@m13v/s4l 1.7.7 → 1.7.8-rc.2

package/scripts/setup_twitter_auth.py

@@ -734,6 +734,49 @@ def _keychain_safe_storage_ok(browser_label: str = "Chrome") -> tuple[bool, str]
     return False, (err_tail[-1] if err_tail else f"exit {r.returncode}")
 
 
+# --- Keychain prompt-once latch (2026-08-06) --------------------------------
+# Product decision: the user is asked for keychain access AT MOST ONCE, by the
+# import attempt itself (copy_browser_cookies' `security` call blocks on the
+# macOS dialog with no timeout, so the one prompt waits for a human answer).
+# Any Deny/Cancel is recorded here, and every later connect_x skips the import
+# path entirely and goes straight to manual login. Without this latch the setup
+# agent saw "keychain locked, re-run connect_x", retried the import, and
+# re-fired the password prompt at a user who had already said no (install
+# a208aa6b, 2026-08-06: three prompts in five minutes). Lives OUTSIDE the
+# per-platform profile dir so the reddit importer can honor the same decision.
+_KEYCHAIN_DECLINED_LATCH = (
+    Path.home() / ".claude" / "browser-profiles" / "keychain-import-declined.json"
+)
+
+
+def _keychain_declined() -> dict | None:
+    """The recorded Deny/Cancel from a previous import attempt, or None."""
+    try:
+        return json.loads(_KEYCHAIN_DECLINED_LATCH.read_text())
+    except Exception:
+        return None
+
+
+def _keychain_mark_declined(source: str, detail: str | None) -> None:
+    try:
+        _KEYCHAIN_DECLINED_LATCH.parent.mkdir(parents=True, exist_ok=True)
+        _KEYCHAIN_DECLINED_LATCH.write_text(json.dumps({
+            "declined_at": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
+            "source": source,
+            "detail": (detail or "")[:500],
+        }))
+    except Exception as e:
+        print(f"setup_twitter_auth: could not write keychain latch ({e})",
+              file=sys.stderr)
+
+
+def _keychain_clear_declined() -> None:
+    try:
+        _KEYCHAIN_DECLINED_LATCH.unlink(missing_ok=True)
+    except Exception:
+        pass
+
+
 def _classify_import_error(detail: str | None) -> str:
     """Map a copy_browser_cookies.py error string to a structured type so the
     upper layers (connect_x, the user) can show a precise remediation instead
@@ -750,9 +793,13 @@ def _classify_import_error(detail: str | None) -> str:
     #   - unlock/confirm prompt, click Cancel/Deny -> errSecUserCanceled (-128)
     # Both mean "the user actively refused", and both have the same fix (re-run
     # and click Allow), so collapse them into one type.
+    # "exit 128" is `security`'s bare exit code for errSecUserCanceled when
+    # stderr is empty (observed install a208aa6b 2026-08-06); without this
+    # match a user's Cancel was misread as a locked keychain and retried.
     if (("access denied" in d) or ("errsecauth" in d) or ("-25293" in d)
             or ("user canceled" in d) or ("user cancelled" in d)
-            or ("errsecusercanceled" in d) or ("-128" in d)):
+            or ("errsecusercanceled" in d) or ("-128" in d)
+            or ("exit 128" in d)):
         return "keychain_acl_denied"
     if ("not be found in the keychain" in d) or ("errsecitemnotfound" in d):
         return "keychain_entry_missing"
@@ -1055,33 +1102,37 @@ def cmd_connect(args) -> dict:
     # there is a real session to copy. Otherwise fall through to manual login.
     will_import = has_importable and not manual_login
 
-    # 1c. Headless + Keychain pre-flight (#3 + #4, added 2026-06-02) — relevant
-    #     ONLY to the import path. copy_browser_cookies.py must read the per-browser
-    #     Safe Storage entry from the OS keychain; SSH/launchd-invoked processes get
-    #     errSecAuthFailed silently (no prompt). The manual-login path skips this.
-    if will_import and _is_headless():
-        # Probe Chrome (the autoposter default); if that's denied, the rest are too.
-        kc_ok, kc_detail = _keychain_safe_storage_ok("Chrome")
-        if not kc_ok:
-            return {
-                "ok": True,
-                "connected": False,
-                "state": "keychain_locked",
-                "error_type": "keychain_locked",
-                "headless": True,
-                "keychain_detail": kc_detail,
-                "note": (
-                    "Cookie import requires reading Chrome's Safe Storage from the macOS "
-                    "Keychain, but this process can't access it (probably running over SSH "
-                    "or another headless context). No GUI prompt is shown for this — macOS "
-                    "denies access silently. To fix, run this once in the same session:\n"
-                    "  security unlock-keychain ~/Library/Keychains/login.keychain-db\n"
-                    "Then re-run connect_x. Or connect X with manual login instead — that "
-                    "signs in directly in the autoposter's own browser and needs no keychain."
-                ),
-                "remediation_cmd": "security unlock-keychain ~/Library/Keychains/login.keychain-db",
-                "cdp": CDP,
-            }
+    # 1c. Keychain prompt-once gate (2026-08-06; replaces the 2026-06-02
+    #     headless probe). The old probe pre-read "Chrome Safe Storage" with a
+    #     10s timeout, which (a) fired a SEPARATE SecurityAgent prompt before
+    #     the import's own one, (b) auto-dismissed that dialog from under the
+    #     user when the timeout killed `security`, and (c) was gated on
+    #     _is_headless(), which is True for EVERY MCP-spawned run (stdin is
+    #     never a tty), so all desktop installs got told "you're probably on
+    #     SSH; run security unlock-keychain and re-run connect_x" — advice the
+    #     setup agent obediently looped on, re-prompting a user who had already
+    #     clicked Cancel.
+    #     Now the import attempt itself is the single keychain prompt: its
+    #     `security` call blocks on the dialog with no timeout, its Deny/Cancel
+    #     comes back as a classifiable error, and the latch below makes the
+    #     answer permanent. A truly headless (SSH/launchd) run fails that same
+    #     call fast with "User interaction is not allowed" -> keychain_locked,
+    #     which is NOT latched (no prompt was ever shown).
+    if will_import:
+        if getattr(args, "retry_keychain_import", False):
+            _keychain_clear_declined()
+        declined = _keychain_declined()
+        if declined:
+            # The one allowed prompt was already answered with Deny/Cancel.
+            # Skip the import path for good and fall through to manual login
+            # in THIS call (will_import False forces open_login below), so
+            # setup keeps moving instead of asking again.
+            will_import = False
+            keychain_declined = declined
+        else:
+            keychain_declined = None
+    else:
+        keychain_declined = None
 
     # 2. Import from the user's everyday browser (skipped entirely when we're on
     #    the manual-login path — `will_import` False makes this loop a no-op).
@@ -1098,6 +1149,13 @@ def cmd_connect(args) -> dict:
             "detail": detail,
             "error_type": error_type,
         })
+        if error_type == "keychain_acl_denied":
+            # The user answered the ONE allowed keychain prompt with
+            # Deny/Cancel. Record it forever and stop the sweep — trying the
+            # next source browser would fire another prompt, and once means
+            # once. Every later connect_x skips the import path entirely.
+            _keychain_mark_declined(src, detail)
+            break
         if not res.get("ok"):
             continue
         # 3. Re-validate after this source.
@@ -1151,6 +1209,9 @@ def cmd_connect(args) -> dict:
     rolled_up_error_type = (
         next(iter(distinct_error_types)) if len(distinct_error_types) == 1 else None
     )
+    # A Deny/Cancel on THIS run's prompt, regardless of what other sources
+    # failed with (the single-type roll-up above misses mixed-error runs).
+    denied_now = any(a.get("error_type") == "keychain_acl_denied" for a in attempts)
     # Open a focused login window when the user asked for manual login, when the
     # keychain prompt was denied (import can't proceed), OR when there was nothing
     # to import in the first place — in that last case manual login is the ONLY
@@ -1158,7 +1219,7 @@ def cmd_connect(args) -> dict:
     open_login = (
         manual_login
         or not will_import
-        or rolled_up_error_type == "keychain_acl_denied"
+        or denied_now
     )
 
     shown = False
@@ -1198,23 +1259,36 @@ def cmd_connect(args) -> dict:
 
     # Build the needs_login note from the rolled-up cause + whether a window opened.
     extra = {}
-    if rolled_up_error_type == "keychain_acl_denied":
-        # The user clicked Deny/Cancel on the keychain prompt. Auto-import would
-        # have worked; they just refused keychain access. Tell them the real fix
-        # (re-run and click Allow), and since we DID open a login window for this
-        # case, point at it as the keychain-free fallback.
+    if denied_now:
+        # The user clicked Deny/Cancel on the ONE allowed keychain prompt. That
+        # answer is final (latched above): do NOT tell the caller to re-run the
+        # import — that advice made setup agents loop and re-prompt. Manual
+        # login is the path now, and a login window is already open for it.
         note = (
-            "It looks like you clicked Deny (or Cancel) on the macOS Keychain prompt. "
-            "To import your X session automatically, the autoposter needs to read Chrome's "
-            "\"Safe Storage\" key from your Keychain. Re-run connect_x and click Allow (or "
-            "Always Allow) on that prompt and the import will finish on its own. "
-            "If you'd rather not grant keychain access, there's already a Chrome window open "
-            "at the X login page"
+            "You declined the macOS Keychain prompt, so automatic import is off — "
+            "we only ask once and won't show that prompt again. "
+            "A Chrome window is open at the X login page"
             + ("" if shown else " (look for a 'Google Chrome' window)")
-            + " — just log in there by hand and ask me to re-check. "
+            + " — log in there by hand (username, password, 2FA if asked) and "
+            "ask me to re-check. Do NOT re-run the cookie import. "
             "(Auto-import tried: " + ", ".join(sources) + ".)"
         )
-        extra["remediation"] = "rerun_connect_x_and_click_allow"
+        extra["remediation"] = "use_manual_login"
+        extra["keychain_prompt"] = "declined_latched"
+    elif keychain_declined:
+        # A PREVIOUS run already recorded the Deny/Cancel; this call skipped the
+        # import path entirely (no prompt was shown) and went straight to the
+        # manual-login window.
+        note = (
+            "You previously declined the macOS Keychain prompt, so I skipped the "
+            "automatic import (we only ask once). A Chrome window is open at the "
+            "X login page"
+            + ("" if shown else " (look for a 'Google Chrome' window)")
+            + " — log in there by hand and ask me to re-check. Do NOT re-run "
+            "the cookie import; it will not prompt again."
+        )
+        extra["remediation"] = "use_manual_login"
+        extra["keychain_prompt"] = "declined_latched"
     elif open_login:
         # Manual login: either the caller asked for it (--manual-login) or there
         # was no existing X session anywhere to import, so this is the only path.
@@ -1291,6 +1365,11 @@ def main() -> int:
                         "A human finding the on-screen/VNC window plus password + 2FA "
                         "routinely exceeds 90s, so the wait is generous. Prevents the "
                         "detection race that misreports the handle as missing.")
+    c.add_argument("--retry-keychain-import", action="store_true",
+                   help="Clear the keychain-declined latch so the import path may "
+                        "show the macOS keychain prompt ONE more time. The prompt "
+                        "is once-only by policy; pass this only when the user "
+                        "explicitly asks to retry the automatic import.")
     args = ap.parse_args()
 
     if args.cmd == "detect-sources":

package/scripts/virality.py

@@ -86,7 +86,18 @@ def calculate_reddit_virality_score(thread):
 # S4L_REDDIT_VIRALITY_*) beat these; explicit args beat env.
 _BAR_DEFAULTS = {
     "twitter": {"pctile": 0.99, "min_sample": 200, "hours": 24},
-    "reddit": {"pctile": 0.99, "min_sample": 200, "hours": 24},
+    # Reddit calibration (2026-08-05): discovery volume per install is ~100x
+    # smaller than X (~60 scored/day vs ~9k), so X's 200-in-24h min-sample
+    # left the bar disarmed on all but spike days (observed: armed only
+    # Jul 30-31, ungated 139-post day Aug 2). A 72h window (fine for threads
+    # that stay actionable ~7 days) with min_sample 50 keeps the bar armed at
+    # normal volume while still failing open on genuinely fresh installs.
+    # These platform defaults are the SINGLE source of truth for gate
+    # calibration; the S4L_<PLATFORM>_VIRALITY_* env overrides are debug-only
+    # and must not be set in plists or shipped configs. (The percentile is
+    # governed server-side by installations.posting_mode regardless of the
+    # pctile requested here.)
+    "reddit": {"pctile": 0.99, "min_sample": 50, "hours": 72},
 }
 
 

package/skill/engage-dm-replies.sh

@@ -171,6 +171,19 @@ PENDING_PLAT_ARG=""
 [ -n "$PLATFORM" ] && PENDING_PLAT_ARG="--platform $PLATFORM"
 PENDING_CONVOS=$(python3 "$REPO_DIR/scripts/dm_engage_helper.py" pending $PENDING_PLAT_ARG --limit 30 2>/dev/null || echo "null")
 
+# Phase D scope guard (2026-08-05). The prompt used to tell the model to re-query
+# the queue itself with `dm_conversation.py pending`, which has NO platform
+# filter. A platform-scoped run (reddit fires at :13/:43) would pick up another
+# platform's needs_reply rows in the 1-3 min window before the owning lane
+# (twitter fires at :14) logged its outbound, and both would send: the recipient
+# got two near-duplicate replies and the loser's log-outbound was DEDUP BLOCKED,
+# so the duplicate never appeared in dm_messages (38 duplicate pairs May-Aug
+# 2026, first reported by HireFireTeam on 2026-07-09). Phase D now re-queries
+# through the server-side-scoped helper, and this note pins the boundary inside
+# the prompt itself.
+PHASE_D_SCOPE_NOTE=""
+[ -n "$PLATFORM" ] && PHASE_D_SCOPE_NOTE="HARD PLATFORM BOUNDARY: this run handles platform '$PLATFORM' ONLY. The pending query above is already scoped to it. If a row or query result for any other platform surfaces anyway, SKIP it silently and make no DB change to it: another lane owns that row, and replying from this run sends the recipient a duplicate message."
+
 if [ "$PENDING_CONVOS" = "null" ] || [ -z "$PENDING_CONVOS" ]; then
     log "No conversations needing replies. Checking platforms for new inbound messages..."
 else
@@ -454,10 +467,12 @@ counting (event_id dedup will block it but don't even try).
 2. Find Reddit conversations needing a reply (includes both newly-ingested
    chat rooms and any legacy PMs logged via step 1):
    ```bash
-   cd ~/social-autoposter && python3 scripts/dm_conversation.py pending
+   cd ~/social-autoposter && python3 scripts/dm_engage_helper.py pending --platform reddit --limit 30
    ```
-   Scope to Reddit when needed via their_author + platform columns. This is
-   the authoritative list; don't reconstruct it from sidebar scrapes.
+   This list is server-side scoped to Reddit; rows for other platforms never
+   belong to this phase (do NOT use the cross-platform `dm_conversation.py
+   pending` here). This is the authoritative list; don't reconstruct it from
+   sidebar scrapes.
 
 3. For each Reddit PM/comment-reply surfaced by step 1 that isn't already in
    dms, create a row and log the inbound (chat rooms already have rows from
@@ -660,10 +675,12 @@ $PHASE_C_BLOCK
 
 ## PHASE D: Reply to all conversations with pending inbound messages
 
-After scanning, query for all conversations needing replies:
+After scanning, query for conversations needing replies (server-side scoped to this run's platform):
 \`\`\`bash
-cd ~/social-autoposter && python3 scripts/dm_conversation.py pending
+cd ~/social-autoposter && python3 scripts/dm_engage_helper.py pending $PENDING_PLAT_ARG --limit 30
 \`\`\`
+Do NOT use \`dm_conversation.py pending\` or hit /api/v1/dms/pending directly: both are cross-platform and will show you rows that belong to other lanes.
+$PHASE_D_SCOPE_NOTE
 
 Known conversations from the database that already need replies:
 $PENDING_CONVOS