installs hitting the
+    identically-worded stall alert (e.g. "autopilot stalled... sustained N
+    checks") would otherwise merge into one issue and hide per-install history."""
     if not _initialized:
         return
     try:
@@ -108,14 +136,14 @@ def capture_message(message, level="error", tags=None, extra=None) -> None:
     except Exception:
         return
     try:
-        if tags or extra:
-            with sentry_sdk.push_scope() as scope:
-                for k, v in (tags or {}).items():
-                    scope.set_tag(str(k), str(v))
-                for k, v in (extra or {}).items():
-                    scope.set_extra(str(k), v)
-                sentry_sdk.capture_message(str(message), level=level)
-        else:
+        with sentry_sdk.push_scope() as scope:
+            for k, v in (tags or {}).items():
+                scope.set_tag(str(k), str(v))
+            for k, v in (extra or {}).items():
+                scope.set_extra(str(k), v)
+            iid = _install_id()
+            if iid:
+                scope.fingerprint = ["{{ default }}", iid]
             sentry_sdk.capture_message(str(message), level=level)
     except Exception:
         return

package/scripts/setup_twitter_auth.py

@@ -1027,17 +1027,50 @@ def cmd_connect(args) -> dict:
     except Exception as e:
         return {"ok": False, "connected": False, "state": "error", "error": str(e), "cdp": CDP}
 
-    # 1b. Headless + Keychain pre-flight (#3 + #4, added 2026-06-02).
-    # On macOS, copy_browser_cookies.py needs to read the per-browser Safe
-    # Storage entry from the OS keychain. SSH-invoked processes get
-    # errSecAuthFailed silently — no prompt, no warning. We probe up front so
-    # the user sees "your keychain is locked / run unlock-keychain" instead of
-    # the misleading "log in manually" cascade.
-    headless = _is_headless()
-    if headless:
-        # Probe with the first source's likely browser label. We don't know
-        # which source will succeed yet, so probe Chrome (the autoposter
-        # default); if that's denied, all the AUTO_SOURCES will be too.
+    # 1b. Choose the connection PATH before doing any keychain work. There are
+    #     two mutually exclusive paths, and only one of them touches the keychain:
+    #       - IMPORT: copy an existing x.com session out of the user's everyday
+    #         browser. This reads that browser's "Safe Storage" key from the macOS
+    #         Keychain, so it (and ONLY it) is gated by the headless keychain
+    #         preflight below.
+    #       - MANUAL LOGIN: open the managed Chrome's own login page and let the
+    #         user sign in by hand. Reads NO keychain and needs NO everyday-browser
+    #         session, so it must NEVER be blocked by the keychain preflight.
+    #     Auto-import is only possible when some installed browser actually holds
+    #     an x.com session. On a fresh or remote/headless box there is nothing to
+    #     import, so gating manual login behind the keychain check dead-ended setup
+    #     on "keychain locked" even though there was no session to copy anyway
+    #     (the exact wedge that stalled the macstadium test box). We now skip
+    #     straight to manual login whenever there's nothing to import.
+    #
+    #     Source selection:
+    #       - explicit --source X   -> just that one (one keychain prompt)
+    #       - --source all          -> the full chrome/arc/brave/edge sweep (legacy)
+    #       - no --source (default) -> the browser(s) that ACTUALLY hold an x.com
+    #         session, so we prompt the keychain for exactly the right one.
+    if args.source == "all":
+        sources = AUTO_SOURCES
+        has_importable = True
+    elif args.source:
+        sources = [args.source]
+        has_importable = True
+    else:
+        _srcs = _list_sources()
+        _with_session = [s["spec"] for s in _srcs if s.get("x_session")]
+        sources = _with_session or ["chrome:Default"]
+        has_importable = bool(_with_session)
+
+    manual_login = bool(getattr(args, "manual_login", False))
+    # Attempt an auto-import ONLY when the user didn't force manual login AND
+    # there is a real session to copy. Otherwise fall through to manual login.
+    will_import = has_importable and not manual_login
+
+    # 1c. Headless + Keychain pre-flight (#3 + #4, added 2026-06-02) — relevant
+    #     ONLY to the import path. copy_browser_cookies.py must read the per-browser
+    #     Safe Storage entry from the OS keychain; SSH/launchd-invoked processes get
+    #     errSecAuthFailed silently (no prompt). The manual-login path skips this.
+    if will_import and _is_headless():
+        # Probe Chrome (the autoposter default); if that's denied, the rest are too.
         kc_ok, kc_detail = _keychain_safe_storage_ok("Chrome")
         if not kc_ok:
             return {
@@ -1053,28 +1086,17 @@ def cmd_connect(args) -> dict:
                     "or another headless context). No GUI prompt is shown for this — macOS "
                     "denies access silently. To fix, run this once in the same session:\n"
                     "  security unlock-keychain ~/Library/Keychains/login.keychain-db\n"
-                    "Then re-run connect_x. If you're on the autoposter machine via SSH, you "
-                    "may also need to run it before every fresh shell, or persist with "
-                    "`security set-keychain-settings -lut 0`."
+                    "Then re-run connect_x. Or connect X with manual login instead — that "
+                    "signs in directly in the autoposter's own browser and needs no keychain."
                 ),
                 "remediation_cmd": "security unlock-keychain ~/Library/Keychains/login.keychain-db",
                 "cdp": CDP,
             }
 
-    # 2. Import from the user's everyday browser.
-    #    - explicit --source X        -> just that one (one keychain prompt)
-    #    - --source all               -> the full chrome/arc/brave/edge sweep (legacy)
-    #    - no --source (the default)  -> auto-pick the browser(s) that ACTUALLY
-    #      hold an x.com session, so we prompt the keychain for exactly the right
-    #      one instead of blindly walking all four and prompting per browser.
-    if args.source == "all":
-        sources = AUTO_SOURCES
-    elif args.source:
-        sources = [args.source]
-    else:
-        sources = _auto_pick_sources()
+    # 2. Import from the user's everyday browser (skipped entirely when we're on
+    #    the manual-login path — `will_import` False makes this loop a no-op).
     attempts = []
-    for src in sources:
+    for src in (sources if will_import else []):
         res = _import_from(src)
         copied = res.get("stdout", "")
         detail = copied or res.get("error") or res.get("stderr")
@@ -1139,8 +1161,15 @@ def cmd_connect(args) -> dict:
     rolled_up_error_type = (
         next(iter(distinct_error_types)) if len(distinct_error_types) == 1 else None
     )
-    manual_login = bool(getattr(args, "manual_login", False))
-    open_login = manual_login or rolled_up_error_type == "keychain_acl_denied"
+    # Open a focused login window when the user asked for manual login, when the
+    # keychain prompt was denied (import can't proceed), OR when there was nothing
+    # to import in the first place — in that last case manual login is the ONLY
+    # path that can work, so we must open the window rather than dead-end.
+    open_login = (
+        manual_login
+        or not will_import
+        or rolled_up_error_type == "keychain_acl_denied"
+    )
 
     shown = False
     if open_login:
@@ -1156,7 +1185,7 @@ def cmd_connect(args) -> dict:
         # That race is what made setup misreport the handle as "missing." If the
         # cookie appears, fall through to the same connected/persist/handle path the
         # auto-import success branch uses.
-        login_wait = getattr(args, "login_wait", 90.0)
+        login_wait = getattr(args, "login_wait", 300.0)
         if login_wait and login_wait > 0 and _poll_for_login(timeout=login_wait):
             try:
                 if _is_session_valid():
@@ -1197,16 +1226,23 @@ def cmd_connect(args) -> dict:
         )
         extra["remediation"] = "rerun_connect_x_and_click_allow"
     elif open_login:
-        # Explicit --manual-login: a window is open and we waited; they just
-        # haven't finished signing in yet.
+        # Manual login: either the caller asked for it (--manual-login) or there
+        # was no existing X session anywhere to import, so this is the only path.
+        # A focused login window is open and we waited; they just haven't finished
+        # signing in yet.
+        _why = (
+            "" if will_import
+            else "No existing X session was found in your everyday browser to import, so "
+        )
+        _tried = (" (Auto-import tried: " + ", ".join(sources) + ".)") if will_import else ""
         note = (
-            "A Chrome window for the autoposter is open at the X login page"
+            _why
+            + "a Chrome window for the autoposter is open at the X login page"
             + ("" if shown else " (if you don't see it, look for a 'Google Chrome' window)")
             + " and you are NOT logged in yet. Log in there yourself — username, password, "
             "and 2FA if prompted — in that window. When your X home timeline shows, ask me "
             "to confirm and I'll re-check (run connect_x again). The session is saved to the "
-            "autoposter's own profile, so this is a one-time step. "
-            "(Auto-import tried: " + ", ".join(sources) + ".)"
+            "autoposter's own profile, so this is a one-time step." + _tried
         )
     else:
         # Auto-import failed for a non-deny reason and the user did NOT ask for
@@ -1294,10 +1330,12 @@ def main() -> int:
                         "the login window only opens when the user DENIED the keychain "
                         "prompt; every other auto-import failure returns needs_login "
                         "without popping an unexpected browser window.")
-    c.add_argument("--login-wait", type=float, default=90.0,
+    c.add_argument("--login-wait", type=float, default=300.0,
                    help="Seconds to wait for a MANUAL login to complete before "
-                        "returning needs_login (default 90; 0 disables the wait). "
-                        "Prevents the detection race that misreports the handle as missing.")
+                        "returning needs_login (default 300; 0 disables the wait). "
+                        "A human finding the on-screen/VNC window plus password + 2FA "
+                        "routinely exceeds 90s, so the wait is generous. Prevents the "
+                        "detection race that misreports the handle as missing.")
     args = ap.parse_args()
 
     if args.cmd == "detect-sources":

package/scripts/snapshot.py

@@ -512,6 +512,26 @@ def _is_newer(latest, current) -> bool:
     return _ver_key(latest) > _ver_key(current)
 
 
+def version_status() -> dict:
+    """Version/update fields ONLY, independent of the rest of compute(). compute()
+    calls _x_status() first, which can block up to 90s in the setup_twitter_auth.py
+    subprocess (CDP to Chrome) whenever a scan job is holding the browser busy —
+    that freezes update_available/latest_version on an otherwise-busy box even
+    though the GitHub check itself is a ~1s curl. Callers that want the "Update
+    available" banner to stay live regardless of X/runtime state should poll this
+    directly instead of waiting on the full compute()."""
+    installed = _resolve_version()
+    channel = _channel()
+    latest, latest_tag = _latest_published(channel)
+    return {
+        "version": installed,
+        "channel": channel,
+        "latest_version": latest,
+        "latest_tag": latest_tag,
+        "update_available": bool(latest) and _is_newer(latest, installed),
+    }
+
+
 # ---- onboarding ledger + live overlay --------------------------------------
 def _onboarding_live(live_status):
     led = _read_json(os.path.join(_state_dir(), "onboarding-progress.json")) or {}