npm - social-autoposter - Versions diffs - 1.3.3 → 1.3.4 - Mend

social-autoposter 1.3.3 → 1.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/bin/server.js +41 -12
package/package.json +1 -1
package/scripts/dm_short_links.py +150 -56

package/bin/server.js CHANGED Viewed

@@ -3562,10 +3562,16 @@ async function handleApi(req, res) {
       const rows = await pq(q);
       let events = (rows && rows.length && rows[0].json_agg) ? rows[0].json_agg : [];
       // Non-admin: drop events not tagged with an allowed project (including
-      // octolens mentions, which have no project column).
+      // octolens mentions, which have no project column). Strip Claude cost
+      // fields; cost is operator-internal (API spend not charged to clients).
       if (!req.user.admin) {
         const allowed = new Set(req.user.projects);
         events = events.filter(e => e.project && allowed.has(e.project));
+        events.forEach(e => {
+          delete e.cost_usd;
+          delete e.cost_usd_orchestrator;
+          delete e.cost_usd_estimated;
+        });
       }
       return json(res, { events });
     })().catch(e => json(res, { error: e.message }, 500));
@@ -6510,7 +6516,7 @@ const HTML = `<!DOCTYPE html>
       <button type="button" class="style-stats-pill" data-value="30d">Last 30d</button>
     </div>
   </div>
-  <details class="style-stats-section" id="cost-stats" open>
+  <details class="style-stats-section sa-admin-only" id="cost-stats" open>
     <summary>
       <span class="style-stats-title"><span class="style-stats-caret">&#9654;</span><span id="cost-stats-heading">Cost per Activity (last 24 hours)</span></span>
       <span class="style-stats-total" id="cost-stats-total"></span>
@@ -6785,7 +6791,7 @@ const HTML = `<!DOCTYPE html>
           <th class="activity-sortable" data-sort="summary">
             <span class="activity-header-label">What <span class="activity-sort-arrow" data-sort-arrow="summary"></span></span>
           </th>
-          <th style="width:90px;text-align:right;" class="activity-sortable" data-sort="cost_usd">
+          <th style="width:90px;text-align:right;" class="activity-sortable sa-admin-only" data-sort="cost_usd">
             <span class="activity-header-label">Cost <span class="activity-sort-arrow" data-sort-arrow="cost_usd"></span></span>
           </th>
           <th style="width:40px;text-align:center;">
@@ -9128,6 +9134,27 @@ async function handleDeleteBtnClick(btn) {
   _saDelFailed.delete(payload.key);
   btn.classList.add('is-loading');
   btn.setAttribute('title', 'sending...');
+  // Optimistic add: the Resend roundtrip is ~15s and the activity table can
+  // re-render mid-flight, detaching this button node from the DOM. The fresh
+  // button reads _saDelPending at render time, so adding the key up-front
+  // guarantees the new button paints pending immediately instead of
+  // reverting to the default trash icon.
+  _saDelPending.add(payload.key);
+  const applyPendingState = () => {
+    document.querySelectorAll('button.sa-del-btn[data-sa-del-payload]').forEach(b => {
+      let k = null;
+      try {
+        const raw = b.getAttribute('data-sa-del-payload') || '';
+        if (raw) k = JSON.parse(decodeURIComponent(escape(atob(raw)))).key;
+      } catch {}
+      if (k === payload.key) {
+        b.classList.remove('is-loading', 'is-failed');
+        b.classList.add('is-pending');
+        b.setAttribute('title', 'pending deletion');
+        b.setAttribute('aria-label', 'pending deletion');
+      }
+    });
+  };
   try {
     const r = await fetch('/api/activity/mark-deletion', {
       method: 'POST',
@@ -9135,19 +9162,18 @@ async function handleDeleteBtnClick(btn) {
       body: JSON.stringify(payload),
     });
     const j = await r.json().catch(() => ({}));
-    btn.classList.remove('is-loading');
     if (r.ok && (j.status === 'pending' || j.already_existed)) {
-      _saDelPending.add(payload.key);
-      btn.classList.add('is-pending');
-      btn.setAttribute('title', 'pending deletion');
-      btn.setAttribute('aria-label', 'pending deletion');
+      applyPendingState();
     } else {
+      _saDelPending.delete(payload.key);
       _saDelFailed.add(payload.key);
+      btn.classList.remove('is-loading');
       btn.classList.add('is-failed');
       const msg = (j && j.error) ? String(j.error) : ('HTTP ' + r.status);
       btn.setAttribute('title', 'failed: ' + msg + ' (click to retry)');
     }
   } catch (e) {
+    _saDelPending.delete(payload.key);
     btn.classList.remove('is-loading');
     _saDelFailed.add(payload.key);
     btn.classList.add('is-failed');
@@ -9395,7 +9421,7 @@ async function loadActivityStats() {
 // post's first-ever snapshot so day 1 never attributes lifetime counts
 // to a capture day; expect those lines to sit at 0 until at least two
 // consecutive days of snapshots have accumulated per post.
-const DAILY_METRICS = [
+let DAILY_METRICS = [
   { id: 'views',           label: 'Views',             color: '#6366f1', endpoint: '/api/views/per-day',    valueKey: 'views_gained',     platformAware: true },
   { id: 'upvotes',         label: 'Upvotes',           color: '#f97316', endpoint: '/api/upvotes/per-day',  valueKey: 'upvotes_gained',   platformAware: true },
   { id: 'comments',        label: 'Comments',          color: '#14b8a6', endpoint: '/api/comments/per-day', valueKey: 'comments_gained',  platformAware: true },
@@ -9408,7 +9434,7 @@ const DAILY_METRICS = [
   // platformAware: filters cost to the chosen platform's activity rows.
   // format: 'usd' so the legend pill, Y-axis ticks, bar labels, and
   // hover tooltip render as dollars (e.g. $12.34) instead of K/M counts.
-  { id: 'cost',            label: 'Cost (USD)',        color: '#dc2626', endpoint: '/api/cost/per-day',     valueKey: 'cost_usd',         platformAware: true,  format: 'usd' },
+  { id: 'cost',            label: 'Cost (USD)',        color: '#dc2626', endpoint: '/api/cost/per-day',     valueKey: 'cost_usd',         platformAware: true,  format: 'usd', adminOnly: true },
   // All funnel metrics count UNIQUE VISITORS (distinct_id), not raw events.
   // A user iterating on the same project (multiple prompts, multiple
   // schedule retries, multiple pageviews) is 1, not N. See
@@ -10108,6 +10134,7 @@ async function loadDailyMetrics() {
   const qsAware = platformAwareParams.join('&');
   const qsProj  = projectOnlyParams.join('&');
   try {
+    const costAvail = window.SA_IS_ADMIN !== false;
     const [views, upvotes, comments, clicks, bookings, funnel, cost] = await Promise.all([
       fetchOne('/api/views/per-day?'    + qsAware),
       fetchOne('/api/upvotes/per-day?'  + qsAware),
@@ -10115,7 +10142,7 @@ async function loadDailyMetrics() {
       fetchOne('/api/clicks/per-day?'   + qsAware),
       fetchOne('/api/bookings/per-day?' + qsProj),
       fetchOne('/api/funnel/per-day?'   + qsProj),
-      fetchOne('/api/cost/per-day?'     + qsAware),
+      costAvail ? fetchOne('/api/cost/per-day?' + qsAware) : Promise.resolve({ rows: [], failed: false }),
     ]);
     const allFailed = [views, upvotes, comments, clicks, bookings, funnel, cost].every(r => r.failed);
     if (allFailed) {
@@ -11414,6 +11441,7 @@ function renderCostStats(payload) {
 let _costStatsLoadedFor = null;
 let _costStatsLoading = false;
 async function loadCostStats(force) {
+  if (window.SA_IS_ADMIN === false) return;
   if (_costStatsLoading) return;
   const hours = currentStatusWindow().hours;
   const row = document.getElementById('cost-stats-platform-pills');
@@ -13884,7 +13912,7 @@ function renderActivity(events) {
         '</div>' +
       '</td>' +
       '<td class="activity-summary">' + summaryHtml + '</td>' +
-      '<td style="text-align:right;font-variant-numeric:tabular-nums;color:var(--text-secondary);">' + fmtCostCell(e.cost_usd, e.cost_usd_orchestrator, e.cost_usd_estimated) + '</td>' +
+      '<td class="sa-admin-only" style="text-align:right;font-variant-numeric:tabular-nums;color:var(--text-secondary);">' + fmtCostCell(e.cost_usd, e.cost_usd_orchestrator, e.cost_usd_estimated) + '</td>' +
       '<td style="text-align:center;">' + renderDeleteBtnHtml(e) + '</td>' +
     '</tr>';
   }).join('');
@@ -14180,6 +14208,7 @@ function saStartApp() {
   document.body.classList.remove('sa-authed-pending');
   const isCloud = document.body.classList.contains('sa-cloud');
   const isAdmin = window.SA_IS_ADMIN !== false;
+  if (!isAdmin) DAILY_METRICS = DAILY_METRICS.filter(m => !m.adminOnly);
   try { window.posthog && window.posthog.capture('dashboard_opened', { is_admin: isAdmin, is_cloud: isCloud }); } catch (e) {}
   // Status + pending are local-only (UI hidden by body.sa-cloud). Endpoints
   // are admin-only too, so skipping them on cloud also stops 403 spam for

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/dm_short_links.py CHANGED Viewed

@@ -522,6 +522,11 @@ def _mint_one_post(conn, *, target_url: str, projects: list, platform: str,
     platform UTMs + code in utm_content), so the LLM's URL in the comment text
     is ignored for routing -- visitors always land on the destination we baked
     in. Pool depth managed by scripts/mint_external_pool.py.
+    Routes DB ops through social-autoposter-website /api/v1/post-links/* so
+    VMs / sandboxes without DATABASE_URL still mint successfully. The `conn`
+    arg is accepted for backward compatibility but ignored. Set
+    SOCIAL_AUTOPOSTER_LEGACY_NEON=1 to fall back to the direct-Neon path.
     """
     target_url = _ensure_scheme((target_url or '').strip())
     if not target_url or target_url == 'https://':
@@ -540,45 +545,68 @@ def _mint_one_post(conn, *, target_url: str, projects: list, platform: str,
             'detail': f"no website for project={project_name!r} in config.json",
         }
+    platform_norm = (platform or '').lower()
+    if platform_norm == 'x':
+        platform_norm = 'twitter'
     project_cfg = next((p for p in projects if p.get('name') == project_name), None)
+    use_legacy = os.environ.get('SOCIAL_AUTOPOSTER_LEGACY_NEON') == '1'
     if project_cfg and project_cfg.get('external_short_links'):
-        # Pool path. Atomically claim the oldest unclaimed pool row matching
-        # (project_name, platform). FOR UPDATE SKIP LOCKED makes concurrent
-        # cycles take different rows instead of contending on the same one.
-        platform_norm = (platform or '').lower()
-        if platform_norm == 'x':
-            platform_norm = 'twitter'
-        cur = conn.execute(
-            "SELECT code, target_url FROM post_links "
-            "WHERE project_name = %s AND platform = %s "
-            "  AND post_id IS NULL AND reply_id IS NULL "
-            "  AND minted_session LIKE 'pool:%%' "
-            "ORDER BY minted_at ASC LIMIT 1 FOR UPDATE SKIP LOCKED",
-            (project_name, platform_norm),
-        )
-        row = cur.fetchone()
-        if not row:
-            return {
-                'ok': False,
-                'error': 'pool_exhausted',
-                'project': project_name,
-                'platform': platform_norm,
-                'detail': (f"external_short_links pool empty for {project_name}/{platform_norm}; "
-                           f"re-mint via scripts/mint_external_pool.py and send updated CSV to client"),
-            }
-        row = dict(row)
-        pool_code = row['code']
-        pool_target = row['target_url']
-        # Re-stamp minted_session with the caller's session so backfill_post_id /
-        # backfill_reply_id finds this row when log_post returns. Without this,
-        # the pool row's minted_session stays 'pool:<slug>-<platform>' and the
-        # backfill UPDATE matches nothing.
-        conn.execute(
-            "UPDATE post_links SET minted_session = %s "
-            "WHERE code = %s",
-            (minted_session, pool_code),
-        )
-        conn.commit()
+        # Pool path. Atomically claim the oldest unclaimed pool row.
+        if use_legacy:
+            cur = conn.execute(
+                "SELECT code, target_url FROM post_links "
+                "WHERE project_name = %s AND platform = %s "
+                "  AND post_id IS NULL AND reply_id IS NULL "
+                "  AND minted_session LIKE 'pool:%%' "
+                "ORDER BY minted_at ASC LIMIT 1 FOR UPDATE SKIP LOCKED",
+                (project_name, platform_norm),
+            )
+            row = cur.fetchone()
+            if not row:
+                return {
+                    'ok': False,
+                    'error': 'pool_exhausted',
+                    'project': project_name,
+                    'platform': platform_norm,
+                }
+            row = dict(row)
+            pool_code = row['code']
+            pool_target = row['target_url']
+            conn.execute(
+                "UPDATE post_links SET minted_session = %s WHERE code = %s",
+                (minted_session, pool_code),
+            )
+            conn.commit()
+        else:
+            sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+            from http_api import api_post
+            try:
+                resp = api_post(
+                    "/api/v1/post-links/claim-pool",
+                    {
+                        "project_name": project_name,
+                        "platform": platform_norm,
+                        "minted_session": minted_session,
+                    },
+                    ok_on_conflict=True,
+                )
+            except Exception as e:
+                return {'ok': False, 'error': 'api_unreachable', 'detail': str(e)}
+            if not resp or not resp.get('ok'):
+                err = (resp or {}).get('error') or {}
+                code = err.get('code') if isinstance(err, dict) else None
+                return {
+                    'ok': False,
+                    'error': code or 'pool_exhausted',
+                    'project': project_name,
+                    'platform': platform_norm,
+                    'detail': err.get('message') if isinstance(err, dict) else str(err),
+                }
+            data = resp.get('data') or {}
+            pool_code = data.get('code')
+            pool_target = data.get('target_url')
         return {
             'ok': True,
             'code': pool_code,
@@ -596,22 +624,54 @@ def _mint_one_post(conn, *, target_url: str, projects: list, platform: str,
         platform=platform,
     )
-    # Posts mint fresh codes every call — no idempotency on (post_id, target_url)
-    # because post_id is NULL at mint time. The minted_session UUID groups the
-    # codes so the caller can backfill them all in one UPDATE after log_post
-    # returns. If a wrap is retried (rare), we get duplicate codes pointing at
-    # the same target_url; orphans of failed posts are bounded and harmless.
+    # Fresh mint: try up to 8 random codes before giving up on collision.
+    if use_legacy:
+        for _ in range(8):
+            code = _gen_code()
+            try:
+                conn.execute(
+                    "INSERT INTO post_links (code, platform, project_name, "
+                    "       target_url, kind, project_at_mint, minted_session) "
+                    "VALUES (%s, %s, %s, %s, %s, %s, %s)",
+                    (code, platform, project_name, final_target, kind,
+                     matched_project, minted_session),
+                )
+                conn.commit()
+                return {
+                    'ok': True,
+                    'code': code,
+                    'short_url': f"{website}/r/{code}",
+                    'target_url': final_target,
+                    'kind': kind,
+                }
+            except Exception as e:
+                if 'duplicate key' in str(e).lower() and 'post_links_pkey' in str(e).lower():
+                    conn.execute("ROLLBACK")
+                    continue
+                raise
+        return {'ok': False, 'error': 'code_collision_after_8_tries'}
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from http_api import api_post
     for _ in range(8):
         code = _gen_code()
         try:
-            conn.execute(
-                "INSERT INTO post_links (code, platform, project_name, "
-                "       target_url, kind, project_at_mint, minted_session) "
-                "VALUES (%s, %s, %s, %s, %s, %s, %s)",
-                (code, platform, project_name, final_target, kind,
-                 matched_project, minted_session),
+            resp = api_post(
+                "/api/v1/post-links/mint",
+                {
+                    "code": code,
+                    "platform": platform,
+                    "project_name": project_name,
+                    "target_url": final_target,
+                    "kind": kind,
+                    "project_at_mint": matched_project,
+                    "minted_session": minted_session,
+                },
+                ok_on_conflict=True,
             )
-            conn.commit()
+        except Exception as e:
+            return {'ok': False, 'error': 'api_unreachable', 'detail': str(e)}
+        if resp and resp.get('ok'):
             return {
                 'ok': True,
                 'code': code,
@@ -619,11 +679,15 @@ def _mint_one_post(conn, *, target_url: str, projects: list, platform: str,
                 'target_url': final_target,
                 'kind': kind,
             }
-        except Exception as e:
-            if 'duplicate key' in str(e).lower() and 'post_links_pkey' in str(e).lower():
-                conn.execute("ROLLBACK")
-                continue
-            raise
+        err = (resp or {}).get('error') or {}
+        err_code = err.get('code') if isinstance(err, dict) else None
+        if err_code == 'code_collision':
+            continue  # try another random code
+        return {
+            'ok': False,
+            'error': err_code or 'mint_api_error',
+            'detail': err.get('message') if isinstance(err, dict) else str(err),
+        }
     return {'ok': False, 'error': 'code_collision_after_8_tries'}
@@ -653,7 +717,11 @@ def wrap_text_for_post(*, text: str, platform: str, project_name: str) -> dict:
     minted_session = str(uuid.uuid4())
     projects = _load_projects()
-    conn = dbmod.get_conn()
+    # Conn is only opened for the legacy direct-Neon path (env-gated). The
+    # default API path doesn't need it; lazy-open avoids a wasted Neon
+    # connection on VMs that don't have DATABASE_URL.
+    use_legacy = os.environ.get('SOCIAL_AUTOPOSTER_LEGACY_NEON') == '1'
+    conn = dbmod.get_conn() if use_legacy else None
     try:
         seen = {}
         codes = []
@@ -704,7 +772,26 @@ def wrap_text_for_post(*, text: str, platform: str, project_name: str) -> dict:
             'skipped': skipped,
         }
     finally:
-        conn.close()
+        if conn is not None:
+            conn.close()
+def _backfill_via_api(*, minted_session: str, post_id: int | None = None,
+                      reply_id: int | None = None) -> int:
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from http_api import api_post
+    body: dict = {"minted_session": minted_session}
+    if post_id is not None:
+        body["post_id"] = int(post_id)
+    if reply_id is not None:
+        body["reply_id"] = int(reply_id)
+    try:
+        resp = api_post("/api/v1/post-links/backfill", body)
+    except Exception:
+        return 0
+    if not resp or not resp.get('ok'):
+        return 0
+    return int((resp.get('data') or {}).get('updated') or 0)
 def backfill_post_id(*, minted_session: str, post_id: int) -> int:
@@ -714,9 +801,14 @@ def backfill_post_id(*, minted_session: str, post_id: int) -> int:
     Caller should NOT raise on rowcount==0 because some posts have no URLs
     and minted_session was None — the caller should skip the backfill in
     that case.
+    Routes through /api/v1/post-links/backfill by default. Set
+    SOCIAL_AUTOPOSTER_LEGACY_NEON=1 for the direct-Neon path.
     """
     if not minted_session or post_id is None:
         return 0
+    if os.environ.get('SOCIAL_AUTOPOSTER_LEGACY_NEON') != '1':
+        return _backfill_via_api(minted_session=minted_session, post_id=post_id)
     conn = dbmod.get_conn()
     try:
         cur = conn.execute(
@@ -735,6 +827,8 @@ def backfill_reply_id(*, minted_session: str, reply_id: int) -> int:
     writes to the `replies` table, not `posts`)."""
     if not minted_session or reply_id is None:
         return 0
+    if os.environ.get('SOCIAL_AUTOPOSTER_LEGACY_NEON') != '1':
+        return _backfill_via_api(minted_session=minted_session, reply_id=reply_id)
     conn = dbmod.get_conn()
     try:
         cur = conn.execute(