@m13v/s4l 1.7.8 → 1.7.9-rc.2

package/mcp/dist/index.js

@@ -3636,14 +3636,27 @@ function writeDraftProvider(provider, setBy) {
     console.error(`[draft-provider] ${provider} (${setBy})`);
 }
 tool("queue_setup", {
-    title: "Get autopilot scheduled-task specs",
-    description: "Returns the scheduled task that runs the hands-free draft autopilot on this machine " +
-        "(s4l-worker, the universal queue worker). For EACH returned task, call the host tool " +
-        "create_scheduled_task with its taskId, cronExpression, prompt, and notifyOnCompletion " +
-        "VERBATIM (do not edit the prompt — it contains exact local paths; notifyOnCompletion MUST be " +
-        "false or the per-minute worker spams a notification every run). The task drains the local job queue that the " +
-        "real pipeline feeds (all job types); the pipeline itself is kicked by launchd jobs this server " +
-        "installs. Use this as the final onboarding step instead of the old per-type worker tasks.",
+    // Title/description are host-aware (2026-08-06): an agent reads the tool
+    // description FIRST, so it must tell the truth for the host it's on.
+    // Historic name kept for fleet compatibility; conceptually this tool is
+    // "arm the drafting engine" — Claude hosts get queue-worker task specs,
+    // Codex/ChatGPT hosts get the provider stamped with nothing to schedule.
+    title: s4lHost() === "codex"
+        ? "Arm the draft autopilot"
+        : "Get autopilot scheduled-task specs",
+    description: s4lHost() === "codex"
+        ? "Arms the hands-free draft autopilot on this machine. On this host there is NOTHING to " +
+            "schedule: drafting runs inline through this app's engine, so ONE call completes autopilot " +
+            "setup (it records the draft engine choice and returns no tasks). Do NOT create any " +
+            "scheduled task or automation. The pipeline itself is kicked by launchd jobs this server " +
+            "installs. Use this as the final onboarding step."
+        : "Returns the scheduled task that runs the hands-free draft autopilot on this machine " +
+            "(s4l-worker, the universal queue worker). For EACH returned task, call the host tool " +
+            "create_scheduled_task with its taskId, cronExpression, prompt, and notifyOnCompletion " +
+            "VERBATIM (do not edit the prompt — it contains exact local paths; notifyOnCompletion MUST be " +
+            "false or the per-minute worker spams a notification every run). The task drains the local job queue that the " +
+            "real pipeline feeds (all job types); the pipeline itself is kicked by launchd jobs this server " +
+            "installs. Use this as the final onboarding step instead of the old per-type worker tasks.",
     inputSchema: {},
 }, async () => {
     // Codex/ChatGPT host: there is no scheduled-task worker at all. Drafting

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.8",
-  "installedAt": "2026-08-07T17:57:02.547Z"
+  "version": "1.7.9-rc.2",
+  "installedAt": "2026-08-09T00:22:23.419Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.8",
+  "version": "1.7.9-rc.2",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {
@@ -72,10 +72,6 @@
       "name": "client_event",
       "description": "Log a lightweight client UI event"
     },
-    {
-      "name": "queue_setup",
-      "description": "Get autopilot scheduled-task specs"
-    },
     {
       "name": "dashboard",
       "description": "S4L dashboard"

package/mcp/menubar/s4l_browser_foreground.py

@@ -157,12 +157,16 @@ class _Worker(threading.Thread):
         # focus back to the app the user was in. Screenshots/clicks are
         # unaffected (CDP is offscreen-raster + synthetic input; the occlusion
         # flags keep hidden tabs painting).
-        # DEFAULT OFF (user decision 2026-07-30): only the telemetry above runs
-        # unless S4L_HARNESS_HIDE=1 opts in. S4L_NO_HARNESS_HIDE force-disables
-        # even when the opt-in is set.
+        # DEFAULT ON (user decision 2026-08-07, reverses the 2026-07-30 default-off
+        # call): the guard hides an offscreen harness that steals the foreground
+        # unless explicitly opted out. Two knobs, by design:
+        #   S4L_NO_HARNESS_HIDE  -> HARD override, force off, checked FIRST so it
+        #       always wins (this is the one-time interactive-login escape hatch).
+        #   S4L_HARNESS_HIDE=0   -> SOFT opt-out for a machine that wants it off.
+        # Unset or any non-"0" value => hide is active (the new default).
         if os.environ.get("S4L_NO_HARNESS_HIDE"):
             return
-        if os.environ.get("S4L_HARNESS_HIDE") != "1":
+        if os.environ.get("S4L_HARNESS_HIDE", "1") == "0":
             return
         pos = details.get("window_position") or ""
         try:

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.8",
+  "version": "1.7.9-rc.2",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/mcp-servers/browser-harness/server.py

@@ -28,12 +28,14 @@ headed, e.g. when Xvfb is available).
 from __future__ import annotations
 
 import asyncio
+import atexit
 import json
 import os
 import shutil
 import socket
 import subprocess
 import sys
+import threading
 import time
 import urllib.request
 import urllib.error
@@ -58,51 +60,16 @@ PROFILE_DIR = Path.home() / ".claude" / "browser-profiles" / PROFILE_NAME
 PID_FILE = Path.home() / ".claude" / "browser-profiles" / f"{PROFILE_NAME}.chrome.pid"
 LOG_FILE = Path.home() / ".claude" / "browser-profiles" / f"{PROFILE_NAME}.chrome.log"
 MCP_LOG_FILE = Path.home() / ".claude" / "browser-profiles" / f"{PROFILE_NAME}.mcp.log"
-
-
-def _playwright_chromium_bins() -> list[str]:
-    """Chromium binaries the runtime's `playwright install chromium` step drops
-    into the shared ms-playwright cache, newest revision first.
-
-    A .mcpb user with no system Chrome (e.g. only Arc installed) still gets a
-    working browser here because the runtime download lands in this cache. The
-    rev number (chromium-1208/1217/1223/...) changes per Playwright pin, and the
-    bundle is named "Google Chrome for Testing" on recent revs / "Chromium" on
-    older ones, so we glob rather than hardcode. macOS uses chrome-mac[-arm64];
-    Linux uses chrome-linux.
-    """
-    cache = Path.home() / "Library" / "Caches" / "ms-playwright"  # macOS
-    linux_cache = Path.home() / ".cache" / "ms-playwright"  # Linux
-    patterns = [
-        # macOS, newer revs (arm64 + x64): "Google Chrome for Testing"
-        "chromium-*/chrome-mac*/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing",
-        # macOS, older revs: "Chromium"
-        "chromium-*/chrome-mac*/Chromium.app/Contents/MacOS/Chromium",
-        # Linux
-        "chromium-*/chrome-linux/chrome",
-    ]
-    found: list[str] = []
-    for root in (cache, linux_cache):
-        if not root.exists():
-            continue
-        for pat in patterns:
-            for hit in root.glob(pat):
-                if hit.exists():
-                    found.append(str(hit))
-
-    def _rev(p: str) -> int:
-        # Sort by the chromium-<rev> number so the newest install wins.
-        for part in Path(p).parts:
-            if part.startswith("chromium-") and part[len("chromium-"):].isdigit():
-                return int(part[len("chromium-"):])
-        return 0
-
-    return sorted(set(found), key=_rev, reverse=True)
+# [bh_tab_event] attribution lines from the harness CLI's stderr. bh_run
+# returns stderr to the calling agent and nothing else persists it, so the
+# reddit/linkedin lanes had ZERO tab-event observability while twitter's
+# cycle logs captured theirs (2026-07-31). One file per profile; correlate
+# against [browser-foreground] in menubar.err.log.
+TAB_EVENT_LOG = Path.home() / ".claude" / "browser-profiles" / f"{PROFILE_NAME}.tab-events.log"
 
 
 def _detect_chrome_bin() -> str:
-    """Find the Chrome binary on disk. Env override wins. Returns "" if nothing
-    real is found (callers can then trigger an install fallback)."""
+    """Find the Chrome binary on disk. Env override wins."""
     env = os.environ.get("BH_CHROME_BIN")
     if env and Path(env).exists():
         return env
@@ -122,56 +89,14 @@ def _detect_chrome_bin() -> str:
         if Path(p).exists():
             return p
 
-    # The runtime's own bundled Chromium (ms-playwright cache). This is what
-    # makes setup work on a machine with no system Chrome installed.
-    for p in _playwright_chromium_bins():
-        return p
-
     # Fall back to PATH lookup.
     for name in ("google-chrome", "google-chrome-stable", "chromium", "chromium-browser"):
         found = shutil.which(name)
         if found:
             return found
 
-    return ""
-
-
-def _chrome_exists(p: str) -> bool:
-    return bool(p) and (Path(p).exists() or shutil.which(p) is not None)
-
-
-def _venv_python() -> str | None:
-    """The runtime venv interpreter (has playwright). Mirrors runtime.ts:
-    <S4L_STATE_DIR|~/.social-autoposter-mcp>/runtime/.venv/bin/python3."""
-    state_dir = Path(os.environ.get("S4L_STATE_DIR", str(Path.home() / ".social-autoposter-mcp")))
-    if sys.platform == "win32":
-        cand = state_dir / "runtime" / ".venv" / "Scripts" / "python.exe"
-    else:
-        cand = state_dir / "runtime" / ".venv" / "bin" / "python3"
-    return str(cand) if cand.exists() else None
-
-
-def _install_chromium() -> dict:
-    """Last-ditch fallback when no Chromium is found anywhere: run
-    `playwright install chromium` so a fresh machine self-heals instead of
-    dead-ending at no_chrome_binary. Uses the runtime venv if present, otherwise
-    the interpreter running this server. The download lands in the shared
-    ms-playwright cache that _detect_chrome_bin() globs."""
-    py = _venv_python() or sys.executable
-    _log(f"no chromium found; attempting `playwright install chromium` via {py}")
-    try:
-        r = subprocess.run(
-            [py, "-m", "playwright", "install", "chromium"],
-            capture_output=True,
-            text=True,
-            timeout=int(os.environ.get("BH_CHROME_INSTALL_TIMEOUT_SEC", "600")),
-        )
-    except Exception as e:  # noqa: BLE001
-        _log(f"chromium install failed to launch: {e}")
-        return {"ok": False, "python": py, "error": str(e)}
-    ok = r.returncode == 0
-    _log(f"chromium install exit={r.returncode}")
-    return {"ok": ok, "python": py, "exit": r.returncode, "out": (r.stdout + r.stderr)[-600:]}
+    # Last-resort default (matches the pre-2026-05-20 hardcoded value).
+    return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
 
 
 def _detect_browser_harness_bin() -> str:
@@ -209,6 +134,90 @@ HEADLESS = os.environ.get("BH_HEADLESS", _DEFAULT_HEADLESS) == "1"
 RUNNING_AS_ROOT = (hasattr(os, "geteuid") and os.geteuid() == 0)
 
 
+# --- Browser-session mutex (2026-07-16) ---------------------------------------
+# Every Claude-driven tool call here (bh_run/bh_navigate/bh_screenshot, all
+# funneling through _run_harness) used to be completely invisible to the
+# Python-side locks (browser_mutex.BrowserMutex, used internally by
+# twitter_browser.py/reddit_browser.py/linkedin_browser.py on every CDP
+# connect). A live bh_run script and a concurrent Python fetch/post could both
+# touch the same shared tab with zero coordination -- the exact mechanism
+# behind the "second blank tab, then it crashes" symptom traced tonight.
+#
+# BH_LOCK_FILE (set per-platform by the *-harness-mcp.json config, matching
+# the exact lock_file each platform's own BrowserMutex uses) and
+# BH_LOCK_MODULE_DIR (pointing at the materialized package's scripts/ dir, so
+# this reuses the ONE proven implementation instead of a fourth divergent
+# copy) are both optional: if either is unset or the import fails, _MUTEX
+# stays None and this file behaves exactly as it did before -- fail-open,
+# never a new way for the server to break.
+#
+# Scope is deliberately PER TOOL CALL, not per-session: several pipelines
+# (dm-outreach-reddit.sh, link-edit-reddit.sh) hold their own lease only
+# during actual CDP work and release between posts on purpose, so a batch
+# doesn't monopolize the browser for the ~30 min a full session can take.
+# Holding this lock for the whole server lifetime would regress that. Per-call
+# still closes the race that actually mattered: a live tool call stomping on
+# (or being stomped by) a concurrent Python read/write of the same tab.
+_MUTEX = None
+_LOCK_FILE = os.environ.get("BH_LOCK_FILE", "").strip()
+if _LOCK_FILE:
+    try:
+        _module_dir = os.environ.get("BH_LOCK_MODULE_DIR", "").strip()
+        if _module_dir and _module_dir not in sys.path:
+            sys.path.insert(0, _module_dir)
+        from browser_mutex import BrowserMutex  # type: ignore
+
+        _MUTEX = BrowserMutex(
+            lock_file=os.path.expanduser(_LOCK_FILE),
+            label=f"{PROFILE_NAME} harness (MCP)",
+        )
+    except Exception as _e:  # pragma: no cover - best-effort, never fatal
+        _MUTEX = None
+        # _log() isn't defined yet at this point in the file (module-level
+        # code runs top-to-bottom, before the Logging section below), so
+        # write directly to stderr instead of depending on definition order.
+        print(f"[browser-harness] lease disabled: import/construct failed ({_e!r})", file=sys.stderr)
+
+
+def _lock_acquire_for_call() -> bool:
+    """True if the tab is ours (or no lock is configured). BrowserMutex.acquire()
+    sys.exit(1)s on contention timeout -- correct for the CLI entrypoints it was
+    designed for, wrong here: it would kill the whole MCP server (and the
+    Claude session using it) over one busy tool call. Caught and converted to
+    a normal 'busy, try again' result instead."""
+    if _MUTEX is None:
+        return True
+    try:
+        _MUTEX.acquire()
+        return True
+    except SystemExit:
+        return False
+
+
+def _lock_release_after_call() -> None:
+    if _MUTEX is not None:
+        try:
+            _MUTEX.release()
+        except Exception:
+            pass
+
+
+def _lock_heartbeat_loop(stop_event: threading.Event) -> None:
+    """Background thread: refresh the lease every 20s while a call is in
+    flight, mirroring the old mcp_lock_proxy.py's proven heartbeat cadence
+    (30s) with a little headroom. Long-running bh_run scripts (up to
+    EXEC_TIMEOUT_SEC=300s by default) would otherwise risk the lease's own
+    300s/180s expiry firing mid-call and letting a peer reclaim it under us."""
+    while not stop_event.wait(20):
+        try:
+            _MUTEX.refresh()
+        except Exception:
+            pass
+
+
+atexit.register(_lock_release_after_call)
+
+
 # --- Logging ---
 
 def _log(msg: str) -> None:
@@ -332,53 +341,22 @@ def _build_chrome_cmd() -> list[str]:
         cmd.append(f"--window-position={win_pos}")
         cmd.append(f"--window-size={win_size}")
 
-    # Open a REAL http(s) page (NOT about:blank) so the harness daemon's
-    # attach_first_page() finds an existing real tab and reuses it. Upstream
-    # browser-harness creates a throwaway about:blank on every re-attach where
-    # is_real_page() is false (which about:blank is); launching blank feeds that
-    # loop, piling up orphan tabs that cleanup_harness_tabs then has to sweep.
-    # Landing URL is derived from the profile's platform; BH_LAUNCH_URL overrides.
-    cmd.append(_launch_url())
+    # Open a real tab so CDP has something to attach to immediately.
+    cmd.append("about:blank")
     return cmd
 
 
-def _launch_url() -> str:
-    """Initial tab URL for the managed Chrome. MUST be a real http(s) page, not
-    about:blank, so the browser-harness daemon reuses it instead of spawning
-    throwaway blank tabs (see _build_chrome_cmd). Derived from PROFILE_NAME;
-    BH_LAUNCH_URL overrides for non-standard profiles."""
-    override = os.environ.get("BH_LAUNCH_URL", "").strip()
-    if override:
-        return override
-    name = PROFILE_NAME.lower()
-    if "linkedin" in name:
-        return "https://www.linkedin.com/feed/"
-    if "reddit" in name:
-        return "https://www.reddit.com/"
-    return "https://x.com"
-
-
 def ensure_chrome() -> dict:
     """Make sure our managed Chrome is running on PORT. Idempotent."""
-    global CHROME_BIN
     if _cdp_alive():
         return {"status": "already_running", "pid": _read_pid(), "cdp": CDP_URL}
 
-    if not _chrome_exists(CHROME_BIN):
-        # Re-detect (the runtime may have finished its chromium download since
-        # this server booted), then auto-install as a last resort so a fresh
-        # machine self-heals instead of dead-ending here.
-        CHROME_BIN = _detect_chrome_bin()
-        if not _chrome_exists(CHROME_BIN):
-            install = _install_chromium()
-            CHROME_BIN = _detect_chrome_bin()
-            if not _chrome_exists(CHROME_BIN):
-                return {
-                    "status": "no_chrome_binary",
-                    "looked_for": CHROME_BIN or "(none found)",
-                    "install_attempt": install,
-                    "hint": "Auto-install of chromium failed. Set BH_CHROME_BIN to a Chrome/Chromium path, or run `playwright install chromium`.",
-                }
+    if not Path(CHROME_BIN).exists() and not shutil.which(CHROME_BIN):
+        return {
+            "status": "no_chrome_binary",
+            "looked_for": CHROME_BIN,
+            "hint": "Set BH_CHROME_BIN to your Chrome/Chromium path, or install google-chrome / chromium.",
+        }
 
     PROFILE_DIR.mkdir(parents=True, exist_ok=True)
     LOG_FILE.parent.mkdir(parents=True, exist_ok=True)
@@ -402,6 +380,42 @@ def ensure_chrome() -> dict:
             pass
         time.sleep(0.5)
 
+    # SINGLETON GATE (2026-08-07): never spawn while ANY live process owns
+    # this profile — including Chromes started by the shell-side launcher,
+    # whose pids are not in our PID_FILE. Chrome's singleton handoff makes
+    # the EXISTING instance front itself (focus steal, plus a reopened blank
+    # window when it is tabless); the "Opening in existing browser session."
+    # lines in LOG_FILE are that event's fingerprint. A CDP probe that
+    # false-negatives under load must wait, not double-launch. Genuine
+    # recovery still works: _ensure_cdp_ready's stop_chrome() reaps the
+    # owner (via _port_owner_pids) before its retry, which makes this gate
+    # pass. Trailing space in the pattern keeps browser-harness from
+    # matching browser-harness-linkedin.
+    try:
+        _owners = subprocess.run(
+            ["pgrep", "-f", "--", f"--user-data-dir={PROFILE_DIR} "],
+            capture_output=True, text=True, timeout=5,
+        ).stdout.split()
+    except Exception:
+        _owners = []
+    if _owners:
+        _log(
+            f"skip launch: pid {_owners[0]} already owns {PROFILE_DIR}; "
+            "waiting for CDP instead of double-launching (singleton handoff "
+            "would front the existing window)"
+        )
+        _gate_deadline = time.time() + 15
+        while time.time() < _gate_deadline:
+            if _cdp_alive():
+                return {"status": "already_running", "pid": int(_owners[0]), "cdp": CDP_URL}
+            time.sleep(0.5)
+        return {
+            "status": "owner_alive_cdp_dead",
+            "pid": int(_owners[0]),
+            "cdp": CDP_URL,
+            "log": str(LOG_FILE),
+        }
+
     cmd = _build_chrome_cmd()
 
     log_fh = LOG_FILE.open("ab")
@@ -633,38 +647,72 @@ def _run_harness(script: str, timeout: int = EXEC_TIMEOUT_SEC) -> dict:
     if cdp_err is not None:
         return cdp_err
 
-    env = os.environ.copy()
-    env["BU_CDP_URL"] = CDP_URL
-    # Make sure ~/.local/bin is on PATH (uv tools live there).
-    env["PATH"] = f"{Path.home()}/.local/bin:" + env.get("PATH", "")
-
-    # Upstream browser-harness dropped the `-c <script>` flag and now reads the
-    # script from stdin only (heredoc style). Pass via stdin so we work against
-    # current upstream; the old `-c` form returns the usage banner and exits 1,
-    # which used to surface as "CDP not connected" on every fresh install.
-    try:
-        proc = subprocess.run(
-            [BROWSER_HARNESS_BIN],
-            input=script,
-            env=env,
-            capture_output=True,
-            text=True,
-            timeout=timeout,
-        )
-    except subprocess.TimeoutExpired as e:
+    # Hold the shared browser-session lease for exactly this call (see the
+    # mutex setup above) so a concurrent Python fetch/post can't stomp the
+    # tab this script is about to drive, and vice versa. Held only around the
+    # actual subprocess, not the CLI-existence/CDP-readiness checks above.
+    if not _lock_acquire_for_call():
         return {
             "ok": False,
-            "error": f"browser-harness timed out after {timeout}s",
-            "stdout": (e.stdout or "") if isinstance(e.stdout, str) else "",
-            "stderr": (e.stderr or "") if isinstance(e.stderr, str) else "",
+            "error": (
+                "browser busy: another process is actively using this harness's "
+                "tab right now (lease contended). Safe to retry shortly."
+            ),
         }
+    _stop_heartbeat = threading.Event()
+    _hb_thread = None
+    if _MUTEX is not None:
+        _hb_thread = threading.Thread(
+            target=_lock_heartbeat_loop, args=(_stop_heartbeat,), daemon=True
+        )
+        _hb_thread.start()
 
-    return {
-        "ok": proc.returncode == 0,
-        "returncode": proc.returncode,
-        "stdout": proc.stdout,
-        "stderr": proc.stderr,
-    }
+    try:
+        env = os.environ.copy()
+        env["BU_CDP_URL"] = CDP_URL
+        # Make sure ~/.local/bin is on PATH (uv tools live there).
+        env["PATH"] = f"{Path.home()}/.local/bin:" + env.get("PATH", "")
+
+        # Upstream browser-harness dropped the `-c <script>` flag and now reads the
+        # script from stdin only (heredoc style). Pass via stdin so we work against
+        # current upstream; the old `-c` form returns the usage banner and exits 1,
+        # which used to surface as "CDP not connected" on every fresh install.
+        try:
+            proc = subprocess.run(
+                [BROWSER_HARNESS_BIN],
+                input=script,
+                env=env,
+                capture_output=True,
+                text=True,
+                timeout=timeout,
+            )
+        except subprocess.TimeoutExpired as e:
+            return {
+                "ok": False,
+                "error": f"browser-harness timed out after {timeout}s",
+                "stdout": (e.stdout or "") if isinstance(e.stdout, str) else "",
+                "stderr": (e.stderr or "") if isinstance(e.stderr, str) else "",
+            }
+
+        try:
+            events = [l for l in (proc.stderr or "").splitlines() if "[bh_tab_event]" in l]
+            if events:
+                with open(TAB_EVENT_LOG, "a") as f:
+                    f.write("\n".join(events) + "\n")
+        except OSError:
+            pass
+
+        return {
+            "ok": proc.returncode == 0,
+            "returncode": proc.returncode,
+            "stdout": proc.stdout,
+            "stderr": proc.stderr,
+        }
+    finally:
+        _stop_heartbeat.set()
+        if _hb_thread is not None:
+            _hb_thread.join(timeout=2)
+        _lock_release_after_call()
 
 
 # --- MCP server ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.8",
+  "version": "1.7.9-rc.2",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/claude_job.py

@@ -1,8 +1,27 @@
 #!/usr/bin/env python3
 """
-claude_job.py — queue-backed substitute for `claude -p` for the pipeline's
-pure text->JSON turns, on every machine (operator Macs and customer .mcpb
-boxes alike).
+claude_job.py — THE DRAFT-ENGINE SEAM: every pure text->JSON drafting turn in
+the pipeline lands here, and <state_dir>/draft-provider.json decides which
+engine answers it (see scripts/draft_provider.py; design + verified facts in
+docs/codex-port-design.md):
+
+  claude-desktop-queue  (default) enqueue to a file queue drained by the
+                        Claude Desktop s4l-worker scheduled task — the
+                        original design, and the only option when Claude
+                        Desktop is the box's sole authenticated engine.
+  claude-p              answer inline via the real `claude -p` (_run_claude_p;
+                        schema INLINED — the CLI parses --json-schema as JSON,
+                        a file path breaks it).
+  codex-exec            answer inline via the ChatGPT-app-bundled `codex exec`
+                        (_run_codex_exec; gpt-5.6-sol default, schema rides
+                        the prompt — OpenAI strict schema mode rejects our
+                        lenient schemas).
+
+All three return byte-identical claude `--output-format json` envelopes and
+the same 0/1/79 exit semantics, so callers can't tell them apart. The queue
+machinery below (next/result, worker notes, heartbeats) only runs for the
+default provider; the inline providers skip it entirely, which also means no
+warm-session leaks and no app-open requirement on those paths.
 
 The deterministic pipeline never calls `claude` directly; every invocation goes
 through scripts/run_claude.sh. For script tags mapped in TAG_TO_TYPE below,
@@ -461,19 +480,22 @@ def _bump_drain_timeout() -> None:
 
 
 # --------------------------------------------------------------------------- #
-# Opt-in worker self-reap (2026-06-27)                                         #
+# Worker self-reap (2026-06-27; DEFAULT ON since 2026-07-04 / v1.6.202)        #
 # --------------------------------------------------------------------------- #
 # A scheduled-task worker turn finishes its one queue iteration but Claude
 # Desktop keeps the agent-mode `claude` process warm (`--input-format
 # stream-json`), so finished workers pile up and leak RAM. The launchd reaper
-# (reap_stale_claude_sessions.py) is the GUARANTEE that bounds this. This opt-in
+# (reap_stale_claude_sessions.py) is the GUARANTEE that bounds this. This
 # path is a faster, source-side trim: once THIS worker is provably done (no work
 # to do, or its result is already on disk), terminate OUR OWN session so it never
-# becomes part of the standing pool. Strictly off unless S4L_WORKER_SELF_REAP is
-# set, so it ships dormant and cannot destabilize the default behaviour.
+# becomes part of the standing pool. It shipped opt-in (dormant unless
+# S4L_WORKER_SELF_REAP was set), which meant it ran nowhere; when Desktop
+# 1.18286.0 changed the cmdline shape the signature-fragile reaper missed too
+# and boxes leaked (Karol, 53 piled workers). Since 2026-07-04 it is ON by
+# default; opt OUT with S4L_WORKER_SELF_REAP=0 (see _self_reap_enabled).
 #
 # Safety properties:
-#   * No-op unless the env flag is set.
+#   * Respects the env kill switch (S4L_WORKER_SELF_REAP=0 disables it).
 #   * Only ever targets a process in OUR OWN ancestry that matches the reaper's
 #     worker signature (claude-code agent-mode session). The producer side
 #     (run-twitter-cycle.sh -> python) has no such ancestor, so a misplaced call

package/skill/lib/browser-launch.sh

@@ -28,6 +28,24 @@
 launch_harness_chrome() {
     local _bl_chrome_bin="$1"; shift
     local _bl_prof_dir="$1"; shift
+    # SINGLETON GATE (2026-08-07): if a live Chrome already owns this profile,
+    # NEVER exec another launch. A duplicate launch does not create a second
+    # instance — Chrome's singleton handoff makes the EXISTING instance FRONT
+    # ITSELF (and reopen a blank window when it has none): the reproduced root
+    # cause of the residual focus steals / "browser restarted on a blank page"
+    # reports. The handoff's "Opening in existing browser session." goes to
+    # stderr that `open` discards, so it never appeared in any log. Probes can
+    # false-negative under load; process liveness is the authority. Callers
+    # that genuinely need a relaunch kill the owner first
+    # (_hc_reap_profile_owners), which makes this gate pass. Trailing space in
+    # the pattern keeps browser-harness from matching browser-harness-linkedin
+    # (same convention as the reaper).
+    local _bl_owner
+    _bl_owner=$(pgrep -f -- "--user-data-dir=$_bl_prof_dir " 2>/dev/null | head -1)
+    if [ -n "$_bl_owner" ]; then
+        echo "[browser-launch] SKIP: pid $_bl_owner already owns $_bl_prof_dir; a duplicate launch would singleton-handoff and front the existing window" >&2
+        return 0
+    fi
     "${S4L_PYTHON:-python3}" -c 'import json, os, sys
 p = os.path.join(sys.argv[1], "Default", "Preferences")
 try: