@m13v/s4l 1.7.6-rc.8 → 1.7.6

package/scripts/cdp_ready_check.py

@@ -1,44 +1,61 @@
 #!/usr/bin/env python3
-"""Real CDP readiness probe for the harness Chrome.
+"""Raw-websocket CDP readiness probe for the harness Chrome.
 
-Exit 0 when a full Playwright connect_over_cdp handshake completes against the
-given CDP URL, 1 when it does not. /json/version alone is a LIVENESS check: a
-wedged Chrome (process alive, HTTP answering, websocket upgrade completing,
-but the browser loop never servicing the CDP session) passes it, and every
-downstream attach then eats Playwright's 180s default timeout while holding
-the browser lock (S4L-4H, Karol 2026-07-11; identical wedge locally 2026-07-09,
-twice, same Chrome instance both times).
+Exit 0 when a real DevTools websocket handshake completes against the given
+CDP URL (browser-level connect + Browser.getVersion round-trip), 1 when it
+does not. /json/version alone is a LIVENESS check: a Chrome whose ws accept
+path died still passes it; this probe exercises the actual session dispatch.
 
-Usage: cdp_ready_check.py [CDP_URL] [TIMEOUT_MS]
+HISTORY — why raw websocket and NOT Playwright (2026-07-17): the original
+probe used sync_playwright().connect_over_cdp. Wedge-diag captures
+(skill/logs/wedge-diag/, v3 discriminator) proved that during every observed
+"wedge" the raw ws handshake completed in <5s while the Playwright connect
+timed out at 20s — with Chrome's DevToolsHandlerThread idle in kevent64 the
+whole time. The stall lives in Playwright's node driver under machine load,
+NOT in Chrome; the Playwright-based verdict was executing a healthy browser
+roughly hourly for days (every cdp_wedge relaunch 07-14..07-17). A probe must
+not depend on machinery heavier than the thing it probes. The S4L-4H /
+Karol-box incidents that motivated the deep probe are equally covered by the
+ws round-trip below (and in hindsight may have been this same client-side
+stall).
+
+Also preserves the renderer-liveness sweep (2026-07-14): a tab whose RENDERER
+crashed ("Aw, Snap") keeps its title/url in every listing while sitting dead;
+probe each page with a trivial Runtime.evaluate and reload it IN PLACE on
+failure — fresh renderer, no kill, no new window, no focus change.
 
-Prints a one-line JSON verdict to stdout so the caller can persist it
-(twitter-backend.sh writes it to skill/logs/cdp-health.json, which
-memory_snapshot.py carries onto the per-minute heartbeat sample).
+Usage: cdp_ready_check.py [CDP_URL] [TIMEOUT_MS]
 
-Falls back to an HTTP-only probe when playwright is not importable under the
-invoking interpreter, so a bare python3 caller degrades to the legacy
-liveness behavior instead of hard-failing.
+Prints a one-line JSON verdict to stdout (same shape/keys as before; mode is
+now "raw_ws"). Falls back to an HTTP-only probe when websocket-client is not
+importable, so a bare python3 caller degrades to liveness instead of failing.
 """
 import json
 import sys
 import time
+import urllib.request
+
+# ProxyHandler({}): loopback CDP must never route through a proxy. macOS
+# system proxy settings leak into urllib's default opener, and a box-wide
+# forwarder 403s 127.0.0.1 probes (2026-07-13 root cause of a "wedged
+# Chrome" misdiagnosis).
+_OPENER = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+
+
+def _get_json(url: str, timeout: float):
+    with _OPENER.open(url, timeout=timeout) as r:
+        return json.loads(r.read())
 
 
 def main() -> int:
     url = (sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:9555").rstrip("/")
-    timeout_ms = int(sys.argv[2]) if len(sys.argv) > 2 else 8000
+    timeout_s = (int(sys.argv[2]) if len(sys.argv) > 2 else 20000) / 1000.0
     t0 = time.time()
     try:
-        from playwright.sync_api import sync_playwright
+        import websocket  # websocket-client, present in the owned runtime venv
     except Exception:
-        import urllib.request
         try:
-            # ProxyHandler({}): loopback CDP must never route through a proxy.
-            # macOS system proxy settings leak into urllib's default opener, and
-            # a box-wide forwarder 403s 127.0.0.1 probes (2026-07-13 root cause
-            # of the "wedged Chrome" misdiagnosis).
-            opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
-            opener.open(f"{url}/json/version", timeout=3)
+            _OPENER.open(f"{url}/json/version", timeout=3)
             print(json.dumps({"ready": True, "mode": "http-only"}))
             return 0
         except Exception as e:
@@ -46,35 +63,49 @@ def main() -> int:
                 "ready": False, "mode": "http-only", "error": str(e)[:120],
             }))
             return 1
+
+    def _ws_call(ws_url: str, method: str, timeout: float, **params):
+        # suppress_origin: Chrome 111+ rejects ws clients whose Origin header
+        # is not in --remote-allow-origins (same pattern as the tab parker).
+        ws = websocket.create_connection(ws_url, timeout=timeout, suppress_origin=True)
+        try:
+            ws.send(json.dumps({"id": 1, "method": method, "params": params}))
+            deadline = time.time() + timeout
+            while time.time() < deadline:
+                msg = json.loads(ws.recv())
+                if msg.get("id") == 1:
+                    return msg
+            raise TimeoutError(f"no reply to {method}")
+        finally:
+            ws.close()
+
     try:
-        with sync_playwright() as p:
-            browser = p.chromium.connect_over_cdp(url, timeout=timeout_ms)
-            n_contexts = len(browser.contexts)
-            # Renderer-liveness sweep (2026-07-14). A tab whose RENDERER
-            # crashed ("Aw, Snap", error code 5) keeps its normal title/url in
-            # every CDP listing and the browser-level handshake stays green,
-            # so it sat visibly dead for 20+ minutes with nothing entitled to
-            # touch it — below the wedge detector (browser-level) and the
-            # stall guard (scan-progress-level). Probe each page with a
-            # trivial evaluate; on failure reload the tab IN PLACE, which
-            # spawns a fresh renderer. No kill, no new window, no focus
-            # change. Best-effort: revival must never fail the readiness
-            # verdict the wedge gate depends on.
-            revived = 0
-            for ctx in browser.contexts:
-                for page in ctx.pages:
+        # Browser-level handshake: the readiness verdict.
+        info = _get_json(f"{url}/json/version", timeout=3)
+        _ws_call(info["webSocketDebuggerUrl"], "Browser.getVersion", timeout_s)
+
+        # Renderer-liveness sweep: revive crashed tabs in place, best-effort;
+        # revival must never fail the readiness verdict the wedge gate uses.
+        revived = 0
+        pages = []
+        try:
+            pages = [t for t in _get_json(f"{url}/json/list", timeout=3)
+                     if t.get("type") == "page" and t.get("webSocketDebuggerUrl")]
+            for t in pages:
+                try:
+                    _ws_call(t["webSocketDebuggerUrl"], "Runtime.evaluate",
+                             4.0, expression="1")
+                except Exception:
                     try:
-                        page.set_default_timeout(4000)
-                        page.evaluate("1")
+                        _ws_call(t["webSocketDebuggerUrl"], "Page.reload", 8.0)
+                        revived += 1
                     except Exception:
-                        try:
-                            page.reload(timeout=15000, wait_until="commit")
-                            revived += 1
-                        except Exception:
-                            pass
-            browser.close()
+                        pass
+        except Exception:
+            pass
+
         out = {
-            "ready": True, "mode": "cdp", "contexts": n_contexts,
+            "ready": True, "mode": "raw_ws", "contexts": len(pages),
             "elapsed_s": round(time.time() - t0, 2),
         }
         if revived:
@@ -83,7 +114,7 @@ def main() -> int:
         return 0
     except Exception as e:
         print(json.dumps({
-            "ready": False, "mode": "cdp",
+            "ready": False, "mode": "raw_ws",
             "elapsed_s": round(time.time() - t0, 2),
             "error": str(e)[:200].replace("\n", " "),
         }))

package/scripts/claude_job.py

@@ -608,14 +608,26 @@ def _atomic_write_text(path: str, text: str) -> None:
 
 
 def _sweep_stale() -> int:
-    """Remove pending/running job files older than STALE_TTL_S. Returns count."""
+    """GC job files orphaned by dead producers. Returns count removed.
+
+    Two different TTLs on purpose:
+      - pending/: a job unclaimed past the producer's whole wait window
+        (DEFAULT_TIMEOUT_S + margin) has no live producer left to consume its
+        result — drafting it later only burns a worker turn on a stale prompt.
+        This is the leak signature of a producer that was SIGKILLed by its
+        external wrapper before its own timeout-cleanup ran (2026-07-18: three
+        orphaned reddit-draft jobs piled up while paused).
+      - running/: a claimed job may legitimately still be drafting, so it gets
+        the longer STALE_TTL_S before we conclude the worker died too.
+    """
     removed = 0
     now = time.time()
-    roots = [running_dir()]
+    pending_ttl = DEFAULT_TIMEOUT_S + 120
+    roots = [(running_dir(), STALE_TTL_S)]
     pend = os.path.join(queue_root(), "pending")
     if os.path.isdir(pend):
-        roots += [os.path.join(pend, d) for d in os.listdir(pend)]
-    for d in roots:
+        roots += [(os.path.join(pend, d), pending_ttl) for d in os.listdir(pend)]
+    for d, ttl in roots:
         if not os.path.isdir(d):
             continue
         for name in os.listdir(d):
@@ -625,7 +637,7 @@ def _sweep_stale() -> int:
             try:
                 with open(fp) as f:
                     created = json.load(f).get("created_at", 0)
-                if now - float(created) > STALE_TTL_S:
+                if now - float(created) > ttl:
                     os.remove(fp)
                     removed += 1
             except Exception:
@@ -719,6 +731,13 @@ def cmd_provider(ns) -> int:
                 % (_before_len - len(prompt))
             )
 
+    # S4L paused: refuse to enqueue at all. Workers won't claim while paused, so
+    # an enqueued job would just sit in pending/ while this producer burns its
+    # whole wait window "drafting" and then dies to its external timeout.
+    if _is_paused():
+        _plog(f"S4L paused; refusing to enqueue {qtype} job")
+        return 1
+
     job_id = uuid.uuid4().hex
     created = time.time()
     # Cycle batch id (run-twitter-cycle.sh exports BATCH_ID) so every provider.log
@@ -749,11 +768,31 @@ def cmd_provider(ns) -> int:
     _act_write(qtype)
 
     res_path = os.path.join(result_dir(), f"{job_id}.json")
-    deadline = created + ns.timeout
+    # Give up before ns.timeout, not at it: external wrappers (post_reddit's
+    # subprocess timeout, gtimeout in shell lanes) start their clocks at
+    # process start — before stdin read + enqueue — so an internal deadline of
+    # exactly created + timeout LOSES that race and the producer gets SIGKILLed
+    # before the cleanup below ever runs (2026-07-18 deathwatch "unexpected
+    # death" at enqueue+1800s, leaking pending files and a stuck "drafting"
+    # label). The 60s margin guarantees the graceful path wins.
+    deadline = created + max(60, ns.timeout - 60)
     last_hb = created  # last menu-bar heartbeat (see below)
     claimed_at = None  # set the moment a worker moves the job pending/ -> running/
     while time.time() < deadline:
         now = time.time()
+        # Pause landed mid-wait: abandon immediately with the same cleanup the
+        # timeout path does, instead of blocking the full wait window against a
+        # queue no worker will drain while paused.
+        if _is_paused():
+            _plog(f"job {job_id} abandoned: S4L paused mid-wait; cleaning up")
+            for p in (pending_path, running_path):
+                try:
+                    os.remove(p)
+                except OSError:
+                    pass
+            _act_clear()
+            _disarm_deathwatch(job_id)
+            return 1
         # A worker claims a job by atomically renaming pending/ -> running/, so the
         # pending file vanishing is our signal that drafting actually STARTED (vs.
         # the job still sitting unclaimed). Latch the claim time once so the label
@@ -972,12 +1011,26 @@ def _attempt_claim(ns, qtype: str) -> bool:
     return False
 
 
+def _is_paused() -> bool:
+    # S4L paused (mcp/src/index.ts pauseS4L / the menubar pause button): the
+    # one flag file every pipeline surface honors.
+    return os.path.exists(os.path.join(state_dir(), "paused.flag"))
+
+
 def cmd_next(ns) -> int:
     _apply_state_dir_override(ns)
-    # S4L paused (mcp/src/index.ts pauseAutopilot): report no work instead of
-    # claiming a job, so an already-queued draft can't drain/post while paused
-    # even though the scheduled task worker still fires on its own cadence.
-    if os.path.exists(os.path.join(state_dir(), "paused.flag")):
+    # GC jobs orphaned by dead/killed producers BEFORE claiming (and before the
+    # pause check, so orphans left behind by a pause don't sit until the next
+    # enqueue-side sweep — while paused nothing enqueues, so this is the only
+    # sweeper running). Without this, a resume would hand workers stale jobs
+    # whose producer died long ago.
+    swept = _sweep_stale()
+    if swept:
+        _plog(f"swept {swept} stale queue job file(s) before claim pass")
+    # S4L paused: report no work instead of claiming a job, so an
+    # already-queued draft can't drain/post while paused even though the
+    # scheduled task worker still fires on its own cadence.
+    if _is_paused():
         print(json.dumps({}))
         return 0
     qtype = ns.type
@@ -997,6 +1050,13 @@ def cmd_next(ns) -> int:
     start = time.time()
     attempt = 0
     while True:
+        # Re-check pause on every iteration, not just at entry: a worker
+        # already inside its wait window when Pause is clicked must stop
+        # claiming immediately (observed 2026-07-18: pause at 12:24, a
+        # pre-pause poller claimed a reddit-draft job at 12:29 anyway).
+        if _is_paused():
+            _plog(f"polling {qtype}: paused.flag appeared mid-wait; exiting without claiming")
+            break
         if _attempt_claim(ns, qtype):
             return 0
         attempt += 1

package/scripts/dm_conversation.py

@@ -42,7 +42,13 @@ import sys
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import db as dbmod
 
-CONFIG_PATH = os.path.expanduser("~/social-autoposter/config.json")
+# THE canonical config loader (scripts/config.py): S4L_CONFIG_PATH / state-dir /
+# S4L_REPO_DIR aware, mtime-cached. Replaces this file's hand-rolled loader and
+# its hardcoded config path (the S4L-4H dead-path class on customer boxes).
+import os as _cfg_os, sys as _cfg_sys
+_cfg_sys.path.insert(0, _cfg_os.path.dirname(_cfg_os.path.abspath(__file__)))
+from config import config_path as _canonical_config_path, load_config
+CONFIG_PATH = _canonical_config_path()
 
 
 def _valid_chat_url(platform, url):
@@ -76,24 +82,21 @@ def _valid_chat_url(platform, url):
     return u
 
 
-def load_config():
-    if os.path.exists(CONFIG_PATH):
-        with open(CONFIG_PATH) as f:
-            return json.load(f)
-    return {}
 
 
 def get_our_account(config, platform):
     accounts = config.get("accounts", {})
+    # No hardcoded fallback on any platform: a default handle/username/name stamped
+    # on a DM silently mis-attributes it to the repo owner. Resolve from config / env
+    # through the one resolver; "" means unknown (caller decides how to degrade).
+    from account_resolver import resolve as _resolve_account
     if platform == "reddit":
-        return accounts.get("reddit", {}).get("username", "Deep_Ad1959")
+        return accounts.get("reddit", {}).get("username") or _resolve_account("reddit") or ""
     elif platform == "linkedin":
-        return accounts.get("linkedin", {}).get("name", "Matthew Diakonov")
+        return accounts.get("linkedin", {}).get("name") or _resolve_account("linkedin") or ""
     elif platform == "x":
-        # No hardcoded fallback: stamping a default handle on an outbound DM
-        # silently mis-attributes it to the repo owner. Resolve from config / env
-        # and fail loud if absent.
-        from account_resolver import resolve as _resolve_account
+        # Twitter fails LOUD if unresolved (an outbound DM must carry a real
+        # sender); reddit/linkedin above degrade to "" since their callers can.
         h = _resolve_account("twitter")
         if not h:
             raise RuntimeError(