social-autoposter 1.6.152 → 1.6.154

package/mcp/dist/index.js

@@ -2713,96 +2713,43 @@ async function scheduleState() {
 // version). Resilient: any probe that throws degrades to a safe default rather
 // than failing the whole snapshot.
 async function buildSnapshot() {
-    const projects = listManagedProjectStatus().map((p) => ({
-        name: p.name,
-        ready: p.ready,
-        missing_required: p.missing_required,
-    }));
-    const rtReady = runtimeReady();
-    const [x, ap, ver] = await Promise.all([
-        rtReady
-            ? xStatus().catch(() => ({ connected: false, state: "" }))
-            : Promise.resolve({ connected: false, state: "runtime_not_ready" }),
-        autopilotLoaded(),
-        versionStatus().catch(() => ({ installed: VERSION, latest: null, update_available: false })),
-    ]);
-    await ensureDoctorPhase(x.connected ? "full" : "pre_connect");
-    if (rtReady)
-        completeOnboardingMilestone("runtime_ready");
-    if (x.connected) {
-        completeOnboardingMilestone("x_connected", { state: x.state || "connected" });
+    // Single source of truth: scripts/snapshot.py computes the snapshot PURELY from
+    // the stateful files (the SAME module the always-on menu bar imports directly,
+    // so the two surfaces can't diverge — and the menu bar no longer depends on this
+    // Node process being up). We shell out for the data, then layer on the MCP-only
+    // side effects snapshot.py deliberately omits (it is a pure reader): the doctor
+    // phase, onboarding-milestone telemetry, and persistence.
+    let snap;
+    try {
+        const res = await runPython("scripts/snapshot.py", [], { timeoutMs: 95_000 });
+        snap = JSON.parse(res.stdout.trim().split("\n").slice(-50).join("\n"));
+        if (snap && snap._error)
+            throw new Error(String(snap._error));
     }
-    if (projects.some((project) => project.ready)) {
-        completeOnboardingMilestone("project_ready", { missing_count: 0 });
+    catch {
+        // Never fail the whole panel: fall back to a minimal locally-derived snapshot.
+        snap = {
+            projects: [], projects_total: 0, projects_ready: 0,
+            x_connected: false, x_state: "", x_handle: null,
+            autopilot_on: false, autopilot_stalled: false, schedule_state: "missing",
+            auto_update_on: false, version: VERSION, latest_version: null,
+            update_available: false, runtime_ready: runtimeReady(),
+            runtime_provisioning: isProvisioning(), setup_complete: false,
+            mode: "promotion", onboarding: onboardingSnapshot(),
+        };
     }
-    // The ONE authoritative "is this install set up" rule: runtime provisioned, at
-    // least one ready project, and X connected. Computed here so there is a single
-    // definition — the menu bar must NOT re-derive its own (it used to, from the
-    // milestone-ledger count, which disagreed with this whenever a milestone was
-    // added late or never recorded, causing the 7/8-vs-"set up" flip-flop).
-    const setupComplete = rtReady && projects.some((p) => p.ready) && !!x.connected;
-    // Read the REAL schedule state at all times (during setup AND while running) —
-    // no setup_complete fallback that lied "ok". Source of truth: schedule_state.py.
-    // The re-arm WARNING stays gated on setup_complete below (we don't nag the user
-    // mid-onboarding); only the value here is always honest.
-    const schedule_state = await scheduleState();
-    // The two draft-autopilot tasks are registered AND firing -> the terminal
-    // onboarding milestone is satisfied (this replaced the removed draft_verified,
-    // which depended on the deleted run_draft_cycle tool and could never complete).
-    if (schedule_state === "ok") {
+    // MCP-only side effects (snapshot.py is a pure reader and does none of these):
+    // the onboarding LEDGER writes here are telemetry/history; the live DISPLAY
+    // statuses already come from snapshot.py's overlay.
+    await ensureDoctorPhase(snap.x_connected ? "full" : "pre_connect");
+    if (snap.runtime_ready)
+        completeOnboardingMilestone("runtime_ready");
+    if (snap.x_connected)
+        completeOnboardingMilestone("x_connected", { state: snap.x_state || "connected" });
+    if ((snap.projects_ready || 0) > 0)
+        completeOnboardingMilestone("project_ready", { missing_count: 0 });
+    if (snap.schedule_state === "ok")
         completeOnboardingMilestone("tasks_scheduled");
-    }
-    // ---- Live-truthful onboarding checklist -------------------------------------
-    // The ledger (onboarding-progress.json) is append-only HISTORY: a completed
-    // milestone never reverts, which is right for telemetry (attempts/blockers/
-    // funnel) but WRONG as a live "is it set up now?" checklist. So for the
-    // milestones that have a cheap live signal, overlay their CURRENT state for
-    // DISPLAY (the dashboard + menu bar render this); the ledger file itself stays
-    // untouched for telemetry. Milestones with no cheap live signal
-    // (environment_checked, profile_scanned, topics_seeded) keep their ledger value.
-    const liveMilestoneStatus = {
-        runtime_ready: rtReady ? "complete" : "pending",
-        x_connected: x.connected ? "complete" : "pending",
-        mode_chosen: modeChosen() ? "complete" : "pending",
-        project_ready: projects.some((p) => p.ready) ? "complete" : "pending",
-        tasks_scheduled: schedule_state === "ok" ? "complete" : "pending",
-    };
-    const ledgerSnapshot = onboardingSnapshot();
-    const liveMilestones = (ledgerSnapshot.milestones || []).map((m) => liveMilestoneStatus[m.id] ? { ...m, status: liveMilestoneStatus[m.id] } : m);
-    const onboardingLive = {
-        ...ledgerSnapshot,
-        milestones: liveMilestones,
-        complete: liveMilestones.every((m) => m.status === "complete"),
-    };
-    const snap = {
-        projects,
-        projects_total: projects.length,
-        projects_ready: projects.filter((p) => p.ready).length,
-        x_connected: !!x.connected,
-        x_state: x.state || "",
-        x_handle: x.handle ?? null,
-        autopilot_on: ap.autopilot_on,
-        // Liveness, not just presence: the routines can be registered (SKILL.md on
-        // disk -> autopilot_on true) yet not firing after a Claude account switch.
-        // autopilot_stalled is the true "drafts aren't being produced" signal.
-        autopilot_stalled: setupComplete && autopilotStalled(),
-        // The ACTUAL schedule state for the CURRENT account ('missing'/'disabled'/
-        // 'ok'). Always the real registry reading; drives the dashboard's "Set up
-        // draft schedule" button (gated on setup_complete in the consumer, not here).
-        schedule_state,
-        auto_update_on: ap.auto_update_on,
-        version: ver.installed || VERSION,
-        latest_version: ver.latest ?? null,
-        update_available: !!ver.update_available,
-        // Runtime install gate: the panel shows the Install card (and disables the
-        // action buttons) until the owned Python/Chromium runtime is provisioned.
-        runtime_ready: rtReady,
-        runtime_provisioning: isProvisioning(),
-        setup_complete: setupComplete,
-        // Engagement mode for display in BOTH surfaces (single source: mode.json).
-        mode: currentMode(),
-        onboarding: onboardingLive,
-    };
     // Persist this snapshot so the menu bar can answer "set up?" the SAME way when
     // the loopback server is unreachable (Claude Desktop closed or mid-restart)
     // instead of falling back to a divergent local rule. Refreshed on every

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.152",
-  "installedAt": "2026-06-29T22:42:31.815Z"
+  "version": "1.6.154",
+  "installedAt": "2026-06-29T23:14:44.360Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.152",
+  "version": "1.6.154",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "The disclaimer above is generic Claude boilerplate. S4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L end to end**\n\n2\\. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -143,6 +143,31 @@ AUTOPILOT_RUNNING_STALL_SECONDS = 900
 # truth, scripts/schedule_state.py (FIRING_WINDOW there). _schedule_state delegates
 # to it, so it is intentionally NOT redefined here.
 
+# How long the producer can sit narrating "drafting replies (Nm)" before we treat
+# the draft as STUCK rather than healthy. The producer writes that label the whole
+# time it blocks waiting for a worker to return a result (up to its 30-min queue
+# timeout). A healthy drain clears in ~1-2 min; if the label has been "drafting"
+# this long, the worker keeps dying mid-run (host inactivity-kill) or never claims,
+# and nothing is draining — so we flip the menu bar from a reassuring spinner to
+# ⚠ instead of letting the stale "drafting (8m)" lie persist. Well above any
+# healthy single drain (the worker itself dies at ~2 min today).
+DRAFT_STUCK_SECONDS = 300
+
+
+def _label_elapsed_secs(label):
+    """Parse the trailing duration the producer encodes in a drafting activity
+    label — 'drafting replies (8m)', '... (queued 18m)', '... (45s)' — into
+    seconds. Returns 0 when there's no parseable duration. _fmt_dur (claude_job.py)
+    only ever emits '<n>s' (<60s) or '<n>m', so this mirror stays trivial."""
+    if not label:
+        return 0
+    import re
+    matches = re.findall(r"(\d+)\s*([sm])\b", str(label))
+    if not matches:
+        return 0
+    n, unit = matches[-1]
+    return int(n) * (60 if unit == "m" else 1)
+
 
 def _glyph(status):
     return GLYPH.get(status, "·")
@@ -1013,6 +1038,22 @@ class S4LMenuBar(rumps.App):
                 attention = True
         else:
             self._stall_reason_info = ("", "")
+        # Draft worker stuck/killed: the producer narrates "drafting replies (Nm)"
+        # the whole time it blocks waiting for a worker to return a result, with NO
+        # idea the worker died. A healthy drain clears in ~1-2 min; once that label
+        # has been "drafting" past DRAFT_STUCK_SECONDS the worker keeps getting
+        # killed mid-run (or never claims) and nothing is draining — flip to ⚠
+        # instead of leaving the reassuring "drafting (8m)" spinner up. Skip when a
+        # more specific cause (rate limit) already owns the reason.
+        if setup_complete and self._stall_reason_info[0] != "rate_limited":
+            _act = st.read_activity()
+            if (
+                _act
+                and _act.get("state") == "drafting"
+                and _label_elapsed_secs(_act.get("label")) >= DRAFT_STUCK_SECONDS
+            ):
+                attention = True
+                self._stall_reason_info = ("draft_stuck", _act.get("label") or "")
         # Drop the stale "drafting" spinner while we need attention so the ⚠ shows.
         self._stalled = attention
 
@@ -1350,6 +1391,14 @@ class S4LMenuBar(rumps.App):
                 items.append(self._label(
                     "   " + (self._stall_reason_info[1] or "wait for reset or switch account")
                 ))
+            elif self._stall_reason_info[0] == "draft_stuck":
+                # Routines fire and the producer keeps narrating "drafting" but the
+                # worker keeps getting killed mid-run / never returns a result. Don't
+                # offer Re-arm (routines are fine); state the real problem.
+                items.append(self._label("⚠ Draft not completing — worker keeps getting killed"))
+                items.append(self._label(
+                    "   " + (self._stall_reason_info[1] or "drafting") + " — no result yet"
+                ))
             elif schedule_state == "disabled":
                 items.append(self._label("⚠ Draft tasks are scheduled but disabled"))
                 items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))

package/mcp/menubar/s4l_state.py

@@ -20,6 +20,7 @@ Everything is best-effort: any failure degrades to "unknown / open Claude".
 import json
 import os
 import subprocess
+import sys
 import threading
 import urllib.request
 from pathlib import Path
@@ -195,23 +196,31 @@ def loopback_tool(name: str, args=None, timeout: float = 20.0):
 
 # ---- the snapshot the menu bar renders ------------------------------------
 def snapshot():
-    """Full live snapshot via the loopback dashboard tool, else the server's last
-    persisted summary, else a thin file-built fallback.
+    """Full snapshot computed DIRECTLY from the stateful files via
+    scripts/snapshot.py — the SAME single-source module the MCP shells out to, so
+    the two surfaces can't diverge. The menu bar no longer depends on the MCP /
+    Claude being up: there is NO loopback call here, so a restarting or closed
+    Claude can't freeze or stale the menu (the old tier-1 `loopback_tool` blocked
+    the UI thread up to 20s and was the freeze).
 
     Three tiers, in order:
-      1. LIVE — loopback reachable: the real dashboard snapshot, with `setup_complete`
-         already computed by the server (the single authoritative rule).
-      2. SUMMARY — loopback down but the server wrote `status-summary.json` while it
-         was last up: read that. It carries the SAME `setup_complete` the live path
-         would, so a server restart can't flip the menu bar's "set up" answer. This
-         is the consolidation that removes the menu bar's old divergent rule.
-      3. LEDGER — no summary ever written (a truly fresh install that has never
-         reached the server): derive the essentials from the onboarding ledger so
-         onboarding progress still shows with nothing running."""
-    snap = loopback_tool("dashboard", {})
-    if isinstance(snap, dict) and "projects_total" in snap:
-        snap["_live"] = True
-        return snap
+      1. LIVE — compute locally from the files (zero MCP dependency).
+      2. SUMMARY — the server's last persisted `status-summary.json`, if the local
+         compute somehow failed.
+      3. LEDGER — nothing else available: derive the essentials from the onboarding
+         ledger so progress still shows."""
+    try:
+        repo = os.environ.get("SAPS_REPO_DIR") or str(Path.home() / "social-autoposter")
+        scripts = os.path.join(repo, "scripts")
+        if scripts not in sys.path:
+            sys.path.insert(0, scripts)
+        import snapshot as _snapshot_mod  # scripts/snapshot.py
+        snap = _snapshot_mod.compute()
+        if isinstance(snap, dict) and "projects_total" in snap:
+            snap["_live"] = True
+            return snap
+    except Exception:
+        pass
     summ = read_json("status-summary.json")
     if isinstance(summ, dict) and "projects_total" in summ:
         summ["_live"] = False

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.152",
+  "version": "1.6.154",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.152",
+  "version": "1.6.154",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/claude_job.py

@@ -677,6 +677,41 @@ def cmd_provider(ns) -> int:
 # --------------------------------------------------------------------------- #
 # next (consumer side, run by a scheduled task)                               #
 # --------------------------------------------------------------------------- #
+def _agent_session_pid():
+    """Best-effort: the Claude agent-mode SESSION pid running THIS worker — the
+    exact process the stale-session reaper (reap_stale_claude_sessions.py) would
+    target. We climb our own process tree to the ancestor whose cmd carries the
+    reaper's worker signature ('claude-code/' + 'local-agent-mode-sessions') and
+    return its pid, so the claim can be stamped with it and the reaper can SPARE
+    that session for the whole drafting turn (instead of SIGTERMing it at the short
+    grace window — the 2026-06-29 draft-kill regression). None if not identifiable;
+    the reaper then falls back to its newest-spare heuristic.
+    """
+    try:
+        out = subprocess.run(
+            ["/bin/ps", "-axo", "pid=,ppid=,command="],
+            capture_output=True, text=True, timeout=10,
+        ).stdout
+        info = {}
+        for line in out.splitlines():
+            m = re.match(r"\s*(\d+)\s+(\d+)\s+(.*)$", line)
+            if m:
+                info[int(m.group(1))] = (int(m.group(2)), m.group(3))
+        pid = os.getpid()
+        for _ in range(16):  # bounded climb up the tree
+            ent = info.get(pid)
+            if not ent or ent[0] <= 1:
+                break
+            ppid = ent[0]
+            pcmd = info.get(ppid, (0, ""))[1]
+            if ("claude-code/" in pcmd) and ("local-agent-mode-sessions" in pcmd):
+                return ppid
+            pid = ppid
+    except Exception:
+        return None
+    return None
+
+
 def cmd_next(ns) -> int:
     _apply_state_dir_override(ns)
     qtype = ns.type
@@ -700,6 +735,12 @@ def cmd_next(ns) -> int:
                 job = json.load(f)
         except Exception:
             continue
+        # Stamp the agent-session pid that holds THIS claim so the reaper spares it
+        # for the whole drafting turn (see _agent_session_pid above).
+        agent_pid = _agent_session_pid()
+        if agent_pid:
+            job["claim_pid"] = agent_pid
+        job["claimed_at"] = time.time()
         prompt_file = None
         schema_file = None
         if ns.prompt_file:
@@ -711,7 +752,16 @@ def cmd_next(ns) -> int:
                 schema_file = os.path.join(queue_root(), f"schema-{job['job_id']}.json")
                 _atomic_write_text(schema_file, schema)
                 job["schema_file"] = schema_file
-            _atomic_write(dst, job)
+        # ALWAYS persist the claim back (claim_pid + any prompt/schema sidecars) so
+        # the reaper can read claim_pid; previously this only happened on the
+        # --prompt-file lane, leaving claim_pid unstamped for inline callers.
+        _atomic_write(dst, job)
+        _plog(
+            f"claimed {job.get('type') or qtype} job {job['job_id']}; "
+            + (f"agent-session pid={agent_pid} stamped (reaper will spare it)"
+               if agent_pid else
+               "agent-session pid NOT found (reaper falls back to newest-spare)")
+        )
         # Narrate the scheduled-task worker's drafting turn to the menu bar. This
         # is the lane that actually runs the LLM; it persists until cmd_result
         # clears it (or the kicker's exit trap does). Covers the box's autopilot.

package/scripts/reap_stale_claude_sessions.py

@@ -40,6 +40,7 @@ even before the owned runtime is provisioned.
 
 from __future__ import annotations
 
+import json
 import os
 import re
 import signal
@@ -207,6 +208,36 @@ def count_running_jobs():
         return None
 
 
+def running_claim_pids():
+    """Set of agent-session pids that currently hold a LIVE claim. The worker stamps
+    its agent-session pid into <state_dir>/claude-queue/running/<job>.json the instant
+    it claims a job (claude_job.py::cmd_next). A session that holds a claim is, by
+    definition, the one doing real drafting work right now — so we spare those pids
+    UNCONDITIONALLY (regardless of age / group size) and only reap sessions that do
+    NOT hold a claim. This is what makes a multi-minute draft survive: it is no longer
+    confused with a leaked/done zombie just because newer empty sessions spawned on
+    top of it. Empty set if the dir is unreadable or nothing has been stamped (then
+    the caller falls back to the newest-spare heuristic, i.e. prior behaviour)."""
+    d = os.path.join(_state_dir(), "claude-queue", "running")
+    pids: set[int] = set()
+    try:
+        names = os.listdir(d)
+    except OSError:
+        return pids
+    for n in names:
+        if not n.endswith(".json") or n.endswith(".tmp"):
+            continue
+        try:
+            with open(os.path.join(d, n)) as f:
+                job = json.load(f)
+            pid = job.get("claim_pid")
+            if isinstance(pid, int) and pid > 1:
+                pids.add(pid)
+        except Exception:
+            continue
+    return pids
+
+
 def _env_int(name: str, default: int) -> int:
     try:
         return int(os.environ.get(name, default))
@@ -218,7 +249,14 @@ def main() -> int:
     dry = "--dry-run" in sys.argv
     max_age = _env_int("SAPS_REAPER_MAX_AGE_SEC", DEFAULT_MAX_AGE_SEC)
     # (1) Queue-correlated reaping knobs.
-    grace = _env_int("SAPS_REAPER_GRACE_SEC", 90)  # spawn->claim race guard
+    # grace: how long an UNCLAIMED session may live before it's reapable. Raised
+    # 90 -> 300 on 2026-06-29: at 90s the reaper was SIGTERMing actively-DRAFTING
+    # worker sessions (a draft legitimately runs minutes), which presented as the
+    # mysterious "~120s code-143 kill". Claim-holders are now spared outright via
+    # running_claim_pids() regardless of grace, so this only governs idle/leaked
+    # sessions; 5 min is a comfortable backstop for them and the count-cap still
+    # bounds memory if the queue signal is ever wrong.
+    grace = _env_int("SAPS_REAPER_GRACE_SEC", 300)  # idle/leaked-session backstop
     keep_margin = _env_int("SAPS_REAPER_KEEP_MARGIN", 1)  # extra newest spared beyond busy set
     # (2) Count-cap backstop: never let one uuid group hold more than this many live
     # workers, regardless of queue state. 0 disables. The default rarely fires once
@@ -227,6 +265,7 @@ def main() -> int:
     max_group = _env_int("SAPS_REAPER_MAX_GROUP", 12)
 
     inflight = count_running_jobs()  # None => queue unreadable => age-gate fallback
+    claim_pids = running_claim_pids()  # agent-session pids actively holding a claim
 
     procs, by_pid = snapshot()
 
@@ -242,31 +281,53 @@ def main() -> int:
         members.sort(key=lambda p: p["age"])  # ascending: newest first
 
         if inflight is not None:
-            # (1) Spare the (inflight + margin) newest — these cover every worker that
-            # could still hold a live claim — and reap the rest once past a short grace.
+            # (1) Spare any session that HOLDS a live claim (it's actively drafting),
+            # plus the (inflight + margin) newest as a fallback for sessions that
+            # claimed before this build stamped claim_pid. Reap the rest past grace.
             spare_n = max(1, inflight + keep_margin)
             for p in members[spare_n:]:
+                if p["pid"] in claim_pids:
+                    continue  # actively holds a claim — never reap, no matter its age
                 if p["age"] >= grace:
                     targets_by_pid[p["pid"]] = p
         else:
             # Fallback: queue unreadable -> legacy age gate, keep only the newest.
             for p in members[1:]:
+                if p["pid"] in claim_pids:
+                    continue
                 if p["age"] >= max_age:
                     targets_by_pid[p["pid"]] = p
 
-        # (2) Count-cap backstop. Never caps BELOW the queue-spared busy set, so it
-        # can only ever add provably-idle workers — no false positives.
+        # (2) Count-cap backstop. Never caps BELOW the queue-spared busy set, and
+        # never reaps a live claim-holder, so it can only ever add provably-idle
+        # workers — no false positives.
         if max_group > 0:
             keep = max_group
             if inflight is not None:
                 keep = max(keep, inflight + keep_margin)
             for p in members[keep:]:
+                if p["pid"] in claim_pids:
+                    continue
                 targets_by_pid[p["pid"]] = p
 
     targets = list(targets_by_pid.values())[:MAX_KILL_PER_RUN]
 
+    # Visibility (per the 2026-06-29 draft-kill investigation): whenever a draft is
+    # in flight, log that we SAW the claim-holder(s) and are sparing them, so a
+    # future "why did the draft die" check can confirm the reaper protected the
+    # right session — or catch it red-handed if this logic ever regresses.
+    if claim_pids:
+        live = sorted(p for p in claim_pids if p in by_pid)
+        dead = sorted(p for p in claim_pids if p not in by_pid)
+        print(
+            f"[claude-reaper] sparing {len(live)} live claim-holder session(s)"
+            f" pids={live}" + (f" (stale-claim pids={dead})" if dead else "")
+            + f"; inflight={inflight} grace={grace}s",
+            file=sys.stderr,
+        )
+
     if not targets:
-        # Stay quiet on the common no-leak path to keep the log stream clean.
+        # No reapable sessions this run (common no-leak path).
         return 0
 
     freed_kb = 0
@@ -289,7 +350,8 @@ def main() -> int:
         f"{prefix} reaped {killed} stale agent-mode claude session(s)"
         f" + {disclaimers} disclaimer stub(s) across {sum(1 for g in groups.values() if len(g) > 1)}"
         f" leaked uuid group(s); mode={mode} inflight={inflight} grace={grace}s"
-        f" max_group={max_group} (age_fallback={max_age}s)",
+        f" spared_claim_pids={sorted(claim_pids)} max_group={max_group}"
+        f" (age_fallback={max_age}s)",
         file=sys.stderr,
     )
     return 0

package/scripts/snapshot.py

@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+"""Single source of truth for the S4L status snapshot.
+
+Produces the SAME dict as the MCP's buildSnapshot() (mcp/src/index.ts), but in
+Python, reading directly from the stateful files plus two existing Python helpers
+(setup_twitter_auth.py for X, schedule_state.py for the draft schedule) and npm
+for the latest version.
+
+WHY this exists: the menu bar must render with Claude / the MCP fully closed. The
+MCP is a Node process tied to Claude Desktop's lifecycle, and it was the ONLY
+thing computing the snapshot — so the always-on menu bar had to ask it over a
+blocking loopback call, which froze the menu whenever the MCP was restarting.
+Moving the compute here lets the menu bar build the snapshot itself from the
+files (zero MCP dependency), while the MCP shells out to this SAME module so
+there's one implementation, no divergence — the schedule_state.py pattern applied
+to the whole snapshot. The source of truth is the FILES; this is just the reader.
+
+PURE READ/COMPUTE: never writes (no onboarding-milestone telemetry, no
+persistence) — the MCP keeps those side effects around this. Slow fields (X
+session, npm latest) are cached per-process with a TTL so a 5s menu-bar tick that
+imports this module stays cheap.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import time
+
+HOME = os.path.expanduser("~")
+
+
+def _state_dir() -> str:
+    return os.environ.get("SAPS_STATE_DIR") or os.path.join(HOME, ".social-autoposter-mcp")
+
+
+def _repo_dir() -> str:
+    return os.environ.get("SAPS_REPO_DIR") or os.path.join(HOME, "social-autoposter")
+
+
+def _claude_cfg_dir() -> str:
+    return os.environ.get("CLAUDE_CONFIG_DIR") or os.path.join(HOME, ".claude")
+
+
+def _config_path() -> str:
+    return os.environ.get("SAPS_CONFIG_PATH") or os.path.join(_repo_dir(), "config.json")
+
+
+# Keep in sync with REQUIRED_FIELDS (mcp/src/setup.ts), QUEUE_WORKERS / UPDATER_LABEL
+# / AUTOPILOT_STALL_MS (mcp/src/index.ts).
+REQUIRED_FIELDS = ["name", "website", "description", "icp", "voice", "search_topics"]
+WORKER_TASK_IDS = ("saps-phase1-query", "saps-phase2b-draft")
+UPDATER_LABEL = "com.m13v.social-autoposter-update"
+AUTOPILOT_STALL_MS = 180_000
+
+# Milestones overlaid with LIVE state for display (the rest keep their ledger
+# value). Mirrors the overlay in buildSnapshot().
+_OVERLAY_IDS = ("runtime_ready", "x_connected", "mode_chosen", "project_ready", "tasks_scheduled")
+
+
+def _read_json(path: str):
+    try:
+        with open(path) as f:
+            return json.load(f)
+    except Exception:
+        return None
+
+
+# ---- projects (config.json + setup-state.json + REQUIRED_FIELDS) -----------
+def _managed_projects():
+    st = _read_json(os.path.join(_state_dir(), "setup-state.json")) or {}
+    return st.get("projects") or []
+
+
+def _project_status(name, cfg_projects):
+    proj = next((p for p in cfg_projects if p.get("name") == name), None)
+    if proj is None:
+        return {"name": name, "ready": False, "missing_required": list(REQUIRED_FIELDS)}
+    missing = []
+    for f in REQUIRED_FIELDS:
+        v = proj.get(f)
+        if v is None:
+            missing.append(f)
+        elif isinstance(v, str) and not v.strip():
+            missing.append(f)
+        elif isinstance(v, (list, tuple)) and len(v) == 0:
+            missing.append(f)
+        elif isinstance(v, dict) and len(v) == 0:
+            missing.append(f)
+    return {"name": name, "ready": len(missing) == 0, "missing_required": missing}
+
+
+def _projects():
+    cfg = _read_json(_config_path()) or {}
+    cfg_projects = cfg.get("projects") or []
+    return [_project_status(n, cfg_projects) for n in _managed_projects()]
+
+
+# ---- runtime / mode / autopilot (all file/launchctl) -----------------------
+def _runtime_ready() -> bool:
+    rt = _read_json(os.path.join(_state_dir(), "runtime.json")) or {}
+    py = rt.get("python")
+    return bool(rt.get("ready") and py and os.path.exists(py))
+
+
+def _runtime_provisioning() -> bool:
+    p = _read_json(os.path.join(_state_dir(), "install-progress.json")) or {}
+    return str(p.get("status") or "").lower() in ("installing", "in_progress", "running", "provisioning")
+
+
+def _mode() -> str:
+    m = ((_read_json(os.path.join(_state_dir(), "mode.json")) or {}).get("mode") or "").strip()
+    return "personal_brand" if m == "personal_brand" else "promotion"
+
+
+def _mode_chosen() -> bool:
+    return os.path.exists(os.path.join(_state_dir(), "mode.json"))
+
+
+def _autopilot_on() -> bool:
+    base = os.path.join(_claude_cfg_dir(), "scheduled-tasks")
+    try:
+        return all(os.path.exists(os.path.join(base, t, "SKILL.md")) for t in WORKER_TASK_IDS)
+    except Exception:
+        return False
+
+
+def _auto_update_on() -> bool:
+    try:
+        out = subprocess.run(["launchctl", "list"], capture_output=True, text=True, timeout=10).stdout
+        return any(UPDATER_LABEL in line for line in out.splitlines())
+    except Exception:
+        return False
+
+
+def _autopilot_stalled() -> bool:
+    qdir = os.path.join(_state_dir(), "claude-queue")
+    ds = _read_json(os.path.join(qdir, "drain-status.json")) or {}
+    try:
+        if int(ds.get("consecutive_timeouts") or 0) >= 1:
+            return True
+    except Exception:
+        pass
+    oldest = None
+    try:
+        pend = os.path.join(qdir, "pending")
+        for sub in os.listdir(pend):
+            subp = os.path.join(pend, sub)
+            if not os.path.isdir(subp):
+                continue
+            for f in os.listdir(subp):
+                if not f.endswith(".json") or f.endswith(".tmp"):
+                    continue
+                try:
+                    m = os.stat(os.path.join(subp, f)).st_mtime * 1000.0
+                    if oldest is None or m < oldest:
+                        oldest = m
+                except Exception:
+                    pass
+    except Exception:
+        pass
+    return oldest is not None and (time.time() * 1000.0 - oldest) > AUTOPILOT_STALL_MS
+
+
+# ---- schedule_state (reuse the shared module) ------------------------------
+def _schedule_state() -> str:
+    try:
+        scripts = os.path.join(_repo_dir(), "scripts")
+        if scripts not in sys.path:
+            sys.path.insert(0, scripts)
+        import schedule_state  # noqa: E402
+        return schedule_state.compute()
+    except Exception:
+        return "missing"
+
+
+# ---- X status (setup_twitter_auth.py status), cached -----------------------
+_x_cache = {"at": 0.0, "val": None}
+_X_TTL = 60.0
+
+
+def _x_status():
+    now = time.time()
+    if _x_cache["val"] is not None and now - _x_cache["at"] < _X_TTL:
+        return _x_cache["val"]
+    val = {"connected": False, "state": "", "handle": None}
+    if _runtime_ready():
+        try:
+            py = os.environ.get("SAPS_PYTHON") or sys.executable or "python3"
+            res = subprocess.run(
+                [py, os.path.join(_repo_dir(), "scripts", "setup_twitter_auth.py"), "status"],
+                capture_output=True, text=True, timeout=90,
+            )
+            # Mirror twitterAuth.ts::parse — JSON in the last lines of stdout.
+            parsed = json.loads("\n".join(res.stdout.strip().splitlines()[-50:]))
+            val = {
+                "connected": bool(parsed.get("connected")),
+                "state": parsed.get("state") or "",
+                "handle": parsed.get("handle"),
+            }
+        except Exception:
+            val = {"connected": False, "state": "status_unavailable", "handle": None}
+    else:
+        val = {"connected": False, "state": "runtime_not_ready", "handle": None}
+    _x_cache.update(at=now, val=val)
+    return val
+
+
+# ---- version (resolveVersion + npm latest + semver), cached ----------------
+_ver_cache = {"at": 0.0, "latest": None}
+_VER_TTL = 600.0
+
+
+def _resolve_version() -> str:
+    for p in (
+        os.path.join(_repo_dir(), "mcp", "dist", "version.json"),
+        os.path.join(_repo_dir(), "package.json"),
+        os.path.join(_repo_dir(), "mcp", "package.json"),
+    ):
+        v = (_read_json(p) or {}).get("version")
+        if isinstance(v, str) and v:
+            return v
+    return "0.0.0-unknown"
+
+
+def _latest_published():
+    now = time.time()
+    if _ver_cache["latest"] is not None and now - _ver_cache["at"] < _VER_TTL:
+        return _ver_cache["latest"]
+    latest = None
+    try:
+        res = subprocess.run(["npm", "view", "social-autoposter", "version"],
+                             capture_output=True, text=True, timeout=8)
+        line = (res.stdout.strip().splitlines() or [""])[-1].strip()
+        if line and line[0].isdigit():
+            latest = line
+    except Exception:
+        latest = None
+    _ver_cache.update(at=now, latest=latest)
+    return latest
+
+
+def _is_newer(latest, current) -> bool:
+    def norm(v):
+        return [int(x) if x.isdigit() else 0 for x in str(v).split("-")[0].split("+")[0].split(".")]
+    a, b = norm(latest), norm(current)
+    for i in range(max(len(a), len(b))):
+        x = a[i] if i < len(a) else 0
+        y = b[i] if i < len(b) else 0
+        if x != y:
+            return x > y
+    return False
+
+
+# ---- onboarding ledger + live overlay --------------------------------------
+def _onboarding_live(live_status):
+    led = _read_json(os.path.join(_state_dir(), "onboarding-progress.json")) or {}
+    ms = led.get("milestones")
+    # The ledger stores milestones as a dict id->record; the snapshot exposes a
+    # list. Mirror onboarding-ledger.cjs publicSnapshot() ordering via MILESTONES.
+    order = ["environment_checked", "runtime_ready", "x_connected", "profile_scanned",
+             "mode_chosen", "project_ready", "topics_seeded", "tasks_scheduled"]
+    out = []
+    if isinstance(ms, dict):
+        for mid in order:
+            rec = dict(ms.get(mid) or {"status": "pending", "attempts": 0})
+            rec["id"] = mid
+            if mid in live_status:
+                rec["status"] = live_status[mid]
+            out.append(rec)
+    elif isinstance(ms, list):
+        for rec in ms:
+            rec = dict(rec)
+            if rec.get("id") in live_status:
+                rec["status"] = live_status[rec["id"]]
+            out.append(rec)
+    result = dict(led)
+    result["milestones"] = out
+    result["complete"] = bool(out) and all(m.get("status") == "complete" for m in out)
+    return result
+
+
+def compute() -> dict:
+    """Build the full snapshot dict (same shape as buildSnapshot())."""
+    projects = _projects()
+    rt_ready = _runtime_ready()
+    x = _x_status()
+    mode = _mode()
+    schedule_state = _schedule_state()
+    any_ready = any(p["ready"] for p in projects)
+    setup_complete = rt_ready and any_ready and bool(x["connected"])
+
+    installed = _resolve_version()
+    latest = _latest_published()
+    update_available = bool(latest) and _is_newer(latest, installed)
+
+    live_status = {
+        "runtime_ready": "complete" if rt_ready else "pending",
+        "x_connected": "complete" if x["connected"] else "pending",
+        "mode_chosen": "complete" if _mode_chosen() else "pending",
+        "project_ready": "complete" if any_ready else "pending",
+        "tasks_scheduled": "complete" if schedule_state == "ok" else "pending",
+    }
+
+    return {
+        "projects": projects,
+        "projects_total": len(projects),
+        "projects_ready": sum(1 for p in projects if p["ready"]),
+        "x_connected": bool(x["connected"]),
+        "x_state": x["state"] or "",
+        "x_handle": x["handle"],
+        "autopilot_on": _autopilot_on(),
+        "autopilot_stalled": setup_complete and _autopilot_stalled(),
+        "schedule_state": schedule_state,
+        "auto_update_on": _auto_update_on(),
+        "version": installed,
+        "latest_version": latest,
+        "update_available": update_available,
+        "runtime_ready": rt_ready,
+        "runtime_provisioning": _runtime_provisioning(),
+        "setup_complete": setup_complete,
+        "mode": mode,
+        "onboarding": _onboarding_live(live_status),
+    }
+
+
+def main() -> int:
+    try:
+        print(json.dumps(compute()))
+    except Exception as e:
+        print(json.dumps({"_error": str(e)}))
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())