@m13v/s4l 1.7.4-rc.34 → 1.7.4-rc.36

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.4-rc.34",
-  "installedAt": "2026-07-13T22:53:49.281Z"
+  "version": "1.7.4-rc.36",
+  "installedAt": "2026-07-14T00:28:50.378Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.4-rc.34",
+  "version": "1.7.4-rc.36",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.4-rc.34",
+  "version": "1.7.4-rc.36",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.4-rc.34",
+  "version": "1.7.4-rc.36",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/twitter_scan.py

@@ -55,6 +55,8 @@ import json
 import os
 import pathlib
 import re
+import sys
+import threading
 import time
 import urllib.parse
 
@@ -245,6 +247,40 @@ def _navigate(url: str) -> None:
         new_tab(url)
 
 
+# Per-query stall guard (2026-07-13). The daemon helpers (goto_url/js) relay
+# CDP through the harness daemon; against a half-wedged Chrome those calls can
+# hang far past any useful budget, and one stuck query froze a Phase 1 scan at
+# "scan 0 · 23m" while holding the browser lock — the entry wedge check can't
+# help because the NEXT cycle can't start until this one dies. Self-heal from
+# inside instead: if a single scan() call exceeds the deadline, print a loud
+# marker, stamp the wedge strike file (so the next cycle's two-strike gate in
+# twitter-backend.sh converges to a kill+relaunch if Chrome is still sick),
+# and hard-exit the scan process so the cycle fails fast and releases the
+# lock. A healthy query completes in well under a minute; 240s is generous.
+_SCAN_QUERY_DEADLINE_S = float(os.environ.get("S4L_SCAN_QUERY_DEADLINE_S", "240"))
+_WEDGE_STRIKE_FILE = "/tmp/s4l_cdp_wedge_strike_9555"  # matches twitter-backend.sh
+
+
+def _arm_stall_guard(query: str):
+    def _fire():
+        sys.stderr.write(
+            f"[twitter_scan] SCAN_STALL_ABORT query={query!r} "
+            f"deadline={_SCAN_QUERY_DEADLINE_S:.0f}s — CDP call hung (wedged "
+            "Chrome); stamping wedge strike and aborting the scan process\n"
+        )
+        sys.stderr.flush()
+        try:
+            pathlib.Path(_WEDGE_STRIKE_FILE).touch()
+        except OSError:
+            pass
+        os._exit(75)  # EX_TEMPFAIL: cycle fails fast, lock + slot free up
+
+    t = threading.Timer(_SCAN_QUERY_DEADLINE_S, _fire)
+    t.daemon = True
+    t.start()
+    return t
+
+
 def scan(
     query: str,
     project: str,
@@ -257,6 +293,21 @@ def scan(
     ###TWEETS_BEGIN###/###TWEETS_END### sentinels for the scan model to relay
     into StructuredOutput; also returns the kept list so direct callers (tests,
     future shell-driven invocations) can consume it without parsing stdout."""
+    _stall_guard = _arm_stall_guard(query)
+    try:
+        return _scan_inner(query, project, search_topic, freshness_hours, skip_ids, settle_seconds)
+    finally:
+        _stall_guard.cancel()
+
+
+def _scan_inner(
+    query: str,
+    project: str,
+    search_topic: str,
+    freshness_hours: int = 6,
+    skip_ids=None,
+    settle_seconds: float = 4.0,
+) -> list:
     skip = {str(s) for s in (skip_ids or [])}
     url = _build_url(query, int(freshness_hours))
     _navigate(url)

package/scripts/watchdog_hung_runs.py

@@ -17,7 +17,15 @@ from pathlib import Path
 
 REPO = Path("/Users/matthewdi/social-autoposter")
 LOG_RUN_PY = REPO / "scripts" / "log_run.py"
-SKILL_PATH_MARKER = "/social-autoposter/skill/"
+# Both homes of skill/*.sh: the operator repo AND the installed-app package.
+# The single operator-repo marker left every kicker-driven cycle (which runs
+# from ~/.social-autoposter-mcp/repo/package/skill/) invisible to this
+# watchdog — a scan stuck on a half-wedged Chrome sat 23+ minutes at zero
+# progress with nothing entitled to kill it (2026-07-13).
+SKILL_PATH_MARKERS = (
+    "/social-autoposter/skill/",
+    "/.social-autoposter-mcp/repo/package/skill/",
+)
 MAX_AGE_SEC = 45 * 60
 
 # --- L2: browser-lock liveness (2026-07-13) ----------------------------------
@@ -212,12 +220,12 @@ def list_skill_shell_processes():
             ppid = int(ppid_s)
         except ValueError:
             continue
-        if SKILL_PATH_MARKER not in command:
+        if not any(m in command for m in SKILL_PATH_MARKERS):
             continue
         script_name = None
         tokens = command.split()
         for tok in tokens:
-            if tok.endswith(".sh") and SKILL_PATH_MARKER in tok:
+            if tok.endswith(".sh") and any(m in tok for m in SKILL_PATH_MARKERS):
                 script_name = os.path.basename(tok)
                 break
         if not script_name:

package/skill/lib/twitter-backend.sh

@@ -232,22 +232,47 @@ ensure_twitter_browser_for_backend() {
         echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Harness Chrome down on port 9555, launching..." >&2
     else
         local _ready_verdict
+        # TWO-STRIKE gate (2026-07-13): one failed handshake is NOT proof of a
+        # wedge. Under heavy system load (observed at loadavg ~18) a perfectly
+        # healthy Chrome blows the 8s Playwright attach budget, and a
+        # single-failure kill produced 3 false wedge-kills in one day on the
+        # operator Mac — each one a relaunch flash plus an "Aw, Snap" corpse
+        # tab from the SIGKILLed renderer. First failure: stamp a strike file
+        # and proceed WITHOUT killing (a truly wedged Chrome makes the cycle's
+        # own pre-flight fail loudly right after, so nothing silently hangs).
+        # Second consecutive failure within 30 minutes: genuinely wedged, kill
+        # + relaunch. A passing check clears any stale strike.
+        local _strike="/tmp/s4l_cdp_wedge_strike_9555"
         if ! _ready_verdict=$(_bh_cdp_ready "$_BH_DEFAULT_URL"); then
-            _need_launch=1; _launch_reason="cdp_wedge"
-            echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Harness Chrome WEDGED on port 9555 (/json/version answers but the CDP handshake never completes: ${_ready_verdict:-no verdict}); killing and relaunching..." >&2
-            # Machine-greppable marker (same stderr-marker convention as
-            # twitter_access_gate; bin/server.js parses these).
-            echo "twitter_cdp_wedge: detected url=$_BH_DEFAULT_URL action=restart" >&2
-            _bh_record_cdp_health wedge_restart "$_ready_verdict"
-            local _wedge_pids
-            _wedge_pids=$(pgrep -f -- "--user-data-dir=$_bh_prof_dir " 2>/dev/null || true)
-            if [ -n "$_wedge_pids" ]; then
-                kill $_wedge_pids 2>/dev/null || true
-                sleep 2
+            if [ -z "$(find "$_strike" -mmin -30 2>/dev/null)" ]; then
+                touch "$_strike"
+                echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Harness Chrome failed the CDP handshake check (${_ready_verdict:-no verdict}); first strike — NOT killing (loaded-machine tolerance). Second consecutive failure within 30m triggers the wedge heal." >&2
+                echo "twitter_cdp_wedge: detected url=$_BH_DEFAULT_URL action=first_strike" >&2
+                _bh_record_cdp_health wedge_first_strike "$_ready_verdict"
+                # Fall through WITHOUT killing: session restore + tab cleanup
+                # below still run.
+            else
+                rm -f "$_strike" 2>/dev/null || true
+                _need_launch=1; _launch_reason="cdp_wedge"
+                echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Harness Chrome WEDGED on port 9555 (second consecutive handshake failure: ${_ready_verdict:-no verdict}); killing and relaunching..." >&2
+                # Machine-greppable marker (same stderr-marker convention as
+                # twitter_access_gate; bin/server.js parses these).
+                echo "twitter_cdp_wedge: detected url=$_BH_DEFAULT_URL action=restart" >&2
+                _bh_record_cdp_health wedge_restart "$_ready_verdict"
+                local _wedge_pids
                 _wedge_pids=$(pgrep -f -- "--user-data-dir=$_bh_prof_dir " 2>/dev/null || true)
-                [ -n "$_wedge_pids" ] && { kill -9 $_wedge_pids 2>/dev/null || true; sleep 1; }
-                rm -f "$_bh_prof_dir/SingletonLock" "$_bh_prof_dir/SingletonSocket" "$_bh_prof_dir/SingletonCookie" 2>/dev/null || true
+                if [ -n "$_wedge_pids" ]; then
+                    kill $_wedge_pids 2>/dev/null || true
+                    sleep 2
+                    _wedge_pids=$(pgrep -f -- "--user-data-dir=$_bh_prof_dir " 2>/dev/null || true)
+                    [ -n "$_wedge_pids" ] && { kill -9 $_wedge_pids 2>/dev/null || true; sleep 1; }
+                    rm -f "$_bh_prof_dir/SingletonLock" "$_bh_prof_dir/SingletonSocket" "$_bh_prof_dir/SingletonCookie" 2>/dev/null || true
+                fi
             fi
+        else
+            # Healthy handshake — clear any earlier strike so isolated blips
+            # never accumulate into a kill.
+            rm -f "$_strike" 2>/dev/null || true
         fi
     fi
     if [ "$_need_launch" = 1 ]; then