@m13v/s4l 1.7.8-rc.3 → 1.7.9-rc.1

package/mcp/dist/index.js

@@ -333,7 +333,8 @@ const server = new McpServer({
         "anything; X is a reasonable default to SUGGEST, but do not connect it, or any platform, without " +
         "the user's answer. Connect exactly what they choose via project_config action:'connect_x' " +
         "and/or action:'connect_reddit'), AND " +
-        "the two draft-autopilot scheduled tasks have been created via queue_setup and are firing " +
+        "the draft autopilot has been armed via queue_setup (on Claude hosts that means its scheduled " +
+        "tasks are created and firing; on this app's host queue_setup alone completes it) " +
         "(see SCHEDULE THE AUTOPILOT below). The owned runtime (private Python + Chromium) provisions " +
         "ITSELF automatically on boot — you do NOT install it. Just poll runtime action:'status' until it " +
         "reports ready; only call runtime action:'install' or action:'doctor' to TROUBLESHOOT if status " +
@@ -350,8 +351,8 @@ const server = new McpServer({
         "DO schedule the draft autopilot as the final step (once running it only queues drafts for " +
         "approval, it never posts on its own). When setup reaches done (" +
         "runtime ready, a project configured with seeded topics, at least one platform connected, and the " +
-        "two scheduled tasks " +
-        "created and firing), call the `dashboard` tool so the user " +
+        "draft autopilot " +
+        "armed via queue_setup), call the `dashboard` tool so the user " +
         "sees the finished setup rendered, then give " +
         "the completion summary.\n\n" +
         "SCHEDULE THE AUTOPILOT (final onboarding step). There is ONE drafting pipeline: a launchd " +
@@ -360,18 +361,24 @@ const server = new McpServer({
         "menu-bar approval cards. Drafting is the queue + worker path, fired automatically by a launchd " +
         "kicker this server installs (every few minutes) — it runs on its own once the tasks exist; " +
         "onboarding does NOT need to wait for or verify a draft. Steps, in order: " +
-        "(1) call `queue_setup` — it pre-writes the worker task prompt and returns the task spec " +
-        "(s4l-worker, the universal queue worker); " +
-        "(2) for EACH returned spec, call the HOST tool `create_scheduled_task` with its taskId, cronExpression, " +
-        "prompt, and notifyOnCompletion VERBATIM — notifyOnCompletion MUST be false, or the per-minute worker " +
-        "pops a 'no jobs' notification every run (if it says the task already exists, that's fine — do not " +
-        "recreate, but DO call `update_scheduled_task` with the same taskId and notifyOnCompletion:false to " +
-        "silence an older install's per-run notifications, then move on); " +
-        "(3) the launchd kicker + scheduled tasks now run the pipeline on their own — call the `dashboard` " +
-        "tool to confirm the schedule is firing (schedule_state 'ok'), then summarize. Do NOT create the " +
-        "old 'social-autoposter-autopilot' task — it is deprecated. Do NOT ask the user to review drafts " +
-        "or pause for input mid-onboarding; once the tasks are created and firing, setup is done. If the " +
-        "host exposes no create_scheduled_task tool, tell the user the autopilot couldn't be scheduled here.\n\n" +
+        (s4lHost() === "codex"
+            ? "(1) call `queue_setup` once — on THIS host it arms the autopilot by itself (drafting runs " +
+                "inline through this app's engine) and returns no tasks; do NOT create any scheduled task or " +
+                "automation; (2) call the `dashboard` tool to confirm schedule_state 'ok', then summarize. " +
+                "Do NOT ask the user to review drafts or pause for input mid-onboarding; once queue_setup " +
+                "returns and the dashboard reads ok, setup is done.\n\n"
+            : "(1) call `queue_setup` — it pre-writes the worker task prompt and returns the task spec " +
+                "(s4l-worker, the universal queue worker); " +
+                "(2) for EACH returned spec, call the HOST tool `create_scheduled_task` with its taskId, cronExpression, " +
+                "prompt, and notifyOnCompletion VERBATIM — notifyOnCompletion MUST be false, or the per-minute worker " +
+                "pops a 'no jobs' notification every run (if it says the task already exists, that's fine — do not " +
+                "recreate, but DO call `update_scheduled_task` with the same taskId and notifyOnCompletion:false to " +
+                "silence an older install's per-run notifications, then move on); " +
+                "(3) the launchd kicker + scheduled tasks now run the pipeline on their own — call the `dashboard` " +
+                "tool to confirm the schedule is firing (schedule_state 'ok'), then summarize. Do NOT create the " +
+                "old 'social-autoposter-autopilot' task — it is deprecated. Do NOT ask the user to review drafts " +
+                "or pause for input mid-onboarding; once the tasks are created and firing, setup is done. If the " +
+                "host exposes no create_scheduled_task tool, tell the user the autopilot couldn't be scheduled here.\n\n") +
         "REDDIT IS AN EQUAL PLATFORM CHOICE, ASKED ALONGSIDE X. Setup is complete with AT LEAST ONE " +
         "platform connected: X-only, Reddit-only, or both — whichever the user picked when you asked " +
         "up front. If they chose both, connect them one at a time (either order) in the same setup " +
@@ -2141,12 +2148,9 @@ tool("engagement_mode", {
         : (personaQueryCount > 0
             ? `Personal-brand lane is on (the default); the persona is provisioned, topic-seeded, and ${personaQueryCount} search quer${personaQueryCount === 1 ? "y" : "ies"} seeded, so there `
             : "Personal-brand lane is on (the default); the persona is provisioned + topic-seeded (but NO search_queries were supplied, so it will run one topic-as-query at a time — re-call engagement_mode action:'set' with a search_queries array of ~30 X search strings expanded from the persona topics to fan out). There ") +
-            "is nothing more to configure (no product project is needed). NOW SCHEDULE THE AUTOPILOT: call " +
-            "queue_setup and create each returned task with create_scheduled_task (prompt and " +
-            "notifyOnCompletion verbatim — notifyOnCompletion must be false; 'already exists' is fine, but then " +
-            "call update_scheduled_task with notifyOnCompletion:false to silence per-run notifications), " +
-            "then call the dashboard tool to confirm the schedule is firing. " +
-            "That is the final setup step — do NOT stop before the autopilot is scheduled.";
+            "is nothing more to configure (no product project is needed). NOW SCHEDULE THE AUTOPILOT: " +
+            scheduleAutopilotSteps() + ". " +
+            "That is the final setup step — do NOT stop before the autopilot is armed.";
     return jsonContent({
         ok: true,
         flags: { personal_brand: personalBrand, promotion },
@@ -2718,7 +2722,7 @@ tool("project_config", {
                         ? (anyPlatform
                             ? "All configured projects are ready and a platform is connected" +
                                 (xConnected ? "" : " (Reddit; X was skipped, which is fine)") +
-                                ". SCHEDULE THE AUTOPILOT: (1) call queue_setup and create each returned task with create_scheduled_task (prompt and notifyOnCompletion verbatim — notifyOnCompletion must be false; 'already exists' is fine, but then call update_scheduled_task with notifyOnCompletion:false to silence per-run notifications); (2) the autopilot then runs on its own (launchd kicker + queue worker). Call the `dashboard` tool to confirm the schedule is firing (schedule_state 'ok') — that is the terminal step; do NOT wait for or verify a draft card. Do NOT pause to ask the user to review drafts."
+                                ". SCHEDULE THE AUTOPILOT: " + scheduleAutopilotSteps() + " — that is the terminal step; do NOT wait for or verify a draft card. Do NOT pause to ask the user to review drafts."
                             : "All configured projects are ready, but NO platform is connected yet; posting needs a logged-in session. X is the default: detect sources and run project_config action:'connect_x', confirm:true; do not ask whether to proceed. If the user prefers Reddit or X can't be connected, run action:'connect_reddit' instead; ONE connected platform completes setup.")
                         : "Some projects are missing required fields (see each project's missing_required). Derive them from config, context, profile_scan, and website research, then call project_config again. Ask only if a required field is genuinely unknowable." +
                             (anyPlatform ? "" : " No platform is connected yet either; X is the default (connect_x with confirm:true), or connect_reddit if the user prefers Reddit."),
@@ -2850,11 +2854,9 @@ tool("project_config", {
                 : result.ready
                     ? `Project '${result.project}' is fully configured.${seedNote} Next: if X is not connected, ` +
                         `detect sources, warn about keychain prompts, and call project_config with ` +
-                        `action:'connect_x', confirm:true immediately. Once X is connected, schedule the autopilot ` +
-                        `(queue_setup + create_scheduled_task per task, passing each spec's fields verbatim including ` +
-                        `notifyOnCompletion:false); the autopilot then drafts on its own. Call the ` +
-                        `dashboard to confirm the schedule is firing (schedule_state 'ok') — that is the final step, ` +
-                        `no need to wait for or verify a draft card.`
+                        `action:'connect_x', confirm:true immediately. Once X is connected, schedule the autopilot: ` +
+                        scheduleAutopilotSteps() +
+                        ` — that is the final step, no need to wait for or verify a draft card.`
                     : `Saved what you provided for '${result.project}'. Still need: ${result.missing_required.join(", ")}. ` +
                         `First derive those fields from existing context, profile_scan, and website research, then ` +
                         `call project_config again with name='${result.project}'. Ask only if a required field is genuinely unknowable.`) +
@@ -3607,6 +3609,21 @@ function runtimeSnapshot() {
 function s4lHost() {
     return (process.env.S4L_HOST || "").trim().toLowerCase() === "codex" ? "codex" : "claude";
 }
+// Host-aware "schedule the autopilot" step text, shared by every onboarding
+// guidance string. Codex/ChatGPT hosts have no create_scheduled_task tool and
+// need none: queue_setup alone arms the autopilot there (drafting runs inline
+// through the app's engine). Hoisted function so module-level instruction
+// strings can call it during load.
+function scheduleAutopilotSteps() {
+    return s4lHost() === "codex"
+        ? "call queue_setup once — on this host it arms the draft autopilot by itself (drafting runs " +
+            "inline through this app's engine) and returns NO tasks; do NOT create any scheduled task or " +
+            "automation — then call the dashboard tool to confirm schedule_state 'ok'"
+        : "call queue_setup and create each returned task with create_scheduled_task (prompt and " +
+            "notifyOnCompletion verbatim — notifyOnCompletion must be false; 'already exists' is fine, but then " +
+            "call update_scheduled_task with notifyOnCompletion:false to silence per-run notifications), " +
+            "then call the dashboard tool to confirm the schedule is firing (schedule_state 'ok')";
+}
 // Stamp <state_dir>/draft-provider.json, the single source of truth read at the
 // run_claude.sh seam (scripts/draft_provider.py / claude_job.py) for which
 // engine answers the pipeline's pure text->JSON drafting turns. Last setup
@@ -3619,14 +3636,27 @@ function writeDraftProvider(provider, setBy) {
     console.error(`[draft-provider] ${provider} (${setBy})`);
 }
 tool("queue_setup", {
-    title: "Get autopilot scheduled-task specs",
-    description: "Returns the scheduled task that runs the hands-free draft autopilot on this machine " +
-        "(s4l-worker, the universal queue worker). For EACH returned task, call the host tool " +
-        "create_scheduled_task with its taskId, cronExpression, prompt, and notifyOnCompletion " +
-        "VERBATIM (do not edit the prompt — it contains exact local paths; notifyOnCompletion MUST be " +
-        "false or the per-minute worker spams a notification every run). The task drains the local job queue that the " +
-        "real pipeline feeds (all job types); the pipeline itself is kicked by launchd jobs this server " +
-        "installs. Use this as the final onboarding step instead of the old per-type worker tasks.",
+    // Title/description are host-aware (2026-08-06): an agent reads the tool
+    // description FIRST, so it must tell the truth for the host it's on.
+    // Historic name kept for fleet compatibility; conceptually this tool is
+    // "arm the drafting engine" — Claude hosts get queue-worker task specs,
+    // Codex/ChatGPT hosts get the provider stamped with nothing to schedule.
+    title: s4lHost() === "codex"
+        ? "Arm the draft autopilot"
+        : "Get autopilot scheduled-task specs",
+    description: s4lHost() === "codex"
+        ? "Arms the hands-free draft autopilot on this machine. On this host there is NOTHING to " +
+            "schedule: drafting runs inline through this app's engine, so ONE call completes autopilot " +
+            "setup (it records the draft engine choice and returns no tasks). Do NOT create any " +
+            "scheduled task or automation. The pipeline itself is kicked by launchd jobs this server " +
+            "installs. Use this as the final onboarding step."
+        : "Returns the scheduled task that runs the hands-free draft autopilot on this machine " +
+            "(s4l-worker, the universal queue worker). For EACH returned task, call the host tool " +
+            "create_scheduled_task with its taskId, cronExpression, prompt, and notifyOnCompletion " +
+            "VERBATIM (do not edit the prompt — it contains exact local paths; notifyOnCompletion MUST be " +
+            "false or the per-minute worker spams a notification every run). The task drains the local job queue that the " +
+            "real pipeline feeds (all job types); the pipeline itself is kicked by launchd jobs this server " +
+            "installs. Use this as the final onboarding step instead of the old per-type worker tasks.",
     inputSchema: {},
 }, async () => {
     // Codex/ChatGPT host: there is no scheduled-task worker at all. Drafting
@@ -5200,6 +5230,23 @@ function startLocalPanel() {
             const port = typeof addr === "object" && addr ? addr.port : 0;
             localPanel = { url: `http://127.0.0.1:${port}/`, server: srv };
             writePanelUrl(localPanel.url);
+            // Periodic reclaim (2026-08-06, Codex port): on ChatGPT/Codex hosts the
+            // app spawns a server per chat session and can kill it without the clean
+            // relinquish (SIGKILL leaves panel-endpoint.json pointing at a dead pid).
+            // Long-lived instances (the launchd keepalive server, a Desktop-hosted
+            // one) re-run writePanelUrl on a slow tick: it cedes to any LIVE
+            // registrant and only takes over dead/absent entries, so the shared file
+            // self-heals within minutes instead of stranding menu-bar approvals.
+            const reclaim = setInterval(() => {
+                try {
+                    if (localPanel)
+                        writePanelUrl(localPanel.url);
+                }
+                catch {
+                    /* best-effort */
+                }
+            }, 120_000);
+            reclaim.unref?.();
             resolve(localPanel.url);
         });
     });

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.8-rc.3",
-  "installedAt": "2026-08-07T01:38:53.876Z"
+  "version": "1.7.9-rc.1",
+  "installedAt": "2026-08-07T20:23:25.293Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.8-rc.3",
+  "version": "1.7.9-rc.1",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {
@@ -72,10 +72,6 @@
       "name": "client_event",
       "description": "Log a lightweight client UI event"
     },
-    {
-      "name": "queue_setup",
-      "description": "Get autopilot scheduled-task specs"
-    },
     {
       "name": "dashboard",
       "description": "S4L dashboard"

package/mcp/menubar/s4l_browser_foreground.py

@@ -157,12 +157,16 @@ class _Worker(threading.Thread):
         # focus back to the app the user was in. Screenshots/clicks are
         # unaffected (CDP is offscreen-raster + synthetic input; the occlusion
         # flags keep hidden tabs painting).
-        # DEFAULT OFF (user decision 2026-07-30): only the telemetry above runs
-        # unless S4L_HARNESS_HIDE=1 opts in. S4L_NO_HARNESS_HIDE force-disables
-        # even when the opt-in is set.
+        # DEFAULT ON (user decision 2026-08-07, reverses the 2026-07-30 default-off
+        # call): the guard hides an offscreen harness that steals the foreground
+        # unless explicitly opted out. Two knobs, by design:
+        #   S4L_NO_HARNESS_HIDE  -> HARD override, force off, checked FIRST so it
+        #       always wins (this is the one-time interactive-login escape hatch).
+        #   S4L_HARNESS_HIDE=0   -> SOFT opt-out for a machine that wants it off.
+        # Unset or any non-"0" value => hide is active (the new default).
         if os.environ.get("S4L_NO_HARNESS_HIDE"):
             return
-        if os.environ.get("S4L_HARNESS_HIDE") != "1":
+        if os.environ.get("S4L_HARNESS_HIDE", "1") == "0":
             return
         pos = details.get("window_position") or ""
         try:

package/mcp/menubar/s4l_menubar.py

@@ -1749,7 +1749,7 @@ class S4LMenuBar(rumps.App):
             self._spin_i = 0
             self._spinner = rumps.Timer(self._spin, 0.12)
             self._spinner.start()
-        self._notify("S4L", "Updating… Claude will restart in a moment.")
+        self._notify("S4L", f"Updating… {self._update_host_word()} will restart in a moment.")
         threading.Thread(target=self._mcpb_update_work, daemon=True).start()
         self._tick(None)
 
@@ -1783,6 +1783,45 @@ class S4LMenuBar(rumps.App):
             pass
         return dirs
 
+    # ---- install-flavor detection (2026-08-06, Codex/ChatGPT port) ---------
+    # A box can carry either or both server installs: the Claude Desktop
+    # extension dir (.mcpb double-click / npm lanes) and the host-neutral
+    # bundle at <state>/app (curl-lane install for the ChatGPT/Codex app).
+    # The updater refreshes every install that exists and restarts only the
+    # host apps that correspond to them.
+    def _has_claude_ext(self):
+        return os.path.isdir(self._ext_dir())
+
+    @staticmethod
+    def _app_bundle_dir():
+        return os.path.join(st.state_dir(), "app")
+
+    def _has_app_bundle(self):
+        return os.path.isfile(os.path.join(self._app_bundle_dir(), "dist", "index.js"))
+
+    def _update_host_word(self):
+        """Which host app the update flow will restart, for user-facing copy."""
+        return "Claude Desktop" if self._has_claude_ext() else "ChatGPT"
+
+    @staticmethod
+    def _chatgpt_running():
+        try:
+            return subprocess.run(["pgrep", "-x", "ChatGPT"],
+                                  capture_output=True, timeout=10).returncode == 0
+        except Exception:
+            return False
+
+    def _restart_chatgpt_if_running(self):
+        """Bounce the ChatGPT app so its next MCP spawn runs the refreshed
+        bundle. Only when it was already running: if it's closed there is
+        nothing stale to replace (codex exec and the next app launch pick up
+        the new files on their own)."""
+        if not self._chatgpt_running():
+            return
+        subprocess.run(["killall", "ChatGPT"], capture_output=True)
+        time.sleep(3)
+        subprocess.run(["open", "-a", "ChatGPT"], capture_output=True, timeout=20)
+
     @staticmethod
     def _claude_running():
         """True while a Claude Desktop main process is alive. pgrep -x matches
@@ -1862,13 +1901,26 @@ class S4LMenuBar(rumps.App):
                 self._sig = None
                 self._notify("S4L update failed", "Couldn't download the update — check your connection.")
                 return
-            r = subprocess.run(["unzip", "-oq", mcpb, "-d", self._ext_dir()],
-                               capture_output=True, timeout=180)
-            if r.returncode != 0:
-                self._updating_mcpb = False
-                self._sig = None
-                self._notify("S4L update failed", "Couldn't unpack the update.")
-                return
+            # Refresh every install flavor present on this box (Claude
+            # extension dir, ChatGPT/Codex app bundle, or both). Unzipping
+            # into a flavor that isn't installed would fabricate a stray
+            # install, so target only what exists; a box with neither keeps
+            # the legacy behavior (ext dir) as the recovery path.
+            has_ext = self._has_claude_ext()
+            has_app = self._has_app_bundle()
+            targets = [d for d, ok in ((self._ext_dir(), has_ext),
+                                       (self._app_bundle_dir(), has_app)) if ok]
+            if not targets:
+                targets = [self._ext_dir()]
+                has_ext = True
+            for tdir in targets:
+                r = subprocess.run(["unzip", "-oq", mcpb, "-d", tdir],
+                                   capture_output=True, timeout=180)
+                if r.returncode != 0:
+                    self._updating_mcpb = False
+                    self._sig = None
+                    self._notify("S4L update failed", "Couldn't unpack the update.")
+                    return
             # Record what we just installed so the tick loop can verify the
             # EFFECTIVE version actually advanced after the restart. The old
             # flow claimed success unconditionally, which lied on boxes whose
@@ -1876,7 +1928,7 @@ class S4LMenuBar(rumps.App):
             # extension dir updated but the running install stayed old.
             target = ""
             try:
-                with open(os.path.join(self._ext_dir(), "manifest.json")) as f:
+                with open(os.path.join(targets[0], "manifest.json")) as f:
                     target = str((json.load(f) or {}).get("version") or "")
             except Exception:
                 target = ""
@@ -1886,36 +1938,42 @@ class S4LMenuBar(rumps.App):
                         json.dump({"target": target, "started_at": time.time()}, f)
                 except Exception:
                     pass
-            # Restart Claude so the refreshed server loads (we're decoupled from it).
-            self._quit_claude_and_wait()
-            # Claude is fully down now — relocate the autopilot scheduled tasks'
-            # cwd so their once-a-minute runs stop flooding the user's interactive
-            # `claude --resume` history. MUST happen while Claude is down (it caches
-            # the registry in memory and clobbers live edits). See queueWorkerCwd()
-            # in mcp/src/index.ts and the same routine in scripts/s4l_box_update.sh.
-            # _fresh (not the in-process call): this is a mid-update self-heal,
-            # so it must run the code that was JUST downloaded, not whatever
-            # this already-running (about to be replaced) process imported at
-            # ITS OWN startup — see _rewrite_scheduled_task_cwd_fresh's docstring.
-            self._rewrite_scheduled_task_cwd_fresh()
+            # Restart whichever host apps correspond to the refreshed installs
+            # (we're decoupled from both).
+            if has_ext:
+                self._quit_claude_and_wait()
+                # Claude is fully down now — relocate the autopilot scheduled tasks'
+                # cwd so their once-a-minute runs stop flooding the user's interactive
+                # `claude --resume` history. MUST happen while Claude is down (it caches
+                # the registry in memory and clobbers live edits). See queueWorkerCwd()
+                # in mcp/src/index.ts and the same routine in scripts/s4l_box_update.sh.
+                # _fresh (not the in-process call): this is a mid-update self-heal,
+                # so it must run the code that was JUST downloaded, not whatever
+                # this already-running (about to be replaced) process imported at
+                # ITS OWN startup — see _rewrite_scheduled_task_cwd_fresh's docstring.
+                self._rewrite_scheduled_task_cwd_fresh()
             if target:
                 # The graceful quit can eat minutes; restart the verify clock
-                # now that Claude is actually down so UPDATE_VERIFY_GRACE_SEC
+                # now that the host is actually down so UPDATE_VERIFY_GRACE_SEC
                 # measures server boot, not app teardown.
                 try:
                     with open(self._update_verify_path(), "w") as f:
                         json.dump({"target": target, "started_at": time.time()}, f)
                 except Exception:
                     pass
-            self._relaunch_claude(user_data_dirs)
+            if has_ext:
+                self._relaunch_claude(user_data_dirs)
+            if has_app:
+                self._restart_chatgpt_if_running()
             self._update_available = False
             self._sig = None
+            host_word = "Claude" if has_ext else "ChatGPT"
             if target:
                 # Honest phrasing: the verdict (success OR the real blocker)
                 # comes from _check_update_verdict once the new server settles.
-                self._notify("S4L update", f"v{target} installed; Claude is restarting. I'll confirm once it's live.")
+                self._notify("S4L update", f"v{target} installed; {host_word} is restarting. I'll confirm once it's live.")
             else:
-                self._notify("S4L updated", "Claude restarted on the latest version.")
+                self._notify("S4L updated", f"{host_word} restarted on the latest version.")
         except Exception as e:
             self._updating_mcpb = False
             self._sig = None
@@ -4267,7 +4325,7 @@ class S4LMenuBar(rumps.App):
             items.append(self._label(f"⬆ Update available · v{self._latest_version}"))
             items.append(
                 rumps.MenuItem(
-                    "Update now & restart Claude Desktop",
+                    f"Update now & restart {self._update_host_word()}",
                     callback=self._do_mcpb_update,
                 )
             )

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.8-rc.3",
+  "version": "1.7.9-rc.1",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.8-rc.3",
+  "version": "1.7.9-rc.1",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/claude_job.py

@@ -1,8 +1,27 @@
 #!/usr/bin/env python3
 """
-claude_job.py — queue-backed substitute for `claude -p` for the pipeline's
-pure text->JSON turns, on every machine (operator Macs and customer .mcpb
-boxes alike).
+claude_job.py — THE DRAFT-ENGINE SEAM: every pure text->JSON drafting turn in
+the pipeline lands here, and <state_dir>/draft-provider.json decides which
+engine answers it (see scripts/draft_provider.py; design + verified facts in
+docs/codex-port-design.md):
+
+  claude-desktop-queue  (default) enqueue to a file queue drained by the
+                        Claude Desktop s4l-worker scheduled task — the
+                        original design, and the only option when Claude
+                        Desktop is the box's sole authenticated engine.
+  claude-p              answer inline via the real `claude -p` (_run_claude_p;
+                        schema INLINED — the CLI parses --json-schema as JSON,
+                        a file path breaks it).
+  codex-exec            answer inline via the ChatGPT-app-bundled `codex exec`
+                        (_run_codex_exec; gpt-5.6-sol default, schema rides
+                        the prompt — OpenAI strict schema mode rejects our
+                        lenient schemas).
+
+All three return byte-identical claude `--output-format json` envelopes and
+the same 0/1/79 exit semantics, so callers can't tell them apart. The queue
+machinery below (next/result, worker notes, heartbeats) only runs for the
+default provider; the inline providers skip it entirely, which also means no
+warm-session leaks and no app-open requirement on those paths.
 
 The deterministic pipeline never calls `claude` directly; every invocation goes
 through scripts/run_claude.sh. For script tags mapped in TAG_TO_TYPE below,
@@ -461,19 +480,22 @@ def _bump_drain_timeout() -> None:
 
 
 # --------------------------------------------------------------------------- #
-# Opt-in worker self-reap (2026-06-27)                                         #
+# Worker self-reap (2026-06-27; DEFAULT ON since 2026-07-04 / v1.6.202)        #
 # --------------------------------------------------------------------------- #
 # A scheduled-task worker turn finishes its one queue iteration but Claude
 # Desktop keeps the agent-mode `claude` process warm (`--input-format
 # stream-json`), so finished workers pile up and leak RAM. The launchd reaper
-# (reap_stale_claude_sessions.py) is the GUARANTEE that bounds this. This opt-in
+# (reap_stale_claude_sessions.py) is the GUARANTEE that bounds this. This
 # path is a faster, source-side trim: once THIS worker is provably done (no work
 # to do, or its result is already on disk), terminate OUR OWN session so it never
-# becomes part of the standing pool. Strictly off unless S4L_WORKER_SELF_REAP is
-# set, so it ships dormant and cannot destabilize the default behaviour.
+# becomes part of the standing pool. It shipped opt-in (dormant unless
+# S4L_WORKER_SELF_REAP was set), which meant it ran nowhere; when Desktop
+# 1.18286.0 changed the cmdline shape the signature-fragile reaper missed too
+# and boxes leaked (Karol, 53 piled workers). Since 2026-07-04 it is ON by
+# default; opt OUT with S4L_WORKER_SELF_REAP=0 (see _self_reap_enabled).
 #
 # Safety properties:
-#   * No-op unless the env flag is set.
+#   * Respects the env kill switch (S4L_WORKER_SELF_REAP=0 disables it).
 #   * Only ever targets a process in OUR OWN ancestry that matches the reaper's
 #     worker signature (claude-code agent-mode session). The producer side
 #     (run-twitter-cycle.sh -> python) has no such ancestor, so a misplaced call
@@ -875,6 +897,50 @@ def _run_codex_exec(ns, qtype: str, prompt: str, schema_text: str | None) -> int
         _disarm_deathwatch(job_id)
 
 
+def _run_claude_p(ns, qtype: str, prompt: str, schema_text: str | None) -> int:
+    """claude-p provider: answer the turn inline via the real `claude -p`
+    (Claude Code CLI, subscription-authenticated). No queue, no worker, no
+    Desktop-app requirement. stdout passes through untouched: it IS the
+    claude json envelope the callers parse. Key transform vs the caller's
+    original argv: the schema goes INLINE (the CLI parses the --json-schema
+    value as JSON; a file path 400s), and the prompt rides stdin so huge
+    drafting prompts never hit ARG_MAX."""
+    batch = (os.environ.get("BATCH_ID") or os.environ.get("SA_CYCLE_ID") or "-").strip() or "-"
+    job_id = uuid.uuid4().hex
+    _arm_deathwatch(job_id, qtype, batch)
+    _act_write(qtype)
+    cmd = ["claude", "-p", "--output-format", "json"]
+    if schema_text:
+        cmd += ["--json-schema", schema_text]
+    budget = max(60, ns.timeout - 60)
+    _plog(f"claude-p start {qtype} job {job_id} batch={batch} timeout={budget}s")
+    started = time.time()
+    try:
+        proc = subprocess.run(cmd, input=prompt, capture_output=True, text=True, timeout=budget)
+    except subprocess.TimeoutExpired:
+        _act_clear()
+        _plog(f"claude-p timed out after {budget}s on job {job_id} ({qtype})")
+        _disarm_deathwatch(job_id)
+        return 79
+    except FileNotFoundError:
+        _act_clear()
+        _plog(f"claude-p provider active but no `claude` CLI on PATH; failing {qtype}")
+        _disarm_deathwatch(job_id)
+        return 1
+    sys.stdout.write(proc.stdout or "")
+    sys.stdout.flush()
+    if proc.returncode == 0 and '"subtype":"success"' in (proc.stdout or ""):
+        _mark_drain_success()
+        _stamp_heartbeat("claude-p", qtype)
+        _plog(f"claude-p done job {job_id} batch={batch} ({qtype}) in {int(time.time() - started)}s")
+    else:
+        _act_clear()
+        tail = (proc.stderr or "").strip()[-300:]
+        _plog(f"claude-p rc={proc.returncode} on job {job_id} ({qtype}); stderr tail: {tail}")
+    _disarm_deathwatch(job_id)
+    return proc.returncode
+
+
 def cmd_provider(ns) -> int:
     _apply_state_dir_override(ns)
     qtype = TAG_TO_TYPE.get(ns.tag)
@@ -926,10 +992,13 @@ def cmd_provider(ns) -> int:
         _plog(f"S4L paused; refusing to enqueue {qtype} job")
         return 1
 
-    # Provider branch (2026-08-06). codex-exec answers inline; claude-p never
-    # reaches here (eligible already said no); anything else is the queue.
-    if draft_provider.get() == "codex-exec":
+    # Provider branch (2026-08-06). codex-exec and claude-p answer inline;
+    # anything else is the queue (the Claude Desktop worker default).
+    _prov = draft_provider.get()
+    if _prov == "codex-exec":
         return _run_codex_exec(ns, qtype, prompt, schema_text)
+    if _prov == "claude-p":
+        return _run_claude_p(ns, qtype, prompt, schema_text)
 
     job_id = uuid.uuid4().hex
     created = time.time()
@@ -1384,16 +1453,14 @@ def cmd_eligible(ns: argparse.Namespace) -> int:
     """Routing probe for run_claude.sh: exit 0 when the tag is queue-mapped,
     1 otherwise. TAG_TO_TYPE is the single routing truth — no env var.
 
-    Provider layer (2026-08-06): when the box's draft provider is `claude-p`,
-    every tag reports NOT eligible, so run_claude.sh's existing fall-through
-    runs the real `claude -p` directly. That IS the claude-p implementation:
-    zero new execution paths, the locked wrapper stays untouched.
+    Provider selection happens INSIDE cmd_provider (codex-exec and claude-p
+    both run inline there); eligible stays a pure tag probe. A fall-through
+    design for claude-p was tried and reverted same-day 2026-08-06: pipeline
+    callers pass --json-schema as a FILE PATH, and the real `claude` CLI
+    parses that value as inline JSON, so the fall-through broke on every
+    schema'd tag. The inline runner rewrites the schema to inline form.
     """
-    if ns.tag not in TAG_TO_TYPE:
-        return 1
-    if draft_provider.get() == "claude-p":
-        return 1
-    return 0
+    return 0 if ns.tag in TAG_TO_TYPE else 1
 
 
 def main() -> int:

package/scripts/install.sh

@@ -107,6 +107,41 @@ os.replace(tmp, p)
 PY
 log "draft provider: $PROVIDER"
 
+# 5. Persistent server (codex-flavor boxes only). Claude Desktop keeps the MCP
+# server process alive while the app runs, so the menu bar always has a live
+# loopback to POST approvals to. The ChatGPT app spawns servers per chat and
+# kills them after, which would strand menu-bar approvals between sessions.
+# A KeepAlive LaunchAgent holds one server up; stdin is held open by tail
+# because the stdio MCP transport exits on stdin EOF.
+if [ "$PROVIDER" = "codex-exec" ]; then
+  PLIST="$HOME/Library/LaunchAgents/com.m13v.s4l-server.plist"
+  mkdir -p "$HOME/Library/LaunchAgents" "$STATE_DIR/logs"
+  cat > "$PLIST" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.m13v.s4l-server</string>
+  <key>ProgramArguments</key><array>
+    <string>/bin/bash</string><string>-c</string>
+    <string>tail -f /dev/null | exec "$NODE" "$SERVER"</string>
+  </array>
+  <key>EnvironmentVariables</key><dict>
+    <key>S4L_HOST</key><string>codex</string>
+    <key>S4L_STATE_DIR</key><string>$STATE_DIR</string>
+    <key>PATH</key><string>$SAFE_PATH</string>
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>$STATE_DIR/logs/s4l-server.log</string>
+  <key>StandardErrorPath</key><string>$STATE_DIR/logs/s4l-server.err.log</string>
+</dict></plist>
+EOF
+  launchctl bootout "gui/$(id -u)/com.m13v.s4l-server" 2>/dev/null || true
+  launchctl bootstrap "gui/$(id -u)" "$PLIST" 2>/dev/null \
+    && log "persistent server LaunchAgent loaded (com.m13v.s4l-server)" \
+    || log "WARN: could not load com.m13v.s4l-server; menu-bar approvals need the ChatGPT app open"
+fi
+
 log "done."
 echo
 echo "Next steps:"