@m13v/s4l 1.7.4-rc.32 → 1.7.4-rc.34

package/mcp/dist/runtime.js

@@ -239,6 +239,30 @@ function bundledVersion() {
         return null;
     }
 }
+// `ensurePipelineCurrent()` extracts updates over the existing materialized
+// repo so customer config and logs survive. That also means deleting a file
+// from the npm tarball does not delete an older copy already on disk. Keep
+// explicit tombstones for retired helpers long enough for the fleet to pass
+// through this release; new installs never receive these files.
+const RETIRED_MATERIALIZED_FILES = [
+    "scripts/saps_mode.py",
+    "scripts/saps_activity.py",
+    "scripts/_lock_preempt_test.py",
+];
+function removeRetiredMaterializedFiles() {
+    for (const rel of RETIRED_MATERIALIZED_FILES) {
+        const target = path.join(MATERIALIZED_REPO, rel);
+        try {
+            if (!fs.existsSync(target))
+                continue;
+            fs.rmSync(target, { force: true });
+            console.error(`[runtime] removed retired pipeline file ${rel}`);
+        }
+        catch (e) {
+            console.error(`[runtime] could not remove retired pipeline file ${rel}: ${e?.message || e}`);
+        }
+    }
+}
 // Re-materialize the pipeline source when a plugin UPDATE shipped a newer
 // pipeline.tgz than what's on disk. The .mcpb update refreshes dist/ (this
 // server) but does NOT re-extract the embedded tarball, so without this the box
@@ -269,6 +293,9 @@ export function ensurePipelineCurrent() {
         const bundled = bundledVersion();
         if (!bundled)
             return; // dev build, no stamp — leave the materialized repo alone.
+        // Run before the version early-return too: a prior package build may have
+        // accidentally included a retired file under this same version.
+        removeRetiredMaterializedFiles();
         const rt = readRuntime();
         if (rt?.pipeline_version === bundled)
             return; // already current.
@@ -283,6 +310,9 @@ export function ensurePipelineCurrent() {
             console.error(`[runtime] pipeline re-materialize failed (exit ${r.status}); keeping existing pipeline`);
             return;
         }
+        // Defense in depth: a stale/locally-built tarball cannot reintroduce a
+        // retired helper even if its package allowlist drifts.
+        removeRetiredMaterializedFiles();
         // Record the new version so we don't re-extract on every boot.
         const next = rt ?? readRuntime();
         if (next) {

package/mcp/dist/version.js

@@ -94,6 +94,67 @@ export function releaseChannel() {
     }
     return "stable";
 }
+const SHARED_TTL_S = 600; // banner latency ceiling: a new release surfaces within 10 min
+const PROBE_LOCK_STALE_MS = 30_000;
+function sharedCachePath() {
+    return path.join(STATE_DIR, "latest-release.json");
+}
+function readSharedCache(channel) {
+    try {
+        const d = JSON.parse(fs.readFileSync(sharedCachePath(), "utf-8"));
+        if (!d || d.channel !== channel || typeof d.at !== "number")
+            return null;
+        return {
+            at: d.at,
+            channel,
+            version: typeof d.version === "string" ? d.version : null,
+            tag: typeof d.tag === "string" ? d.tag : null,
+            etag: typeof d.etag === "string" ? d.etag : null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeSharedCache(c) {
+    try {
+        fs.mkdirSync(STATE_DIR, { recursive: true });
+        const tmp = `${sharedCachePath()}.tmp.${process.pid}`;
+        fs.writeFileSync(tmp, JSON.stringify(c));
+        fs.renameSync(tmp, sharedCachePath());
+    }
+    catch {
+        /* best effort; worst case another process re-probes */
+    }
+}
+// Single-flight guard so N concurrent processes with an expired shared cache
+// don't all probe at once. acquired=false ONLY when another probe holds a
+// FRESH lock; any other failure probes anyway rather than going blind.
+function tryProbeLock() {
+    const lock = path.join(STATE_DIR, "latest-release.lock");
+    const create = () => fs.closeSync(fs.openSync(lock, "wx"));
+    try {
+        fs.mkdirSync(STATE_DIR, { recursive: true });
+        create();
+        return { acquired: true, lock };
+    }
+    catch (e) {
+        if (e.code === "EEXIST") {
+            try {
+                if (Date.now() - fs.statSync(lock).mtimeMs > PROBE_LOCK_STALE_MS) {
+                    fs.unlinkSync(lock); // stale: holder died mid-probe
+                    create();
+                    return { acquired: true, lock };
+                }
+            }
+            catch {
+                /* raced with the holder */
+            }
+            return { acquired: false, lock: null };
+        }
+        return { acquired: true, lock: null };
+    }
+}
 function parseSemverish(v) {
     return /^\d+\.\d+\.\d+/.test(v) ? v : null;
 }
@@ -128,41 +189,45 @@ async function latestFromGithubRedirect() {
         return null;
     }
 }
-// In-process conditional-request state: long-lived processes send If-None-Match
-// on every probe and get free 304s; each new release costs a single 200.
-const apiState = { etag: null, latest: null };
-async function latestFromGithubApi() {
+// Conditional-request state lives in the SHARED cache file (latest-release.json)
+// so the ETag survives process boundaries: short-lived MCP respawns used to pay
+// a full 200 per process; now every probe sends If-None-Match and gets a free
+// 304 between releases.
+async function curlConditional(url, etag) {
+    const args = ["-sS", "-m", "10", "-H", "Accept: application/vnd.github+json"];
+    if (etag)
+        args.push("-H", `If-None-Match: ${etag}`);
+    args.push("-w", "\n__CURL_STATUS__:%{http_code}\n__CURL_ETAG__:%header{etag}", url);
+    const res = await run("curl", args, { timeoutMs: 12000, noTee: true });
+    let status = 0;
+    let newEtag = null;
+    const body = [];
+    for (const line of (res.stdout || "").split("\n")) {
+        if (line.startsWith("__CURL_STATUS__:"))
+            status = parseInt(line.slice(16).trim(), 10) || 0;
+        else if (line.startsWith("__CURL_ETAG__:"))
+            newEtag = line.slice(14).trim() || null;
+        else
+            body.push(line);
+    }
+    return { status, etag: newEtag, body: body.join("\n") };
+}
+// Stable probe (releases/latest). On 304 serves the caller-supplied cached
+// version with the same etag; If-None-Match is only sent when there IS a
+// cached value to serve.
+async function latestFromGithubApi(etag = null, cached = null) {
     try {
-        const args = ["-sS", "-m", "10", "-H", "Accept: application/vnd.github+json"];
-        if (apiState.etag)
-            args.push("-H", `If-None-Match: ${apiState.etag}`);
-        args.push("-w", "\n__CURL_STATUS__:%{http_code}\n__CURL_ETAG__:%header{etag}", RELEASES_LATEST_API);
-        const res = await run("curl", args, { timeoutMs: 12000, noTee: true });
-        let status = 0;
-        let etag = null;
-        const body = [];
-        for (const line of (res.stdout || "").split("\n")) {
-            if (line.startsWith("__CURL_STATUS__:"))
-                status = parseInt(line.slice(16).trim(), 10) || 0;
-            else if (line.startsWith("__CURL_ETAG__:"))
-                etag = line.slice(14).trim() || null;
-            else
-                body.push(line);
-        }
-        if (status === 304)
-            return apiState.latest;
-        if (status !== 200)
-            return null;
-        const tag = JSON.parse(body.join("\n")).tag_name;
+        const r = await curlConditional(RELEASES_LATEST_API, cached ? etag : null);
+        if (r.status === 304)
+            return { version: cached, etag };
+        if (r.status !== 200)
+            return { version: null, etag: null };
+        const tag = JSON.parse(r.body).tag_name;
         const v = typeof tag === "string" ? parseSemverish(tag.replace(/^v/, "").trim()) : null;
-        if (v) {
-            apiState.etag = etag;
-            apiState.latest = v;
-        }
-        return v;
+        return v ? { version: v, etag: r.etag } : { version: null, etag: null };
     }
     catch {
-        return null;
+        return { version: null, etag: null };
     }
 }
 async function latestFromNpm() {
@@ -177,18 +242,24 @@ async function latestFromNpm() {
 }
 // Staging channel: newest release OVERALL (prereleases included) from the
 // releases LIST, since releases/latest excludes prereleases. Drafts are skipped;
-// "newest" is by the rc-aware verKey. Returns {version, tag} or null.
-async function latestFromGithubListStaging() {
+// "newest" is by the rc-aware verKey. On 304 serves the caller-supplied cached
+// {version, tag} with the same etag. Returns {version, tag, etag} or null.
+async function latestFromGithubListStaging(etag = null, cached = null) {
     try {
-        const res = await run("curl", ["-sS", "-m", "10", "-H", "Accept: application/vnd.github+json", RELEASES_LIST_API], { timeoutMs: 12000, noTee: true });
-        const rels = JSON.parse(res.stdout || "[]");
+        const haveCached = !!(cached && cached.version && cached.tag);
+        const r = await curlConditional(RELEASES_LIST_API, haveCached ? etag : null);
+        if (r.status === 304 && haveCached)
+            return { version: cached.version, tag: cached.tag, etag };
+        if (r.status !== 200)
+            return null;
+        const rels = JSON.parse(r.body || "[]");
         if (!Array.isArray(rels))
             return null;
         let best = null;
-        for (const r of rels) {
-            if (!r || typeof r !== "object" || r.draft)
+        for (const rel of rels) {
+            if (!rel || typeof rel !== "object" || rel.draft)
                 continue;
-            const tag = r.tag_name;
+            const tag = rel.tag_name;
             if (typeof tag !== "string")
                 continue;
             const v = parseSemverish(tag.replace(/^v/, "").trim());
@@ -198,7 +269,7 @@ async function latestFromGithubListStaging() {
             if (best == null || cmpKey(key, best.key) > 0)
                 best = { version: v, tag, key };
         }
-        return best ? { version: best.version, tag: best.tag } : null;
+        return best ? { version: best.version, tag: best.tag, etag: r.etag } : null;
     }
     catch {
         return null;
@@ -221,28 +292,66 @@ async function resolveLatest() {
     const now = Date.now();
     if (cache && cache.channel === channel && now - cache.at < TTL_MS)
         return { version: cache.latest, tag: cache.tag, channel };
+    // Level 2: shared cross-process cache file (see SharedCache above).
+    const shared = readSharedCache(channel);
+    if (shared && now / 1000 - shared.at < SHARED_TTL_S) {
+        cache = { at: now, latest: shared.version, tag: shared.tag, channel };
+        return { version: shared.version, tag: shared.tag, channel };
+    }
+    const { acquired, lock } = tryProbeLock();
+    if (!acquired) {
+        // Another process is probing right now; serve the stale shared value (or
+        // null) instead of doubling the request. The short in-process TTL means we
+        // pick up its fresh result within a minute.
+        const v = shared?.version ?? null;
+        const t = shared?.tag ?? null;
+        cache = { at: now, latest: v, tag: t, channel };
+        return { version: v, tag: t, channel };
+    }
     let version = null;
     let tag = null;
-    if (channel === "staging") {
-        const s = await latestFromGithubListStaging();
-        if (s) {
-            version = s.version;
-            tag = s.tag;
+    let etag = null;
+    try {
+        if (channel === "staging") {
+            const s = await latestFromGithubListStaging(shared?.etag ?? null, shared ? { version: shared.version, tag: shared.tag } : null);
+            if (s) {
+                version = s.version;
+                tag = s.tag;
+                etag = s.etag;
+            }
+            else {
+                // Degrade to the stable probes so a staging box tracks at least stable
+                // rather than going blind when the list endpoint fails. etag stays
+                // null: a releases/latest etag must never be replayed against the
+                // LIST endpoint on the next staging probe.
+                version =
+                    (await latestFromGithubApi()).version ?? (await latestFromGithubRedirect());
+                tag = version ? `v${version}` : null;
+            }
         }
         else {
-            // Degrade to the stable probes so a staging box tracks at least stable
-            // rather than going blind when the list endpoint fails.
-            version = (await latestFromGithubApi()) ?? (await latestFromGithubRedirect());
+            const r = await latestFromGithubApi(shared?.etag ?? null, shared?.version ?? null);
+            version = r.version;
+            etag = r.etag;
+            if (version == null) {
+                version = await latestFromGithubRedirect();
+                etag = null;
+            }
+            if (version == null)
+                version = await latestFromNpm();
             tag = version ? `v${version}` : null;
         }
+        writeSharedCache({ at: now / 1000, channel, version, tag, etag });
     }
-    else {
-        version = await latestFromGithubApi();
-        if (version == null)
-            version = await latestFromGithubRedirect();
-        if (version == null)
-            version = await latestFromNpm();
-        tag = version ? `v${version}` : null;
+    finally {
+        if (lock) {
+            try {
+                fs.unlinkSync(lock);
+            }
+            catch {
+                /* already gone */
+            }
+        }
     }
     cache = { at: now, latest: version, tag, channel };
     return { version, tag, channel };

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.4-rc.32",
-  "installedAt": "2026-07-13T22:36:08.709Z"
+  "version": "1.7.4-rc.34",
+  "installedAt": "2026-07-13T22:53:49.281Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.4-rc.32",
+  "version": "1.7.4-rc.34",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -83,9 +83,10 @@ sys.stderr = _TimestampedStderr(sys.stderr)
 # best-effort: a missing repo path or SDK degrades to a silent no-op.
 _sentry = None
 try:
-    # Read the repo dir from the plist env; this read runs
-    # BEFORE scripts/ is on sys.path, so the s4l_env mirror can't help yet.
-    _repo = os.environ.get("S4L_REPO_DIR")
+    # Read the repo dir from the plist env. This runs BEFORE scripts/ is on
+    # sys.path, so the s4l_env mirror cannot help yet; the old key is accepted
+    # only at this bootstrap seam so pre-rename plists can find the mirror.
+    _repo = os.environ.get("S4L_REPO_DIR") or os.environ.get("SAPS_REPO_DIR")
     if _repo:
         _scripts = os.path.join(_repo, "scripts")
         if _scripts not in sys.path:

package/mcp/menubar/s4l_state.py

@@ -31,7 +31,7 @@ from pathlib import Path
 # The repo dir must be read tolerantly INLINE (old name included) because the
 # mirror module itself lives in $REPO/scripts and isn't importable before the
 # sys.path insertion below. Best-effort: failure degrades to defaults.
-_repo_for_env = os.environ.get("S4L_REPO_DIR")
+_repo_for_env = os.environ.get("S4L_REPO_DIR") or os.environ.get("SAPS_REPO_DIR")
 if _repo_for_env:
     _scripts_for_env = os.path.join(_repo_for_env, "scripts")
     if _scripts_for_env not in sys.path:

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.4-rc.32",
+  "version": "1.7.4-rc.34",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.4-rc.32",
+  "version": "1.7.4-rc.34",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",
@@ -57,6 +57,7 @@
     "!scripts/_serp_report.py",
     "!scripts/_serp_vs_gsc_report.py",
     "!scripts/_test_since_hook.py",
+    "!scripts/_lock_preempt_test.py",
     "!scripts/add_deploy_metadata.py",
     "!scripts/add_nightowl_to_config.py",
     "!scripts/amplitude_user_lookup.py",

package/scripts/s4l_box_update.sh

@@ -61,7 +61,7 @@ esac
 # four space-separated tokens: "<channel> <tag> <version> <mcpb_url>".
 STATE_DIR="${S4L_STATE_DIR:-$HOME/.social-autoposter-mcp}"
 RESOLVED="$(S4L_STATE_DIR="$STATE_DIR" "$PY" - <<'PYEOF' 2>/dev/null || true
-import json, os, re, subprocess
+import json, os, re, subprocess, time
 
 state = os.environ.get("S4L_STATE_DIR") or os.path.join(os.path.expanduser("~"), ".social-autoposter-mcp")
 try:
@@ -113,6 +113,25 @@ if best is None:
     print("unresolved")
     raise SystemExit(0)
 tag = best[1]
+# Deposit the freshly resolved release into the SHARED cross-process cache
+# (<state dir>/latest-release.json) that version.ts and snapshot.py read, so
+# this probe also feeds the menu bar / MCP for the next TTL window instead of
+# them re-spending quota. etag stays null (this resolver does not capture one);
+# the next conditional probe simply pays one 200 and re-seeds it. Best effort:
+# a failed write never blocks the update itself. NOTE: staging resolves here
+# from the same LIST endpoint the other surfaces use, but stable picks newest
+# non-prerelease from the LIST while they use releases/latest — same result,
+# so the cache stays consistent either way.
+try:
+    os.makedirs(state, exist_ok=True)
+    _p = os.path.join(state, "latest-release.json")
+    _tmp = "%s.tmp.%d" % (_p, os.getpid())
+    with open(_tmp, "w") as _f:
+        json.dump({"at": time.time(), "channel": channel,
+                   "version": tag.lstrip("v"), "tag": tag, "etag": None}, _f)
+    os.replace(_tmp, _p)
+except Exception:
+    pass
 print("%s %s %s %s" % (channel, tag, tag.lstrip("v"), TAG_DL % (REPO, tag)))
 PYEOF
 )"

package/scripts/s4l_mode.py

@@ -70,9 +70,8 @@ toggle): this CLI and mode.json are the only way to flip it.
 `env` additionally exports S4L_CYCLE_LANE=<lane> for both lanes so the wrapper
 knows which lane this cycle is without re-deriving it.
 
-Before the 2026-07-06 SAPS->S4L rename this file lived at scripts/saps_mode.py;
-a thin shim keeps that old path alive for the chflags-locked
-run-twitter-cycle.sh. Do not reference the old name in new code.
+The pre-2026-07-06 helper filename is retired. Current code must import or
+invoke this module directly.
 """
 
 import json
@@ -101,7 +100,7 @@ DEFAULT_PERSONAL_BRAND_SHARE = 0.5
 
 
 def state_dir() -> Path:
-    # Mirrors mcp/src/index.ts sapsStateDir() and menubar/s4l_state.py state_dir().
+    # Mirrors mcp/src/index.ts s4lStateDir() and menubar/s4l_state.py state_dir().
     return Path(
         os.environ.get("S4L_STATE_DIR")
         or (Path.home() / ".social-autoposter-mcp")

package/scripts/snapshot.py

@@ -325,6 +325,81 @@ def _x_status():
 _ver_cache = {"at": 0.0, "latest": None, "tag": None, "channel": None, "checked": False}
 _VER_TTL = 55.0
 
+# SHARED CROSS-PROCESS CACHE (2026-07-13): <state dir>/latest-release.json.
+# Every surface that resolves the newest release (this module, mcp/src/
+# version.ts, scripts/s4l_box_update.sh) reads and writes THIS one file, so a
+# box makes at most one real GitHub probe per _SHARED_TTL no matter how many
+# short-lived processes spin up (MCP servers respawn per s4l-worker session,
+# buildSnapshot shells this module as a fresh subprocess, the menu bar ticks).
+# The persisted ETag makes even those probes quota-free between releases (304s
+# do not count against the anonymous 60/h-per-IP quota, and before this cache
+# each process held its OWN in-process ETag that died with the process, so
+# every respawn paid a full 200). Added after the box's aggregate probing
+# (~80-100 req/h across processes) burned the quota on 2026-07-13 and silenced
+# the update banner. Failures (version=None) are cached too, same rationale as
+# _ver_cache. Keep the file shape in lockstep with version.ts::SharedCache:
+# {"at": <epoch s>, "channel": ..., "version": ..., "tag": ..., "etag": ...}
+_SHARED_TTL = 600.0  # banner latency ceiling: a new release surfaces within 10 min
+_PROBE_LOCK_STALE = 30.0
+
+
+def _shared_cache_path():
+    return os.path.join(_state_dir(), "latest-release.json")
+
+
+def _read_shared_cache(channel):
+    d = _read_json(_shared_cache_path())
+    if not isinstance(d, dict) or d.get("channel") != channel:
+        return None
+    if not isinstance(d.get("at"), (int, float)):
+        return None
+    return {
+        "at": float(d["at"]),
+        "channel": channel,
+        "version": d.get("version") if isinstance(d.get("version"), str) else None,
+        "tag": d.get("tag") if isinstance(d.get("tag"), str) else None,
+        "etag": d.get("etag") if isinstance(d.get("etag"), str) else None,
+    }
+
+
+def _write_shared_cache(channel, version, tag, etag):
+    try:
+        os.makedirs(_state_dir(), exist_ok=True)
+        p = _shared_cache_path()
+        tmp = "%s.tmp.%d" % (p, os.getpid())
+        with open(tmp, "w") as f:
+            json.dump({"at": time.time(), "channel": channel,
+                       "version": version, "tag": tag, "etag": etag}, f)
+        os.replace(tmp, p)
+    except Exception:
+        pass  # best effort; worst case another process re-probes
+
+
+def _try_probe_lock():
+    """Single-flight guard so N concurrent processes with an expired shared
+    cache don't all probe at once. Returns (acquired, lock_path). acquired is
+    False ONLY when another probe holds a FRESH lock (< _PROBE_LOCK_STALE s);
+    any other failure returns (True, None) so we probe anyway rather than go
+    blind on a broken state dir."""
+    lock = os.path.join(_state_dir(), "latest-release.lock")
+    try:
+        os.makedirs(_state_dir(), exist_ok=True)
+        fd = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+        os.close(fd)
+        return True, lock
+    except FileExistsError:
+        try:
+            if time.time() - os.path.getmtime(lock) > _PROBE_LOCK_STALE:
+                os.unlink(lock)  # stale: holder died mid-probe
+                fd = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+                os.close(fd)
+                return True, lock
+        except Exception:
+            pass
+        return False, None
+    except Exception:
+        return True, None
+
 _RELEASES_LATEST_URL = "https://github.com/m13v/s4l/releases/latest"
 _RELEASES_LATEST_API = "https://api.github.com/repos/m13v/s4l/releases/latest"
 # Staging resolves the newest release OVERALL from the releases LIST, since
@@ -367,56 +442,64 @@ def _latest_from_github_redirect():
         return None
 
 
-# In-process conditional-request state. Long-lived processes (the menu bar) send
-# If-None-Match on every probe and get free 304s; short-lived shell-outs pay one
-# 200 per process, which is rare enough to stay far under quota.
-_api_state = {"etag": None, "latest": None}
-
-
-def _latest_from_github_api():
+# Conditional-request state lives in the SHARED cache file (latest-release.json)
+# so the ETag survives process boundaries: short-lived shell-outs used to pay a
+# full 200 per process; now every probe sends If-None-Match and gets a free 304
+# between releases.
+def _curl_conditional(url, etag):
+    """GET url with optional If-None-Match. Returns (status, new_etag, body)."""
+    args = ["/usr/bin/curl", "-sS", "-m", "10",
+            "-H", "Accept: application/vnd.github+json"]
+    if etag:
+        args += ["-H", "If-None-Match: %s" % etag]
+    args += ["-w", "\n__CURL_STATUS__:%{http_code}\n__CURL_ETAG__:%header{etag}", url]
+    res = subprocess.run(args, capture_output=True, text=True, timeout=12)
+    status, new_etag, body = 0, None, []
+    for line in (res.stdout or "").splitlines():
+        if line.startswith("__CURL_STATUS__:"):
+            status = int(line.split(":", 1)[1].strip() or 0)
+        elif line.startswith("__CURL_ETAG__:"):
+            new_etag = line.split(":", 1)[1].strip() or None
+        else:
+            body.append(line)
+    return status, new_etag, "\n".join(body)
+
+
+def _latest_from_github_api(etag=None, cached=None):
+    """Stable probe (releases/latest). Returns (version, etag). On 304 serves
+    the caller-supplied cached version with the same etag; If-None-Match is only
+    sent when there IS a cached value to serve."""
     try:
-        args = ["/usr/bin/curl", "-sS", "-m", "10",
-                "-H", "Accept: application/vnd.github+json"]
-        if _api_state["etag"]:
-            args += ["-H", "If-None-Match: %s" % _api_state["etag"]]
-        args += ["-w", "\n__CURL_STATUS__:%{http_code}\n__CURL_ETAG__:%header{etag}",
-                 _RELEASES_LATEST_API]
-        res = subprocess.run(args, capture_output=True, text=True, timeout=12)
-        status, etag, body = 0, None, []
-        for line in (res.stdout or "").splitlines():
-            if line.startswith("__CURL_STATUS__:"):
-                status = int(line.split(":", 1)[1].strip() or 0)
-            elif line.startswith("__CURL_ETAG__:"):
-                etag = line.split(":", 1)[1].strip() or None
-            else:
-                body.append(line)
+        status, new_etag, body = _curl_conditional(
+            _RELEASES_LATEST_API, etag if cached else None)
         if status == 304:
-            return _api_state["latest"]
+            return cached, etag
         if status != 200:
-            return None
-        tag = (json.loads("\n".join(body)) or {}).get("tag_name")
+            return None, None
+        tag = (json.loads(body) or {}).get("tag_name")
         v = _parse_semverish(tag.lstrip("v").strip()) if isinstance(tag, str) else None
-        if v:
-            _api_state.update(etag=etag, latest=v)
-        return v
+        return (v, new_etag) if v else (None, None)
     except Exception:
-        return None
+        return None, None
 
 
-def _latest_from_github_list_staging():
+def _latest_from_github_list_staging(etag=None, cached=None):
     """Staging channel: newest release OVERALL (prereleases included) from the
-    releases LIST endpoint. Returns (version, tag) or (None, None). Drafts are
-    skipped. 'Newest' is by the rc-aware key so 1.6.193 outranks 1.6.193-rc.N and
-    rc.2 outranks rc.1."""
+    releases LIST endpoint. Returns (version, tag, etag) or (None, None, None).
+    Drafts are skipped. 'Newest' is by the rc-aware key so 1.6.193 outranks
+    1.6.193-rc.N and rc.2 outranks rc.1. On 304 serves the caller-supplied
+    cached (version, tag) with the same etag."""
     try:
-        res = subprocess.run(
-            ["/usr/bin/curl", "-sS", "-m", "10",
-             "-H", "Accept: application/vnd.github+json",
-             _RELEASES_LIST_API],
-            capture_output=True, text=True, timeout=12)
-        rels = json.loads(res.stdout or "[]")
+        cached_v, cached_tag = cached if isinstance(cached, tuple) else (None, None)
+        status, new_etag, body = _curl_conditional(
+            _RELEASES_LIST_API, etag if (cached_v and cached_tag) else None)
+        if status == 304:
+            return cached_v, cached_tag, etag
+        if status != 200:
+            return None, None, None
+        rels = json.loads(body or "[]")
         if not isinstance(rels, list):
-            return None, None
+            return None, None, None
         best_v, best_tag, best_key = None, None, None
         for r in rels:
             if not isinstance(r, dict) or r.get("draft"):
@@ -430,9 +513,11 @@ def _latest_from_github_list_staging():
             k = _ver_key(v)
             if best_key is None or k > best_key:
                 best_v, best_tag, best_key = v, tag, k
-        return best_v, best_tag
+        if best_v is None:
+            return None, None, None
+        return best_v, best_tag, new_etag
     except Exception:
-        return None, None
+        return None, None, None
 
 
 def _latest_from_npm():
@@ -460,31 +545,64 @@ def _resolve_version() -> str:
 def _latest_published(channel=None):
     """(version, tag) for the newest release on this box's channel. The tag is
     what the staging download URL is built from; stable callers can ignore it and
-    use releases/latest/download. Cached with the channel so a mid-process
-    channel flip re-probes instead of serving the other channel's cached value."""
+    use releases/latest/download. Two cache layers, both keyed by channel so a
+    mid-process flip re-probes instead of serving the other channel's value:
+      1. in-process _ver_cache (55s) — spares the file read on tight tick loops;
+      2. shared latest-release.json (_SHARED_TTL) — spares the NETWORK probe
+         across ALL processes on the box.
+    Failures (latest=None) are cached in both, like version.ts: a tick loop
+    re-probing an unreachable/rate-limited GitHub every few seconds would burn
+    the unauthenticated API quota (60/h per IP) and lock itself out for good."""
     if channel is None:
         channel = _channel()
     now = time.time()
-    # Cache failures (latest=None) too, like version.ts: a menu-bar tick loop
-    # re-probing an unreachable/rate-limited GitHub every few seconds would burn
-    # the unauthenticated API quota (60/h per IP) and lock itself out for good.
     if (_ver_cache["checked"] and _ver_cache["channel"] == channel
             and now - _ver_cache["at"] < _VER_TTL):
         return _ver_cache["latest"], _ver_cache["tag"]
-    if channel == "staging":
-        latest, tag = _latest_from_github_list_staging()
-        # Fallback to the stable probes if the list endpoint fails, so a staging
-        # box degrades to "at least track stable" rather than going blind.
-        if latest is None:
-            latest = _latest_from_github_api() or _latest_from_github_redirect()
+    shared = _read_shared_cache(channel)
+    if shared and now - shared["at"] < _SHARED_TTL:
+        _ver_cache.update(at=now, latest=shared["version"], tag=shared["tag"],
+                          channel=channel, checked=True)
+        return shared["version"], shared["tag"]
+    acquired, lock = _try_probe_lock()
+    if not acquired:
+        # Another process is probing right now; serve the stale shared value
+        # (or None) instead of doubling the request. Short in-process TTL means
+        # we pick up its fresh result within a minute.
+        latest = shared["version"] if shared else None
+        tag = shared["tag"] if shared else None
+        _ver_cache.update(at=now, latest=latest, tag=tag, channel=channel, checked=True)
+        return latest, tag
+    etag = shared["etag"] if shared else None
+    try:
+        if channel == "staging":
+            latest, tag, new_etag = _latest_from_github_list_staging(
+                etag, (shared["version"], shared["tag"]) if shared else None)
+            # Fallback to the stable probes if the list endpoint fails, so a
+            # staging box degrades to "at least track stable" than going blind.
+            # new_etag stays None: a releases/latest etag must never be replayed
+            # against the LIST endpoint on the next staging probe.
+            if latest is None:
+                latest, _ = _latest_from_github_api()
+                new_etag = None
+                if latest is None:
+                    latest = _latest_from_github_redirect()
+                tag = ("v" + latest) if latest else None
+        else:
+            latest, new_etag = _latest_from_github_api(
+                etag, shared["version"] if shared else None)
+            if latest is None:
+                latest, new_etag = _latest_from_github_redirect(), None
+            if latest is None:
+                latest = _latest_from_npm()
             tag = ("v" + latest) if latest else None
-    else:
-        latest = _latest_from_github_api()
-        if latest is None:
-            latest = _latest_from_github_redirect()
-        if latest is None:
-            latest = _latest_from_npm()
-        tag = ("v" + latest) if latest else None
+        _write_shared_cache(channel, latest, tag, new_etag)
+    finally:
+        if lock:
+            try:
+                os.unlink(lock)
+            except Exception:
+                pass
     _ver_cache.update(at=now, latest=latest, tag=tag, channel=channel, checked=True)
     return latest, tag
 

package/skill/lib/linkedin-backend.sh

@@ -333,25 +333,39 @@ ensure_linkedin_browser_for_backend() {
         # The occlusion/backgrounding flags matter: the window sits offscreen,
         # and without them Chrome stops laying out SPA-rendered content, so
         # every element measures 0x0 and clicks become impossible (2026-07-03).
-        # os.setsid: Chrome must escape THIS job's process group — launchd
-        # SIGKILLs a transient job's whole process group when the shell exits,
-        # and `disown` does not change the pgid, so Chrome died with every
-        # completed run and the next lane's relaunch stole the user's focus
-        # (2026-07-12; same fix as twitter-backend.sh).
-        "${S4L_PYTHON:-python3}" -c 'import os,sys
+        # Launch flags shared by both spawn paths below.
+        local _li_launch_args=(
+            --remote-debugging-port=9556
+            --user-data-dir="$HOME/.claude/browser-profiles/browser-harness-linkedin"
+            --no-first-run --no-default-browser-check
+            --disable-features=ChromeWhatsNewUI
+            --disable-backgrounding-occluded-windows
+            --disable-renderer-backgrounding
+            --disable-background-timer-throttling
+            "${_extra[@]}"
+            about:blank
+        )
+        # macOS + .app-bundled Chrome: `open -n -g` launches a NEW instance
+        # WITHOUT stealing the user's focus (a directly-exec'd Chrome always
+        # activates itself), and LaunchServices parents it outside this launchd
+        # job's process group. Same fix + rationale as twitter-backend.sh
+        # (2026-07-13). Fallback: direct exec in a new session — os.setsid so
+        # Chrome escapes the job's process group; launchd SIGKILLs a transient
+        # job's whole pgroup when the shell exits, and `disown` does not change
+        # the pgid (2026-07-12).
+        local _li_app_bundle=""
+        case "$_chrome_bin" in
+            *.app/Contents/MacOS/*) _li_app_bundle="${_chrome_bin%%/Contents/MacOS/*}" ;;
+        esac
+        if [ "$(uname -s)" = "Darwin" ] && [ -n "$_li_app_bundle" ] && [ -d "$_li_app_bundle" ]; then
+            open -n -g -a "$_li_app_bundle" --args "${_li_launch_args[@]}" >/dev/null 2>&1 || true
+        else
+            "${S4L_PYTHON:-python3}" -c 'import os,sys
 os.setsid()
 os.execv(sys.argv[1], sys.argv[1:])' \
-            "$_chrome_bin" \
-            --remote-debugging-port=9556 \
-            --user-data-dir="$HOME/.claude/browser-profiles/browser-harness-linkedin" \
-            --no-first-run --no-default-browser-check \
-            --disable-features=ChromeWhatsNewUI \
-            --disable-backgrounding-occluded-windows \
-            --disable-renderer-backgrounding \
-            --disable-background-timer-throttling \
-            "${_extra[@]}" \
-            about:blank >/dev/null 2>&1 &
-        disown
+                "$_chrome_bin" "${_li_launch_args[@]}" >/dev/null 2>&1 &
+            disown
+        fi
         for _i in 1 2 3 4 5 6 7 8 9 10 11 12; do
             curl -sf --max-time 2 -o /dev/null http://127.0.0.1:9556/json/version 2>/dev/null && break
             sleep 1

package/skill/lib/twitter-backend.sh

@@ -309,27 +309,47 @@ ensure_twitter_browser_for_backend() {
             [ -n "$_stale_pids" ] && { kill -9 $_stale_pids 2>/dev/null || true; sleep 1; }
             rm -f "$_prof_dir/SingletonLock" "$_prof_dir/SingletonSocket" "$_prof_dir/SingletonCookie" 2>/dev/null || true
         fi
-        # os.setsid: Chrome must escape THIS job's process group. The kicker is a
-        # transient launchd job, and launchd SIGKILLs the job's whole process
-        # group the moment the shell exits (no AbandonProcessGroup) — `disown`
-        # does not change the pgid, so a plainly-backgrounded Chrome died on
-        # every cycle completion and the NEXT cycle's relaunch stole the user's
-        # focus (2026-07-12 root cause; the foreground-telemetry `cause:launched`
-        # loop). A new session makes Chrome survive its launcher regardless of
-        # which lane spawned it.
-        "${S4L_PYTHON:-python3}" -c 'import os,sys
+        # Launch flags shared by both spawn paths below.
+        local _launch_args=(
+            --remote-debugging-port=9555
+            --user-data-dir="$HOME/.claude/browser-profiles/browser-harness"
+            --no-first-run --no-default-browser-check
+            --password-store=basic --use-mock-keychain
+            --disable-features=ChromeWhatsNewUI,CalculateNativeWinOcclusion
+            --disable-backgrounding-occluded-windows
+            "${_extra[@]}"
+            "${BH_LAUNCH_URL:-https://x.com}"
+        )
+        # macOS + .app-bundled Chrome: launch via `open -n -g` so the window
+        # NEVER steals the user's focus. A directly-exec'd Chrome always
+        # activates itself on launch — every legitimate relaunch (wedge heal,
+        # user quit, crash) popped a window over the user's work (the
+        # foreground-telemetry `cause:launched` events, 2026-07-13). -n forces
+        # a NEW instance (the user's personal Chrome may already be running;
+        # without -n LaunchServices would just poke it and drop our --args),
+        # -g launches WITHOUT activation. LaunchServices also parents the
+        # process outside this launchd job's process group, which independently
+        # covers the 2026-07-12 pgroup-reaping bug the setsid fallback fixes.
+        local _app_bundle=""
+        case "$_chrome_bin" in
+            *.app/Contents/MacOS/*) _app_bundle="${_chrome_bin%%/Contents/MacOS/*}" ;;
+        esac
+        if [ "$(uname -s)" = "Darwin" ] && [ -n "$_app_bundle" ] && [ -d "$_app_bundle" ]; then
+            open -n -g -a "$_app_bundle" --args "${_launch_args[@]}" >/dev/null 2>&1 || true
+        else
+            # Fallback (Linux, bare chromium binaries): direct exec in a NEW
+            # SESSION. os.setsid: Chrome must escape THIS job's process group —
+            # launchd SIGKILLs a transient job's whole process group the moment
+            # the shell exits (no AbandonProcessGroup), and `disown` does not
+            # change the pgid, so a plainly-backgrounded Chrome died on every
+            # cycle completion and the NEXT cycle's relaunch stole the user's
+            # focus (2026-07-12 root cause).
+            "${S4L_PYTHON:-python3}" -c 'import os,sys
 os.setsid()
 os.execv(sys.argv[1], sys.argv[1:])' \
-            "$_chrome_bin" \
-            --remote-debugging-port=9555 \
-            --user-data-dir="$HOME/.claude/browser-profiles/browser-harness" \
-            --no-first-run --no-default-browser-check \
-            --password-store=basic --use-mock-keychain \
-            --disable-features=ChromeWhatsNewUI,CalculateNativeWinOcclusion \
-            --disable-backgrounding-occluded-windows \
-            "${_extra[@]}" \
-            "${BH_LAUNCH_URL:-https://x.com}" >/dev/null 2>&1 &
-        disown
+                "$_chrome_bin" "${_launch_args[@]}" >/dev/null 2>&1 &
+            disown
+        fi
         for _i in 1 2 3 4 5 6 7 8 9 10 11 12; do
             curl -sf --max-time 2 -o /dev/null http://127.0.0.1:9555/json/version 2>/dev/null && break
             sleep 1

package/skill/run-twitter-cycle.sh

@@ -1878,7 +1878,7 @@ if [ "$S4L_DRAFT_PROMPT_VARIANT" = "treatment_v3" ]; then
 else
     DRAFT_DIRECTIVE="Otherwise: draft a reply using the best engagement style. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling, do not apply any other length rule here. NEVER em dashes. Apply the matched project's \`voice\` block from ALL_PROJECTS_JSON: follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present. The matched project's learned_preferences block in ALL_PROJECTS_JSON is distilled human review feedback and is MANDATORY, not advisory: follow every learned_preferences.draft_style_notes entry when writing (it overrides the engagement style's structural template on conflict), and treat learned_preferences.audience_avoid / thread_avoid matches as strong reasons to skip the candidate. Never violate content_guardrails.do_not."
 fi
-# Personal-brand lane (S4L_ACTIVE_LANE=personal_brand, set by saps_mode.py):
+# Personal-brand lane (S4L_ACTIVE_LANE=personal_brand, set by s4l_mode.py):
 # replace the product-framed directive entirely. This lane is pure organic
 # growth: no product, no link, no CTA. The reply must add real value grounded in
 # the persona's first-hand material (the PERSONA CORPUS block + the persona voice

package/scripts/_lock_preempt_test.py

@@ -1,60 +0,0 @@
-import json, os, sys, time, subprocess, signal
-sys.path.insert(0, os.path.join(os.path.dirname(__file__)))
-
-LOCK = os.path.expanduser("~/.claude/twitter-browser-lock.json")
-os.makedirs(os.path.dirname(LOCK), exist_ok=True)
-
-def write_lock(pid, role):
-    with open(LOCK, "w") as f:
-        json.dump({"session_id": f"python:{pid}", "timestamp": int(time.time()), "role": role}, f)
-
-def clean():
-    try: os.remove(LOCK)
-    except OSError: pass
-
-# ---- TEST 1: poster preempts a LIVE scan holder ----
-clean()
-victim = subprocess.Popen(["sleep", "120"])
-write_lock(victim.pid, "scan")
-os.environ["SAPS_LOCK_ROLE"] = "post"
-import importlib, twitter_browser
-importlib.reload(twitter_browser)
-t0 = time.time()
-twitter_browser._acquire_browser_lock()
-dt = time.time() - t0
-held = json.load(open(LOCK))
-victim_alive = victim.poll() is None
-print(f"TEST1 poster-preempts-scan: took={dt:.1f}s holder_now={held['session_id']} role={held.get('role')} victim_alive={victim_alive}")
-assert held["session_id"] == f"python:{os.getpid()}", "poster should hold lock"
-assert held.get("role") == "post"
-assert not victim_alive, "scan victim should be killed"
-assert dt < 10, "should preempt fast, not wait 45s"
-if victim.poll() is None: victim.kill()
-print("TEST1 PASS")
-
-# ---- TEST 2: scanner does NOT preempt a live POST holder (waits then gives up) ----
-clean()
-poster = subprocess.Popen(["sleep", "120"])
-write_lock(poster.pid, "post")
-os.environ["SAPS_LOCK_ROLE"] = "scan"
-twitter_browser.LOCK_WAIT_MAX = 4  # shorten the give-up window for the test
-twitter_browser.LOCK_ROLE = "scan"
-twitter_browser._LOCK_SESSION_ID = f"python:{os.getpid()}"
-twitter_browser._LOCK_INHERITED = False
-import io, contextlib
-t0 = time.time()
-rc = None
-try:
-    twitter_browser._acquire_browser_lock()
-    rc = "acquired"
-except SystemExit as e:
-    rc = f"exit:{e.code}"
-dt = time.time() - t0
-poster_alive = poster.poll() is None
-print(f"TEST2 scanner-vs-post: result={rc} took={dt:.1f}s poster_alive={poster_alive}")
-assert rc == "exit:1", "scanner must NOT take a live post holder; should give up"
-assert poster_alive, "scanner must NOT kill the poster"
-if poster.poll() is None: poster.kill()
-print("TEST2 PASS")
-clean()
-print("ALL PASS")

package/scripts/saps_activity.py

@@ -1,18 +0,0 @@
-#!/usr/bin/env python3
-"""LEGACY-NAME SHIM (brand rename SAPS -> S4L, completed 2026-07-06).
-
-The real module is scripts/s4l_activity.py. This shim exists ONLY for callers
-that cannot be edited (chflags-locked pipeline scripts) and for older installed
-runtimes. Do NOT add new references to this filename; import or invoke
-s4l_activity.py directly.
-"""
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from s4l_activity import *  # noqa: F401,F403,E402
-from s4l_activity import _main  # noqa: E402
-
-if __name__ == "__main__":
-    raise SystemExit(_main(sys.argv[1:]))

package/scripts/saps_mode.py

@@ -1,18 +0,0 @@
-#!/usr/bin/env python3
-"""LEGACY-NAME SHIM (brand rename SAPS -> S4L, completed 2026-07-06).
-
-The real module is scripts/s4l_mode.py. This shim exists ONLY for callers that
-cannot be edited (the chflags-locked run-twitter-cycle.sh) and for older
-installed runtimes. Do NOT add new references to this filename; import or
-invoke s4l_mode.py directly.
-"""
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from s4l_mode import *  # noqa: F401,F403,E402
-from s4l_mode import main  # noqa: E402
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv[1:]))