@m13v/s4l 1.7.1-rc.2 → 1.7.1-rc.21

package/mcp/menubar/s4l_menubar.py

@@ -132,20 +132,24 @@ except Exception as _import_err:
 import s4l_state as st  # noqa: E402
 
 # AppKit is available in the owned venv (PyObjC is a rumps dependency). We use it
-# only to pull the accessory (LSUIElement) app to the front before showing an
-# NSAlert: an agent app that isn't the active app has its rumps.alert appear
-# BEHIND the frontmost window ("modal doesn't show on top"), because runModal
-# doesn't activate the app for us. Guarded so a missing AppKit never breaks the
-# menu bar — the alert still shows, just possibly not front-most.
+# to pull the accessory (LSUIElement) app to the front AND to force the alert
+# window itself above whatever else is on screen. Guarded so a missing AppKit
+# never breaks the menu bar — the alert still shows, just possibly not
+# front-most.
 try:
-    from AppKit import NSApplication  # noqa: E402
+    from AppKit import NSApplication, NSAlert, NSFloatingWindowLevel  # noqa: E402
 except Exception:
     NSApplication = None
+    NSAlert = None
+    NSFloatingWindowLevel = None
 
 
 def _activate_front():
-    """Bring this accessory app to the front so the next NSAlert (rumps.alert)
-    opens on top of whatever was frontmost, instead of behind it. Best-effort."""
+    """Bring this accessory app to the front so the next alert opens on top of
+    whatever was frontmost, instead of behind it. Best-effort; kept as a
+    belt-and-suspenders call alongside _show_alert's own window-level fix
+    below, since activation also affects which app is "key" for keyboard
+    input on the alert's buttons."""
     try:
         if NSApplication is not None:
             NSApplication.sharedApplication().activateIgnoringOtherApps_(True)
@@ -153,6 +157,44 @@ def _activate_front():
         pass
 
 
+def _show_alert(title=None, message='', ok=None, cancel=None, other=None):
+    """Like rumps.alert(), but actually shows up on top.
+
+    rumps.alert() builds an NSAlert and immediately calls runModal() with no
+    window-level or ordering call at all — it just assumes the app is already
+    active. activateIgnoringOtherApps_ (_activate_front, above) is async, so
+    it can lose the race against runModal()'s own (assumed-active) window
+    presentation: the alert window is created at the default level and never
+    explicitly raised, so when this accessory app ISN'T active (e.g. Claude
+    Desktop is frontmost), it renders BEHIND Claude's window instead of on
+    top of it. Confirmed recurring 2026-07-07 (uninstall modal hidden behind
+    Claude Desktop) despite the activation call landing 2026-06-30.
+
+    Fix: build the NSAlert ourselves (same call rumps.alert uses) and force
+    its window to NSFloatingWindowLevel + orderFrontRegardless() BEFORE
+    runModal(), mirroring the pattern s4l_card.py's review panel already uses
+    successfully (see _ReviewPanel._build: setLevel_(NSFloatingWindowLevel) +
+    orderFrontRegardless()). Floating level sits above normal app windows in
+    the window server's global z-order regardless of app-activation state,
+    so it doesn't depend on the activation race resolving in time."""
+    _activate_front()
+    if NSAlert is None:
+        # AppKit unavailable in this venv: fall back to rumps' plain alert.
+        return rumps.alert(title=title, message=message, ok=ok, cancel=cancel, other=other)
+    msg = str(message).replace('%', '%%')
+    if not isinstance(cancel, str):
+        cancel = 'Cancel' if cancel else None
+    alert = NSAlert.alertWithMessageText_defaultButton_alternateButton_otherButton_informativeTextWithFormat_(
+        title, ok, cancel, other, msg)
+    alert.setAlertStyle_(0)  # same style rumps.alert() uses
+    try:
+        alert.window().setLevel_(NSFloatingWindowLevel)
+        alert.window().orderFrontRegardless()
+    except Exception:
+        pass
+    return alert.runModal()
+
+
 CLAUDE_APP = "Claude"
 
 
@@ -182,6 +224,14 @@ MENUBAR_PLIST = os.path.join(
 # start actions (restart_menubar tool, queue_setup re-arm). Keep the filename in
 # sync with MENUBAR_STOP_FLAG in mcp/src/runtime.ts.
 STOP_FLAG = os.path.join(st.state_dir(), "stopped.flag")
+# Pause sentinel (lighter than STOP_FLAG): while present, the pipeline daemons
+# (kicker/reaper/stall-watch/memory-snapshot) stay unloaded and claude_job.py's
+# `next` reports no work — but Claude Desktop, this tray, and the draft
+# schedule registration are untouched. Written/cleared ONLY by the MCP's
+# pause_s4l tool (see _pause_work below); this constant is read-only
+# here, purely to render the menu label. Keep the filename in sync with
+# pauseFlagPath() in mcp/src/index.ts.
+PAUSE_FLAG = os.path.join(st.state_dir(), "paused.flag")
 
 # Autopilot scheduled tasks. Queue workers must RUN in a dedicated folder
 # (~/.s4l-worker) so their once-a-minute sessions don't flood the user's
@@ -242,6 +292,11 @@ REARM_PROMPT = (
     "If the task already exists, call update_scheduled_task with taskId s4l-worker and "
     "notifyOnCompletion false instead. "
     "Do not redo my X connection or project setup — only register the scheduled task. "
+    "Before calling create_scheduled_task/list_scheduled_tasks/update_scheduled_task, run "
+    "(via Bash, best-effort, ignore any error and continue if the path doesn't exist): "
+    "python3 ~/.social-autoposter-mcp/repo/package/scripts/mark_event.py start <that tool's name>; "
+    "immediately after it returns, run the same with 'end' instead of 'start'. This makes a hang "
+    "in that host tool directly observable instead of invisible. "
     "Keep replies short."
 )
 # Universal diagnose-and-heal prompt behind the ⚠ "Diagnose & fix" menu item. One
@@ -270,7 +325,11 @@ DIAGNOSE_PROMPT_TEMPLATE = (
     "to fix, say so in the report. "
     "(3) schedule missing/disabled — re-register via queue_setup or the host "
     "create_scheduled_task with notifyOnCompletion false and the prompt from "
-    "~/.claude/scheduled-tasks/s4l-worker/SKILL.md.\n"
+    "~/.claude/scheduled-tasks/s4l-worker/SKILL.md. Before calling create_scheduled_task/"
+    "list_scheduled_tasks/update_scheduled_task, bracket it (Bash, best-effort, ignore if "
+    "missing): python3 ~/.social-autoposter-mcp/repo/package/scripts/mark_event.py start "
+    "<tool name>, then ...end <tool name> right after it returns — makes a hang in that "
+    "host tool directly observable.\n"
     "HARD RULE: fix state files only. Never edit, copy, or patch code in "
     "~/.social-autoposter-mcp or any extension bundle (hot patches are auto-reverted "
     "and mask the real bug).\n"
@@ -469,6 +528,24 @@ class S4LMenuBar(rumps.App):
             f"[s4l-menubar] accessibility_trusted={st.accessibility_trusted()}\n"
         )
         sys.stderr.flush()
+        # Status-item visibility watchdog (telemetry only). A live process says
+        # nothing about whether macOS is actually DRAWING our icon: on 2026-07-07
+        # a customer's menu bar process ran for ~25 min with no visible icon
+        # (post-reboot login storm) and support had no signal to tell "process
+        # dead" from "icon hidden". _tick probes the real NSStatusItem every 60s,
+        # persists menubar-state.json (memory_snapshot ships it on the heartbeat)
+        # and logs transitions to stderr. Deliberately NO auto-restart: the
+        # occlusion probe also reads not-visible during fullscreen apps and the
+        # locked screen, so acting on it would false-fire; the remote fix is the
+        # restart_menubar MCP tool.
+        # First probe at +60s, not immediately: the window server takes a few
+        # seconds to place a fresh status item (occlusion reads not-visible and
+        # the frame sits at x=0 until then — measured 2026-07-07), so an eager
+        # probe would log a false "hidden" on every single process start.
+        self._icon_check_due_at = time.monotonic() + 60.0
+        self._icon_hidden_since = None
+        self._icon_last_on_screen = "unprobed"
+        self._icon_watch_started = time.monotonic()
         self._timer = rumps.Timer(self._tick, POLL_SECONDS)
         self._timer.start()
         # Light 1s poll for server activity (scanning/drafting/posting/…); it
@@ -577,7 +654,7 @@ class S4LMenuBar(rumps.App):
             msg = "Click OK, then open Claude and ask it to " + action_desc + "."
         try:
             _activate_front()
-            rumps.alert(title=title, message=msg, ok="OK")
+            _show_alert(title=title, message=msg, ok="OK")
         except Exception:
             self._notify("S4L · prompt copied" if copied else "S4L",
                          "Paste the prompt into Claude (Cmd+V) and press Enter.")
@@ -633,7 +710,21 @@ class S4LMenuBar(rumps.App):
         clipboard, open Claude, and tell the user to paste it. (The dashboard
         widget's button does this in one click via app.sendMessage — no paste.) We
         do NOT auto-type (focus/timing flaky) and do NOT write the registry directly
-        (can't reliably target a just-switched-into account)."""
+        (can't reliably target a just-switched-into account).
+
+        The click itself is captured (mirroring _diagnose_fix) — previously this
+        button had NO telemetry at all, so a past incident (Karol, 2026-07-07)
+        could only establish "a human must have clicked SOMETHING" from the code
+        path, never which button or exactly when. The registry snapshot rides as
+        an extra so the pre-rearm state is on record without on-box forensics."""
+        sched = getattr(self, "_schedule_state_cache", "") or ""
+        _capture_msg(
+            "S4L rearm clicked",
+            phase="rearm",
+            surface="menubar",
+            schedule_state=sched or "unknown",
+            _extra={"registry": _registry_summary_for_capture()},
+        )
         self._clipboard_prompt(
             REARM_PROMPT,
             "Set up the draft schedule",
@@ -648,7 +739,7 @@ class S4LMenuBar(rumps.App):
         also run the registry self-heal, which additionally repairs the
         account-switch orphan case, so this one click covers both known causes."""
         _activate_front()
-        choice = rumps.alert(
+        choice = _show_alert(
             title="Restart Claude Desktop?",
             message=(
                 "Claude’s scheduler stopped running the draft tasks (a known "
@@ -976,7 +1067,7 @@ class S4LMenuBar(rumps.App):
         # ok=1 (plugin reset, keeps X login + browser layer), other=-1 (deep wipe),
         # cancel=0. See rumps.alert: default=1, alternate=0, other=-1.
         _activate_front()
-        choice = rumps.alert(
+        choice = _show_alert(
             title="Uninstall S4L?",
             message=(
                 "This quits Claude Desktop, removes the S4L extension + its "
@@ -1019,7 +1110,7 @@ class S4LMenuBar(rumps.App):
     def _alert(self, title, message):
         try:
             _activate_front()
-            rumps.alert(title=title, message=message, ok="OK")
+            _show_alert(title=title, message=message, ok="OK")
         except Exception:
             pass
 
@@ -1043,6 +1134,40 @@ class S4LMenuBar(rumps.App):
             pass
         return False
 
+    def _pause_toggle(self, _=None):
+        """Pause/Resume: the lighter, fully reversible alternative to Quit. Stops
+        S4L's own scan/draft/post pipeline (the launchd kicker + its support
+        daemons) while leaving Claude Desktop, this tray, and the draft
+        schedule registration alone — nothing is deleted, so it survives a
+        Claude restart and Resume brings it right back. Runs the real
+        launchctl work directly via st.pause_s4l()/resume_s4l() (this process
+        already does its own launchctl calls elsewhere, e.g. _quit_work) so it
+        works even when Claude Desktop is closed — no MCP/loopback round trip."""
+        action = "resume" if os.path.exists(PAUSE_FLAG) else "pause"
+        self._notify("S4L", "Resuming…" if action == "resume" else "Pausing…")
+        threading.Thread(target=self._pause_work, args=(action,), daemon=True).start()
+
+    def _pause_work(self, action):
+        res = st.pause_s4l() if action == "pause" else st.resume_s4l()
+        ok = bool(res.get("ok"))
+        if action == "pause":
+            self._notify(
+                "S4L",
+                "S4L paused. Drafting and posting are stopped; Claude and the tray "
+                "stay up. Click Resume S4L to start again."
+                if ok else "Couldn't fully pause S4L — see logs.",
+            )
+        else:
+            self._notify(
+                "S4L", "S4L resumed." if ok else "Couldn't fully resume S4L — see logs."
+            )
+        self._sig = None
+        try:
+            self._tick(None)
+        except Exception as e:
+            sys.stderr.write(f"[s4l-menubar] pause toggle rebuild failed: {e}\n")
+            sys.stderr.flush()
+
     def _quit_app(self, _=None):
         """The single Quit path. Quitting stops the autopilot completely: the
         draft/query scheduled tasks are removed so they no longer fire, AND the
@@ -1054,7 +1179,7 @@ class S4LMenuBar(rumps.App):
         modal FIRST that Claude Desktop will restart, since the app window will
         close and reopen under them."""
         _activate_front()
-        choice = rumps.alert(
+        choice = _show_alert(
             title="Quit the S4L autoposter?",
             message=(
                 "Quitting stops the autoposter completely: the draft + query "
@@ -1740,16 +1865,14 @@ class S4LMenuBar(rumps.App):
             self._cwd_healed = True
             return
         _activate_front()
-        choice = rumps.alert(
-            title="Tidy the S4L background tasks?",
+        choice = _show_alert(
+            title="Tidy S4L background tasks?",
             message=(
-                "S4L can tidy its background tasks: merge the old draft + query "
-                "tasks into ONE universal worker (s4l-worker) and make sure "
-                "their once-a-minute runs stay in a dedicated folder instead of "
-                "cluttering your `claude --resume` history.\n\n"
-                "Claude Desktop will restart once to apply — its window will "
-                "close and reopen in a moment. Your X login, drafts, and config "
-                "all stay."
+                "Move the background worker to a dedicated folder so its "
+                "once-a-minute runs stop cluttering your `claude --resume` "
+                "history.\n\n"
+                "Claude Desktop will restart once to apply. Your X login, "
+                "drafts, and config all stay."
             ),
             ok="Tidy & restart Claude", cancel="Later",
         )
@@ -2020,6 +2143,98 @@ class S4LMenuBar(rumps.App):
             self._notify("S4L", f"Resuming {resumed} approved draft(s) after restart…")
 
     # ---- tick: read state, set title, (re)build menu ----------------------
+    def _probe_statusitem(self):
+        """Actual on-screen state of our NSStatusItem: (visible_pref, on_screen).
+
+        visible_pref False = the item was removed from the bar (e.g. the user
+        Cmd-dragged it off). on_screen False with visible_pref True = the item
+        exists but macOS is not drawing it: menu bar full / notch clipping, a
+        status-item render glitch after a login storm, OR a benign fullscreen
+        app / locked screen (why this feeds telemetry, never an automatic
+        action). Two independent signals are recorded because we don't yet know
+        which one is reliable in the field: the window's occlusion state and
+        whether its frame intersects any screen (clipped items get parked
+        off-screen). Either value may be None when the probe can't answer (old
+        macOS, rumps internals moved). Never raises."""
+        try:
+            item = getattr(getattr(self, "_nsapp", None), "nsstatusitem", None)
+            if item is None:
+                return None, None
+            visible_pref = None
+            try:
+                visible_pref = bool(item.isVisible())
+            except Exception:
+                pass
+            on_screen = None
+            try:
+                win = item.button().window()
+                if win is not None:
+                    from AppKit import NSScreen, NSWindowOcclusionStateVisible
+                    occluded_visible = bool(
+                        win.occlusionState() & NSWindowOcclusionStateVisible
+                    )
+                    f = win.frame()
+                    intersects = False
+                    for s in NSScreen.screens():
+                        sf = s.frame()
+                        if (
+                            f.origin.x < sf.origin.x + sf.size.width
+                            and f.origin.x + f.size.width > sf.origin.x
+                            and f.origin.y < sf.origin.y + sf.size.height
+                            and f.origin.y + f.size.height > sf.origin.y
+                        ):
+                            intersects = True
+                            break
+                    on_screen = occluded_visible and intersects
+            except Exception:
+                pass
+            return visible_pref, on_screen
+        except Exception:
+            return None, None
+
+    def _icon_watch_tick(self, now):
+        """60s-throttled visibility probe + menubar-state.json write. See the
+        __init__ comment for why this exists and why it never self-heals."""
+        if now < self._icon_check_due_at:
+            return
+        self._icon_check_due_at = now + 60.0
+        try:
+            visible_pref, on_screen = self._probe_statusitem()
+            if on_screen is False:
+                if self._icon_hidden_since is None:
+                    self._icon_hidden_since = now
+            else:
+                self._icon_hidden_since = None
+            hidden_for = (
+                int(now - self._icon_hidden_since)
+                if self._icon_hidden_since is not None
+                else 0
+            )
+            if on_screen != self._icon_last_on_screen:
+                sys.stderr.write(
+                    f"[s4l-menubar] statusitem on_screen={on_screen} "
+                    f"visible_pref={visible_pref} hidden_for_sec={hidden_for}\n"
+                )
+                sys.stderr.flush()
+                self._icon_last_on_screen = on_screen
+            dest = os.path.join(st.state_dir(), "menubar-state.json")
+            tmp = dest + ".tmp"
+            with open(tmp, "w") as f:
+                json.dump(
+                    {
+                        "ts": time.time(),
+                        "pid": os.getpid(),
+                        "uptime_sec": int(now - self._icon_watch_started),
+                        "statusitem_on_screen": on_screen,
+                        "statusitem_visible_pref": visible_pref,
+                        "hidden_for_sec": hidden_for,
+                    },
+                    f,
+                )
+            os.replace(tmp, dest)
+        except Exception:
+            pass
+
     def _tick(self, _):
         # Post-update verdict: cheap (a single stat when no update is pending).
         try:
@@ -2053,6 +2268,8 @@ class S4LMenuBar(rumps.App):
                         pass
             else:
                 self._resumed = False
+        # Status-item visibility telemetry (60s-throttled inside; see __init__).
+        self._icon_watch_tick(now)
         # The activity spinner owns the TITLE while a tool runs (we don't fight it at
         # 0.12s), but the menu + update indicator must still refresh mid-run —
         # otherwise the "Update now & restart Claude Desktop" item never appears on a box that's always
@@ -2243,6 +2460,7 @@ class S4LMenuBar(rumps.App):
             attention,
             schedule_state,
             self._stall_reason_info,
+            os.path.exists(PAUSE_FLAG),
         )
         if sig != self._sig:
             self._sig = sig
@@ -2618,10 +2836,23 @@ class S4LMenuBar(rumps.App):
                 with self._review_lock:
                     activity_label = self._posting_activity_label_locked()
                 cl = [n] if decision.get("drop_link") else None
-                if decision.get("edited"):
+                # Two-draft cards: a draft_variant means the human picked
+                # (or kept) a specific slot on a dual-draft card, route
+                # through edits=[...] even with no hand-typed change, so the
+                # candidate's style/assigned_style/assigned_mode switch to
+                # match whichever draft is actually posting (mcp/src/index.ts
+                # post_drafts applies both from the same entry). Without
+                # this, a card where the human accepted the recommended
+                # draft as-is (edited=False) would still need its variant
+                # tag carried through for consistency with a later switch.
+                draft_variant = decision.get("draft_variant")
+                if decision.get("edited") or draft_variant:
+                    edit = {"n": n, "text": decision.get("text") or ""}
+                    if draft_variant:
+                        edit["variant"] = draft_variant
                     res = st.post_drafts(
                         batch,
-                        edits=[{"n": n, "text": decision.get("text") or ""}],
+                        edits=[edit],
                         clear_link=cl,
                         activity_label=activity_label,
                     )
@@ -2689,6 +2920,18 @@ class S4LMenuBar(rumps.App):
         items.append(header)
         items.append(rumps.separator)
 
+        # Pause: the lighter, fully reversible alternative to Quit — stops
+        # drafting/posting but leaves Claude Desktop, this tray, and the draft
+        # schedule alone. Top of the menu: it's the primary control. See
+        # _pause_toggle.
+        if os.path.exists(PAUSE_FLAG):
+            items.append(self._label("⏸ S4L is paused — drafting & posting stopped"))
+            items.append(rumps.MenuItem("Resume S4L", callback=self._pause_toggle))
+        else:
+            items.append(rumps.MenuItem("Pause S4L", callback=self._pause_toggle))
+            items.append(self._label("   stop drafting/posting, keep Claude + tray running"))
+        items.append(rumps.separator)
+
         # Attention = the draft schedule isn't running for THIS account (missing or
         # disabled). "Set up draft schedule" fixes it via host create_scheduled_task.
         # When the schedule IS firing (ok), attention is False and nothing shows here