@m13v/s4l 1.7.6-rc.4 → 1.7.6-rc.5

package/mcp/dist/index.js

@@ -914,6 +914,16 @@ function expiredStampOverridable(c) {
         c.posted !== true &&
         c.discard_reason === "backend_status_expired");
 }
+// Prompt-sandbox replay cards (run-twitter-cycle.sh S4L_SANDBOX_CANDIDATES_FILE)
+// carry experiments.sandbox=true; older sandbox rows predate that stamp but all
+// use the synthetic >=900,000,000 id range twitter_prompt_sandbox.py assigns.
+function isSandboxCandidate(c) {
+    const exps = c.experiments;
+    if (exps && typeof exps === "object" && exps.sandbox)
+        return true;
+    const id = Number(c.candidate_id);
+    return Number.isFinite(id) && id >= 900_000_000;
+}
 function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
@@ -930,24 +940,35 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
         if (fresh && Array.isArray(fresh.candidates)) {
+            // candidate_id is NOT unique in the review-queue store: sandbox reruns
+            // and re-merged drafts append sibling rows with the same id. Stamping
+            // only one sibling (the old Map single-slot) left the others matching
+            // the drain's approved && !posted && !terminal filter, so the backlog
+            // re-drained the same candidate every heartbeat forever (2026-07-17
+            // incident: 23-card loop at 60s cadence). Stamp EVERY row with the id.
             const freshById = new Map();
             fresh.candidates.forEach((c) => {
-                if (c.candidate_id !== undefined && c.candidate_id !== null)
-                    freshById.set(String(c.candidate_id), c);
+                if (c.candidate_id !== undefined && c.candidate_id !== null) {
+                    const key = String(c.candidate_id);
+                    const list = freshById.get(key);
+                    if (list)
+                        list.push(c);
+                    else
+                        freshById.set(key, [c]);
+                }
             });
             for (const c of stamped) {
-                const f = freshById.get(String(c.candidate_id));
-                if (!f)
-                    continue;
-                if (c.posted === true) {
-                    f.posted = true;
-                    f.terminal = false;
-                    if (c.our_url)
-                        f.our_url = c.our_url;
-                }
-                else if (c.terminal === true && f.posted !== true) {
-                    f.terminal = true;
-                    f.terminal_reason = c.terminal_reason;
+                for (const f of freshById.get(String(c.candidate_id)) ?? []) {
+                    if (c.posted === true) {
+                        f.posted = true;
+                        f.terminal = false;
+                        if (c.our_url)
+                            f.our_url = c.our_url;
+                    }
+                    else if (c.terminal === true && f.posted !== true) {
+                        f.terminal = true;
+                        f.terminal_reason = c.terminal_reason;
+                    }
                 }
             }
             writePlan(batchId, fresh);
@@ -1043,7 +1064,12 @@ async function postApproved(batchId, plan) {
     // and the stamp is cleared so every downstream terminal check agrees it's live.
     const approved = (plan.candidates || []).filter((c) => c.approved === true &&
         c.posted !== true &&
-        (c.terminal !== true || expiredStampOverridable(c)));
+        (c.terminal !== true || expiredStampOverridable(c)) &&
+        // Prompt-sandbox replays can never post (twitter_post_plan.py post_one()
+        // hard-refuses them), so draining one is pure churn: it burns a browser
+        // lock turn and, if its terminal stamp later loses a store-write race,
+        // loops forever. Exclude them here regardless of stamp state.
+        !isSandboxCandidate(c));
     for (const c of approved) {
         if (c.terminal === true) {
             c.terminal = false;
@@ -3468,8 +3494,8 @@ async function autopilotLoaded() {
 // fires every minute, claims ONE job, runs the pipeline's own prompt as its
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
-const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
-// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+const QUEUE_WORKER_PROMPT_VERSION = 9; // v9 (2026-07-17): poll window widened 240s -> 900s (see QUEUE_WORKER_POLL_SECONDS); version bump forces the prompt refresh that carries the new --wait-seconds onto existing installs. v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v10 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
 // sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
 // within one continuous worker session) instead of drafting inline. Validated
 // via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
@@ -3478,19 +3504,26 @@ const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_jo
 // notification) or the host kills the whole parent+child chain in 1-3 min.
 // Never live-fire tested against a real production job. Full design, what's
 // validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
-// Bump this constant to 9 only once that plan is actually implemented.
+// Bump this constant to 10 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
-// 240s (4 min): comfortably inside the 900s single-Bash-call survival verified
-// live on 2026-07-06, and covers a meaningful chunk of the ~8min average
-// real job inter-arrival gap measured on the box, while still keeping each
-// worker session bounded. The cron's `* * * * *` cadence remains the outer
-// safety net for whatever the poll window doesn't catch.
+// 900s (15 min, per Matthew 2026-07-17, up from 240s): sits AT the single-
+// Bash-call survival ceiling verified live on 2026-07-06 (the host's ~90s
+// inactivity kill fires only on model silence, and one in-flight tool call
+// survived a full 900s probe). This covers the ~8min average real job
+// inter-arrival gap outright, so most jobs are claimed by an already-polling
+// session instead of paying a fresh spin-up, and MCP boot side effects
+// (backfill checks, backlog drains) run 1/15min instead of 1/5min. Watch
+// point: 900s has zero margin below the verified ceiling — if workers start
+// dying mid-poll with no reaper kill recorded, the host clipped the call;
+// back off to 600s. The cron's `* * * * *` cadence remains the outer safety
+// net for whatever the poll window doesn't catch.
 // COUPLING: scripts/reap_stale_claude_sessions.py's S4L_REAPER_CLAIM_GRACE_SEC
 // default MUST stay >= this value + margin — a claimless session inside this
 // poll window is legitimately still working, not a husk, and a too-tight
 // claim_grace would SIGTERM it mid-poll before it ever gets to claim.
-const QUEUE_WORKER_POLL_SECONDS = 240;
+// (Bumped to 1020s alongside this change.)
+const QUEUE_WORKER_POLL_SECONDS = 900;
 // One spec per worker task. queueType MUST match scripts/claude_job.py TAG_TO_TYPE.
 const QUEUE_WORKERS = [
     { taskId: WORKER_TASK_ID, queueType: "any", human: "universal queue" },
@@ -5694,7 +5727,10 @@ async function drainApprovedBacklog() {
         const cands = plan?.candidates || [];
         const backlog = cands.filter((c) => c.approved === true &&
             c.posted !== true &&
-            (c.terminal !== true || expiredStampOverridable(c)));
+            (c.terminal !== true || expiredStampOverridable(c)) &&
+            // Same sandbox exclusion as postApproved's own filter: a sandbox
+            // replay can never post, so it must never count as backlog.
+            !isSandboxCandidate(c));
         if (!backlog.length)
             return;
         console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.4",
-  "installedAt": "2026-07-17T16:50:15.589Z"
+  "version": "1.7.6-rc.5",
+  "installedAt": "2026-07-17T17:09:56.264Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.4",
+  "version": "1.7.6-rc.5",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6-rc.4",
+  "version": "1.7.6-rc.5",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6-rc.4",
+  "version": "1.7.6-rc.5",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/merge_review_queue.py

@@ -265,17 +265,45 @@ def _sync_with_backend(cands: list) -> tuple[int, int]:
         and not (c.get("experiments") or {}).get("sandbox")
         and _thread_url(c)
     ]
-    if not pending:
+    # Approved-but-unposted cards get the INVERSE sync: never pruned (the
+    # approval is a settled human decision, see docstring above), but if the
+    # backend row says the reply already LANDED (status='posted'), stamp
+    # posted=True here so the store agrees with the database. Without this
+    # there is no path that ever corrects a lost posted stamp: the drain's
+    # in-process stamp can lose a whole-file write race against the menubar
+    # or a peer drain, after which the card shows failed/terminal forever
+    # while the reply is live on X (2026-07-17 incident: 6 posted replies
+    # rendered as duplicate_thread_pre_post kills).
+    approved_open = [
+        c
+        for c in cands
+        if c.get("approved")
+        and not c.get("posted")
+        and c.get("platform") != "reddit"
+        and not (c.get("experiments") or {}).get("sandbox")
+        and _thread_url(c)
+    ]
+    if not pending and not approved_open:
         return 0, 0
-    urls = sorted({_thread_url(c) for c in pending})[:500]
+    urls = sorted({_thread_url(c) for c in pending} | {_thread_url(c) for c in approved_open})[:500]
     try:
         sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
         from http_api import api_get
 
-        resp = api_get(
-            "/api/v1/twitter-candidates",
-            query={"tweet_urls": ",".join(urls), "limit": 500},
-        )
+        # Scope to OUR candidate rows: the bulk GET has no tenant isolation,
+        # so without install_id another install's row for the same tweet_url
+        # (e.g. two customers discovering one viral thread) could be read
+        # back as "our" status and mis-stamp posted/terminal on our card.
+        query = {"tweet_urls": ",".join(urls), "limit": 500}
+        try:
+            from identity import get_identity
+
+            own_install = (get_identity() or {}).get("install_id")
+            if own_install:
+                query["install_id"] = own_install
+        except Exception:
+            pass  # fail open: unscoped lookup, same behavior as before
+        resp = api_get("/api/v1/twitter-candidates", query=query)
         rows = (resp.get("data") or {}).get("candidates") or []
     except BaseException as e:  # http_api raises SystemExit on terminal failure
         print(f"[merge_review_queue] backend sync skipped: {e}", file=sys.stderr)
@@ -295,6 +323,14 @@ def _sync_with_backend(cands: list) -> tuple[int, int]:
             c["terminal"] = True
             c["discard_reason"] = f"backend_status_{status}"
             pruned += 1
+    for c in approved_open:
+        row = by_url.get(_thread_url(c))
+        if row and row.get("status") == "posted":
+            c["posted"] = True
+            c["terminal"] = False
+            c.pop("post_failed", None)
+            c.pop("post_error", None)
+            stamped += 1
     return stamped, pruned
 
 

package/scripts/reap_stale_claude_sessions.py

@@ -820,12 +820,13 @@ def main() -> int:
     # (it stays in pending), never a lost draft — a DRAFTING session is protected by
     # claim_pids, not by grace, so no grace value can kill a real draft.
     #
-    # Default 300s (2026-07-06): QUEUE_WORKER_POLL_SECONDS (240s) + ~60s margin for
-    # cold agent-mode boot (skill load + MCP init) and this reaper's own ps-scan
-    # latency. COUPLING: must stay >= QUEUE_WORKER_POLL_SECONDS + margin — if that
-    # constant grows, bump this default (or S4L_REAPER_CLAIM_GRACE_SEC) to match, or
-    # the reaper will SIGTERM a legitimately-polling worker before it ever claims.
-    claim_grace = _env_int("S4L_REAPER_CLAIM_GRACE_SEC", 300)
+    # Default 1020s (2026-07-17): QUEUE_WORKER_POLL_SECONDS (900s) + ~120s margin
+    # for cold agent-mode boot (skill load + MCP init) and this reaper's own
+    # ps-scan latency. COUPLING: must stay >= QUEUE_WORKER_POLL_SECONDS + margin;
+    # if that constant grows, bump this default (or S4L_REAPER_CLAIM_GRACE_SEC) to
+    # match, or the reaper will SIGTERM a legitimately-polling worker before it
+    # ever claims. (Was 300s while the poll window was 240s.)
+    claim_grace = _env_int("S4L_REAPER_CLAIM_GRACE_SEC", 1020)
 
     inflight = count_running_jobs()  # None => queue unreadable => age-gate fallback
     claim_pids = running_claim_pids()  # agent-session pids actively holding a claim