social-autoposter 1.6.13 → 1.6.14

package/bin/cli.js

@@ -153,20 +153,20 @@ function isAppMakerVm() {
 // AppMaker-specific TWITTER_CDP_URL before its `${VAR:-default}` fallback hits.
 // Idempotent: rewrites the file every invocation so a config edit on the VM
 // can't drift away from what cli.js intends.
-function writeAppMakerEnvFile() {
+function writeAppMakerEnvFile(handleFromDb) {
   const envPath = path.join(HOME, '.social-autoposter-env');
-  // Preserve a previously-set AUTOPOSTER_TWITTER_HANDLE across rewrites. This
-  // is per-VM state (which @handle this sandbox posts as) and is NOT something
-  // the generic bootstrap knows — the operator sets it once after login, and
-  // the cycle + restore_twitter_session.py read it via twitter_account.resolve_handle().
-  // The sandbox's config.json (which also carries the handle) gets reseeded
-  // from /etc/skel-root on substitution, so the env var is the durable home.
-  let preservedHandle = '';
-  try {
-    const prev = fs.readFileSync(envPath, 'utf8');
-    const m = prev.match(/^\s*export\s+AUTOPOSTER_TWITTER_HANDLE=(.+)\s*$/m);
-    if (m) preservedHandle = m[1].trim();
-  } catch { /* no prior file */ }
+  // Source of truth for the handle is the DB (social_accounts.handle keyed by
+  // vm_session_key). bootstrap-vm passes it in. Fallback: preserve a previously
+  // set value across rewrites if no DB-sourced handle was provided (matters
+  // when this runs from `social-autoposter update` without a fresh DB fetch).
+  let preservedHandle = String(handleFromDb || '').trim().replace(/^@/, '');
+  if (!preservedHandle) {
+    try {
+      const prev = fs.readFileSync(envPath, 'utf8');
+      const m = prev.match(/^\s*export\s+AUTOPOSTER_TWITTER_HANDLE=(.+)\s*$/m);
+      if (m) preservedHandle = m[1].trim();
+    } catch { /* no prior file */ }
+  }
 
   const lines = [
     '# social-autoposter per-host env overrides',
@@ -290,6 +290,115 @@ function applyAppMakerMcpConfigOverrides() {
 // uv installed and broke Phase 1's Claude scan (the MCP server's `command:
 // /root/.local/bin/uv` resolved to ENOENT, Claude got no tools, returned an
 // empty envelope).
+// AppMaker VM self-bootstrap. Single entry point that the appmaker template
+// startup.sh calls on every fresh sandbox boot. Reads the stable sessionKey
+// from /run/mk0r-session.json (which the appmaker bridge rewrites on every
+// session bind, and which survives E2B sandbox substitution — only the
+// sandboxId changes), then asks the social-autoposter HTTP API which Twitter
+// account this VM is bound to (handle + stored login cookies, keyed by
+// social_accounts.vm_session_key). With that single DB answer it sets up
+// everything: env file (with the DB-sourced handle), profile symlink, MCP
+// config (BH_PORT=9222), uuid-runtime, then restores the Twitter login by
+// re-injecting the stored cookies via CDP.
+//
+// This is the "one proper fix" for sandbox substitution: the VM holds no
+// per-VM state on disk — the DB does, keyed by the stable sessionKey. So
+// any fresh sandbox can rebuild itself by reading /run/mk0r-session.json
+// and calling one route.
+function bootstrapVm() {
+  if (!isAppMakerVm()) {
+    console.error('bootstrap-vm: not an AppMaker VM (no /opt/startup.sh + CDP :9222). Use `init` or `update` on dev boxes.');
+    process.exit(2);
+  }
+  console.log('  AppMaker VM bootstrap: resolving identity from DB by sessionKey...');
+
+  let sessionKey;
+  try {
+    const raw = fs.readFileSync('/run/mk0r-session.json', 'utf8');
+    sessionKey = (JSON.parse(raw) || {}).sessionKey;
+  } catch (err) {
+    console.error(`bootstrap-vm: cannot read /run/mk0r-session.json: ${err.message}`);
+    process.exit(3);
+  }
+  if (!sessionKey) {
+    console.error('bootstrap-vm: /run/mk0r-session.json has no sessionKey');
+    process.exit(3);
+  }
+  console.log(`    sessionKey=${sessionKey}`);
+
+  // Get the X-Installation header via identity.py (same Python helper http_api.py
+  // uses, so auth stays single-sourced).
+  const identityPath = path.join(PKG_ROOT, 'scripts', 'identity.py');
+  const headerRes = spawnSync('/usr/bin/python3', [identityPath, 'header'], {
+    encoding: 'utf8',
+  });
+  if (headerRes.status !== 0) {
+    console.error(`bootstrap-vm: identity.py header failed: ${headerRes.stderr || headerRes.error}`);
+    process.exit(4);
+  }
+  const installHeader = (headerRes.stdout || '').trim();
+
+  const base = (process.env.AUTOPOSTER_API_BASE || 'https://s4l.ai').replace(/\/+$/, '');
+  const url = `${base}/api/v1/twitter/vm-session?session_key=${encodeURIComponent(sessionKey)}`;
+  console.log(`    GET ${url}`);
+
+  // Use curl (always present on the appmaker template) so we don't pull in
+  // a Node HTTP dep here.
+  const curl = spawnSync('curl', [
+    '-sS', '--max-time', '15',
+    '-H', `X-Installation: ${installHeader}`,
+    '-H', 'Content-Type: application/json',
+    url,
+  ], { encoding: 'utf8' });
+  if (curl.status !== 0) {
+    console.error(`bootstrap-vm: curl failed: ${curl.stderr || curl.error}`);
+    process.exit(5);
+  }
+  let payload;
+  try {
+    payload = JSON.parse(curl.stdout || '{}');
+  } catch (err) {
+    console.error(`bootstrap-vm: bad JSON from API: ${curl.stdout.slice(0, 300)}`);
+    process.exit(6);
+  }
+  if (!payload.ok || !payload.data) {
+    console.error(`bootstrap-vm: API error: ${JSON.stringify(payload).slice(0, 300)}`);
+    process.exit(7);
+  }
+  const { handle, cookies, vm_project_id } = payload.data;
+  if (!handle) {
+    console.error('bootstrap-vm: API returned no handle. social_accounts.vm_session_key may be unset for this VM.');
+    process.exit(8);
+  }
+  console.log(`    bound to @${handle} (vm_project_id=${vm_project_id || 'none'}, cookies=${(cookies || []).length})`);
+
+  // Write env file with DB-sourced handle (durable across `social-autoposter update`).
+  writeAppMakerEnvFile(handle);
+
+  // Existing setup steps. installBrowserHarness already installs uuid-runtime,
+  // symlinks the profile, and patches the MCP config — call it directly.
+  installBrowserHarness();
+
+  // Restore the Twitter login if we have stored cookies and the Chrome is
+  // up. No-op when Chrome isn't reachable yet (startup ordering); the cycle
+  // preflight will run restore_twitter_session.py on its next tick.
+  if ((cookies || []).length > 0) {
+    const restorePath = path.join(HOME, 'social-autoposter', 'scripts', 'restore_twitter_session.py');
+    if (fs.existsSync(restorePath)) {
+      console.log('    invoking restore_twitter_session.py to re-inject cookies...');
+      // Source the env file so AUTOPOSTER_TWITTER_HANDLE / TWITTER_CDP_URL are set.
+      const r = spawnSync('bash', ['-lc',
+        `source ${HOME}/.social-autoposter-env 2>/dev/null; /usr/bin/python3 ${restorePath} || true`,
+      ], { stdio: 'inherit' });
+      void r;
+    }
+  } else {
+    console.log('    no stored cookies; manual login still required this once.');
+  }
+
+  console.log('  bootstrap-vm: done.');
+}
+
 function installBrowserHarness() {
   const onAppMaker = isAppMakerVm();
   if (onAppMaker) {
@@ -745,6 +854,8 @@ if (cmd === 'init') {
   init();
 } else if (cmd === 'update') {
   update();
+} else if (cmd === 'bootstrap-vm') {
+  bootstrapVm();
 } else if (cmd === 'export-cookies') {
   // Forward to cookie-helper with 'export' + remaining args
   process.argv = [process.argv[0], process.argv[1], 'export', ...process.argv.slice(3)];
@@ -762,6 +873,7 @@ if (cmd === 'init') {
   console.log('  npx social-autoposter              open the dashboard');
   console.log('  npx social-autoposter init          first-time setup');
   console.log('  npx social-autoposter update        update scripts, preserve config');
+  console.log('  npx social-autoposter bootstrap-vm  AppMaker VM self-bootstrap (DB-driven)');
   console.log('  npx social-autoposter export-cookies [dir]  export browser cookies');
   console.log('  npx social-autoposter import-cookies [dir]  import browser cookies');
 }

package/bin/server.js

@@ -572,6 +572,17 @@ const PLATFORM_LABELS = {
   hackernews: 'HackerNews', youtube: 'YouTube', instagram: 'Instagram',
 };
 
+// twitter-ripen-freshness-abc variant defs (shipped 2026-05-22). Shared between
+// the /api/experiments endpoint (Experiments tab) and the post-comments-twitter
+// row in the job-history pill render so both surfaces describe a variant the
+// same way. When the experiment ends, drop the desc but keep the keys so old
+// history rows still resolve to something readable.
+const TWITTER_VARIANT_DEFS = {
+  A: { label: 'Control',           desc: 'ripen + 6h freshness (legacy)' },
+  B: { label: 'No-ripen',          desc: 'skip 20-min wait + 6h freshness' },
+  C: { label: 'No-ripen + tight',  desc: 'skip 20-min wait + 1h freshness' },
+};
+
 // Standalone jobs with no platform axis. script_name -> display label.
 const STANDALONE_JOBS = {
   serp_seo: { job_type: 'seo', job_label: 'SERP SEO' },
@@ -1307,7 +1318,7 @@ async function enrichPostCommentsTwitterRuns(runs) {
   const candidateRows = await pq(
     "SELECT discovered_at, posted_at, t1_checked_at, drafted_at, " +
     "       (draft_reply_text IS NOT NULL) AS has_draft, status, batch_id, " +
-    "       matched_project, tweet_url " +
+    "       matched_project, tweet_url, cycle_variant " +
     "FROM twitter_candidates " +
     "WHERE discovered_at >= $1::timestamp OR posted_at >= $1::timestamp OR t1_checked_at >= $1::timestamp OR status='pending'",
     [since]
@@ -1384,9 +1395,34 @@ async function enrichPostCommentsTwitterRuns(runs) {
       batch_id: r.batch_id || '',
       matched_project: r.matched_project || '',
       tweet_url: r.tweet_url || '',
+      cycle_variant: r.cycle_variant || null,
     };
   });
 
+  // Deterministic variant fallback: when a run has an ownBatchId but no
+  // candidate rows yet carry cycle_variant (e.g. Phase 1 aborted before
+  // upserting any row, or rows were rolled back), recompute it the same way
+  // skill/run-twitter-cycle.sh does: sha1(batch_id) % 3 -> 'ABC'. Keeps the
+  // job-history "experiment X" pill populated for scan-only / aborted cycles.
+  // Ship date of twitter-ripen-freshness-abc. Before this, run-twitter-cycle.sh
+  // didn't compute TWITTER_CYCLE_VARIANT and every cycle ran legacy (=variant A
+  // by today's labels). We refuse to back-label those runs from the hash because
+  // it would mislabel them as B/C — they never actually ran those code paths.
+  const EXPERIMENT_SHIP_MS = new Date('2026-05-22T00:00:00').getTime();
+  const variantFromBatchId = (batchId) => {
+    if (!batchId) return null;
+    const batchMs = parseTwitterBatchIdMs(batchId);
+    if (!Number.isFinite(batchMs) || batchMs < EXPERIMENT_SHIP_MS) return null;
+    try {
+      const hex = crypto.createHash('sha1').update(batchId).digest('hex');
+      // Mirror Python's int(hex,16) % 3 exactly. The 160-bit hash doesn't fit
+      // in a JS Number, so use BigInt for the full-width modulus; truncating
+      // hex digits would silently disagree with the shell-side variant.
+      const n = BigInt('0x' + hex);
+      return 'ABC'[Number(n % 3n)];
+    } catch { return null; }
+  };
+
   for (const run of txRuns) {
     const startMs = new Date(run.started_at).getTime();
     const endMs = new Date(run.finished_at).getTime() + 60 * 1000;
@@ -1440,10 +1476,16 @@ async function enrichPostCommentsTwitterRuns(runs) {
         projectsList.push(proj);
       }
     };
+    // Experiment variant (A/B/C) for this run. Primary source: any candidate
+    // row tied to ownBatchId carries cycle_variant (Phase 1 stamps it after
+    // discovery). Fallback: recompute from sha1(ownBatchId) % 3 so scan-only
+    // / aborted cycles still surface the right bucket.
+    let runVariant = null;
     for (const c of candNorm) {
       if (!ownBatchId || c.batch_id !== ownBatchId) continue;
       candidatesPassed++;
       recordProject(c.matched_project);
+      if (!runVariant && c.cycle_variant) runVariant = c.cycle_variant;
       if (c.status === 'posted') {
         posted++;
         // Salvage signature: candidate's discovered_at predates this cycle's
@@ -1622,6 +1664,12 @@ async function enrichPostCommentsTwitterRuns(runs) {
       // pill row so the operator can see at a glance which projects consumed
       // the cycle, even when posted=0. Mirrors enrichPostCommentsRedditRuns.
       projects_worked: projectsList,
+      // A/B/C experiment bucket for this run (twitter-ripen-freshness-abc,
+      // shipped 2026-05-22). Primary source is twitter_candidates.cycle_variant
+      // for any row tied to ownBatchId; falls back to sha1(ownBatchId) % 3 so
+      // scan-only / aborted cycles still surface the variant. Rendered next to
+      // `projects` in the job-history result row.
+      experiment_variant: runVariant || variantFromBatchId(ownBatchId),
       styles_used: stylesUsedTx,
       cost_usd: prior.cost_usd || 0,
       failed: prior.failed || 0,
@@ -5331,6 +5379,109 @@ async function handleApi(req, res) {
     return;
   }
 
+  // GET /api/experiments - currently-running A/B/C tests across the pipeline.
+  // First (and only, for now) experiment is the twitter-cycle variant test
+  // shipped 2026-05-22: variant A = ripen+6h (control), B = no-ripen+6h, C =
+  // no-ripen+1h. Variant assignment lives on twitter_candidates.cycle_variant
+  // (set by skill/run-twitter-cycle.sh from hash(BATCH_ID) % 3). This endpoint
+  // reads that column directly; no separate experiments table yet. When a
+  // second experiment ships we'll either add another block here or promote
+  // to a real table. Admin-only: experimentation state isn't client-facing.
+  if (p === '/api/experiments' && req.method === 'GET') {
+    if (!req.user.admin) return json(res, { error: 'forbidden' }, 403);
+    (async () => {
+      try {
+        // One row per variant, joining candidates -> posts to derive the
+        // post-rate funnel and engagement-on-our-reply. Thread-age-at-discover
+        // p50 uses tweet_posted_at vs discovered_at (we have ~100% coverage on
+        // tweet_posted_at over the experiment window). Engagement is taken from
+        // twitter_candidates.{likes,replies,views} which the stats job refreshes
+        // to T-final values, not the t0/t1 snapshot columns.
+        const rows = await pq(`
+          WITH base AS (
+            SELECT tc.cycle_variant AS variant,
+                   tc.id,
+                   tc.batch_id,
+                   tc.status,
+                   tc.discovered_at,
+                   tc.tweet_posted_at,
+                   tc.posted_at,
+                   tc.post_id,
+                   EXTRACT(EPOCH FROM (tc.discovered_at - tc.tweet_posted_at)) / 60.0 AS thread_age_min,
+                   p.views AS our_views,
+                   p.upvotes AS our_likes,
+                   p.comments_count AS our_replies
+            FROM twitter_candidates tc
+            LEFT JOIN posts p ON p.id = tc.post_id
+            WHERE tc.cycle_variant IS NOT NULL
+              AND tc.cycle_variant IN ('A','B','C')
+              AND tc.discovered_at > NOW() - INTERVAL '30 days'
+          )
+          SELECT variant,
+                 COUNT(*) AS n_candidates,
+                 COUNT(DISTINCT batch_id) AS n_batches,
+                 COUNT(*) FILTER (WHERE status = 'posted') AS n_posted,
+                 COUNT(*) FILTER (WHERE status = 'skipped') AS n_skipped,
+                 COUNT(*) FILTER (WHERE status = 'expired') AS n_expired,
+                 COUNT(*) FILTER (WHERE status = 'pending') AS n_pending,
+                 PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY thread_age_min)
+                   FILTER (WHERE thread_age_min IS NOT NULL) AS thread_age_min_p50,
+                 AVG(our_views) FILTER (WHERE status = 'posted') AS avg_views,
+                 AVG(our_likes) FILTER (WHERE status = 'posted') AS avg_likes,
+                 AVG(our_replies) FILTER (WHERE status = 'posted') AS avg_replies,
+                 MIN(discovered_at) AS started_at
+          FROM base
+          GROUP BY variant
+          ORDER BY variant
+        `, []);
+        const variantDefs = TWITTER_VARIANT_DEFS;
+        const variants = ['A', 'B', 'C'].map(k => {
+          const row = (rows || []).find(r => r.variant === k) || {};
+          const n = Number(row.n_candidates || 0);
+          const posted = Number(row.n_posted || 0);
+          return {
+            key: k,
+            label: variantDefs[k].label,
+            desc: variantDefs[k].desc,
+            n_candidates: n,
+            n_batches: Number(row.n_batches || 0),
+            n_posted: posted,
+            n_skipped: Number(row.n_skipped || 0),
+            n_expired: Number(row.n_expired || 0),
+            n_pending: Number(row.n_pending || 0),
+            post_rate_pct: n > 0 ? (posted / n) * 100 : null,
+            thread_age_min_p50: row.thread_age_min_p50 != null ? Number(row.thread_age_min_p50) : null,
+            avg_views: row.avg_views != null ? Number(row.avg_views) : null,
+            avg_likes: row.avg_likes != null ? Number(row.avg_likes) : null,
+            avg_replies: row.avg_replies != null ? Number(row.avg_replies) : null,
+            started_at: row.started_at || null,
+          };
+        });
+        const totals = variants.reduce((acc, v) => {
+          acc.n_candidates += v.n_candidates;
+          acc.n_posted += v.n_posted;
+          acc.n_batches += v.n_batches;
+          return acc;
+        }, { n_candidates: 0, n_posted: 0, n_batches: 0 });
+        const startedAt = variants.map(v => v.started_at).filter(Boolean).sort()[0] || null;
+        const experiments = [{
+          id: 'twitter-ripen-freshness-abc',
+          name: 'Twitter ripen + freshness (A/B/C)',
+          status: 'running',
+          started_at: startedAt,
+          hypothesis: 'Skipping the 20-min ripen and tightening discover freshness to 1h cuts thread-age-at-discover (p50 ~181 min on legacy) without hurting post-rate.',
+          primary_metric: 'thread_age_min_p50',
+          totals,
+          variants,
+        }];
+        json(res, { experiments });
+      } catch (e) {
+        json(res, { error: String(e && e.message || e) }, 500);
+      }
+    })();
+    return;
+  }
+
   // GET /api/cost/stats - per-activity-type count + total cost over a trailing
   // window. Types: thread (posts.posted_at), comment (replies.replied),
   // page (seo_keywords + gsc_queries), dm_thread (dms.sent_at). Per-row cost is
@@ -8049,6 +8200,33 @@ const HTML = `<!DOCTYPE html>
   .style-stats-table tfoot td { border-top: 2px solid var(--border-strong, var(--border)); border-bottom: none; background: var(--bg-subtle); font-weight: 600; color: var(--text); }
   .style-stats-table tfoot td:first-child { text-transform: uppercase; font-size: 11px; letter-spacing: 0.04em; color: var(--text-secondary); }
   .style-stats-empty { padding: 16px 20px; color: var(--text-muted); font-size: 13px; border-top: 1px solid var(--border); }
+
+  /* Experiments tab: A/B/C cards.
+     Reuses base card chrome from .style-stats-table so it inherits the dashboard theme. */
+  .experiments-header { padding: 20px 20px 8px; }
+  .experiments-title { margin: 0; font-size: 18px; font-weight: 600; color: var(--text); }
+  .experiments-sub { margin-top: 4px; font-size: 12px; color: var(--text-muted); }
+  .exp-kpi-band { display: flex; gap: 24px; padding: 12px 20px 20px; border-bottom: 1px solid var(--border); }
+  .exp-kpi { display: flex; flex-direction: column; gap: 2px; }
+  .exp-kpi-n { font-size: 22px; font-weight: 700; color: var(--text); line-height: 1; }
+  .exp-kpi-label { font-size: 11px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.04em; }
+  .exp-card { margin: 20px; border: 1px solid var(--border); border-radius: 8px; background: var(--bg-subtle); overflow: hidden; }
+  .exp-card-head { display: flex; justify-content: space-between; gap: 16px; align-items: flex-start; padding: 16px 18px; border-bottom: 1px solid var(--border); flex-wrap: wrap; }
+  .exp-card-title { font-size: 14px; font-weight: 600; color: var(--text); }
+  .exp-card-hypothesis { margin-top: 4px; font-size: 12px; color: var(--text-secondary); max-width: 720px; line-height: 1.45; }
+  .exp-card-meta { display: flex; flex-direction: column; align-items: flex-end; gap: 4px; font-size: 11px; color: var(--text-muted); }
+  .exp-status { display: inline-block; padding: 2px 8px; border-radius: 999px; font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.04em; }
+  .exp-status-running { background: var(--accent-panel-bg); color: var(--text); border: 1px solid #3b82f6; }
+  .exp-status-decided { background: #6b21a8; color: #fff; }
+  .exp-status-shipped { background: #166534; color: #fff; }
+  .exp-table { width: 100%; border-collapse: collapse; font-size: 12px; }
+  .exp-table th { text-align: left; padding: 10px 12px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.04em; font-size: 11px; font-weight: 600; border-bottom: 1px solid var(--border); background: var(--bg); }
+  .exp-table th.num, .exp-table td.num { text-align: right; font-variant-numeric: tabular-nums; }
+  .exp-table td { padding: 12px; border-bottom: 1px solid var(--border); color: var(--text); vertical-align: top; }
+  .exp-table tbody tr:last-child td { border-bottom: none; }
+  .exp-variant-key { display: inline-block; min-width: 22px; text-align: center; padding: 1px 6px; border-radius: 4px; background: var(--bg); border: 1px solid var(--border); font-weight: 700; margin-right: 6px; }
+  .exp-variant-label { font-weight: 600; }
+  .exp-variant-desc { font-size: 11px; color: var(--text-muted); margin-top: 2px; }
   .style-stats-controls { padding: 10px 20px; border-top: 1px solid var(--border); display: flex; flex-direction: column; gap: 6px; font-size: 12px; color: var(--text-secondary); }
   .style-stats-pill-row { display: flex; align-items: center; flex-wrap: wrap; gap: 6px; }
   .style-stats-pill-row .label { color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.04em; font-size: 11px; margin-right: 4px; }
@@ -8180,6 +8358,7 @@ const HTML = `<!DOCTYPE html>
   <div class="tab" data-tab="trends">Trends</div>
   <div class="tab" data-tab="activity">Activity</div>
   <div class="tab" data-tab="top">Top</div>
+  <div class="tab sa-admin-only" data-tab="experiments">Experiments</div>
   <div class="tab sa-admin-only" data-tab="logs">Logs</div>
   <div class="tab sa-admin-only" data-tab="settings">Settings</div>
 </div>
@@ -8649,6 +8828,16 @@ const HTML = `<!DOCTYPE html>
   </div>
 </div>
 
+<div class="content hidden" id="tab-experiments">
+  <div class="experiments-header">
+    <h2 class="experiments-title">Experiments</h2>
+    <div class="experiments-sub">A/B/C tests running across the pipeline. Read-only first cut; one card per active experiment, variants side-by-side.</div>
+  </div>
+  <div id="experiments-list">
+    <div class="style-stats-empty">Loading\u2026</div>
+  </div>
+</div>
+
 <div class="content hidden" id="tab-logs">
   <div class="log-controls">
     <select id="log-job-filter">
@@ -9165,6 +9354,13 @@ function fmtElapsed(s) {
   return h + 'h ' + (m % 60) + 'm';
 }
 
+// twitter-ripen-freshness-abc variant defs, baked into the client from the
+// Node-side TWITTER_VARIANT_DEFS so the Experiments tab and the job-history
+// pill describe a variant the same way. JSON.stringify keeps it backslash-free
+// inside this HTML backtick template (any \\n / \\t in here would silently
+// blank the page per the documented HTML-template gotcha).
+const TWITTER_VARIANT_DEFS = ${JSON.stringify(TWITTER_VARIANT_DEFS)};
+
 function renderResult(run) {
   const r = run.result || {};
   const pill = (label, n, _color) =>
@@ -9380,6 +9576,23 @@ function renderResult(run) {
             + r.projects_worked.join(', ')
             + '</span></span>'
           : '') +
+        (r.experiment_variant
+          ? (function () {
+              const v = r.experiment_variant;
+              const def = TWITTER_VARIANT_DEFS[v] || null;
+              const desc = def ? def.desc : '';
+              const label = def ? def.label : '';
+              const tooltip = 'twitter-ripen-freshness-abc'
+                + (label ? ' — ' + v + ' ' + label : '')
+                + (desc ? ': ' + desc : '');
+              return '<span title="' + tooltip.replace(/"/g, '&quot;')
+                + '" style="display:inline-block;margin-right:10px;font-size:12px;color:var(--muted);">'
+                + 'experiment '
+                + '<span style="color:var(--text);font-weight:600;">'
+                + v + (desc ? ': ' + desc : '')
+                + '</span></span>';
+            })()
+          : '') +
         (Array.isArray(r.styles_used) && r.styles_used.length
           ? '<span style="display:inline-block;margin-right:10px;font-size:12px;color:var(--muted);">'
             + 'styles '
@@ -10651,6 +10864,106 @@ function stopLogAutoRefresh() {
 }
 
 // Settings
+function fmtIntK(n) {
+  if (n == null) return '\u2014';
+  if (n >= 1000000) return (n / 1000000).toFixed(1) + 'M';
+  if (n >= 1000) return (n / 1000).toFixed(1) + 'k';
+  return String(Math.round(n));
+}
+
+function fmtMinHm(min) {
+  if (min == null || !isFinite(min)) return '\u2014';
+  if (min < 60) return Math.round(min) + 'm';
+  const h = Math.floor(min / 60);
+  const m = Math.round(min - h * 60);
+  return h + 'h ' + (m < 10 ? '0' + m : m) + 'm';
+}
+
+async function loadExperiments() {
+  const container = document.getElementById('experiments-list');
+  if (!container) return;
+  container.innerHTML = '<div class="style-stats-empty">Loading\u2026</div>';
+  let payload;
+  try {
+    const res = await fetch('/api/experiments');
+    payload = await res.json();
+    if (!res.ok || payload.error) throw new Error(payload.error || ('HTTP ' + res.status));
+  } catch (e) {
+    container.innerHTML = '<div class="style-stats-empty">Failed to load: ' + (e.message || e) + '</div>';
+    return;
+  }
+  const experiments = payload.experiments || [];
+  if (!experiments.length) {
+    container.innerHTML = '<div class="style-stats-empty">No experiments running.</div>';
+    return;
+  }
+  // Top KPI band: count running/decided/shipped across all experiments.
+  const kpiCounts = { running: 0, decided: 0, shipped: 0 };
+  experiments.forEach(e => { if (kpiCounts[e.status] != null) kpiCounts[e.status]++; });
+  const kpiHtml = (
+    '<div class="exp-kpi-band">' +
+      '<div class="exp-kpi"><span class="exp-kpi-n">' + kpiCounts.running + '</span><span class="exp-kpi-label">running</span></div>' +
+      '<div class="exp-kpi"><span class="exp-kpi-n">' + kpiCounts.decided + '</span><span class="exp-kpi-label">decided</span></div>' +
+      '<div class="exp-kpi"><span class="exp-kpi-n">' + kpiCounts.shipped + '</span><span class="exp-kpi-label">shipped</span></div>' +
+    '</div>'
+  );
+  const cards = experiments.map(exp => {
+    const variants = exp.variants || [];
+    const variantRows = variants.map(v => {
+      const postRate = v.post_rate_pct != null ? v.post_rate_pct.toFixed(2) + '%' : '\u2014';
+      const threadAge = fmtMinHm(v.thread_age_min_p50);
+      const views = v.avg_views != null ? fmtIntK(v.avg_views) : '\u2014';
+      const likes = v.avg_likes != null ? fmtIntK(v.avg_likes) : '\u2014';
+      const replies = v.avg_replies != null ? fmtIntK(v.avg_replies) : '\u2014';
+      return (
+        '<tr>' +
+          '<td><span class="exp-variant-key">' + v.key + '</span> <span class="exp-variant-label">' + (v.label || '') + '</span><div class="exp-variant-desc">' + (v.desc || '') + '</div></td>' +
+          '<td class="num">' + fmtIntK(v.n_candidates) + '</td>' +
+          '<td class="num">' + fmtIntK(v.n_batches) + '</td>' +
+          '<td class="num">' + fmtIntK(v.n_posted) + '</td>' +
+          '<td class="num">' + postRate + '</td>' +
+          '<td class="num">' + threadAge + '</td>' +
+          '<td class="num">' + views + '</td>' +
+          '<td class="num">' + likes + '</td>' +
+          '<td class="num">' + replies + '</td>' +
+        '</tr>'
+      );
+    }).join('');
+    const startedTxt = exp.started_at ? new Date(exp.started_at).toLocaleString() : '\u2014';
+    return (
+      '<div class="exp-card">' +
+        '<div class="exp-card-head">' +
+          '<div>' +
+            '<div class="exp-card-title">' + (exp.name || exp.id) + '</div>' +
+            '<div class="exp-card-hypothesis">' + (exp.hypothesis || '') + '</div>' +
+          '</div>' +
+          '<div class="exp-card-meta">' +
+            '<span class="exp-status exp-status-' + exp.status + '">' + exp.status + '</span>' +
+            '<span class="exp-started">started ' + startedTxt + '</span>' +
+            '<span class="exp-totals">' + fmtIntK(exp.totals && exp.totals.n_candidates) + ' candidates / ' + fmtIntK(exp.totals && exp.totals.n_posted) + ' posted</span>' +
+            '<span class="exp-primary">primary: ' + (exp.primary_metric || '\u2014') + '</span>' +
+          '</div>' +
+        '</div>' +
+        '<table class="exp-table">' +
+          '<thead><tr>' +
+            '<th>Variant</th>' +
+            '<th class="num">Cands</th>' +
+            '<th class="num">Batches</th>' +
+            '<th class="num">Posted</th>' +
+            '<th class="num">Post rate</th>' +
+            '<th class="num">Thread age @discover (p50)</th>' +
+            '<th class="num">Views/post</th>' +
+            '<th class="num">Likes/post</th>' +
+            '<th class="num">Replies/post</th>' +
+          '</tr></thead>' +
+          '<tbody>' + variantRows + '</tbody>' +
+        '</table>' +
+      '</div>'
+    );
+  }).join('');
+  container.innerHTML = kpiHtml + cards;
+}
+
 async function loadSettings() {
   try {
     const [configRes, envRes] = await Promise.all([fetch('/api/config'), fetch('/api/env')]);
@@ -17427,6 +17740,12 @@ function activateTab(name) {
     loadSettings();
     _tabLoaded.settings = true;
   }
+  if (name === 'experiments') {
+    // Always refetch: cycles fire every 15 min, so stale data is more painful
+    // than the cheap pq() roundtrip. Single endpoint, single SQL pass.
+    loadExperiments();
+    _tabLoaded.experiments = true;
+  }
   return true;
 }
 document.querySelectorAll('.tab').forEach(tab => {
@@ -17447,7 +17766,7 @@ _saInstallDeleteListener();
 // visible to the user (some tabs are admin-only).
 (function restoreActiveTab() {
   const saved = saLoad('sa.activeTab.v1', null);
-  const valid = ['status', 'stats', 'trends', 'activity', 'top', 'logs', 'settings'];
+  const valid = ['status', 'stats', 'trends', 'activity', 'top', 'experiments', 'logs', 'settings'];
   if (!saved || !valid.includes(saved) || saved === 'stats') return;
   // Defer a tick so admin-only visibility (driven by auth init) settles
   // before we try to switch.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.13",
+  "version": "1.6.14",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/schema-postgres.sql

@@ -107,6 +107,57 @@ CREATE INDEX IF NOT EXISTS idx_thread_top_replies_refresh
   ON thread_top_replies(platform, status, engagement_updated_at)
   WHERE status = 'active';
 
+-- 2026-05-22: snowflake-derived posted_at on both rails (see
+-- migrations/2026-05-22-snowflake-derived-posted-at.sql for the full
+-- rationale). Twitter snowflake IDs encode their creation timestamp:
+-- ts_ms = (id >> 22) + 1288834974657. We already store reply_tweet_id
+-- on thread_top_replies and the thread tweet ID lives in
+-- posts.thread_url, so both columns are derivable arithmetically. Using
+-- GENERATED STORED so the routes never need to know.
+ALTER TABLE thread_top_replies
+  ADD COLUMN IF NOT EXISTS reply_posted_at TIMESTAMPTZ
+  GENERATED ALWAYS AS (
+    CASE
+      WHEN reply_tweet_id ~ '^\d+$'
+      THEN to_timestamp(
+        ((reply_tweet_id::bigint) >> 22) / 1000.0 + 1288834974.657
+      )
+      ELSE NULL
+    END
+  ) STORED;
+
+ALTER TABLE posts
+  ADD COLUMN IF NOT EXISTS thread_posted_at TIMESTAMPTZ
+  GENERATED ALWAYS AS (
+    CASE
+      WHEN thread_url ~ '/status/\d+'
+      THEN to_timestamp(
+        ((substring(thread_url FROM '/status/(\d+)')::bigint) >> 22) / 1000.0 + 1288834974.657
+      )
+      ELSE NULL
+    END
+  ) STORED;
+
+CREATE INDEX IF NOT EXISTS idx_posts_platform_thread_posted_at
+  ON posts (platform, thread_posted_at)
+  WHERE thread_posted_at IS NOT NULL;
+
+-- 2026-05-22: link metadata on thread_top_replies (see
+-- migrations/2026-05-22-thread-top-replies-link-metadata.sql). The
+-- snapshot now captures min 1, max 2 replies per thread: rank=1 is
+-- top by likes regardless of link; rank=2 is the top link-bearing
+-- reply (if one exists and differs by URL). has_link is a derived
+-- convenience flag for analytics + partial indexes.
+ALTER TABLE thread_top_replies
+  ADD COLUMN IF NOT EXISTS reply_link_url TEXT,
+  ADD COLUMN IF NOT EXISTS reply_link_display TEXT;
+ALTER TABLE thread_top_replies
+  ADD COLUMN IF NOT EXISTS has_link BOOLEAN
+  GENERATED ALWAYS AS (reply_link_url IS NOT NULL) STORED;
+CREATE INDEX IF NOT EXISTS idx_thread_top_replies_has_link
+  ON thread_top_replies(post_id, has_link)
+  WHERE has_link = TRUE;
+
 CREATE TABLE IF NOT EXISTS threads (
     id SERIAL PRIMARY KEY,
     platform TEXT NOT NULL,