@m13v/s4l 1.7.7-rc.8 → 1.7.7

package/bin/cli.js

@@ -456,6 +456,18 @@ function installBrowserHarness() {
         label: 'focus-suppression + tab-event observability',
         absentWarn: 'harness Chrome may steal OS focus on every tab switch',
       },
+      {
+        // Daemon attach_first_page: reuse an existing blank tab and create in
+        // the BACKGROUND when truly tabless. Without it, a blank-only browser
+        // traps the daemon in a stale-session loop where every re-attach mints
+        // a foreground about:blank = one macOS focus steal per iteration
+        // (2026-08-03, 30+/day on the reddit harness).
+        file: 'browser-harness-daemon-blank-tab-attach.patch',
+        sentinelFile: path.join('src', 'browser_harness', 'daemon.py'),
+        sentinelStr: 'no page tabs at all',
+        label: 'daemon blank-tab background attach',
+        absentWarn: 'harness daemon re-attach may pop the Chrome window (focus steal)',
+      },
     ];
     for (const p of vendoredPatches) {
       const patchPath = path.join(PKG_ROOT, 'scripts', 'patches', p.file);

package/mcp/dist/runtime.js

@@ -34,6 +34,82 @@ const BROWSER_HARNESS_PIN = "6d20866664ea3d9691b27bbf64f42ae097437dc3";
 const BROWSER_HARNESS_REPO = "https://github.com/browser-use/browser-harness";
 const HARNESS_DIR = path.join(os.homedir(), "Developer", "browser-harness");
 const HARNESS_BIN = path.join(os.homedir(), ".local", "bin", "browser-harness");
+// Vendored fixes applied on top of the pin (we don't control upstream).
+// KEEP IN SYNC WITH bin/cli.js `vendoredPatches`. Each: patch file under
+// scripts/patches/ + a sentinel (file, substring) that means the fix is
+// already present (upstream merged it, or we applied it), so a non-applying
+// patch only warns when the fix is genuinely absent. Order matters: patches
+// are generated to apply sequentially onto the pristine pin (each also
+// applies standalone, verified 2026-08-03). NEVER fail install over these.
+const HARNESS_VENDORED_PATCHES = [
+    {
+        file: "browser-harness-loopback-cdp-proxy.patch",
+        sentinelFile: path.join("src", "browser_harness", "admin.py"),
+        sentinelStr: "cdp_urlopen",
+        label: "loopback-proxy",
+        absentWarn: "CDP probes may 403 behind a system proxy",
+    },
+    {
+        // Suppress OS-focus-stealing Target.activateTarget on offscreen automation
+        // harnesses; [bh_tab_event] observability. Was previously applied only by
+        // the npm installer (bin/cli.js) — a bare .mcpb provision skipped it, so
+        // mcpb-only boxes ran upstream helpers that steal focus on every tab
+        // switch (gap closed 2026-08-03).
+        file: "browser-harness-focus-and-observability.patch",
+        sentinelFile: path.join("src", "browser_harness", "helpers.py"),
+        sentinelStr: "_is_offscreen_harness",
+        label: "focus-suppression + tab-event observability",
+        absentWarn: "harness Chrome may steal OS focus on every tab switch",
+    },
+    {
+        // Daemon attach_first_page: reuse an existing blank tab and create in the
+        // BACKGROUND when truly tabless. Without it, a blank-only browser traps
+        // the daemon in a stale-session loop where every re-attach mints a
+        // foreground about:blank = one macOS focus steal per iteration.
+        file: "browser-harness-daemon-blank-tab-attach.patch",
+        sentinelFile: path.join("src", "browser_harness", "daemon.py"),
+        sentinelStr: "no page tabs at all",
+        label: "daemon blank-tab background attach",
+        absentWarn: "harness daemon re-attach may pop the Chrome window (focus steal)",
+    },
+];
+/** Apply every vendored patch to HARNESS_DIR (check-then-apply, sentinel-aware).
+ * Returns a human-readable summary; never throws. */
+async function applyHarnessVendoredPatches() {
+    const results = [];
+    for (const p of HARNESS_VENDORED_PATCHES) {
+        const patchPath = path.join(MATERIALIZED_REPO, "scripts", "patches", p.file);
+        if (!fs.existsSync(patchPath)) {
+            results.push(`${p.label}: patch file missing`);
+            continue;
+        }
+        const chk = await sh("git", ["-C", HARNESS_DIR, "apply", "--check", patchPath], {
+            timeoutMs: 30000,
+        });
+        if (chk.code === 0) {
+            const app = await sh("git", ["-C", HARNESS_DIR, "apply", patchPath], { timeoutMs: 30000 });
+            results.push(`${p.label}: ${app.code === 0 ? "applied" : `apply failed (${app.code})`}`);
+            continue;
+        }
+        let present = false;
+        try {
+            present = fs
+                .readFileSync(path.join(HARNESS_DIR, p.sentinelFile), "utf-8")
+                .includes(p.sentinelStr);
+        }
+        catch {
+            /* file moved — fall through to the warning */
+        }
+        if (present) {
+            results.push(`${p.label}: already present`);
+        }
+        else {
+            console.error(`[runtime] browser-harness ${p.label} patch no longer applies and the fix is absent upstream; ${p.absentWarn}`);
+            results.push(`${p.label}: ABSENT (patch stale)`);
+        }
+    }
+    return results.join("; ");
+}
 // The harness drives a REAL Google Chrome over CDP (see twitter-backend.sh
 // _resolve_chrome_bin). Nothing installs Chrome, the runtime only ever
 // downloaded Playwright's Chromium (which the cycle does NOT use), so a .mcpb
@@ -733,40 +809,37 @@ export async function ensureHarnessPatched() {
         // installing) rather than racing on the same checkout.
         if (anotherProcessProvisioning())
             return { ok: false, detail: "provisioning in progress elsewhere" };
-        // Version marker of the CURRENT vendored patch: a symbol that exists only
-        // in its newest revision (v2 added the daemon.py websocket-proxy
-        // neutralization after v1's cdp_urlopen alone proved insufficient — the
-        // WS dial still routed through the macOS system proxy and died with
-        // "proxy rejected connection: HTTP 503"). Bump this string whenever the
-        // patch gains a new hunk, or upgraded installs will silently keep the
-        // previous revision.
+        // Version markers of the CURRENT vendored patches. A patch revision's
+        // marker is a symbol that exists only in its newest revision (the proxy
+        // patch's v2 added the daemon.py websocket-proxy neutralization —
+        // s4l_no_proxy_ws — after v1's cdp_urlopen alone proved insufficient).
+        // A NEW fix gets a NEW patch file + sentinel (see HARNESS_VENDORED_PATCHES)
+        // rather than new hunks in an old patch, or upgraded installs whose old
+        // sentinel still matches would silently keep the previous revision.
         const daemonPy = path.join(HARNESS_DIR, "src", "browser_harness", "daemon.py");
         if (!fs.existsSync(daemonPy))
             return { ok: false, detail: "harness not installed yet" };
-        if (fs.readFileSync(daemonPy, "utf-8").includes("s4l_no_proxy_ws")) {
+        const daemonSrc = fs.readFileSync(daemonPy, "utf-8");
+        const helpersPy = path.join(HARNESS_DIR, "src", "browser_harness", "helpers.py");
+        const helpersSrc = fs.existsSync(helpersPy) ? fs.readFileSync(helpersPy, "utf-8") : "";
+        if (daemonSrc.includes("s4l_no_proxy_ws") &&
+            daemonSrc.includes("no page tabs at all") &&
+            helpersSrc.includes("_is_offscreen_harness")) {
             return { ok: true, detail: "already patched" };
         }
-        const harnessPatch = path.join(MATERIALIZED_REPO, "scripts", "patches", "browser-harness-loopback-cdp-proxy.patch");
-        if (!fs.existsSync(harnessPatch))
-            return { ok: false, detail: "patch file missing from package" };
-        // Discard any PRIOR vendored-patch revision (e.g. v1) so the cumulative
-        // patch applies onto pristine pinned sources. Only src/ is touched; the
-        // checkout is a managed artifact, never a place for local edits.
+        // Discard any PRIOR vendored-patch revision so the patch set applies onto
+        // pristine pinned sources, then re-apply ALL vendored patches (the old
+        // single-patch flow re-applied only the proxy fix here, silently wiping
+        // the focus + daemon patches whenever this boot-repair fired). Only src/
+        // is touched; the checkout is a managed artifact, never a place for
+        // local edits.
         await sh("git", ["-C", HARNESS_DIR, "checkout", "--", "src/browser_harness"], {
             timeoutMs: 30000,
         });
-        const chk = await sh("git", ["-C", HARNESS_DIR, "apply", "--check", harnessPatch], {
-            timeoutMs: 30000,
-        });
-        if (chk.code !== 0) {
-            return { ok: false, detail: "patch does not apply (dirty or diverged checkout)" };
-        }
-        const app = await sh("git", ["-C", HARNESS_DIR, "apply", harnessPatch], { timeoutMs: 30000 });
-        if (app.code !== 0)
-            return { ok: false, detail: `git apply failed (exit ${app.code})` };
+        const summary = await applyHarnessVendoredPatches();
         // Reload the daemon so the long-lived process re-imports the patched source.
         await sh(HARNESS_BIN, ["--reload"], { timeoutMs: 30000 });
-        return { ok: true, detail: "patched + daemon reloaded" };
+        return { ok: true, detail: `patched + daemon reloaded (${summary})` };
     }
     catch (e) {
         return { ok: false, detail: String(e?.message || e) };
@@ -1011,37 +1084,12 @@ async function provision(progress) {
             timeoutMs: 120000,
         });
         await sh("git", ["-C", HARNESS_DIR, "reset", "--hard", "FETCH_HEAD"], { timeoutMs: 60000 });
-        // Vendored fix on top of the pin: loopback CDP requests must never route
-        // through a proxy. macOS system proxy settings leak into urllib's default
-        // opener, and a box-wide forwarder 403s every 127.0.0.1 probe, so Chrome
-        // reads as "wedged"/logged-out while it is actually fine (2026-07-13).
-        // Upstream doesn't carry the fix and we don't control that repo, so apply
-        // our patch at install time, on every machine. If it stops applying
-        // cleanly, upstream has either merged the fix (detected below; fine) or
-        // refactored the files (warn); never fail the install over it.
-        const harnessPatch = path.join(MATERIALIZED_REPO, "scripts", "patches", "browser-harness-loopback-cdp-proxy.patch");
-        if (fs.existsSync(harnessPatch)) {
-            const chk = await sh("git", ["-C", HARNESS_DIR, "apply", "--check", harnessPatch], {
-                timeoutMs: 30000,
-            });
-            if (chk.code === 0) {
-                await sh("git", ["-C", HARNESS_DIR, "apply", harnessPatch], { timeoutMs: 30000 });
-            }
-            else {
-                let fixedUpstream = false;
-                try {
-                    fixedUpstream = fs
-                        .readFileSync(path.join(HARNESS_DIR, "src", "browser_harness", "admin.py"), "utf-8")
-                        .includes("cdp_urlopen");
-                }
-                catch {
-                    /* file moved — fall through to the warning */
-                }
-                if (!fixedUpstream) {
-                    console.error("[runtime] browser-harness loopback-proxy patch no longer applies and the fix is absent upstream; CDP probes may 403 behind a system proxy");
-                }
-            }
-        }
+        // Vendored fixes on top of the pin (loopback-proxy, focus-suppression,
+        // daemon blank-tab attach — see HARNESS_VENDORED_PATCHES). Applied at
+        // install time on every machine since we don't control upstream. This
+        // previously applied ONLY the proxy patch, so bare .mcpb boxes ran
+        // upstream helpers/daemon that steal OS focus (gap closed 2026-08-03).
+        await applyHarnessVendoredPatches();
         // Install the CLI via uv tool (lands at ~/.local/bin/browser-harness).
         // --force so a refreshed source / changed entry point is reinstalled.
         const inst = await sh(uv, ["tool", "install", "--force", "-e", HARNESS_DIR], {

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.7-rc.8",
-  "installedAt": "2026-08-03T22:41:58.148Z"
+  "version": "1.7.7",
+  "installedAt": "2026-08-04T18:33:55.672Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.7-rc.8",
+  "version": "1.7.7",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.7-rc.8",
+  "version": "1.7.7",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.7-rc.8",
+  "version": "1.7.7",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/browser_lifecycle.py

@@ -103,7 +103,25 @@ def background_new_page(browser, context, url: str = "about:blank", timeout_ms:
                 cdp.detach()
             except Exception:
                 pass
-    except Exception:
+    except Exception as e:
+        # LOUD fallback: this is the one remaining way a harness tab can be
+        # created in the foreground (= macOS focus steal). Log to stderr AND
+        # the universal browser-activity.log, because several lanes' stderr is
+        # captured into MCP results and never reaches disk (2026-08-04: an
+        # unattributed focus-pop hit exactly this observability hole).
+        msg = (f"[background_new_page] CDP background create failed "
+               f"({type(e).__name__}: {str(e)[:120]}); falling back to "
+               f"FOREGROUND new_page (focus steal likely)")
+        print(msg, file=sys.stderr)
+        try:
+            _p = os.path.expanduser("~/.claude/browser-profiles/browser-activity.log")
+            with open(_p, "a") as _f:
+                import time as _t
+                _f.write(f"[{_t.strftime('%Y-%m-%d %H:%M:%S')}] pycdp "
+                         f"script=browser_lifecycle.py action=fg_fallback "
+                         f"pid={os.getpid()} detail={type(e).__name__}\n")
+        except Exception:
+            pass
         return context.new_page()
 
 

package/scripts/copy_browser_cookies.py

@@ -364,7 +364,9 @@ def inject_via_cdp(cookies: Iterable[Cookie], cdp_url: str = "http://127.0.0.1:9
         log.info("Storage.setCookies unavailable (no tabs); opening stub tab and retrying")
         target_id = None
         try:
-            r = _send("Target.createTarget", {"url": "about:blank"})
+            # background: a foreground createTarget activates Chrome on macOS
+            # and steals app focus, even for a utility tab like this one.
+            r = _send("Target.createTarget", {"url": "about:blank", "background": True})
             target_id = r.get("result", {}).get("targetId")
             if not target_id:
                 log.warning("Couldn't create stub tab: %s", r)

package/scripts/patches/browser-harness-daemon-blank-tab-attach.patch

@@ -0,0 +1,30 @@
+diff --git a/src/browser_harness/daemon.py b/src/browser_harness/daemon.py
+index de51934..fb443c2 100644
+--- a/src/browser_harness/daemon.py
++++ b/src/browser_harness/daemon.py
+@@ -207,9 +207,22 @@ class Daemon:
+         targets = (await self.cdp.send_raw("Target.getTargets"))["targetInfos"]
+         pages = [t for t in targets if is_real_page(t)]
+         if not pages:
+-            # No real pages — create one instead of attaching to omnibox popup
+-            tid = (await self.cdp.send_raw("Target.createTarget", {"url": "about:blank"}))["targetId"]
+-            log(f"no real pages found, created about:blank ({tid})")
++            # No real pages: attach to an existing plain page tab (e.g. an
++            # about:blank left by a prior attach) before creating anything.
++            # is_real_page() rejects about: urls, so without this fallback a
++            # blank-only browser mints a NEW blank on every re-attach, forever.
++            pages = [t for t in targets if t.get("type") == "page"]
++            if pages:
++                log(f"no real pages found, reusing {pages[0].get('url','')[:60]} ({pages[0]['targetId']})")
++        if not pages:
++            # Truly no page tabs — create one instead of attaching to omnibox
++            # popup. background=True: a foreground Target.createTarget raises
++            # the Chrome window and steals macOS app focus (2026-07-15 7/7
++            # same-second correlation); a re-attach must never pop a window.
++            tid = (await self.cdp.send_raw(
++                "Target.createTarget", {"url": "about:blank", "background": True}
++            ))["targetId"]
++            log(f"no page tabs at all, created background about:blank ({tid})")
+             pages = [{"targetId": tid, "url": "about:blank", "type": "page"}]
+         self.session = (await self.cdp.send_raw(
+             "Target.attachToTarget", {"targetId": pages[0]["targetId"], "flatten": True}

package/scripts/reddit_ban_check.py

@@ -114,7 +114,10 @@ def _reddit_page(pw):
         if page is None and ctx.pages:
             page = ctx.pages[0]
         if page is None:
-            page = ctx.new_page()
+            # Zero pages: create in the BACKGROUND (2026-08-04). A plain
+            # new_page() is a foreground Target.createTarget = focus steal.
+            from browser_lifecycle import background_new_page
+            page = background_new_page(browser, ctx)
         page.set_default_timeout(20000)
         return browser, page
     except Exception: