@m13v/s4l 1.7.7 → 1.7.8-rc.2

package/scripts/install.sh

@@ -0,0 +1,119 @@
+#!/bin/bash
+# S4L universal installer: curl -fsSL https://s4l.ai/install | sh
+#
+# Zero-toolchain by design: needs only stock macOS (curl, unzip, python3).
+# Downloads the release bundle (the .mcpb zip, which vendors its own Node
+# runtime and the whole pipeline), extracts it to a durable host-neutral dir,
+# registers the MCP server with whichever agent app is present (ChatGPT/Codex
+# and/or Claude Code), and stamps the draft provider for the invoking host.
+# The heavy runtime (Python venv, Chromium) self-provisions on first server
+# boot, exactly as it does for .mcpb installs.
+#
+# Host detection order:
+#   1. Invoking agent env: CODEX_THREAD_ID => codex chat; CLAUDE_CODE_*/CLAUDECODE
+#      => Claude Code chat. The invoking host's engine becomes the draft provider.
+#   2. Otherwise: whatever is installed (both is fine; provider prefers claude-p
+#      when the claude CLI exists, else codex-exec).
+#
+# Channels: S4L_CHANNEL=staging pulls the staging-latest prerelease instead of
+# the stable release. Optional S4L_INSTALL_HOST=codex|claude forces the provider
+# choice regardless of detection.
+
+set -euo pipefail
+
+REPO="m13v/s4l"
+STABLE_URL="https://github.com/$REPO/releases/latest/download/social-autoposter.mcpb"
+STAGING_URL="https://github.com/$REPO/releases/download/staging-latest/social-autoposter.mcpb"
+STATE_DIR="${S4L_STATE_DIR:-$HOME/.social-autoposter-mcp}"
+APP_DIR="$STATE_DIR/app"
+CODEX_BIN="/Applications/ChatGPT.app/Contents/Resources/codex"
+
+log() { echo "[s4l-install] $*"; }
+die() { echo "[s4l-install] ERROR: $*" >&2; exit 1; }
+
+[ "$(uname -s)" = "Darwin" ] || die "macOS only for now."
+[ "$(uname -m)" = "arm64" ] || die "Apple Silicon only for now (the bundle vendors a darwin-arm64 Node)."
+
+URL="$STABLE_URL"
+[ "${S4L_CHANNEL:-}" = "staging" ] && URL="$STAGING_URL"
+
+# 1. Download + extract. The .mcpb is a plain zip.
+TMP="$(mktemp -d /tmp/s4l-install.XXXXXX)"
+trap 'rm -rf "$TMP"' EXIT
+log "downloading $URL"
+/usr/bin/curl -fsSL -o "$TMP/s4l.mcpb" "$URL" || die "download failed"
+mkdir -p "$TMP/app"
+/usr/bin/unzip -q "$TMP/s4l.mcpb" -d "$TMP/app" || die "unzip failed"
+[ -f "$TMP/app/dist/index.js" ] || die "bundle missing dist/index.js (bad download?)"
+[ -x "$TMP/app/vendor/node-darwin-arm64/bin/node" ] || die "bundle missing vendored node"
+
+mkdir -p "$STATE_DIR"
+rm -rf "$APP_DIR.new"
+mv "$TMP/app" "$APP_DIR.new"
+if [ -d "$APP_DIR" ]; then rm -rf "$APP_DIR.old" && mv "$APP_DIR" "$APP_DIR.old"; fi
+mv "$APP_DIR.new" "$APP_DIR"
+rm -rf "$APP_DIR.old"
+log "installed bundle to $APP_DIR"
+
+NODE="$APP_DIR/vendor/node-darwin-arm64/bin/node"
+SERVER="$APP_DIR/dist/index.js"
+SAFE_PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+
+# 2. Which host is driving this install?
+HOST="${S4L_INSTALL_HOST:-}"
+if [ -z "$HOST" ]; then
+  if [ -n "${CODEX_THREAD_ID:-}" ]; then HOST="codex"
+  elif [ -n "${CLAUDECODE:-}" ] || [ -n "${CLAUDE_CODE_ENTRYPOINT:-}" ]; then HOST="claude"
+  fi
+fi
+
+HAVE_CODEX=0; [ -x "$CODEX_BIN" ] && HAVE_CODEX=1
+HAVE_CLAUDE=0; command -v claude >/dev/null 2>&1 && HAVE_CLAUDE=1
+[ "$HAVE_CODEX" = "1" ] || [ "$HAVE_CLAUDE" = "1" ] || die "neither the ChatGPT app nor the claude CLI was found; install one first (or double-click the .mcpb for Claude Desktop)."
+
+# 3. Register the MCP server with every host present (registration is cheap and
+# idempotent; the PROVIDER below is what decides who answers drafting turns).
+if [ "$HAVE_CODEX" = "1" ]; then
+  "$CODEX_BIN" mcp remove s4l >/dev/null 2>&1 || true
+  "$CODEX_BIN" mcp add s4l --env "S4L_HOST=codex" --env "PATH=$SAFE_PATH" -- "$NODE" "$SERVER" \
+    && log "registered MCP server with the ChatGPT app (codex)" \
+    || log "WARN: codex mcp add failed; register manually with: codex mcp add s4l --env S4L_HOST=codex -- $NODE $SERVER"
+fi
+if [ "$HAVE_CLAUDE" = "1" ]; then
+  claude mcp remove -s user s4l >/dev/null 2>&1 || true
+  claude mcp add -s user s4l --env "PATH=$SAFE_PATH" -- "$NODE" "$SERVER" \
+    && log "registered MCP server with Claude Code" \
+    || log "WARN: claude mcp add failed; register manually with: claude mcp add -s user s4l -- $NODE $SERVER"
+fi
+
+# 4. Stamp the draft provider (single source of truth for which engine answers
+# drafting turns; see scripts/draft_provider.py in the bundle).
+PROVIDER=""
+case "$HOST" in
+  codex)  PROVIDER="codex-exec" ;;
+  claude) PROVIDER="claude-p" ;;
+  *) if [ "$HAVE_CLAUDE" = "1" ]; then PROVIDER="claude-p"; else PROVIDER="codex-exec"; fi ;;
+esac
+/usr/bin/python3 - "$STATE_DIR" "$PROVIDER" <<'PY'
+import json, os, sys, time
+sd, provider = sys.argv[1], sys.argv[2]
+p = os.path.join(sd, "draft-provider.json")
+tmp = p + ".tmp"
+with open(tmp, "w") as f:
+    json.dump({"provider": provider,
+               "set_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+               "set_by": "install.sh"}, f, indent=2)
+os.replace(tmp, p)
+PY
+log "draft provider: $PROVIDER"
+
+log "done."
+echo
+echo "Next steps:"
+if [ "$HOST" = "codex" ] || { [ -z "$HOST" ] && [ "$HAVE_CODEX" = "1" ]; }; then
+  echo "  1. Fully quit and reopen the ChatGPT app so it picks up the new S4L connector."
+  echo "  2. In a new chat, say: Set up S4L for my product."
+else
+  echo "  1. Restart your Claude session so it picks up the new S4L MCP server."
+  echo "  2. In a new chat, say: Set up S4L for my product."
+fi

package/scripts/scan_reddit_replies.py

@@ -7,9 +7,12 @@ reddit-agent profile cookies (refreshed by bootstrap_reddit_cookies.py),
 inserts new rows into `replies`, and immediately fires engage_reddit.py
 with --limit so the loop runs end-to-end every 5 min.
 
-Inbox cannot tell us depth/parent_reply_id (it shows comment-replies and
-post-replies identically). We insert depth=1 / parent_reply_id=NULL; the
-engage step reads the live thread URL anyway.
+Thread matching is two-stage: first against `posts` (threads we submitted),
+then via the item's parent_id (t1_<our_comment_id>) against
+replies.our_reply_id (replies to our comments on other people's threads).
+The second stage inserts a followup row (parent_reply_id + depth); without
+it every comment-chain reply is dropped as unmatched_thread, which orphaned
+all comment-chain conversations between 2026-04-17 and 2026-08-05.
 
 Items older than BACKFILL_HOURS that aren't already in the DB are marked
 status='skipped' / skip_reason='backfill_old' so they show in the
@@ -50,11 +53,12 @@ ENGAGE_SCRIPT = os.path.expanduser("~/social-autoposter/scripts/engage_reddit.py
 INBOX_URL = "https://old.reddit.com/message/inbox/.json"
 PAGE_LIMIT = 100
 MAX_PAGES = 10  # caps pagination at ~1000 items; inbox retention is shorter than that anyway
-BACKFILL_HOURS = 48
+BACKFILL_HOURS = int(os.environ.get("S4L_REDDIT_BACKFILL_HOURS", "48"))
 JITTER_MAX_SECS = 60
 PAGE_PAUSE_SECS = 1.5
-OWN_COMMENTS_PAGES = 20  # hard cap on pagination depth (max 2000 items)
-OWN_COMMENTS_LOOKBACK_DAYS = 30  # stop once we pass this many days back
+OWN_COMMENTS_PAGES = 20  # hard cap on pagination depth (reddit caps listings at ~1000 items)
+OWN_COMMENTS_LOOKBACK_DAYS = 90  # stop once we pass this many days back; replies to
+# comments older than the (30-day) old value were dropped as unmatched_thread
 
 THREAD_ID_RE = re.compile(r"/comments/([a-z0-9]+)/")
 
@@ -97,12 +101,20 @@ class SessionInvalidError(Exception):
 
 def fetch_own_replies(reddit_account, cookie_header, user_agent,
                        pages=OWN_COMMENTS_PAGES, lookback_days=OWN_COMMENTS_LOOKBACK_DAYS):
-    """Build {parent_comment_id: {reply_id, reply_url, reply_content, replied_at}}
-    by paging /user/<account>/comments.json. Used to detect comments the account
-    already replied to outside the pipeline (e.g., manual browser replies).
-    Stops when a page's oldest comment is older than lookback_days, or after
-    `pages` pages, whichever comes first."""
+    """Build two maps by paging /user/<account>/comments.json:
+
+    1. {parent_comment_id: {reply_id, reply_url, reply_content, replied_at}}
+       Used to detect comments the account already replied to outside the
+       pipeline (e.g., manual browser replies).
+    2. {our_comment_id: parent_comment_id} for every comment of ours whose
+       parent is a comment (t1_). Used by the comment-chain matcher: an inbox
+       reply's parent_id is OUR comment, and OUR comment's parent is the
+       their_comment_id recorded on the replies row we posted from.
+
+    Returns (map1, map2). Stops when a page's oldest comment is older than
+    lookback_days, or after `pages` pages, whichever comes first."""
     out = {}
+    own_parents = {}
     after = None
     cutoff = time.time() - lookback_days * 86400
     url_base = f"https://old.reddit.com/user/{reddit_account}/comments/.json?limit={PAGE_LIMIT}"
@@ -114,11 +126,11 @@ def fetch_own_replies(reddit_account, cookie_header, user_agent,
         try:
             with urllib.request.urlopen(req, timeout=20) as resp:
                 if "application/json" not in resp.headers.get("Content-Type", ""):
-                    return out  # non-fatal; just skip the map
+                    return out, own_parents  # non-fatal; just skip the map
                 data = json.loads(resp.read()).get("data", {})
         except Exception as e:
             print(f"  own-replies fetch failed on page {page+1}: {e}")
-            return out
+            return out, own_parents
         children = data.get("children", []) or []
         oldest_on_page = 0
         for c in children:
@@ -130,6 +142,9 @@ def fetch_own_replies(reddit_account, cookie_header, user_agent,
             if not parent.startswith("t1_"):
                 continue  # only comment-parents; post-parents handled via inbox matching
             parent_id = parent.removeprefix("t1_")
+            our_id = d.get("id")
+            if our_id and our_id not in own_parents:
+                own_parents[our_id] = parent_id
             if parent_id in out:
                 continue
             reply_id = d.get("id")
@@ -146,12 +161,12 @@ def fetch_own_replies(reddit_account, cookie_header, user_agent,
         if oldest_on_page and oldest_on_page < cutoff:
             break  # we've reached lookback horizon
         time.sleep(PAGE_PAUSE_SECS)
-    return out
+    return out, own_parents
 
 
 class InboxScanner:
     def __init__(self, reddit_account, user_agent, cookie_header, excluded_authors=None,
-                 own_replies_map=None):
+                 own_replies_map=None, own_comment_parents=None):
         # No DB handle anymore — every read/write hits the API. The `db` field
         # is kept for back-compat with `_insert_reply(self.db, ...)` callers
         # (they pass it through unchanged); the helper itself ignores the value.
@@ -163,10 +178,14 @@ class InboxScanner:
         self.excluded = {a.lower() for a in (excluded_authors or set())}
         self.excluded.update({"automoderator", "[deleted]", self.reddit_account_lower})
         self.own_replies_map = own_replies_map or {}
+        self.own_comment_parents = own_comment_parents or {}
         # Cache thread_id -> post_id lookups across a single scan so we don't
         # hit /api/v1/posts once per inbox entry (the same thread often
         # appears multiple times in a single page).
         self._post_id_cache = {}
+        # Cache our_reply_id -> parent replies row for comment-chain matching.
+        self._parent_reply_cache = {}
+        self.parent_matched = 0
         self.discovered = 0
         self.skipped_old = 0
         self.skipped_other = 0
@@ -199,10 +218,59 @@ class InboxScanner:
                     break
         except Exception:
             post_id = None
+        if post_id is None:
+            # Exact fallback for posts older than the 500-row window (replies
+            # keep arriving on months-old submissions).
+            try:
+                resp = api_get(
+                    "/api/v1/posts",
+                    query={"platform": "reddit", "limit": 1,
+                           "thread_url_contains": f"/comments/{thread_id}/"},
+                )
+                posts = ((resp or {}).get("data") or {}).get("posts") or []
+                if posts:
+                    post_id = int(posts[0].get("id"))
+            except Exception:
+                post_id = None
         self._post_id_cache[thread_id] = post_id
         return post_id
 
-    def _insert(self, post_id, comment_id, author, content, comment_url, status, skip_reason=None):
+    def _parent_reply_for_item(self, d):
+        """Match a comment_reply inbox item to OUR earlier comment on someone
+        else's thread. The posts-table match above only covers threads WE
+        submitted; most engagement is comments on other people's threads.
+        The DB does not store our comments' reddit ids (our_reply_id is
+        NULL on virtually all reddit rows), so the linkage goes through the
+        grandparent: the inbox item's parent_id is OUR comment; our own
+        comments listing (own_comment_parents) gives that comment's parent,
+        which is exactly the their_comment_id recorded on the replies row we
+        posted from. Returns that row (dict with id/post_id/depth) or None."""
+        parent = d.get("parent_id") or ""
+        if not parent.startswith("t1_"):
+            return None
+        our_id = parent.removeprefix("t1_")
+        grandparent_id = self.own_comment_parents.get(our_id)
+        if not grandparent_id:
+            return None
+        if grandparent_id in self._parent_reply_cache:
+            return self._parent_reply_cache[grandparent_id]
+        row = None
+        try:
+            resp = api_get(
+                "/api/v1/replies",
+                query={"platform": "reddit", "their_comment_id": grandparent_id,
+                       "limit": 1},
+            )
+            rows = ((resp or {}).get("data") or {}).get("replies") or []
+            if rows:
+                row = rows[0]
+        except Exception:
+            row = None
+        self._parent_reply_cache[grandparent_id] = row
+        return row
+
+    def _insert(self, post_id, comment_id, author, content, comment_url, status, skip_reason=None,
+                parent_reply_id=None, depth=1):
         override = self.own_replies_map.get(comment_id)
         if override:
             from datetime import datetime, timezone
@@ -210,7 +278,7 @@ class InboxScanner:
             replied_at = datetime.fromtimestamp(ts, tz=timezone.utc) if ts else None
             result = _insert_reply(
                 self.db, post_id, "reddit", comment_id, author, content, comment_url,
-                parent_reply_id=None, depth=1, status="replied", skip_reason=None,
+                parent_reply_id=parent_reply_id, depth=depth, status="replied", skip_reason=None,
                 our_reply_id=override.get("our_reply_id"),
                 our_reply_content=override.get("our_reply_content"),
                 our_reply_url=override.get("our_reply_url"),
@@ -221,7 +289,7 @@ class InboxScanner:
             return
         result = _insert_reply(
             self.db, post_id, "reddit", comment_id, author, content, comment_url,
-            parent_reply_id=None, depth=1, status=status, skip_reason=skip_reason,
+            parent_reply_id=parent_reply_id, depth=depth, status=status, skip_reason=skip_reason,
         )
         if result == "pending":
             self.discovered += 1
@@ -246,21 +314,32 @@ class InboxScanner:
                 if not comment_id:
                     continue
                 author = d.get("author") or "[deleted]"
-                if author.lower() in self.excluded:
+                if author.lower() in self.excluded or author.lower().endswith("-modteam"):
+                    # *-ModTeam items are removal notices, not conversations;
+                    # the strike pipeline tracks removals separately.
                     self.skipped_other += 1
                     continue
                 context = d.get("context") or ""
                 post_id = self._post_id_for_context(context)
+                parent_reply_id = None
+                depth = 1
                 if not post_id:
-                    self.unmatched += 1
-                    continue
+                    parent = self._parent_reply_for_item(d)
+                    if not parent:
+                        self.unmatched += 1
+                        continue
+                    self.parent_matched += 1
+                    post_id = parent.get("post_id")  # nullable; next-pending LEFT JOINs posts
+                    parent_reply_id = parent.get("id")
+                    depth = (parent.get("depth") or 1) + 1
                 comment_url = "https://old.reddit.com" + context.split("?")[0]
                 content = d.get("body") or ""
                 created = float(d.get("created_utc") or 0)
                 if created and created < backfill_cutoff:
                     pre = self.discovered + self.skipped_old
                     self._insert(post_id, comment_id, author, content, comment_url,
-                                 status="skipped", skip_reason="backfill_old")
+                                 status="skipped", skip_reason="backfill_old",
+                                 parent_reply_id=parent_reply_id, depth=depth)
                     if (self.discovered + self.skipped_old) == pre:
                         consecutive_known += 1
                     else:
@@ -268,7 +347,8 @@ class InboxScanner:
                 else:
                     pre = self.discovered
                     self._insert(post_id, comment_id, author, content, comment_url,
-                                 status="pending")
+                                 status="pending",
+                                 parent_reply_id=parent_reply_id, depth=depth)
                     if self.discovered == pre:
                         consecutive_known += 1
                     else:
@@ -293,7 +373,8 @@ class InboxScanner:
             f"Inbox scan complete: seen={self.total_seen} "
             f"new_pending={self.discovered} backfill_skipped={self.skipped_old} "
             f"already_replied={self.already_replied} "
-            f"excluded_author={self.skipped_other} unmatched_thread={self.unmatched}"
+            f"excluded_author={self.skipped_other} unmatched_thread={self.unmatched} "
+            f"parent_matched={self.parent_matched}"
         )
         return {
             "discovered": self.discovered,
@@ -301,6 +382,7 @@ class InboxScanner:
             "already_replied": self.already_replied,
             "excluded": self.skipped_other,
             "unmatched": self.unmatched,
+            "parent_matched": self.parent_matched,
             "total_seen": self.total_seen,
         }
 
@@ -349,11 +431,13 @@ def main():
 
     user_agent = f"social-autoposter/1.0 (u/{reddit_account} inbox-scan)"
     excluded_authors = {a for a in config.get("exclusions", {}).get("authors", [])}
-    own_replies_map = fetch_own_replies(reddit_account, cookie_header, user_agent)
-    print(f"Own-replies map: {len(own_replies_map)} parent comment_ids we've already replied to")
+    own_replies_map, own_comment_parents = fetch_own_replies(reddit_account, cookie_header, user_agent)
+    print(f"Own-replies map: {len(own_replies_map)} parent comment_ids we've already replied to; "
+          f"{len(own_comment_parents)} own comments mapped for chain matching")
     scanner = InboxScanner(reddit_account, user_agent, cookie_header,
                            excluded_authors=excluded_authors,
-                           own_replies_map=own_replies_map)
+                           own_replies_map=own_replies_map,
+                           own_comment_parents=own_comment_parents)
     try:
         scanner.scan()
     except SessionInvalidError as e:

package/scripts/schedule_state.py

@@ -221,6 +221,22 @@ def compute(glob_pattern: str | None = None) -> str:
     the module docstring for why. Pass an explicit glob_pattern to scan a
     literal pattern instead (e.g. a test fixture dir); this bypasses account
     scoping entirely, matching the old unconditional behavior."""
+    # Provider layer (2026-08-06): when the box's draft provider is claude-p or
+    # codex-exec (scripts/draft_provider.py), drafting runs inline in the
+    # launchd cycle itself; NO Claude Desktop worker task is required, so the
+    # registry scan below is irrelevant and its 'missing' verdict would be a
+    # false alarm on every surface (menubar warning, dashboard "Set up draft
+    # schedule", Sentry). Health for those providers is watched by the queue
+    # drain-latency rails, which the inline path already stamps.
+    if glob_pattern is None:
+        try:
+            sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+            import draft_provider  # noqa: E402
+
+            if draft_provider.get() != "claude-desktop-queue":
+                return "ok"
+        except Exception:
+            pass
     patterns = [glob_pattern] if glob_pattern is not None else _active_registry_glob_patterns()
     newest_epoch, newest_enabled = None, False
     # Track the freshest just-created, enabled, never-yet-fired task so a schedule

package/scripts/setup_reddit_auth.py

@@ -89,6 +89,9 @@ try:
         _classify_import_error,
         _is_headless,
         _keychain_safe_storage_ok,
+        _keychain_declined,
+        _keychain_mark_declined,
+        _keychain_clear_declined,
     )
 except Exception:  # pragma: no cover - defensive
     def _classify_import_error(detail):  # type: ignore[misc]
@@ -100,6 +103,15 @@ except Exception:  # pragma: no cover - defensive
     def _keychain_safe_storage_ok(browser_label="Chrome"):  # type: ignore[misc]
         return True, "probe unavailable"
 
+    def _keychain_declined():  # type: ignore[misc]
+        return None
+
+    def _keychain_mark_declined(source, detail):  # type: ignore[misc]
+        pass
+
+    def _keychain_clear_declined():  # type: ignore[misc]
+        pass
+
 # Vendored cookie copier - stdlib-only browser/profile detection plus the
 # actual keychain-decrypt + CDP-inject copy. Same module connect_x uses,
 # parameterized here by --domains reddit.com.
@@ -752,31 +764,19 @@ def cmd_connect(args) -> dict:
     manual_login = bool(getattr(args, "manual_login", False))
     will_import = has_importable and not manual_login
 
-    # 1c. Headless keychain preflight, import path only (manual login reads no
-    # keychain and must never be blocked by this).
-    if will_import and _is_headless():
-        kc_ok, kc_detail = _keychain_safe_storage_ok("Chrome")
-        if not kc_ok:
-            return {
-                "ok": True,
-                "connected": False,
-                "state": "keychain_locked",
-                "error_type": "keychain_locked",
-                "headless": True,
-                "keychain_detail": kc_detail,
-                "note": (
-                    "Cookie import requires reading the browser's Safe Storage from "
-                    "the macOS Keychain, but this process can't access it (probably "
-                    "running over SSH or another headless context). Run this once in "
-                    "the same session:\n"
-                    "  security unlock-keychain ~/Library/Keychains/login.keychain-db\n"
-                    "Then re-run connect_reddit. Or connect Reddit with manual login "
-                    "instead; that signs in directly in the autoposter's own browser "
-                    "and needs no keychain."
-                ),
-                "remediation_cmd": "security unlock-keychain ~/Library/Keychains/login.keychain-db",
-                "cdp": CDP,
-            }
+    # 1c. Keychain prompt-once gate (2026-08-06; replaces the headless probe —
+    # see setup_twitter_auth.py for the full rationale). The user is asked for
+    # keychain access at most ONCE across ALL platforms: the import attempt
+    # itself is the single prompt, and a Deny/Cancel recorded by either the X
+    # or the reddit importer permanently routes both to manual login.
+    if will_import:
+        if getattr(args, "retry_keychain_import", False):
+            _keychain_clear_declined()
+        keychain_declined = _keychain_declined()
+        if keychain_declined:
+            will_import = False
+    else:
+        keychain_declined = None
 
     # 2. Import from the user's everyday browser.
     attempts = []
@@ -791,6 +791,12 @@ def cmd_connect(args) -> dict:
             "detail": detail,
             "error_type": error_type,
         })
+        if error_type == "keychain_acl_denied":
+            # The user answered the ONE allowed keychain prompt with
+            # Deny/Cancel. Record it (shared latch with connect_x) and stop
+            # the sweep — the next source would fire another prompt.
+            _keychain_mark_declined(src, detail)
+            break
         if not res.get("ok"):
             continue
         fields = _validate_session()
@@ -816,10 +822,13 @@ def cmd_connect(args) -> dict:
     rolled_up_error_type = (
         next(iter(distinct_error_types)) if len(distinct_error_types) == 1 else None
     )
+    # A Deny/Cancel on THIS run's prompt, regardless of what other sources
+    # failed with (the single-type roll-up above misses mixed-error runs).
+    denied_now = any(a.get("error_type") == "keychain_acl_denied" for a in attempts)
     open_login = (
         manual_login
         or not will_import
-        or rolled_up_error_type == "keychain_acl_denied"
+        or denied_now
     )
 
     shown = False
@@ -834,19 +843,31 @@ def cmd_connect(args) -> dict:
                     note="You logged in manually; the autoposter detected the live "
                          "reddit session in its own browser profile.")
 
-    if rolled_up_error_type == "keychain_acl_denied":
+    if denied_now:
+        # Prompt-once policy: the Deny/Cancel is latched; never suggest
+        # re-running the import — that advice made setup agents loop and
+        # re-prompt. Manual login is the path now.
+        note = (
+            "You declined the macOS Keychain prompt, so automatic import is off — "
+            "we only ask once and won't show that prompt again. "
+            "A Chrome window is open at the Reddit login page"
+            + ("" if shown else " (look for a 'Google Chrome' window)")
+            + "; log in there by hand and ask me to re-check. Do NOT re-run "
+            "the cookie import. (Auto-import tried: " + ", ".join(sources) + ".)"
+        )
+        extra = {"remediation": "use_manual_login", "keychain_prompt": "declined_latched"}
+    elif keychain_declined:
+        # An earlier run (X or reddit) already recorded the Deny/Cancel; this
+        # call skipped the import entirely and opened the manual-login window.
         note = (
-            "It looks like you clicked Deny (or Cancel) on the macOS Keychain prompt. "
-            "To import your Reddit session automatically, the autoposter needs to read "
-            "your browser's \"Safe Storage\" key from your Keychain. Re-run "
-            "connect_reddit and click Allow (or Always Allow) and the import will "
-            "finish on its own. If you'd rather not grant keychain access, there's "
-            "already a Chrome window open at the Reddit login page"
+            "You previously declined the macOS Keychain prompt, so I skipped the "
+            "automatic import (we only ask once). A Chrome window is open at the "
+            "Reddit login page"
             + ("" if shown else " (look for a 'Google Chrome' window)")
-            + "; just log in there by hand and ask me to re-check. "
-            "(Auto-import tried: " + ", ".join(sources) + ".)"
+            + "; log in there by hand and ask me to re-check. Do NOT re-run "
+            "the cookie import; it will not prompt again."
         )
-        extra = {"remediation": "rerun_connect_reddit_and_click_allow"}
+        extra = {"remediation": "use_manual_login", "keychain_prompt": "declined_latched"}
     elif open_login:
         _why = (
             "" if will_import
@@ -907,6 +928,11 @@ def main() -> int:
     c.add_argument("--login-wait", type=float, default=300.0,
                    help="Seconds to wait for a MANUAL login to complete before "
                         "returning needs_login (default 300; 0 disables the wait).")
+    c.add_argument("--retry-keychain-import", action="store_true",
+                   help="Clear the shared keychain-declined latch so the import path "
+                        "may show the macOS keychain prompt ONE more time. The prompt "
+                        "is once-only by policy; pass this only when the user "
+                        "explicitly asks to retry the automatic import.")
     args = ap.parse_args()
 
     if args.cmd == "detect-sources":