@m13v/s4l 1.7.6-rc.5 → 1.7.6-rc.6

package/mcp/dist/index.js

@@ -909,6 +909,11 @@ async function ensureTwitterBrowserForPost() {
 // thread still exists. Without this override, a card approved while (or just
 // before) the sync stamped it is refused as already-decided and the approval
 // silently no-ops (2 of 3 approvals lost on 2026-07-10).
+// Give-up bound for approved cards whose post attempts keep failing
+// transiently (browser lock contention, timeouts). 5 attempts spans several
+// drain cycles — plenty for genuine transients to clear — while guaranteeing
+// no card can retry forever (2026-07-17 zombie-card incident).
+const MAX_POST_ATTEMPTS = 5;
 function expiredStampOverridable(c) {
     return (c.terminal === true &&
         c.posted !== true &&
@@ -964,11 +969,29 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
                         f.terminal = false;
                         if (c.our_url)
                             f.our_url = c.our_url;
+                        // A post outcome closes the card's history: the pre-approval
+                        // freshness stamp must not survive it.
+                        delete f.discard_reason;
                     }
                     else if (c.terminal === true && f.posted !== true) {
                         f.terminal = true;
                         f.terminal_reason = c.terminal_reason;
+                        // CRITICAL (2026-07-17 Nhat zombie-card incident, 438 retries over
+                        // 5 days): a stale discard_reason="backend_status_expired" left on
+                        // the fresh copy makes expiredStampOverridable() treat THIS
+                        // post-outcome terminal as overridable, so every later drain
+                        // resurrects the card, re-posts, dedup-skips, and re-stamps —
+                        // forever. A terminal that came from an actual post attempt is
+                        // final; delete the expiry stamp so the override can never fire
+                        // on it again. (The drain's own `delete c.discard_reason` happens
+                        // on an in-memory copy that is never the write source; this line
+                        // is the one that persists.)
+                        delete f.discard_reason;
                     }
+                    // Carry the retry counter so the give-up bound survives across
+                    // drains (each drain reads the store fresh).
+                    if (typeof c.post_attempts === "number" && c.post_attempts > (f.post_attempts || 0))
+                        f.post_attempts = c.post_attempts;
                 }
             }
             writePlan(batchId, fresh);
@@ -1508,6 +1531,21 @@ async function postApproved(batchId, plan) {
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
                 // equivalent transient failures self-healed on the very next drain.
+                //
+                // BOUNDED (2026-07-17): sticky is right, sticky-forever is not — an
+                // unbounded retry is a zombie generator (one card retried 438 times
+                // over 5 days on the Nhat install). Count the transient failures and
+                // give up loudly after MAX_POST_ATTEMPTS; the terminal_reason keeps
+                // the last failure visible so the give-up is diagnosable, and the
+                // on-disk post-events trail records it for forensics.
+                const attempts = (typeof c.post_attempts === "number" ? c.post_attempts : 0) + 1;
+                c.post_attempts = attempts;
+                if (attempts >= MAX_POST_ATTEMPTS) {
+                    c.terminal = true;
+                    c.terminal_reason = `gave_up_after_${attempts}_failed_attempts:${r.reason || "failed"}`;
+                    console.error(`[post] giving up on candidate ${r.candidate_id} after ${attempts} failed attempts (last: ${r.reason || "failed"})`);
+                    logPostEvent(`retry_budget_exhausted candidate=${r.candidate_id} attempts=${attempts} last=${r.reason || "failed"}`);
+                }
                 touchedPlan = true;
             }
         });
@@ -5717,33 +5755,18 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
         },
     ],
 }));
-// Post any cards the user APPROVED that never landed — e.g. a restart killed the
-// batch mid-way. "Proceed to post the already-approved items." postApproved is
-// idempotent (it filters posted/terminal), so this only drains the genuine
-// backlog and never double-posts. Best-effort; never throws.
-async function drainApprovedBacklog() {
-    try {
-        const plan = readPlan(REVIEW_QUEUE_ID);
-        const cands = plan?.candidates || [];
-        const backlog = cands.filter((c) => c.approved === true &&
-            c.posted !== true &&
-            (c.terminal !== true || expiredStampOverridable(c)) &&
-            // Same sandbox exclusion as postApproved's own filter: a sandbox
-            // replay can never post, so it must never count as backlog.
-            !isSandboxCandidate(c));
-        if (!backlog.length)
-            return;
-        console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);
-        await postApproved(REVIEW_QUEUE_ID, plan);
-    }
-    catch (e) {
-        console.error("[post] drainApprovedBacklog error:", e?.message || e);
-        // Same reasoning as the other postApproved call site: don't let an
-        // escaped exception leave the cross-instance posting flag stuck true.
-        postingActive = false;
-        stopPostingFlagHeartbeat();
-    }
-}
+// REMOVED (2026-07-17): drainApprovedBacklog. It ran 30s after EVERY MCP boot,
+// which was sane when boots meant "user launched Claude Desktop" — but each
+// queue-worker session boots its own MCP server, so the drain had silently
+// become a ~5-minute cron running across up to 4 concurrent MCP instances.
+// Combined with universal posting preemption, every drain wakeup SIGKILLed
+// whatever held the twitter-browser lock (profile scans included), and any
+// stamp bug turned into an infinite retry loop (438 retries over 5 days on
+// one Nhat card). Backlog recovery is now owned by ONE long-lived process:
+// the menubar's _resume_approved_queue, which runs on loopback-reachable and
+// periodically thereafter (mcp/menubar/s4l_menubar.py). Do NOT re-add a
+// boot-time drain here; if the menubar is dead, ensureMenubar() below revives
+// it and its resume covers the backlog.
 async function main() {
     initSentry();
     // Detect a self-update (old_version -> new_version) as the very first thing
@@ -5919,13 +5942,9 @@ async function main() {
     void startLocalPanel()
         .then((url) => console.error(`[social-autoposter-mcp] panel loopback ready at ${url}`))
         .catch((e) => console.error("[social-autoposter-mcp] panel loopback start failed:", e?.message || e));
-    // Resume posting any approved-but-unposted cards a prior run/restart left behind.
-    // Delayed so the runtime + harness Chrome have settled; never blocks boot.
-    {
-        const t = setTimeout(() => void drainApprovedBacklog(), 30_000);
-        if (typeof t.unref === "function")
-            t.unref();
-    }
+    // NOTE (2026-07-17): the boot-time drainApprovedBacklog() call that lived
+    // here is gone — backlog recovery is owned by the menubar's periodic
+    // _resume_approved_queue (single drainer; see the removal note above).
     // Ensure the macOS menu bar mini-dashboard is installed + running. Idempotent
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.5",
-  "installedAt": "2026-07-17T17:09:56.264Z"
+  "version": "1.7.6-rc.6",
+  "installedAt": "2026-07-17T17:26:23.362Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.5",
+  "version": "1.7.6-rc.6",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -579,6 +579,12 @@ class S4LMenuBar(rumps.App):
         # a hitch every 5s tick.
         self._resumed = False
         self._loopback_check_due_at = 0.0
+        # Periodic approved-backlog drain cadence (2026-07-17): the menubar is
+        # the single drainer now that the MCP boot-time drain is gone. 10 min
+        # keeps a transiently-failed approval's retry latency reasonable while
+        # staying far below the old effective 5-min/multi-instance churn.
+        self.RESUME_PERIOD_S = 600.0
+        self._resume_due_at = 0.0
         # Reliable self-check of our own Accessibility (TCC) grant — this is the
         # faithful reading (our launchd process identity, not a parent's). Logged
         # so menubar.err.log records whether keystroke posting will work.
@@ -2301,16 +2307,14 @@ class S4LMenuBar(rumps.App):
         never confirmed posted (the in-memory _post_q died with the old process).
         Skip any the plan already shows as posted, so a card that landed on X just
         before the kill — but whose status update was lost — isn't posted twice."""
-        # Store lane (canonical): approved-but-unposted rows in the review store.
-        # Legacy lane: pre-store approved-queue.json entries (read-only now; the
-        # ledger is no longer written). Union, store first, dedup by (batch, n).
+        # Store lane ONLY (2026-07-17): approved-but-unposted rows in the review
+        # store, the single source of truth. The legacy approved-queue.json lane
+        # (a read-only third truth source that the ledger stopped writing long
+        # ago) was removed — its entries could never settle, so it re-enqueued
+        # the same dead approvals on every resume forever. If a genuinely
+        # pre-store approval ever resurfaces, it is visible in the store lane
+        # or it is gone; do not re-add the union.
         pending = list(st.store_pending_posts())
-        seen = {(it.get("batch"), it.get("n")) for it in pending}
-        legacy = [
-            it for it in st.approved_queue_pending()
-            if (it.get("batch"), it.get("n")) not in seen
-        ]
-        pending.extend(legacy)
         if not pending:
             return
         posted_ns = set()
@@ -2462,8 +2466,19 @@ class S4LMenuBar(rumps.App):
         if now >= self._loopback_check_due_at:
             self._loopback_check_due_at = now + 60.0
             if st.loopback_reachable():
-                if not self._resumed:
+                # Periodic backlog drain (2026-07-17): the menubar is now the
+                # SINGLE owner of approved-backlog recovery. The MCP server's
+                # boot-time drainApprovedBacklog was removed (each queue-worker
+                # session boots an MCP, so "boot-time" had become a 5-minute
+                # cron across concurrent instances). Here it runs on the one
+                # long-lived process instead: on loopback recovery and every
+                # RESUME_PERIOD_S thereafter, but only while nothing is
+                # in-flight (avoids enqueueing a card twice while an earlier
+                # drain still holds it in _post_q). _resume_approved_queue is
+                # idempotent against the store (skips posted/terminal rows).
+                if (not self._resumed or now >= self._resume_due_at) and self._posts_outstanding == 0:
                     self._resumed = True
+                    self._resume_due_at = now + self.RESUME_PERIOD_S
                     try:
                         self._resume_approved_queue()
                     except Exception as e:

package/mcp/menubar/s4l_state.py

@@ -1434,11 +1434,10 @@ def approved_queue_set_status(batch, n, status, error=None):
             _write_approved_queue(d)
 
 
-def approved_queue_pending():
-    """Approvals not yet confirmed posted (queued or posting). Re-enqueued by the
-    menu bar on startup so a restart RESUMES the drain instead of re-presenting."""
-    return [it for it in read_approved_queue()["items"]
-            if it.get("status") in ("queued", "posting")]
+# approved_queue_pending() REMOVED (2026-07-17): the legacy approved-queue.json
+# resume lane was a third source of truth whose entries could never settle (the
+# ledger stopped being written), so it re-enqueued dead approvals forever. The
+# store lane (store_pending_posts) is the only resume source now.
 
 
 def post_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, timeout=900, activity_label=None):

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6-rc.5",
+  "version": "1.7.6-rc.6",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6-rc.5",
+  "version": "1.7.6-rc.6",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",