brand-manager-worker 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brand-manager-worker",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "The Goose Tools brand-deal worker — your computer reads your brand email and drafts replies in your voice for goosetools.com, using your own Claude account. Drafts only; it never sends.",
   "repository": {
     "type": "git",

package/worker/agent-cli.js

@@ -0,0 +1,275 @@
+// Agent CLI adapter — runs a job's prompt through whichever coding-agent CLI
+// the user picked on goosetools.com (claim payloads carry `agentCli`).
+//
+// VENDORED FILE: keep byte-identical across brand-manager-worker,
+// caption-maker, and carousel-maker (worker/agent-cli.js in each). Fix a bug
+// here, copy it to the other two.
+//
+// Modes, chosen for speed-vs-capability (see brand-manager commit c0c1b33 —
+// tool-looping turned 36-second drafts into 10-minute ones):
+//   "text"    — plain prompt-in/text-out, no tool flags at all (captions).
+//   "oneshot" — tools explicitly OFF, all context inlined by the caller.
+//   "read"    — file-reading allowed (carousel drafts look at photos).
+//   "session" — tools ON and resumable where the CLI supports it.
+//
+// Honest capability notes per CLI:
+//   claude   — full support: fine tool control, JSON envelope, --resume.
+//   codex    — sandbox-level tool control only; resumable threads; JSONL out.
+//   gemini   — no headless resume: sessionId is always null, callers replay
+//              history (they already do this whenever sessionId is absent).
+//   opencode — plain text out; session continuation is version-dependent, so
+//              we don't claim it: sessionId is always null.
+//
+// Session ids are namespaced ("claude:<uuid>", "codex:<thread-id>") because
+// the server stores them per conversation and the user can switch agents
+// between turns — a Claude uuid means nothing to Codex. resolveSession()
+// drops a mismatched id so the caller falls back to history replay. Bare
+// un-prefixed ids predate namespacing and are treated as Claude's.
+
+import { spawn } from "node:child_process";
+import { spawnSync } from "node:child_process";
+
+export const AGENT_IDS = ["claude-code", "codex", "gemini", "opencode"];
+
+const INSTALL_HINTS = {
+  "claude-code": "npm install -g @anthropic-ai/claude-code",
+  codex: "npm install -g @openai/codex, then run: codex login",
+  gemini: "npm install -g @google/gemini-cli, then run: gemini (to sign in)",
+  opencode: "npm install -g opencode-ai, then run: opencode auth login",
+};
+
+const LABELS = {
+  "claude-code": "Claude Code",
+  codex: "Codex CLI",
+  gemini: "Gemini CLI",
+  opencode: "OpenCode",
+};
+
+// Session-id namespace per agent. claude-code writes "claude:" for continuity
+// with the bare ids already stored server-side.
+const SESSION_PREFIX = {
+  "claude-code": "claude",
+  codex: "codex",
+  gemini: "gemini",
+  opencode: "opencode",
+};
+
+function bin(agent) {
+  if (agent === "claude-code") return process.env.CLAUDE_BIN ?? "claude";
+  return agent; // codex / gemini / opencode binaries share their id
+}
+
+/** "claude" (legacy claim payloads) → "claude-code"; unknown → null. */
+export function normalizeAgent(v) {
+  if (v == null || v === "" ) return "claude-code";
+  if (v === "claude") return "claude-code";
+  return AGENT_IDS.includes(v) ? v : null;
+}
+
+/**
+ * Turn a stored (possibly namespaced, possibly another agent's) session id
+ * into one usable by `agent`, or null — null tells the caller to inline the
+ * conversation history instead of resuming.
+ */
+export function resolveSession(agent, sessionId) {
+  if (!sessionId) return null;
+  const idx = sessionId.indexOf(":");
+  if (idx === -1) {
+    // Legacy bare id — those were always Claude Code session uuids.
+    return agent === "claude-code" ? sessionId : null;
+  }
+  const prefix = sessionId.slice(0, idx);
+  return prefix === SESSION_PREFIX[agent] ? sessionId.slice(idx + 1) : null;
+}
+
+function namespaced(agent, rawId) {
+  return rawId ? `${SESSION_PREFIX[agent]}:${rawId}` : null;
+}
+
+// Strip ANSI escapes and other terminal noise some CLIs print around answers.
+export function cleanText(text) {
+  // eslint-disable-next-line no-control-regex
+  return String(text).replace(/\[[0-9;]*[A-Za-z]/g, "").trim();
+}
+
+// stdio[0] MUST be "ignore". Inherited stdin makes invocations hang forever
+// under launchd — brand-manager hit this exact bug (fixed in 3b1f955) and it
+// presents as the worker silently doing nothing after a reboot.
+function run(agent, args, { timeoutMs, cwd }) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin(agent), args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => (stdout += d));
+    child.stderr.on("data", (d) => (stderr += d));
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error(`${LABELS[agent]} timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(
+        err.code === "ENOENT"
+          ? new Error(
+              `${LABELS[agent]} isn't installed on this computer. Install: ${INSTALL_HINTS[agent]} — or switch your agent back to Claude Code in Setup on goosetools.com.`,
+            )
+          : err,
+      );
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve(stdout);
+      else
+        reject(
+          new Error(`${LABELS[agent]} exited ${code}: ${stderr.slice(0, 600)}`),
+        );
+    });
+  });
+}
+
+/** Is the CLI on PATH? { installed, hint } — cheap, for startup diagnostics. */
+export function detect(agent) {
+  const res = spawnSync(bin(agent), ["--version"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 10_000,
+  });
+  return {
+    installed: res.status === 0,
+    hint: INSTALL_HINTS[agent],
+    label: LABELS[agent],
+  };
+}
+
+// Tools Claude must NOT touch in oneshot mode — everything is inlined.
+const CLAUDE_TOOLS_OFF = "Read,Edit,Write,Bash,Glob,Grep,WebFetch,WebSearch";
+
+/**
+ * Run a prompt through the chosen agent CLI.
+ * Returns { text, sessionId } — sessionId is namespaced and null whenever
+ * the CLI can't resume (callers then replay history on the next turn).
+ */
+export async function runAgent({
+  agent = "claude-code",
+  prompt,
+  cwd,
+  mode = "text",
+  sessionId = null,
+  tools = "Read,Edit,Write,Glob,Grep",
+  timeoutMs = 5 * 60 * 1000,
+}) {
+  const normalized = normalizeAgent(agent);
+  if (!normalized) {
+    throw new Error(
+      `Unknown agent "${agent}" — update this worker: npx --yes <package>@latest install`,
+    );
+  }
+  const resume = resolveSession(normalized, sessionId);
+
+  if (normalized === "claude-code") {
+    if (mode === "session") {
+      const args = [
+        "-p",
+        prompt,
+        "--output-format",
+        "json",
+        "--permission-mode",
+        "acceptEdits",
+        "--allowedTools",
+        tools,
+      ];
+      if (resume) args.push("--resume", resume);
+      const raw = await run(normalized, args, { timeoutMs, cwd });
+      // The json envelope carries the session id. Be forgiving: a shape
+      // change shouldn't lose the user's answer.
+      try {
+        const parsed = JSON.parse(raw);
+        return {
+          text: parsed.result ?? parsed.text ?? raw,
+          sessionId: namespaced(
+            normalized,
+            parsed.session_id ?? parsed.sessionId ?? resume ?? null,
+          ),
+        };
+      } catch {
+        return { text: raw, sessionId: namespaced(normalized, resume) };
+      }
+    }
+    const args = ["-p", prompt, "--output-format", "text"];
+    if (mode === "oneshot") args.push("--disallowedTools", CLAUDE_TOOLS_OFF);
+    if (mode === "read") args.push("--allowedTools", "Read");
+    const text = await run(normalized, args, { timeoutMs, cwd });
+    return { text, sessionId: null };
+  }
+
+  if (normalized === "codex") {
+    // Sandbox is the only tool control codex offers; read-only + the prompt's
+    // own "don't use tools" language is the closest match to oneshot.
+    const sandbox = mode === "session" ? "workspace-write" : "read-only";
+    const args = ["exec"];
+    if (resume) args.push("resume", resume);
+    args.push("--skip-git-repo-check", "--sandbox", sandbox, "--json");
+    if (cwd) args.push("--cd", cwd);
+    args.push(prompt);
+    const raw = await run(normalized, args, { timeoutMs, cwd });
+    // --json emits JSONL events; harvest the thread id and the last agent
+    // message, falling back to the raw output if the shape ever changes.
+    let threadId = resume ?? null;
+    let last = null;
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("{")) continue;
+      try {
+        const evt = JSON.parse(trimmed);
+        threadId =
+          evt.thread_id ?? evt.session_id ?? evt.thread?.id ?? threadId;
+        const item = evt.item ?? evt;
+        const type = item.item_type ?? item.type;
+        if (
+          (type === "agent_message" || type === "assistant_message") &&
+          typeof (item.text ?? item.message) === "string"
+        ) {
+          last = item.text ?? item.message;
+        }
+      } catch {
+        // not an event line — ignore
+      }
+    }
+    return {
+      text: cleanText(last ?? raw),
+      sessionId: mode === "session" ? namespaced(normalized, threadId) : null,
+    };
+  }
+
+  if (normalized === "gemini") {
+    // No reliable headless resume — never claim one. Session mode gets yolo
+    // approvals so its tools can run unattended.
+    const args = ["-p", prompt, "--output-format", "json"];
+    if (mode === "session") args.push("--yolo");
+    let raw;
+    try {
+      raw = await run(normalized, args, { timeoutMs, cwd });
+    } catch (err) {
+      // Older gemini builds lack --output-format; retry plain.
+      if (!/output-format|unknown option/i.test(String(err.message))) throw err;
+      raw = await run(normalized, ["-p", prompt], { timeoutMs, cwd });
+      return { text: cleanText(raw), sessionId: null };
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        text: cleanText(parsed.response ?? parsed.result ?? raw),
+        sessionId: null,
+      };
+    } catch {
+      return { text: cleanText(raw), sessionId: null };
+    }
+  }
+
+  // opencode — plain text out; we don't claim session continuation (it's
+  // version-dependent), so every turn replays history.
+  const raw = await run(normalized, ["run", prompt], { timeoutMs, cwd });
+  return { text: cleanText(raw), sessionId: null };
+}

package/worker/agent.js

@@ -7,6 +7,7 @@
 
 import { oneShot, parseJson, session } from "./claude.js";
 import { loadContext, invalidateContext } from "./context.js";
+import { refreshStatsIfStale } from "./ig-stats.js";
 import { BRAND_DIR } from "./paths.js";
 
 // Automated / no-reply senders never send brand deals — skip them WITHOUT
@@ -139,6 +140,9 @@ function buildPrompt({ thread, reason, instruction, contracts, context }) {
  * failure — and null MUST mean "retry later", never "skip this thread".
  */
 export async function decide({ thread, reason, instruction = null, contracts = [] }) {
+  // Live numbers before the media kit is inlined. Refreshes only when the
+  // snapshot is a week old or more; a failure keeps the last one.
+  if ((await refreshStatsIfStale()).refreshed) invalidateContext();
   const context = loadContext();
   const prompt = buildPrompt({ thread, reason, instruction, contracts, context });
   const stdout = await oneShot(prompt, { cwd: BRAND_DIR });

package/worker/api.js

@@ -45,7 +45,11 @@ export const TOKEN =
   localEnv.WORKER_TOKEN ??
   sharedEnv.WORKER_TOKEN;
 
-export const POLL_MS = 30_000;
+// 5 min, not 30s: a 24/7 30s poll kept the prod database awake around the
+// clock and burned its whole compute quota. Brand work is background inbox
+// tending — nobody is watching a spinner — and the loop drains bursts
+// immediately once one job is claimed, so only the first pickup waits.
+export const POLL_MS = 5 * 60 * 1000;
 
 /** POST to /api/brand/worker/<path>. Returns null on 204 (no work). */
 export async function api(path, body) {

package/worker/claude.js

@@ -1,77 +1,59 @@
-// Running Claude on this machine.
+// Running the user's coding agent on this machine.
+//
+// Historically this file shelled out to Claude Code directly; the actual CLI
+// plumbing now lives in agent-cli.js (vendored, shared across the Goose Tools
+// workers) and honors the agent the user picked on goosetools.com — the claim
+// payload's `agentCli`. index.js calls setAgent() once per job; the worker
+// handles jobs serially, so module state is safe.
 //
 // Two modes, and the split matters for speed. brand-manager learned this the
-// hard way (commit c0c1b33): letting Claude loop on tools to gather its own
+// hard way (commit c0c1b33): letting the agent loop on tools to gather its own
 // context took 5–10 minutes per draft versus ~36 seconds when everything was
 // inlined up front. So:
 //
 //   oneShot()  — drafting. Tools OFF, all context inlined by the caller. Fast.
 //   session()  — chat, voice-audit, stats, learn. Tools ON, scoped to the
-//                brand directory, and resumable so a follow-up message
-//                remembers the previous turn.
+//                brand directory, and resumable where the CLI supports it
+//                (Claude and Codex do; Gemini and OpenCode return a null
+//                sessionId, and callers replay history instead).
 //
-// There is no API key anywhere here. This runs on the user's own Claude
-// subscription via the `claude` CLI, same as every other Goose Tools worker.
+// There is no API key anywhere here. This runs on the user's own agent
+// subscription via that agent's CLI, same as every other Goose Tools worker.
 
-import { spawn } from "node:child_process";
+import { runAgent, normalizeAgent, resolveSession } from "./agent-cli.js";
 
-const CLAUDE_BIN = process.env.CLAUDE_BIN ?? "claude";
+let currentAgent = "claude-code";
 
-// stdio[0] MUST be "ignore". Inherited stdin makes every invocation hang
-// forever under launchd — brand-manager hit this exact bug (fixed in 3b1f955)
-// and it presents as the worker silently doing nothing after a reboot.
-function run(args, { timeoutMs, cwd }) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(CLAUDE_BIN, args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (d) => (stdout += d));
-    child.stderr.on("data", (d) => (stderr += d));
-    const timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      reject(new Error(`claude timed out after ${timeoutMs}ms`));
-    }, timeoutMs);
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      reject(
-        err.code === "ENOENT"
-          ? new Error("Claude Code not found. Install: npm install -g @anthropic-ai/claude-code")
-          : err,
-      );
-    });
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      if (code === 0) resolve(stdout);
-      else reject(new Error(`claude exited ${code}: ${stderr.slice(0, 600)}`));
-    });
-  });
+/** Set by index.js from the claim payload before each job's handler runs. */
+export function setAgent(agentCli) {
+  currentAgent = normalizeAgent(agentCli) ?? "claude-code";
+}
+
+export function getAgent() {
+  return currentAgent;
 }
 
 /** Single-shot, no tools. For drafting, where the caller inlines all context. */
 export async function oneShot(prompt, { timeoutMs = 4 * 60 * 1000, cwd } = {}) {
-  return run(
-    [
-      "-p",
-      prompt,
-      "--output-format",
-      "text",
-      "--disallowedTools",
-      "Read,Edit,Write,Bash,Glob,Grep,WebFetch,WebSearch",
-    ],
-    { timeoutMs, cwd },
-  );
+  const { text } = await runAgent({
+    agent: currentAgent,
+    prompt,
+    cwd,
+    mode: "oneshot",
+    timeoutMs,
+  });
+  return text;
 }
 
 /**
- * A real, resumable Claude Code session with tools, scoped to the brand
- * directory. This is what makes the website chat behave like talking to the
- * agent in a terminal: it can read the ledgers, edit the rate card, search
- * Gmail through the worker's own commands, and remember the last turn.
+ * A real, resumable agent session with tools, scoped to the brand directory.
+ * This is what makes the website chat behave like talking to the agent in a
+ * terminal: it can read the ledgers, edit the rate card, and (where the CLI
+ * supports resuming) remember the last turn.
  *
- * Returns { text, sessionId } — pass sessionId back in to continue.
+ * Returns { text, sessionId } — pass sessionId back in to continue. The id is
+ * namespaced per agent; a stored id from a different agent is dropped and the
+ * caller's history-replay path covers the gap.
  */
 export async function session(
   prompt,
@@ -84,39 +66,33 @@ export async function session(
     tools = "Read,Edit,Write,Glob,Grep",
   } = {},
 ) {
-  const args = [
-    "-p",
+  return runAgent({
+    agent: currentAgent,
     prompt,
-    "--output-format",
-    "json",
-    "--permission-mode",
-    "acceptEdits",
-    "--allowedTools",
+    cwd,
+    mode: "session",
+    sessionId,
     tools,
-  ];
-  if (sessionId) args.push("--resume", sessionId);
-
-  const raw = await run(args, { timeoutMs, cwd });
+    timeoutMs,
+  });
+}
 
-  // --output-format json gives a result envelope carrying the session id.
-  // Be forgiving: a shape change shouldn't lose the user's answer, so fall
-  // back to treating the output as plain text.
-  try {
-    const parsed = JSON.parse(raw);
-    return {
-      text: parsed.result ?? parsed.text ?? raw,
-      sessionId: parsed.session_id ?? parsed.sessionId ?? sessionId ?? null,
-    };
-  } catch {
-    return { text: raw, sessionId: sessionId ?? null };
-  }
+/**
+ * Would `sessionId` actually resume under the current agent? Callers check
+ * this before building a prompt so they can inline conversation history when
+ * the answer is no (agent switched, or the CLI can't resume at all).
+ */
+export function canResume(sessionId) {
+  if (!sessionId) return false;
+  if (currentAgent === "gemini" || currentAgent === "opencode") return false;
+  return resolveSession(currentAgent, sessionId) !== null;
 }
 
 /**
- * Pull a JSON object out of Claude's text output. Ported verbatim in spirit
- * from brand-manager's parseDecision: prefer a fenced block, else take the
- * first {...last }. Returns null on failure — the caller must treat that as
- * "retry later", never as "skip this thread".
+ * Pull a JSON object out of the agent's text output. Ported verbatim in
+ * spirit from brand-manager's parseDecision: prefer a fenced block, else take
+ * the first {...last }. Returns null on failure — the caller must treat that
+ * as "retry later", never as "skip this thread".
  */
 export function parseJson(text) {
   const fenced = text.match(/```json\s*([\s\S]*?)```/);

package/worker/cli.js

@@ -15,7 +15,7 @@ import { fileURLToPath } from "node:url";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
-const command = ["install", "update", "status", "uninstall", "run"].includes(process.argv[2])
+const command = ["install", "update", "status", "uninstall", "run", "doctor"].includes(process.argv[2])
   ? process.argv[2]
   : "run";
 
@@ -48,7 +48,10 @@ function has(cmd) {
   }
 }
 
-if (!has("claude")) {
+// Claude Code is the default agent, so it's required to set up; the other
+// agents (picked in Setup on goosetools.com) are checked lazily per job and
+// reported by `doctor`.
+if (command !== "doctor" && !has("claude")) {
   console.error(
     "\nClaude Code isn't installed yet (it writes your replies).\n" +
       "Install it with:  npm install -g @anthropic-ai/claude-code\n" +
@@ -58,7 +61,15 @@ if (!has("claude")) {
   process.exit(1);
 }
 
-if (command === "install") {
+if (command === "doctor") {
+  const { AGENT_IDS, detect } = await import("./agent-cli.js");
+  for (const id of AGENT_IDS) {
+    const d = detect(id);
+    console.log(
+      `${d.installed ? "✓" : "✗"} ${d.label}${d.installed ? "" : `  — install: ${d.hint}`}`,
+    );
+  }
+} else if (command === "install") {
   const { install } = await import("./service.js");
   install({
     url: (flag("--url") ?? "https://goosetools.com").replace(/\/$/, ""),

package/worker/handlers.js

@@ -12,7 +12,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { classify, decide, learnFromEdit } from "./agent.js";
 import { extractContracts } from "./attachments.js";
-import { session } from "./claude.js";
+import { session, canResume } from "./claude.js";
 import { invalidateContext } from "./context.js";
 import { appendDraftLog, lastDraftFor } from "./drafts-log.js";
 import { createReplyDraft } from "./gmail-draft.js";
@@ -201,7 +201,7 @@ export async function runChat(job) {
     `base/rules/feedback-loop.md before saving any preference), voice/ playbook/ deals/ stats/ are`,
     `their personal layer — read what you need, and APPEND edits per the feedback loop.`,
     `You cannot send email, and you cannot access Gmail from this session.`,
-    job.sessionId ? "" : history ? `\nConversation so far:\n${history}` : "",
+    canResume(job.sessionId) ? "" : history ? `\nConversation so far:\n${history}` : "",
     threadBlock,
     ``,
     `The creator says:`,

package/worker/ig-stats.js

@@ -0,0 +1,270 @@
+// Live Instagram stats, pulled from the Graph API instead of read off
+// screenshots. Rewrites stats/latest.md (and latest.json) so the drafting
+// agent always has a current media kit inlined.
+//
+// Trigger: refreshStatsIfStale() runs before every draft / outreach pitch.
+// It is cheap (four GETs) and never throws — a failed fetch leaves the last
+// snapshot in place and the staleness rule inside latest.md does the rest.
+//
+// Auth: an Instagram User access token (Instagram API with Instagram Login,
+// scope instagram_business_manage_insights) in ~/.goosetools/ig-token. The
+// dashboard's "Generate access tokens" button issues a 60-day long-lived
+// token; we refresh it ourselves once it is a week old, so it never expires
+// as long as the worker keeps running.
+
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { GOOSE_DIR, STATS_DIR } from "./paths.js";
+
+export const IG_TOKEN_FILE = join(GOOSE_DIR, "ig-token");
+const LATEST_MD = join(STATS_DIR, "latest.md");
+const LATEST_JSON = join(STATS_DIR, "latest.json");
+const GRAPH = "https://graph.instagram.com/v22.0";
+
+/** Refetch when the snapshot is older than this. A brand asking for numbers
+ *  gets at most a week-old window, and usually today's. */
+export const MAX_AGE_DAYS = 7;
+const TOKEN_REFRESH_DAYS = 7;
+const DAY = 86_400_000;
+
+function readToken() {
+  if (!existsSync(IG_TOKEN_FILE)) return null;
+  const t = readFileSync(IG_TOKEN_FILE, "utf8").trim();
+  return t || null;
+}
+
+async function get(token, path, params) {
+  const url = new URL(`${GRAPH}/${path}`);
+  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+  url.searchParams.set("access_token", token);
+  const res = await fetch(url);
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || body.error) {
+    throw new Error(`IG ${path}: ${res.status} ${body.error?.message ?? ""}`.trim());
+  }
+  return body;
+}
+
+/** Long-lived tokens last 60 days; refreshing needs the token to be >24h old. */
+async function maybeRefreshToken(token) {
+  const ageDays = (Date.now() - statSync(IG_TOKEN_FILE).mtimeMs) / DAY;
+  if (ageDays < TOKEN_REFRESH_DAYS) return token;
+  try {
+    const r = await get(token, "refresh_access_token", { grant_type: "ig_refresh_token" });
+    if (r.access_token) {
+      writeFileSync(IG_TOKEN_FILE, r.access_token, { mode: 0o600 });
+      return r.access_token;
+    }
+  } catch (err) {
+    console.error(`· ig token refresh failed (using current token): ${err.message}`);
+  }
+  return token;
+}
+
+const breakdownOf = (insights) =>
+  insights.data?.[0]?.total_value?.breakdowns?.[0]?.results?.map((r) => ({
+    key: r.dimension_values[0],
+    value: r.value,
+  })) ?? [];
+
+/** Pull everything the media kit needs. Pure fetch; no file writes. */
+export async function fetchIgStats(token) {
+  const now = new Date();
+  const since = Math.floor((now.getTime() - 30 * DAY) / 1000);
+  const until = Math.floor(now.getTime() / 1000);
+
+  const profile = await get(token, "me", { fields: "username,followers_count,media_count" });
+
+  const totals = await get(token, "me/insights", {
+    metric: "reach,views,total_interactions,likes,comments,shares,saves,reposts",
+    period: "day",
+    metric_type: "total_value",
+    since: String(since),
+    until: String(until),
+  });
+  const t = Object.fromEntries(
+    (totals.data ?? []).map((m) => [m.name, m.total_value?.value ?? 0]),
+  );
+
+  const demo = {};
+  for (const b of ["gender", "age", "country", "city"]) {
+    const r = await get(token, "me/insights", {
+      metric: "follower_demographics",
+      period: "lifetime",
+      timeframe: "this_month",
+      breakdown: b,
+      metric_type: "total_value",
+    });
+    demo[b] = breakdownOf(r).sort((a, z) => z.value - a.value);
+  }
+
+  const media = await get(token, "me/media", {
+    fields: "id,media_product_type,timestamp",
+    limit: "50",
+  });
+  const cutoff = new Date(now.getTime() - 30 * DAY).toISOString();
+  const recent = (media.data ?? []).filter((m) => m.timestamp > cutoff);
+
+  return {
+    capturedAt: now.toISOString(),
+    windowStart: new Date(since * 1000).toISOString().slice(0, 10),
+    windowEnd: now.toISOString().slice(0, 10),
+    username: profile.username,
+    followers: profile.followers_count,
+    reach: t.reach ?? 0,
+    views: t.views ?? 0,
+    interactions: t.total_interactions ?? 0,
+    likes: t.likes ?? 0,
+    comments: t.comments ?? 0,
+    shares: t.shares ?? 0,
+    saves: t.saves ?? 0,
+    reposts: t.reposts ?? 0,
+    postsPosted: recent.length,
+    reelsPosted: recent.filter((m) => m.media_product_type === "REELS").length,
+    demographics: demo,
+  };
+}
+
+const k = (n) =>
+  n >= 1_000_000
+    ? `${(n / 1_000_000).toFixed(n >= 10_000_000 ? 0 : 1)}M`
+    : n >= 1_000
+      ? `${(n / 1_000).toFixed(n >= 10_000 ? 0 : 1)}K`
+      : String(n);
+const pct = (part, whole) => (whole ? `${((100 * part) / whole).toFixed(1)}%` : "n/a");
+const list = (rows, n, whole) =>
+  rows
+    .slice(0, n)
+    .map((r) => `${r.key} ${pct(r.value, whole)}`)
+    .join(", ");
+
+const AGE_ORDER = ["13-17", "18-24", "25-34", "35-44", "45-54", "55-64", "65+"];
+
+/** The media kit the agent reads. Keeps the same headings the screenshot
+ *  reader wrote, so anything that learned the old layout still works. */
+export function renderLatestMd(s, { screenshotsSection = "" } = {}) {
+  const captured = s.capturedAt.slice(0, 10);
+  const staleOn = new Date(Date.parse(s.capturedAt) + 30 * DAY).toISOString().slice(0, 10);
+  const g = s.demographics.gender ?? [];
+  const known = g.filter((r) => r.key === "M" || r.key === "F");
+  const knownTotal = known.reduce((a, r) => a + r.value, 0);
+  const men = known.find((r) => r.key === "M")?.value ?? 0;
+  const women = known.find((r) => r.key === "F")?.value ?? 0;
+  const ages = (s.demographics.age ?? []).slice();
+  const ageTotal = ages.reduce((a, r) => a + r.value, 0);
+  ages.sort((a, z) => AGE_ORDER.indexOf(a.key) - AGE_ORDER.indexOf(z.key));
+  const core = ages
+    .filter((r) => ["18-24", "25-34", "35-44"].includes(r.key))
+    .reduce((a, r) => a + r.value, 0);
+  const countryTotal = (s.demographics.country ?? []).reduce((a, r) => a + r.value, 0);
+  const cityTotal = (s.demographics.city ?? []).reduce((a, r) => a + r.value, 0);
+  const eng = pct(s.interactions, s.reach);
+
+  return `# @${s.username} — media kit
+
+_Source: Instagram Graph API (live). Window: ${s.windowStart} to ${s.windowEnd} (30 days). Captured ${captured}._
+
+## STALENESS RULE (read before using any number below)
+- This snapshot is **current only within 30 days of its capture date** (line above). Compare against
+  today's date. Captured ${captured} means it goes stale on ${staleOn}.
+- If stale: do **not** put any of these numbers or the screenshots in a draft, even when a brand asks.
+  Write the sentence as "I can send over current reach and audience numbers" and add the flag
+  \`"stats stale since ${staleOn} — refresh before sending"\` to the decision JSON so Erin refreshes.
+- If current: numbers go out only when asked (see \`playbook/negotiation.md\`, standing rule).
+
+## Headline (30 days)
+- **Followers:** ${s.followers.toLocaleString("en-US")} (~${k(s.followers)})
+- **Views:** ${k(s.views)}
+- **Accounts reached:** ${k(s.reach)}
+- **Posts:** ${s.postsPosted} (${s.reelsPosted} Reels)
+
+## Engagement (30 days)
+- Likes ${k(s.likes)} · Comments ${k(s.comments)} · Reposts ${k(s.reposts)} · Shares ${k(s.shares)} · Saves ${k(s.saves)}
+- ~${k(s.interactions)} total interactions → **~${eng} engagement by reach**
+
+## Audience (followers)
+- **Gender:** ${pct(men, knownTotal)} men / ${pct(women, knownTotal)} women (of followers who state one)
+- **Age:** ${ages.map((r) => `${r.key} = ${pct(r.value, ageTotal)}`).join(", ")} — ~${pct(core, ageTotal)} aged 18–44.
+- **Top countries:** ${list(s.demographics.country ?? [], 5, countryTotal)}
+- **Top cities:** ${list(s.demographics.city ?? [], 5, cityTotal)}
+- **Niche:** developers / engineers / tech workers (coding, dev life, WFH).
+
+## How to present reach (only when a brand asks for stats / media kit)
+Lead with views/reach, then note that content performs well above the follower count when it does.
+e.g. "Over the last 30 days my Reels pulled ~${k(s.views)} views and reached ~${k(s.reach)} accounts, with ~${eng}
+engagement by reach. Audience is mostly developers, engineers, and tech workers."
+Use these exact figures, never ones from older drafts or the voice file. Never use this framing
+unprompted, to justify a rate, or to correct a brand's benchmark.
+
+${screenshotsSection.trim() || `## Screenshots to attach on request
+Screenshots live in \`screenshots/\`; newest by date prefix is current. If none are newer than this
+snapshot's window, say the numbers come from Instagram's own insights and offer a screenshot on request.`}
+`;
+}
+
+/** Capture date of the current snapshot, or null if there is none. */
+export function snapshotCapturedAt() {
+  if (existsSync(LATEST_JSON)) {
+    try {
+      return JSON.parse(readFileSync(LATEST_JSON, "utf8")).capturedAt ?? null;
+    } catch {
+      /* fall through to the markdown */
+    }
+  }
+  if (!existsSync(LATEST_MD)) return null;
+  const m = readFileSync(LATEST_MD, "utf8").match(/Captured (\d{4}-\d{2}-\d{2})/);
+  return m ? m[1] : null;
+}
+
+/** Fetch now and rewrite latest.md/json. Returns the stats object. */
+export async function refreshStats() {
+  let token = readToken();
+  if (!token) throw new Error(`no Instagram token at ${IG_TOKEN_FILE}`);
+  token = await maybeRefreshToken(token);
+  const stats = await fetchIgStats(token);
+
+  // Keep the screenshot list only if it has a capture inside this window;
+  // June screenshots next to September numbers would contradict the kit.
+  const prior = existsSync(LATEST_MD) ? readFileSync(LATEST_MD, "utf8") : "";
+  const shotsSection = prior.match(/## Screenshots to attach on request[\s\S]*$/)?.[0] ?? "";
+  const shotDates = [...shotsSection.matchAll(/screenshots\/(\d{4}-\d{2}-\d{2})/g)].map((m) => m[1]);
+  const shots = shotDates.some((d) => d >= stats.windowStart) ? shotsSection : "";
+  writeFileSync(LATEST_MD, renderLatestMd(stats, { screenshotsSection: shots }));
+  writeFileSync(LATEST_JSON, JSON.stringify(stats, null, 2));
+  return stats;
+}
+
+/**
+ * The pre-draft hook. Refreshes when the snapshot is older than MAX_AGE_DAYS
+ * (or missing). Never throws: no token, network down, or a Meta error all
+ * leave the previous snapshot alone and log one line.
+ */
+export async function refreshStatsIfStale({ maxAgeDays = MAX_AGE_DAYS, log = console } = {}) {
+  if (!readToken()) return { refreshed: false, reason: "no-token" };
+  const at = snapshotCapturedAt();
+  const ageDays = at ? (Date.now() - Date.parse(at)) / DAY : Infinity;
+  if (ageDays < maxAgeDays) return { refreshed: false, reason: "fresh", ageDays };
+  try {
+    const s = await refreshStats();
+    log.log(
+      `· ig stats refreshed: ${k(s.followers)} followers, ${k(s.views)} views / ${k(s.reach)} reach (30d)`,
+    );
+    return { refreshed: true, stats: s };
+  } catch (err) {
+    log.error(`· ig stats refresh failed (keeping last snapshot): ${err.message}`);
+    return { refreshed: false, reason: "error", error: err.message };
+  }
+}
+
+// `node worker/ig-stats.js` — refresh on demand from a terminal.
+if (process.argv[1] && process.argv[1].endsWith("ig-stats.js")) {
+  refreshStats()
+    .then((s) => {
+      console.log(readFileSync(LATEST_MD, "utf8"));
+      console.log(`wrote ${LATEST_MD} (captured ${s.capturedAt})`);
+    })
+    .catch((err) => {
+      console.error(err.message);
+      process.exit(1);
+    });
+}

package/worker/index.js

@@ -13,6 +13,7 @@ import { api, syncAssets, BASE_URL, POLL_MS, TOKEN } from "./api.js";
 import { BRAND_DIR, ensureDirs } from "./paths.js";
 import { buildMirror } from "./mirror.js";
 import { runOutreachChat, runOutreachDraft } from "./outreach.js";
+import { setAgent } from "./claude.js";
 import {
   runChat,
   runDraft,
@@ -22,6 +23,14 @@ import {
   runStats,
   runVoiceAudit,
 } from "./handlers.js";
+import { acquireWorkerLock } from "./lock.js";
+
+// One worker of each kind per machine — a second one would split the queue
+// with this one. Stands down with an explanation if another already holds it.
+acquireWorkerLock("brand", {
+  label: "The Brand Manager worker",
+  stopHint: "launchctl bootout gui/$(id -u)/com.goosetools.brand   (or close its terminal)",
+});
 
 if (!TOKEN) {
   console.error(
@@ -37,6 +46,9 @@ console.log(`brand worker → ${BASE_URL}`);
 console.log(`files        → ${BRAND_DIR}`);
 
 async function handle(job) {
+  // The claim payload says which agent CLI the user picked; handlers and the
+  // claude.js delegates read it for the duration of this job.
+  setAgent(job.agentCli);
   switch (job.kind) {
     case "index": {
       // Pure local read — no Gmail needed, so this works with nothing else

package/worker/lock.js

@@ -0,0 +1,103 @@
+// One worker of each kind per machine.
+//
+// Nothing stops you starting a second worker: the daemon runs in the
+// background, and `run` in a terminal is the normal way to watch one work or
+// to try a change from a checkout. Both then poll the same queue with the same
+// token.
+//
+// The server is safe — claiming a job is a single compare-and-set, so two
+// workers never get the same one. The damage is quieter than that. They SPLIT
+// the queue, so jobs land on whichever copy happened to pick them up: half
+// from the code you're editing, half from the installed release, with a
+// different state directory behind each. And the polling doubles, which is
+// what the idle interval exists to keep down in the first place.
+//
+// So: whoever gets here first holds the lock, and the second one stands down
+// with an explanation instead of quietly competing.
+
+import { execFileSync } from "node:child_process";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const LOCK_DIR = join(homedir(), ".goosetools", "locks");
+
+/**
+ * Take the lock for `name` ("worker", "caption", "brand", "overlay"), or print
+ * who has it and exit. Returns nothing — it either succeeds or ends the
+ * process.
+ *
+ * `stopHint` is the command that stops the OTHER copy, and it's the whole
+ * point of the message: "already running" without it just moves the puzzle.
+ */
+export function acquireWorkerLock(name, { label, stopHint }) {
+  mkdirSync(LOCK_DIR, { recursive: true });
+  const file = join(LOCK_DIR, `${name}.pid`);
+
+  const holder = readHolder(file);
+  if (holder && isAlive(holder.pid)) {
+    console.log(
+      `\n${label} is already running on this computer (pid ${holder.pid}${
+        holder.since ? `, since ${holder.since}` : ""
+      }).\n\n` +
+        "Two of them would split the queue between them — some jobs done by\n" +
+        "one copy, some by the other. Stopping here instead.\n\n" +
+        `  Stop the other one:  ${stopHint}\n`,
+    );
+    process.exit(0);
+  }
+
+  // Either no lock, or one left behind by a worker that was killed. Both are
+  // ours to take: an O_EXCL create loses to a worker that beat us here by
+  // milliseconds, which is the one race worth caring about.
+  if (holder) rmSync(file, { force: true });
+  let fd;
+  try {
+    fd = openSync(file, "wx");
+  } catch {
+    console.log(`\n${label} started somewhere else a moment ago. Stopping here.\n`);
+    process.exit(0);
+  }
+  writeSync(fd, `${process.pid}\n${new Date().toISOString()}\n`);
+  closeSync(fd);
+
+  const release = () => rmSync(file, { force: true });
+  process.on("exit", release);
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(sig, () => {
+      release();
+      process.exit(0);
+    });
+  }
+}
+
+function readHolder(file) {
+  if (!existsSync(file)) return null;
+  try {
+    const [pid, since] = readFileSync(file, "utf8").split("\n");
+    const n = Number.parseInt(pid, 10);
+    return Number.isFinite(n) ? { pid: n, since: since?.trim() || null } : null;
+  } catch {
+    return null;
+  }
+}
+
+// A pid file outlives a SIGKILLed worker, and pids get reused — so "is that
+// pid alive" isn't enough on its own. Checking that it's a node process is
+// cheap and rules out the reuse case that would otherwise lock out the daemon
+// until someone deleted the file by hand.
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return false;
+  }
+  try {
+    return /node/.test(execFileSync("ps", ["-p", String(pid), "-o", "command="], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }));
+  } catch {
+    return false;
+  }
+}

package/worker/outreach.js

@@ -13,7 +13,8 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { BASE_DIR, BRAND_DIR, PLAYBOOK_DIR, STATS_DIR, VOICE_DIR } from "./paths.js";
-import { oneShot, parseJson, session } from "./claude.js";
+import { refreshStatsIfStale } from "./ig-stats.js";
+import { oneShot, parseJson, session, canResume } from "./claude.js";
 import { createGmailDraft } from "./gmail-draft.js";
 
 const read = (p, cap = 20_000) =>
@@ -60,7 +61,7 @@ function historyBlock(history) {
  */
 export async function runOutreachChat(job) {
   const prompt = `${outreachMode()}
-${job.sessionId ? "" : historyBlock(job.history)}
+${canResume(job.sessionId) ? "" : historyBlock(job.history)}
 ## This turn
 
 The creator says: "${job.instruction ?? ""}"
@@ -104,6 +105,7 @@ export async function runOutreachDraft(job) {
   if (!job.gmailAccessToken)
     return { ok: false, error: "Connect Gmail on goosetools.com first" };
 
+  await refreshStatsIfStale();
   const prompt = `${outreachMode()}
 
 ## The creator's layers (personal wins over base on any conflict)

package/worker/service.js

@@ -62,7 +62,16 @@ function servicePath() {
     npmGlobalBin(),
     ...(process.platform === "win32"
       ? [process.env.PATH ?? ""]
-      : ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"]),
+      : [
+          "/opt/homebrew/bin",
+          "/usr/local/bin",
+          // opencode's installer and some npm setups drop binaries here.
+          `${process.env.HOME ?? ""}/.local/bin`,
+          "/usr/bin",
+          "/bin",
+          "/usr/sbin",
+          "/sbin",
+        ]),
   ].filter(Boolean);
   return [...new Set(parts)].join(process.platform === "win32" ? ";" : ":");
 }