@m13v/s4l 1.7.5-rc.13 → 1.7.5-rc.14

package/mcp/dist/index.js

@@ -1014,95 +1014,149 @@ async function postApproved(batchId, plan) {
     const approvedTwitter = approved.filter((c) => c.platform !== "reddit");
     let redditPosted = 0;
     let redditFailed = 0;
+    let redditSkippedPeerDrain = false;
     if (approvedReddit.length) {
-        for (const c of approvedReddit) {
-            const cc = c;
-            const dec = cc.reddit_decision;
-            const meta = (cc.reddit_plan_meta || {});
-            if (!dec) {
-                c.terminal = true;
-                c.terminal_reason = "reddit_decision_missing";
-                redditFailed++;
-                continue;
-            }
-            // The card's reply_text is the CANONICAL text (post_drafts edits write
-            // there); the embedded decision still carries the draft-time original.
-            // Posting dec.text verbatim would silently discard a human edit.
-            const decPost = {
-                ...dec,
-                text: (typeof cc.reply_text === "string" && cc.reply_text.trim())
-                    ? cc.reply_text
-                    : dec.text,
-            };
-            if (cc.engagement_style)
-                decPost.engagement_style = cc.engagement_style;
-            const miniPlan = {
-                project_name: meta.project_name || cc.matched_project,
-                batch_id: cc.reddit_batch_id || meta.batch_id || "reddit-mcp-approval",
-                phase: "draft",
-                decisions: [decPost],
-                style_assignment: meta.style_assignment || {},
-                generation_trace_path: meta.generation_trace_path,
-                session_id: meta.session_id || meta.draft_session_id,
-            };
-            const tmpPlan = path.join(process.env.S4L_TMP_DIR || "/tmp", `reddit_mcp_post_${Date.now()}_${Math.floor(Math.random() * 1e6)}.json`);
-            let r;
+        // Cross-instance drain gate (2026-07-14 drain storm): every one-shot MCP
+        // boot (the queue worker fires ~every minute; each boot runs the startup
+        // backlog drain) drained the SAME sticky approvals concurrently — 26
+        // drain plans in ~30 minutes, all fighting over the one reddit tab and
+        // false-positiving each other's posts. reddit-posting-active.json is the
+        // arbiter: post_reddit.py heartbeats it per row, and we stamp it around
+        // the whole drain here. A fresh flag (<120s) means a peer is mid-drain:
+        // leave the cards for it — approvals are sticky, nothing is lost.
+        const redditFlagPath = path.join(s4lStateDir(), "reddit-posting-active.json");
+        let redditPeerFresh = false;
+        try {
+            redditPeerFresh = Date.now() - fs.statSync(redditFlagPath).mtimeMs < 120_000;
+        }
+        catch {
+            redditPeerFresh = false;
+        }
+        const stampRedditFlag = () => {
             try {
-                fs.writeFileSync(tmpPlan, JSON.stringify(miniPlan));
-                r = await runPython("scripts/post_reddit.py", ["--phase", "post", "--in", tmpPlan], {
-                    timeoutMs: 900_000,
-                    env: {
-                        REDDIT_CDP_URL: process.env.REDDIT_CDP_URL || "http://127.0.0.1:9557",
-                        // Reviewed posts never get the active-campaign suffix (same rule
-                        // as the twitter manual-approval path below).
-                        S4L_SKIP_CAMPAIGN_SUFFIX: "1",
-                    },
-                    onLine: (line) => {
-                        const t = line.replace(/\s+$/, "");
-                        if (t.trim())
-                            console.error(`[post-reddit] ${t}`);
-                    },
-                });
+                fs.writeFileSync(redditFlagPath, JSON.stringify({ pid: process.pid, hb: Math.floor(Date.now() / 1000) }));
             }
-            catch (err) {
-                r = { code: -1, stdout: "", stderr: String(err) };
+            catch {
+                /* best effort */
+            }
+        };
+        if (redditPeerFresh) {
+            redditSkippedPeerDrain = true;
+            logPostEvent(`postApproved_reddit_skip batch=${batchId} reason=peer_drain_active cards=${approvedReddit.length}`);
+        }
+        else {
+            stampRedditFlag();
+            try {
+                for (const c of approvedReddit) {
+                    stampRedditFlag();
+                    const cc = c;
+                    const dec = cc.reddit_decision;
+                    const meta = (cc.reddit_plan_meta || {});
+                    if (!dec) {
+                        c.terminal = true;
+                        c.terminal_reason = "reddit_decision_missing";
+                        redditFailed++;
+                        continue;
+                    }
+                    // The card's reply_text is the CANONICAL text (post_drafts edits write
+                    // there); the embedded decision still carries the draft-time original.
+                    // Posting dec.text verbatim would silently discard a human edit.
+                    const decPost = {
+                        ...dec,
+                        text: (typeof cc.reply_text === "string" && cc.reply_text.trim())
+                            ? cc.reply_text
+                            : dec.text,
+                    };
+                    if (cc.engagement_style)
+                        decPost.engagement_style = cc.engagement_style;
+                    const miniPlan = {
+                        project_name: meta.project_name || cc.matched_project,
+                        batch_id: cc.reddit_batch_id || meta.batch_id || "reddit-mcp-approval",
+                        phase: "draft",
+                        decisions: [decPost],
+                        style_assignment: meta.style_assignment || {},
+                        generation_trace_path: meta.generation_trace_path,
+                        session_id: meta.session_id || meta.draft_session_id,
+                    };
+                    const tmpPlan = path.join(process.env.S4L_TMP_DIR || "/tmp", `reddit_mcp_post_${Date.now()}_${Math.floor(Math.random() * 1e6)}.json`);
+                    let r;
+                    try {
+                        fs.writeFileSync(tmpPlan, JSON.stringify(miniPlan));
+                        r = await runPython("scripts/post_reddit.py", ["--phase", "post", "--in", tmpPlan], {
+                            timeoutMs: 900_000,
+                            env: {
+                                REDDIT_CDP_URL: process.env.REDDIT_CDP_URL || "http://127.0.0.1:9557",
+                                // Reviewed posts never get the active-campaign suffix (same rule
+                                // as the twitter manual-approval path below).
+                                S4L_SKIP_CAMPAIGN_SUFFIX: "1",
+                            },
+                            onLine: (line) => {
+                                const t = line.replace(/\s+$/, "");
+                                if (t.trim())
+                                    console.error(`[post-reddit] ${t}`);
+                            },
+                        });
+                    }
+                    catch (err) {
+                        r = { code: -1, stdout: "", stderr: String(err) };
+                    }
+                    finally {
+                        try {
+                            fs.unlinkSync(tmpPlan);
+                        }
+                        catch {
+                            /* best effort */
+                        }
+                    }
+                    // post_reddit.py's summary marker: `[post_reddit] phase=post ... posted=N failed=M`
+                    const out = `${r.stdout}\n${r.stderr}`;
+                    const postedN = Number((/posted=(\d+)/.exec(out) || [])[1] || 0);
+                    if (r.code === 0 && postedN > 0) {
+                        c.posted = true;
+                        c.terminal = false;
+                        const urlMatch = /(https:\/\/(?:old\.|www\.)?reddit\.com\/r\/\S+)/.exec((/\[post_reddit\][^\n]*posted[^\n]*/i.exec(out) || [""])[0]);
+                        if (urlMatch)
+                            c.our_url = urlMatch[1];
+                        redditPosted++;
+                    }
+                    else {
+                        // Leave the approval sticky (approved && !posted && !terminal) so the
+                        // next post_drafts call retries, mirroring twitter's failed-drain
+                        // semantics; only stamp terminal on a conclusive CDP refusal.
+                        const cdpReason = (/\[post_reddit\] CDP FAILED: ([a-z_]+)/.exec(out) || [])[1];
+                        if (cdpReason && ["thread_locked", "thread_archived", "thread_not_found", "blocked_by_author"].includes(cdpReason)) {
+                            c.terminal = true;
+                            c.terminal_reason = `reddit_${cdpReason}`;
+                        }
+                        redditFailed++;
+                    }
+                }
             }
             finally {
+                // Clear only OUR stamp; a peer that took over mid-drain keeps its own.
                 try {
-                    fs.unlinkSync(tmpPlan);
+                    const cur = JSON.parse(fs.readFileSync(redditFlagPath, "utf-8"));
+                    if (cur && cur.pid === process.pid)
+                        fs.unlinkSync(redditFlagPath);
                 }
                 catch {
                     /* best effort */
                 }
             }
-            // post_reddit.py's summary marker: `[post_reddit] phase=post ... posted=N failed=M`
-            const out = `${r.stdout}\n${r.stderr}`;
-            const postedN = Number((/posted=(\d+)/.exec(out) || [])[1] || 0);
-            if (r.code === 0 && postedN > 0) {
-                c.posted = true;
-                c.terminal = false;
-                const urlMatch = /(https:\/\/(?:old\.|www\.)?reddit\.com\/r\/\S+)/.exec((/\[post_reddit\][^\n]*posted[^\n]*/i.exec(out) || [""])[0]);
-                if (urlMatch)
-                    c.our_url = urlMatch[1];
-                redditPosted++;
-            }
-            else {
-                // Leave the approval sticky (approved && !posted && !terminal) so the
-                // next post_drafts call retries, mirroring twitter's failed-drain
-                // semantics; only stamp terminal on a conclusive CDP refusal.
-                const cdpReason = (/\[post_reddit\] CDP FAILED: ([a-z_]+)/.exec(out) || [])[1];
-                if (cdpReason && ["thread_locked", "thread_archived", "thread_not_found", "blocked_by_author"].includes(cdpReason)) {
-                    c.terminal = true;
-                    c.terminal_reason = `reddit_${cdpReason}`;
-                }
-                redditFailed++;
-            }
+            logPostEvent(`postApproved_reddit batch=${batchId} attempted=${approvedReddit.length} posted=${redditPosted} failed=${redditFailed}`);
         }
-        logPostEvent(`postApproved_reddit batch=${batchId} attempted=${approvedReddit.length} posted=${redditPosted} failed=${redditFailed}`);
     }
     if (approvedTwitter.length === 0) {
         // All-reddit batch: persist the stamps and return without touching the
         // twitter preflight/lock path.
+        if (redditSkippedPeerDrain) {
+            return {
+                attempted: 0,
+                posted: 0,
+                exit_code: 0,
+                summary: "reddit: skipped (peer drain active); cards stay approved for the next drain",
+            };
+        }
         if (approvedReddit.length)
             mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.5-rc.13",
-  "installedAt": "2026-07-15T01:32:54.676Z"
+  "version": "1.7.5-rc.14",
+  "installedAt": "2026-07-15T01:50:34.288Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.5-rc.13",
+  "version": "1.7.5-rc.14",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.5-rc.13",
+  "version": "1.7.5-rc.14",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.5-rc.13",
+  "version": "1.7.5-rc.14",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/browser_mutex.py

@@ -0,0 +1,316 @@
+#!/usr/bin/env python3
+"""browser_mutex.py — THE per-platform browser-session mutex (2026-07-14).
+
+A faithful, parameterized extraction of scripts/twitter_browser.py's
+battle-hardened file mutex, so every platform driver shares ONE implementation
+instead of three divergent ones (reddit_browser.py's old copy still had the
+check-then-write claim race AND the dead-holder starvation twitter fixed on
+2026-06-16). The twitter semantics are preserved bit-for-bit: same lockfile
+JSON shape ({session_id, timestamp, role}), same reclaim ladder, same
+"locked by session" give-up string downstream parsers grep for.
+
+This mutex serializes the PYTHON drivers of one harness Chrome. It deliberately
+does NOT share a path with the shell pipeline lock (skill/lock.sh's
+/tmp/social-autoposter-<name>.lock dirs): pipelines hold that lock around whole
+phases while their child python ops take THIS one per op — merging the two onto
+one path would deadlock that nesting (or need ancestor-walk inheritance in
+every acquire). Unification here means one LIBRARY, not one lock.
+
+Reclaim ladder (a holder we can PROVE dead is taken immediately, so a crashed
+peer can never starve the fleet):
+  1. holder == us            -> re-entrant; refresh and proceed.
+  1b. holder == $S4L_LOCK_OWNER (live) -> batch inherit: a poster parent holds
+      the lock across a whole approved batch; its child reply subprocesses
+      refresh instead of contending, and leave release to the parent.
+  2. UUID holder, pid gone   -> stale legacy (Claude session) lock, reclaim.
+  3. python:PID, pid gone    -> dead peer, reclaim.
+  4. age >= expiry           -> failsafe (role "post" holders get the shorter
+                                post_lock_expiry so a hung poster self-clears).
+  5. live UUID holder        -> inherit (parent Claude session).
+  5b. we are role "post", holder is a LIVE lower-priority python peer ->
+      PREEMPT it (SIGTERM, grace, SIGKILL) and claim: posting is the scarce
+      user-initiated action; the aborted scan re-runs next tick.
+  6. live python peer        -> wait, then give up after wait_max with the
+                                structured "locked by session" error.
+
+Do NOT "simplify" by letting shell pipelines rm -f the lockfile: that blind rm
+deleted LIVE peers' locks (defect b, removed 2026-06-16). See
+docs/twitter_browser_lock.md for the incident history behind every branch.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import signal
+import subprocess
+import sys
+import time
+
+_UUID_RE = re.compile(
+    r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I
+)
+
+
+class BrowserMutex:
+    def __init__(
+        self,
+        lock_file: str,
+        label: str,
+        lock_expiry: int = 300,
+        post_lock_expiry: int = 180,
+        wait_max: int = 45,
+        poll_interval: int = 2,
+        preempt_kill_wait: int = 5,
+        role: str | None = None,
+        on_touch=None,
+    ):
+        """label is the human prefix in error strings ("Twitter browser",
+        "Reddit browser") — downstream parsers grep "locked by session", keep
+        the shape. on_touch (optional callable) runs after every successful
+        acquire/refresh (reddit bumps its bash lease there); it must never
+        raise consequences: exceptions are swallowed."""
+        self.lock_file = os.path.expanduser(lock_file)
+        self.label = label
+        self.lock_expiry = lock_expiry
+        self.post_lock_expiry = post_lock_expiry
+        self.wait_max = wait_max
+        self.poll_interval = poll_interval
+        self.preempt_kill_wait = preempt_kill_wait
+        self.role = (role or os.environ.get("S4L_LOCK_ROLE") or "scan").strip() or "scan"
+        self.on_touch = on_touch
+        self.session_id = f"python:{os.getpid()}"
+        self.inherited = False
+        self.acquired_at: float | None = None
+
+    # ---- liveness probes ----------------------------------------------------
+    @staticmethod
+    def _is_uuid_holder_alive(holder: str) -> bool:
+        if not holder:
+            return False
+        try:
+            return (
+                subprocess.run(
+                    ["pgrep", "-f", f"claude.*--session-id {holder}"],
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.DEVNULL,
+                    timeout=2,
+                ).returncode
+                == 0
+            )
+        except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+            return True  # err on the side of NOT stealing
+
+    @staticmethod
+    def _is_python_holder_alive(holder: str) -> bool:
+        if not holder.startswith("python:"):
+            return True  # not a python holder; this probe makes no claim
+        try:
+            pid = int(holder.split(":", 1)[1])
+        except (ValueError, IndexError):
+            return True
+        try:
+            os.kill(pid, 0)
+            return True
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            return True
+        except OSError:
+            return True
+
+    # ---- claim / preempt ----------------------------------------------------
+    def _try_take(self) -> bool:
+        """O_CREAT|O_EXCL makes "is it free? then take it" one syscall, so two
+        cold-start acquirers can't both win (defect c)."""
+        try:
+            fd = os.open(self.lock_file, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
+        except FileExistsError:
+            return False
+        except OSError:
+            return False
+        try:
+            os.write(fd, json.dumps(
+                {"session_id": self.session_id, "timestamp": int(time.time()), "role": self.role}
+            ).encode())
+        finally:
+            os.close(fd)
+        return True
+
+    def _preempt(self, pid: int) -> bool:
+        try:
+            os.kill(pid, signal.SIGTERM)
+        except ProcessLookupError:
+            return True
+        except OSError:
+            return False
+        deadline = time.time() + self.preempt_kill_wait
+        while time.time() < deadline:
+            try:
+                os.kill(pid, 0)
+            except OSError:
+                return True
+            time.sleep(0.2)
+        try:
+            os.kill(pid, signal.SIGKILL)
+        except OSError:
+            pass
+        try:
+            os.kill(pid, 0)
+        except OSError:
+            return True
+        return False
+
+    def _touch(self):
+        if self.on_touch:
+            try:
+                self.on_touch()
+            except Exception:
+                pass
+
+    # ---- public API -----------------------------------------------------------
+    def acquire(self):
+        deadline = time.time() + self.wait_max
+        try:
+            os.makedirs(os.path.dirname(self.lock_file), exist_ok=True)
+        except OSError:
+            pass
+        while True:
+            if not os.path.exists(self.lock_file):
+                if self._try_take():
+                    break
+                if time.time() >= deadline:
+                    print(json.dumps({
+                        "success": False,
+                        "error": f"{self.label} lock contended on create; waited {self.wait_max}s, giving up."
+                    }))
+                    sys.exit(1)
+                time.sleep(self.poll_interval)
+                continue
+            try:
+                with open(self.lock_file) as f:
+                    lock = json.load(f)
+            except (json.JSONDecodeError, OSError):
+                if self._try_take():
+                    break
+                if time.time() >= deadline:
+                    print(json.dumps({
+                        "success": False,
+                        "error": f"{self.label} lock unreadable; waited {self.wait_max}s, giving up."
+                    }))
+                    sys.exit(1)
+                time.sleep(self.poll_interval)
+                continue
+            age = time.time() - lock.get("timestamp", 0)
+            holder = lock.get("session_id", "")
+            holder_role = lock.get("role", "scan")  # legacy locks (no role) = preemptable
+
+            # 1. Re-entrant.
+            if holder == self.session_id and not self.inherited:
+                self.refresh()
+                break
+
+            # 1b. Batch-owner inherit (posting).
+            batch_owner = os.environ.get("S4L_LOCK_OWNER") or ""
+            if holder and holder == batch_owner and self._is_python_holder_alive(holder):
+                self.session_id = holder
+                self.inherited = True
+                self.refresh()
+                print(f"[browser_lock] inherited batch owner={holder} "
+                      f"role={holder_role} -> pid={os.getpid()}", file=sys.stderr)
+                break
+
+            # 2-4. Reclaim provably dead/expired holders.
+            reclaim_reason = ""
+            if _UUID_RE.match(holder or "") and not self._is_uuid_holder_alive(holder):
+                reclaim_reason = "dead_uuid"
+            elif holder.startswith("python:") and not self._is_python_holder_alive(holder):
+                reclaim_reason = "dead_python"
+            elif age >= (self.post_lock_expiry if holder_role == "post" else self.lock_expiry):
+                reclaim_reason = "expired"
+            if reclaim_reason:
+                try:
+                    os.remove(self.lock_file)
+                except OSError:
+                    pass
+                if self._try_take():
+                    print(f"[browser_lock] reclaimed holder={holder or '<none>'} "
+                          f"reason={reclaim_reason} age={int(age)}s -> pid={os.getpid()}",
+                          file=sys.stderr)
+                    break
+                time.sleep(self.poll_interval)
+                continue
+
+            # 5. Live UUID holder = parent Claude session -> inherit.
+            if _UUID_RE.match(holder or ""):
+                self.session_id = holder
+                self.inherited = True
+                break
+
+            # 5b. POSTING PRIORITY: preempt a live lower-priority python peer.
+            if (
+                self.role == "post"
+                and holder.startswith("python:")
+                and holder_role != "post"
+                and self._is_python_holder_alive(holder)
+            ):
+                try:
+                    victim_pid = int(holder.split(":", 1)[1])
+                except (ValueError, IndexError):
+                    victim_pid = 0
+                if victim_pid and self._preempt(victim_pid):
+                    try:
+                        os.remove(self.lock_file)
+                    except OSError:
+                        pass
+                    if self._try_take():
+                        print(
+                            f"[browser_lock] post preempted holder={holder} "
+                            f"role={holder_role} age={int(age)}s -> pid={os.getpid()}",
+                            file=sys.stderr,
+                        )
+                        break
+                time.sleep(self.poll_interval)
+                continue
+
+            # 6. Live python peer: wait, then give up (real contention).
+            if time.time() >= deadline:
+                print(json.dumps({
+                    "success": False,
+                    "error": f"{self.label} locked by session {holder} ({int(age)}s, peer alive); waited {self.wait_max}s, giving up."
+                }))
+                sys.exit(1)
+            time.sleep(self.poll_interval)
+            continue
+        self.acquired_at = time.time()
+        self._touch()
+
+    def refresh(self):
+        try:
+            with open(self.lock_file, "w") as f:
+                json.dump({"session_id": self.session_id, "timestamp": int(time.time()), "role": self.role}, f)
+        except OSError:
+            pass
+        self._touch()
+
+    def release(self):
+        """Inherited locks are the PARENT'S to release; never clobber them."""
+        if self.inherited:
+            return
+        try:
+            if os.path.exists(self.lock_file):
+                with open(self.lock_file) as f:
+                    lock = json.load(f)
+                if lock.get("session_id") == self.session_id:
+                    os.remove(self.lock_file)
+                    if self.acquired_at:
+                        held = time.time() - self.acquired_at
+                        if held >= 5:
+                            print(
+                                f"[browser-lock] held {held:.0f}s "
+                                f"(role={self.role}, pid={os.getpid()})",
+                                file=sys.stderr,
+                            )
+        except (json.JSONDecodeError, OSError):
+            pass