social-autoposter 1.6.178 → 1.6.180

package/mcp/dist/index.js

@@ -1030,12 +1030,57 @@ const WEBSITE_RESEARCH_INSTRUCTIONS = "PRODUCT RESEARCH (do this before saving t
     "SAME call — YOU are the model, so do the expansion in-session; it seeds directly with no `claude -p`. " +
     "If the site is thin or unreachable, use only supported facts and leave optional detail conservative; " +
     "ask the user only if a required field is genuinely unknowable.";
-// ---- project_config: per-project config (the "brain": project, website, voice) -----
-// Run this FIRST. The action tools refuse until at least one project is ready.
-// You can set up MULTIPLE products and fill each project's fields INCREMENTALLY
-// across several calls — readiness is derived from config.json, never a stored
-// flag. Call with status:true (or just no name) to list every project this
-// install manages and what each still needs.
+async function seedSearchQueriesForProject(project, rawQueries) {
+    const agentQueries = normalizeStringList(rawQueries) ?? [];
+    let queries = [];
+    if (!agentQueries.length) {
+        return {
+            note: " (No search_queries supplied, so the cycle will run off the seeded topics one at a time. " +
+                "To fan out, re-run with a search_queries array of ~30 X search strings you expand from these " +
+                "topics — it seeds them directly, no claude CLI.)",
+            queries,
+        };
+    }
+    try {
+        const qfile = path.join(os.tmpdir(), `saps-queries-${project}-${Date.now()}.json`);
+        fs.writeFileSync(qfile, JSON.stringify({ queries: agentQueries.map((q) => ({ query: q, topic: "" })) }));
+        const qseed = await runPython("scripts/seed_search_queries.py", ["--project", project, "--queries-json", qfile, "--supply-test", "auto", "--emit-json"], { timeoutMs: 600_000 });
+        try {
+            fs.unlinkSync(qfile);
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+        const qm = /seeded=(\d+)\s+inserted=(\d+)\s+updated=(\d+)/.exec(qseed.stdout);
+        const qjson = qseed.stdout.split("===QUERIES_JSON===")[1];
+        if (qjson) {
+            try {
+                queries = (JSON.parse(qjson.trim()).queries ?? []);
+            }
+            catch {
+                /* leave empty; count note still informs the user */
+            }
+        }
+        if (qseed.code === 0 && qm) {
+            const n = queries.length || Number(qm[1]);
+            return {
+                note: ` Seeded ${n} search quer${n === 1 ? "y" : "ies"} so the cycle can fan out instead of running a single query.`,
+                queries,
+            };
+        }
+        if (qseed.code !== 0) {
+            const qtail = (qseed.stderr || qseed.stdout).trim().split("\n").slice(-1)[0] || "unknown error";
+            return {
+                note: ` (Search queries not seeded yet — ${qtail}. The cycle still runs off the seeded topics.)`,
+                queries,
+            };
+        }
+        return { note: "", queries };
+    }
+    catch (e) {
+        return { note: ` (Search-query seeding skipped — ${e.message}.)`, queries };
+    }
+}
 // ---- engagement_mode: choose personal-brand vs product (setup-time) --------
 // Part of onboarding: AFTER X connect + profile_scan, BEFORE product config, the
 // agent asks the user which mode they want and calls this. It persists the mode
@@ -1051,9 +1096,11 @@ tool("engagement_mode", {
         "is scanned, personal-brand is already the default, so ASK the user the ONE question: do they " +
         "ALSO want to promote a product? Then call action:'set' with personal_brand:true and " +
         "promotion:true|false. Pass the voice/description/topics you extracted from the profile scan so " +
-        "the persona is grounded in who they actually are. If they want promotion too, continue to " +
-        "configure the product project with project_config afterward. The user flips either lane any " +
-        "time from the menu-bar checkmarks.",
+        "the persona is grounded in who they actually are, AND expand those topics into a search_queries " +
+        "array of ~30 concrete X advanced-search strings in the SAME call (identical to project_config) " +
+        "so the personal-brand cycle has a real query bank on day one instead of running one crude " +
+        "topic-as-query. If they want promotion too, continue to configure the product project with " +
+        "project_config afterward. The user flips either lane any time from the menu-bar checkmarks.",
     inputSchema: {
         action: z
             .enum(["get", "set", "toggle"])
@@ -1092,6 +1139,14 @@ tool("engagement_mode", {
             .union([z.array(z.string()), z.string()])
             .optional()
             .describe("~15 topics the persona has genuine experience with, drawn from the scan."),
+        search_queries: z
+            .union([z.array(z.string()), z.string()])
+            .optional()
+            .describe("Cold-start X search-query bank YOU expand from search_topics, in THIS same call — same " +
+            "as project_config. Fan each persona topic into a few concrete X advanced-search strings " +
+            "(aim ~30 total, e.g. 'mac menu bar app -filter:replies', 'screen recording lang:en') so " +
+            "the personal-brand cycle fans out instead of running one crude topic-as-query. Seeded " +
+            "directly with NO `claude -p`. Without it the persona bank is empty on day one."),
     },
 }, async (args) => {
     const action = args.action || "get";
@@ -1183,6 +1238,17 @@ tool("engagement_mode", {
         personaTopicCount = m ? Number(m[1]) : 0;
         personaTopicsSeeded = true;
     }
+    // Seed the persona's search QUERIES too — identical to the product path
+    // (project_config). Personal-brand-only setups used to seed topics but never
+    // queries, so their Phase 1 bank was empty and the cycle ran one crude
+    // topic-as-query (Karol, 2026-06-30). Only after the topic seed succeeds.
+    let personaQueryCount = 0;
+    let personaQueryNote = "";
+    if (personaTopicsSeeded) {
+        const qr = await seedSearchQueriesForProject(personaName, args.search_queries);
+        personaQueryCount = qr.queries.length;
+        personaQueryNote = qr.note;
+    }
     completeOnboardingMilestone("mode_chosen", { personal_brand: personalBrand, promotion, persona: personaName });
     // Personal-brand-only is a first-class setup path: the persona is the draftable
     // project, so seeding its topics IS the topics_seeded milestone. Without this the
@@ -1220,8 +1286,10 @@ tool("engagement_mode", {
                 "is provisioned + topic-seeded. "
             : "Product promotion is on and the persona is provisioned. ") +
             "NOW CONTINUE SETUP: configure the product project with project_config (research the product " +
-            "site and fill description, icp, voice, search_topics)."
-        : "Personal-brand lane is on (the default); the persona is provisioned + topic-seeded, so there " +
+            "site and fill description, icp, voice, search_topics, search_queries)."
+        : (personaQueryCount > 0
+            ? `Personal-brand lane is on (the default); the persona is provisioned, topic-seeded, and ${personaQueryCount} search quer${personaQueryCount === 1 ? "y" : "ies"} seeded, so there `
+            : "Personal-brand lane is on (the default); the persona is provisioned + topic-seeded (but NO search_queries were supplied, so it will run one topic-as-query at a time — re-call engagement_mode action:'set' with a search_queries array of ~30 X search strings expanded from the persona topics to fan out). There ") +
             "is nothing more to configure (no product project is needed). NOW SCHEDULE THE AUTOPILOT: call " +
             "queue_setup and create each returned task with create_scheduled_task (prompt verbatim; " +
             "'already exists' is fine), then call the dashboard tool to confirm the schedule is firing. " +
@@ -1234,6 +1302,8 @@ tool("engagement_mode", {
         persona_created: personaCreated,
         persona_topics_seeded: personaTopicsSeeded,
         persona_topic_count: personaTopicCount,
+        persona_query_count: personaQueryCount,
+        persona_query_note: personaQueryNote || null,
         kicker_installed: kickerInstall ? kickerInstall.ok : null,
         kicker_detail: kickerInstall ? kickerInstall.detail : null,
         onboarding: onboardingSnapshot(),
@@ -1616,59 +1686,34 @@ tool("project_config", {
                 blockOnboardingMilestone("topics_seeded", "topic_seed_failed", tail, { exit_code: seed.code });
                 seedNote = ` (Heads up: couldn't seed search topics into the DB yet — ${tail}. The autopilot will report clearly if topics are missing.)`;
             }
-            // Cold-start QUERY supply: fan the seeded topics out into >=30 real X
-            // search queries (project_search_queries) so the deterministic Phase 1
-            // bank (qualified_query_bank.py) has something to run on day one.
-            // Without this, a freshly-configured project's bank is empty and the
-            // cycle falls back to ONE crude topic-as-query.
-            //
-            // CLAUDE-FREE: the in-session agent (you) expands topics -> queries and
-            // passes them as `search_queries` in THIS call. We seed them directly via
-            // --queries-json, so setup never shells out to `claude -p` (which isn't
-            // installed in the Desktop / .mcpb lane and was the FileNotFoundError
-            // users hit). If the agent didn't supply queries, we skip expansion
-            // entirely — the topic-as-query fallback still runs, just narrower — and
-            // nudge the agent to re-run with search_queries. (2026-06-19)
-            // Accept search_queries as a real array OR a stringified JSON array /
-            // comma list — the model often passes the latter, and the old
-            // Array.isArray-only gate silently dropped it, leaving the query bank
-            // empty on a fresh install (Karol, 2026-06-30).
-            const agentQueries = normalizeStringList(args.search_queries) ?? [];
-            if (seed.code === 0 && agentQueries.length) {
-                try {
-                    const qfile = path.join(os.tmpdir(), `saps-queries-${result.project}-${Date.now()}.json`);
-                    fs.writeFileSync(qfile, JSON.stringify({ queries: agentQueries.map((q) => ({ query: q, topic: "" })) }));
-                    const qseed = await runPython("scripts/seed_search_queries.py", ["--project", result.project, "--queries-json", qfile,
-                        "--supply-test", "auto", "--emit-json"], { timeoutMs: 600_000 });
-                    try {
-                        fs.unlinkSync(qfile);
-                    }
-                    catch { /* best-effort cleanup */ }
-                    const qm = /seeded=(\d+)\s+inserted=(\d+)\s+updated=(\d+)/.exec(qseed.stdout);
-                    const qjson = qseed.stdout.split("===QUERIES_JSON===")[1];
-                    if (qjson) {
-                        try {
-                            searchQueries = (JSON.parse(qjson.trim()).queries ?? []);
-                        }
-                        catch {
-                            /* leave empty; count note still informs the user */
-                        }
-                    }
-                    if (qseed.code === 0 && qm) {
-                        const n = searchQueries.length || Number(qm[1]);
-                        seedNote += ` Seeded ${n} search quer${n === 1 ? "y" : "ies"} so the cycle can fan out instead of running a single query.`;
-                    }
-                    else if (qseed.code !== 0) {
-                        const qtail = (qseed.stderr || qseed.stdout).trim().split("\n").slice(-1)[0] || "unknown error";
-                        seedNote += ` (Search queries not seeded yet — ${qtail}. The cycle still runs off the seeded topics.)`;
-                    }
-                }
-                catch (e) {
-                    seedNote += ` (Search-query seeding skipped — ${e.message}.)`;
-                }
+            // Cold-start QUERY supply (shared with the persona/engagement_mode path
+            // via seedSearchQueriesForProject): fan the agent-supplied search_queries
+            // into project_search_queries so the Phase 1 bank fans out on day one
+            // instead of running ONE crude topic-as-query. Only after the topic seed
+            // succeeds, matching the persona path's guard.
+            if (seed.code === 0) {
+                const qr = await seedSearchQueriesForProject(result.project, args.search_queries);
+                seedNote += qr.note;
+                searchQueries = qr.queries;
             }
-            else if (seed.code === 0) {
-                seedNote += ` (No search_queries supplied, so the cycle will run off the seeded topics one at a time. To fan out, re-call project_config with a search_queries array of ~30 X search strings you expand from these topics — it seeds them directly, no claude CLI.)`;
+        }
+        // Install/refresh the launchd kicker NOW, the moment a product project is
+        // ready — identical to the persona path (engagement_mode). Before this, a
+        // promotion-only setup never installed the kicker at setup time (the persona
+        // path explicitly skips promotion-only, and project_config didn't pick it
+        // up), so drafting didn't start until a later Claude/queue-worker boot ran
+        // the boot-time install. ensureQueueKickerInstalled is idempotent + product/
+        // persona-aware, so calling it from both setup paths is safe. Best-effort:
+        // a kicker hiccup never fails setup. (2026-06-30)
+        let kickerInstall = null;
+        if (result.ready) {
+            try {
+                kickerInstall = await ensureQueueKickerInstalled();
+                console.error(`[project_config] launchd kicker: ${kickerInstall.ok ? "ok" : "skip"} (${kickerInstall.detail})`);
+            }
+            catch (e) {
+                kickerInstall = { ok: false, detail: e?.message || String(e) };
+                console.error("[project_config] kicker install failed:", e?.message || e);
             }
         }
         // Surface any advanced (escape-hatch) field edits in the note so the
@@ -1691,6 +1736,8 @@ tool("project_config", {
             topics_seeded: topicsSeeded,
             topic_count: topicCount,
             search_queries: searchQueries,
+            kicker_installed: kickerInstall ? kickerInstall.ok : null,
+            kicker_detail: kickerInstall ? kickerInstall.detail : null,
             fields_set: result.fields_set,
             fields_removed: result.fields_removed,
             config_path: configPath(),

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.178",
-  "installedAt": "2026-07-01T02:07:11.872Z"
+  "version": "1.6.180",
+  "installedAt": "2026-07-01T17:24:56.073Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.178",
+  "version": "1.6.180",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -1476,6 +1476,16 @@ class S4LMenuBar(rumps.App):
         # and would freeze the card UI while the user reviews the rest of the stack.
         if not decision.get("approved"):
             n = decision.get("n")
+            # Durable local record FIRST, mirroring approved_queue_add for approvals.
+            # review_drafts() consults this, so the rejected card is suppressed from
+            # re-review IMMEDIATELY and even if the loopback is down when the
+            # background plan-flag write below runs. Without this, a reject was a
+            # fire-and-forget loopback call with a swallowed exception, so rejects
+            # silently vanished and the card "came back" — unlike durable approvals.
+            try:
+                st.review_reject_add(batch, n)
+            except Exception:
+                pass
 
             def _persist_reject():
                 try:

package/mcp/menubar/s4l_state.py

@@ -488,17 +488,20 @@ def review_drafts(plan, batch="review-queue"):
     posted, terminal (rejected/dead), or already approved is a settled decision and
     must never be re-presented for review (approved ones proceed to post).
 
-    Also excludes cards already sitting in the durable approved-queue (queued or
-    posting). The main plan's `approved`/`posted` flags are only stamped once a
-    post LANDS, so without this a card the user just approved would re-present
-    while it drains — and after a restart the whole un-posted approval backlog
-    would re-present (the exact "I approved these already" bug)."""
-    approved_ns = approved_queue_active_ns(batch)
+    Also excludes cards with ANY durable decision (approved, edited, rejected, or a
+    decided-but-failed post) via review_settled_ns(). approve/reject/edit are now
+    IDENTICAL: each writes a durable local record the INSTANT the user clicks, so a
+    decided card never re-presents even if the loopback (Claude Desktop) is down
+    when the decision's plan-flag write is attempted. The main plan's
+    `approved`/`terminal`/`posted` flags are only stamped once the loopback write
+    lands, so without this a card the user just decided would re-present (the exact
+    "I already decided these" bug)."""
+    settled_ns = review_settled_ns(batch)
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
         if c.get("posted") is True or c.get("terminal") is True or c.get("approved") is True:
             continue
-        if (i + 1) in approved_ns:
+        if (i + 1) in settled_ns:
             continue
         out.append(
             {
@@ -635,6 +638,28 @@ def toggle_mode():
     return write_mode(new)
 
 
+def review_reject_add(batch, n):
+    """Record a REJECT the INSTANT the user clicks, mirroring approved_queue_add.
+    Reject and approve are now IDENTICAL: both write a durable local record before
+    any loopback call, so review_drafts() suppresses the card even if the loopback
+    (Claude Desktop) is down when the reject's plan `terminal` write is attempted.
+    Dedups on (batch, n); a reject is FINAL and overrides any earlier status."""
+    with _approved_lock:
+        d = read_approved_queue()
+        for it in d["items"]:
+            if it.get("batch") == batch and it.get("n") == n:
+                if it.get("status") != "rejected":
+                    it.update(status="rejected", error=None, ts=time_iso())
+                    _write_approved_queue(d)
+                return
+        d["items"].append({
+            "batch": batch, "n": n, "text": "", "edited": False,
+            "drop_link": False, "candidate_url": "", "status": "rejected",
+            "error": None, "ts": time_iso(),
+        })
+        _write_approved_queue(d)
+
+
 def approved_queue_add(batch, n, text="", edited=False, candidate_url="", drop_link=False):
     """Record an approval the INSTANT the user clicks, before any posting. Dedups
     on (batch, n): re-approving a card that's still queued/posting/posted is a
@@ -690,6 +715,18 @@ def approved_queue_active_ns(batch):
             if it.get("batch") == batch and it.get("status") in ("queued", "posting", "posted")}
 
 
+def review_settled_ns(batch):
+    """Plan indices with ANY durable user DECISION for this batch — review_drafts()
+    excludes these so approve, edit, and reject behave IDENTICALLY: a decided card
+    never re-presents for review. Covers queued/posting/posted (approved, in flight
+    or landed), `rejected`, AND `failed` (a decided-but-failed post is surfaced via
+    the failure notification + dashboard, NOT by re-showing it as a fresh review
+    card — that re-show was the "I already decided these came back" bug)."""
+    return {it.get("n") for it in read_approved_queue()["items"]
+            if it.get("batch") == batch
+            and it.get("status") in ("queued", "posting", "posted", "failed", "rejected")}
+
+
 def post_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, timeout=900, activity_label=None):
     """Post / reject drafts via the loopback tool. `post` = 1-based numbers to post
     as-is; `edits` = [{n, text}] to rewrite then post; `reject` = numbers to mark

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.178",
+  "version": "1.6.180",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.178",
+  "version": "1.6.180",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/build_persona.py

@@ -94,8 +94,13 @@ GROUNDING_INSTRUCTIONS = (
     "posts/replies in the x source). Keep the organic rules: first person, "
     "specific, no links, no feature lists, no sales, no em dashes.\n"
     "  search_topics  ~15 topics they have genuine experience with.\n"
+    "  content_corpus (OPTIONAL but STRONGLY encouraged) the RAW gathered "
+    "corpus as one plain-text block: the persona's actual posts, replies, repo "
+    "descriptions, site copy, verbatim. This is NOT synthesized. It becomes the "
+    "grounding pool the drafter quotes real specifics from, so keep it dense and "
+    "first-hand. Trim only obvious noise; do NOT paraphrase. Cap ~8000 chars.\n"
     + PUBLIC_ONLY_NOTE
-    + "\nThen write the four fields to /tmp/persona.json and run "
+    + "\nThen write the fields to /tmp/persona.json and run "
     "`build_persona.py apply --from /tmp/persona.json`, or hand them to the "
     "project_config tool for the persona project."
 )
@@ -331,15 +336,34 @@ def cmd_apply(args) -> int:
         proj["search_topics"] = [str(t).strip() for t in topics if str(t).strip()]
         changed.append("search_topics")
 
+    # Raw corpus -> sidecar file (NOT config.json). config.json is inlined into
+    # many prompts (ALL_PROJECTS_JSON), so a multi-KB corpus there would bloat
+    # every cycle's token bill. Instead persist it beside config.json and let the
+    # persona lane read it only when it actually drafts. cmd_apply is the single
+    # writer; the cycle is read-only.
+    corpus_written = None
+    corpus = data.get("content_corpus")
+    if isinstance(corpus, str) and corpus.strip():
+        corpus_path = cfg_path.parent / "persona_corpus.txt"
+        try:
+            corpus_path.write_text(corpus.strip()[:8000] + "\n")
+            corpus_written = str(corpus_path)
+            changed.append("content_corpus")
+        except Exception as e:
+            print(f"[build_persona] corpus sidecar write failed: {e}", file=sys.stderr)
+
     if args.dry_run:
         print(json.dumps({"would_update": name, "fields": changed,
-                          "search_topics": proj.get("search_topics")}, indent=2))
+                          "search_topics": proj.get("search_topics"),
+                          "corpus_sidecar": corpus_written}, indent=2))
         return 0
 
     tmp = cfg_path.with_suffix(".json.tmp")
     tmp.write_text(json.dumps(cfg, ensure_ascii=False, indent=2) + "\n")
     tmp.replace(cfg_path)
     print(f"[build_persona] updated config.json persona {name!r}: {', '.join(changed)}")
+    if corpus_written:
+        print(f"[build_persona] wrote raw corpus sidecar -> {corpus_written}")
 
     # Seed the (possibly new) topics into project_search_topics via the canonical
     # path, so pick_search_topic has a live universe for the persona.

package/scripts/memory_snapshot.py

@@ -828,7 +828,12 @@ def _maybe_leak_alert(output: Path, current: dict[str, Any]) -> None:
 
     Runs on the JSONL path (every ~minute), reading its own recent history from the
     file just written, so it needs no extra state beyond a small cooldown marker."""
-    groups_to_watch = ("claude_cli", "remote_macos_mcp_servers")
+    # Watch claude_cli (the runaway worker fan-out) and the claude sessions
+    # CONFIGURED with the remote-macos-use MCP. Karol's 06-30 double-leak lived
+    # entirely in these two: claude_cli 289 + sessions_configured_remote_macos_mcp
+    # 280 at peak, while remote_macos_mcp_servers (the standalone server procs)
+    # stayed 0 the whole time. Watching the server group would have been blind.
+    groups_to_watch = ("claude_cli", "sessions_configured_remote_macos_mcp")
     samples = _env_int("SAPS_LEAK_ALERT_SAMPLES", 5)      # consecutive climbs required
     floor = _env_int("SAPS_LEAK_ALERT_FLOOR", 20)          # ignore below this count
     climb_min = _env_int("SAPS_LEAK_ALERT_CLIMB_MIN", 12)  # min first->last growth

package/scripts/saps_mode.py

@@ -217,6 +217,11 @@ def _persona_env_lines() -> str:
         [
             f"export SAPS_FORCE_PROJECT={shlex.quote(name)}",
             "export TWITTER_TAIL_LINK_RATE=0",
+            # Explicit lane signal so the (locked) cycle can branch the draft
+            # directive + inject the persona corpus without re-deriving the lane
+            # from SAPS_FORCE_PROJECT (which is also set by manual single-project
+            # MCP draft_cycle runs). Only the personal_brand lane sets this.
+            "export SAPS_ACTIVE_LANE=personal_brand",
         ]
     )
 

package/scripts/twitter_gen_links.py

@@ -171,6 +171,14 @@ def resolve_link(candidate: dict, projects: dict, page_gen_rate: float) -> tuple
     """
     proj_name = candidate.get("matched_project") or ""
     proj = projects.get(proj_name) or {}
+    # Personal-brand (persona) lane is link-free by definition. Self-promotion
+    # mode is pure organic engagement: no company, no signup, no profile URL. Any
+    # `website`/`url` a persona project happens to carry (some installs got the
+    # user's own X profile written there) must NEVER become a tail link. Enforce
+    # it here at the single source so no downstream surface (review card, manual
+    # post_drafts) has to strip a link that should never have been generated.
+    if proj.get("persona"):
+        return ("", "persona_no_link")
     plain_url = proj.get("website") or proj.get("url") or ""
     has_lp = bool(candidate.get("has_landing_pages"))
     keyword = (candidate.get("link_keyword") or "").strip()

package/skill/run-twitter-cycle.sh

@@ -1730,7 +1730,28 @@ done <<< "$CANDIDATES"
 ALL_PROJECTS_JSON=$(python3 -c "
 import json, os
 config = json.load(open(os.path.expanduser('~/social-autoposter/config.json')))
-print(json.dumps({p['name']: p for p in config.get('projects', [])}, indent=2))
+projects = config.get('projects', [])
+lane = os.environ.get('SAPS_ACTIVE_LANE', '')
+if lane == 'personal_brand':
+    # Personal-brand lane is pure organic growth: the drafter must NOT see any
+    # product config at all (no website, links, booking_link, get_started_link,
+    # features, pricing, CTAs). We emit ONLY the persona project, and ONLY the
+    # drafting-relevant fields, so there is literally no product context in the
+    # prompt to accidentally pitch, quote, or link. This also kills cross-routing
+    # (no 'other project' exists to route a candidate to). Whitelist, not
+    # denylist: any field added to the persona entry later stays out unless
+    # explicitly allowed here.
+    ALLOWED = {
+        'name', 'description', 'content_angle', 'voice',
+        'voice_relationship', 'content_guardrails',
+    }
+    persona = next((p for p in projects if p.get('persona') is True), None)
+    out = {}
+    if persona:
+        out[persona['name']] = {k: v for k, v in persona.items() if k in ALLOWED}
+    print(json.dumps(out, indent=2))
+else:
+    print(json.dumps({p['name']: p for p in projects}, indent=2))
 " 2>/dev/null || echo "{}")
 
 # Engagement-style picker (2026-05-19): pick ONE assigned style for this
@@ -1796,6 +1817,14 @@ if [ "$SAPS_DRAFT_PROMPT_VARIANT" = "treatment" ]; then
 else
     DRAFT_DIRECTIVE="Otherwise: draft a reply using the best engagement style. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling, do not apply any other length rule here. NEVER em dashes. Apply the matched project's \`voice\` block from ALL_PROJECTS_JSON: follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present."
 fi
+# Personal-brand lane (SAPS_ACTIVE_LANE=personal_brand, set by saps_mode.py):
+# replace the product-framed directive entirely. This lane is pure organic
+# growth: no product, no link, no CTA. The reply must add real value grounded in
+# the persona's first-hand material (the PERSONA CORPUS block + the persona voice
+# block), not concede-and-agree filler. Overrides both A/B arms above.
+if [ "${SAPS_ACTIVE_LANE:-}" = "personal_brand" ]; then
+    DRAFT_DIRECTIVE="Otherwise: draft a reply that stands on its own as a genuinely useful contribution to THIS thread. Ground it in the persona's real, first-hand experience from the PERSONA CORPUS block below (specific projects, real numbers, sharp opinions, actual failures) and in the persona's \`voice\` block from ALL_PROJECTS_JSON. Add exactly ONE of: a concrete specific from that lived experience, a sharp non-obvious opinion, a useful pointer, or a question that genuinely moves the thread forward. NEVER generic agreement ('makes sense', 'this is spot on', 'great point', 'the nuance here is'). This is a personal account, not a brand: sound like a real person in the thread. If web search is available and the thread hinges on a current fact, verify it before drafting rather than guessing. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling. NEVER em dashes. Follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present."
+fi
 
 if [ -n "$PICKED_STYLE" ]; then
     TOP_REPORT=$(python3 "$REPO_DIR/scripts/top_performers.py" --platform twitter --style "$PICKED_STYLE" 2>/dev/null || echo "(top performers report unavailable)")
@@ -1903,6 +1932,21 @@ else
 fi
 rm -f "$MEDIA_URLS_FILE" 2>/dev/null || true
 
+# --- PERSONA CORPUS injection (personal_brand lane only) --------------------
+# build_persona.py apply writes a raw first-hand corpus sidecar next to
+# config.json. In the personal_brand lane we inline it so the drafter grounds
+# replies in real specifics (projects, numbers, opinions) instead of the single
+# synthesized content_angle paragraph. Empty string in the promotion lane, so
+# promotion prompts stay lean and config.json is never bloated with the corpus.
+CORPUS_BLOCK=""
+if [ "${SAPS_ACTIVE_LANE:-}" = "personal_brand" ] && [ -f "$REPO_DIR/persona_corpus.txt" ]; then
+    CORPUS_BLOCK="## PERSONA CORPUS (raw first-hand material — ground your reply in THIS)
+This is the persona's own public writing and work, verbatim. Quote and draw real specifics from it: actual projects, real numbers, sharp opinions, real failures. Do NOT invent anything not supported here or in the persona voice block. Use it to make the reply concrete and unmistakably human.
+$(cat "$REPO_DIR/persona_corpus.txt")
+"
+    log "Phase 2b-prep: injected persona corpus ($(wc -c < "$REPO_DIR/persona_corpus.txt" | tr -d ' ') bytes)."
+fi
+
 log "Phase 2b-prep: Claude reading threads and drafting replies (no post cap)..."
 
 # Pre-assign the prep session UUID in the parent shell so it survives the
@@ -1926,7 +1970,7 @@ PREP_SCHEMA='{"type":"object","properties":{"candidates":{"type":"array","items"
 PREP_PROMPT="${TW_ENGINE_PREFIX}You are the Social Autoposter prep step.
 
 Your ONLY job in THIS session:
-  1. Read each candidate's thread context from the PRE-SCORED CANDIDATES block below (each entry's 'Text:' field is the parent tweet). You have NO browser and NO tools this session — draft ONLY from the context inlined in this prompt; do not attempt to fetch, navigate, or open any URL.
+  1. Read each candidate's thread context from the PRE-SCORED CANDIDATES block below (each entry's 'Text:' field is the parent tweet). You have WebSearch and WebFetch available: use them ONLY when a thread hinges on a current fact, a name, a release, or a claim you are not sure about, so your reply is specific and correct instead of vague. You do NOT have the Twitter/X browser this session — never fetch, navigate, or open a tweet/x.com URL, and never try to load the thread itself; the thread text you need is already inlined below. Most replies need no search at all; reach for it only when it materially improves the reply.
   2. Draft a reply for each.
   3. Persist each fresh draft via log_draft.py.
   4. Emit a structured plan describing the chosen candidates, the reply text, and (when applicable) the SEO link keyword + slug.
@@ -1940,6 +1984,7 @@ Read $REPO_DIR/config.json for project metadata.
 Virality is a composite predictor of how big this thread will get AFTER you reply: it combines engagement velocity (eng/hour), author reach (follower tier), age decay (6h half-life), retweet ratio, reply count, and discussion quality (reply:like ratio). On historical posted data the highest-Virality cohort (score >= 10000) received ~36x the median reply views of the lowest cohort (score < 10), so prioritize on-brand candidates with HIGH Virality. Rule of thumb: Virality >= 100 = strong thread on a real growth curve, your reply is likely to land 10-100x more eyeballs than a low-Virality thread. Delta (5min) is the raw T1-T0 engagement count and is shown for context only; do not re-rank on Delta.
 $CANDIDATE_BLOCK
 $MEDIA_BLOCK
+$CORPUS_BLOCK
 
 ## PROJECT ROUTING (per-candidate)
 Each candidate has a 'Project match' field. Use that project unless the thread content clearly better fits another project.
@@ -1955,7 +2000,7 @@ There is NO cap on how many candidates you may pick this cycle. Pick EVERY candi
 
 For each chosen candidate:
 1. Read the candidate's parent tweet from its 'Text:' field in the PRE-SCORED CANDIDATES block above.
-2. Understand the context from that inlined text (you have no browser; everything you need to draft is already in this prompt).
+2. Understand the context from that inlined text (the thread text is already in this prompt; you do NOT have the Twitter browser, but you MAY use WebSearch/WebFetch for external facts when a thread needs them to be answered well).
 3. DRAFT HANDLING (existing vs fresh):
    - If the candidate block shows an EXISTING DRAFT line AND draft age < 30 minutes, REUSE the draft text verbatim. Set engagement_style to the existing style. Do NOT call log_draft.py; do NOT redraft. Reason: prior cycle paid the LLM cost.
    - $DRAFT_DIRECTIVE
@@ -2017,7 +2062,7 @@ CRITICAL:
 - DO NOT call twitter_browser.py.
 - DO NOT call generate_page.py (the shell runs it AFTER your session, outside the lock).
 - DO NOT call log_post.py or campaign_bump.py.
-- You have NO browser and NO tools this session; draft only from the inlined candidate context above. Do not navigate, fetch, or open any URL.
+- You do NOT have the Twitter/X browser this session: never navigate, fetch, or open a tweet/x.com URL, and never try to reload the thread. WebSearch/WebFetch ARE available for external fact-checking only; use them sparingly and never to open the tweet itself.
 - NEVER use em dashes. Use commas, periods, or regular dashes (-).
 - Reply in the SAME LANGUAGE as the parent tweet."
 
@@ -2025,7 +2070,15 @@ CRITICAL:
 # On Linux ARG_MAX is 2MB; the assembled prompt (config.json + top_report +
 # styles + schema + candidates) busts that on the VM, dying with E2BIG
 # "Argument list too long". stdin has no such cap.
-PREP_OUTPUT=$(printf '%s' "$PREP_PROMPT" | "$REPO_DIR/scripts/run_claude.sh" "run-twitter-cycle-prep" --strict-mcp-config --mcp-config "$TW_MCP_CONFIG" -p --output-format json --json-schema "$PREP_SCHEMA" 2>&1)
+# --allowedTools: restore external fact-checking to the prep drafter (removed
+# 2026-06-26). --strict-mcp-config stays so the twitter-harness browser MCP is NOT
+# loaded: the model can search the web but can never touch the CDP Chrome that
+# Phase 2b-post drives (that would break the two-lock). The tools are passed as a
+# SINGLE comma-separated token on purpose: claude_job.py's queue parser (box
+# installs) treats --allowedTools as a one-value flag, so a space-separated second
+# tool would leak in as the prompt. On the box these flags ride through
+# claude_job.py; Desktop's own web search + the reworded prompt enable it there.
+PREP_OUTPUT=$(printf '%s' "$PREP_PROMPT" | "$REPO_DIR/scripts/run_claude.sh" "run-twitter-cycle-prep" --strict-mcp-config --mcp-config "$TW_MCP_CONFIG" --allowedTools WebSearch,WebFetch -p --output-format json --json-schema "$PREP_SCHEMA" 2>&1)
 
 echo "$PREP_OUTPUT" >> "$LOG_FILE"
 
@@ -2035,14 +2088,12 @@ echo "$PREP_OUTPUT" >> "$LOG_FILE"
 # volume (the May-June ~10x ramp that collapsed per-post reach ~15x) while
 # keeping the strongest thread. Deferred picks are dropped from the plan so they
 # stay status='pending' (NOT 'skipped'); Phase 0 salvage re-judges them next
-# cycle and reuses their fresh drafts. DRAFT_ONLY (manual MCP review) keeps every
-# draft so the human sees the full set. Override with SAPS_TWITTER_POST_TOP_N
-# (default 1; 0 = no cap).
-if [ "${DRAFT_ONLY:-0}" = "1" ]; then
-    POST_TOP_N=0
-else
-    POST_TOP_N="${SAPS_TWITTER_POST_TOP_N:-1}"
-fi
+# cycle and reuses their fresh drafts. (2026-06-30) The cap is now the SINGLE
+# standard for BOTH lanes: autopilot direct-post AND DRAFT_ONLY manual MCP review.
+# The old DRAFT_ONLY=1 -> POST_TOP_N=0 special-case was removed on purpose, so the
+# human reviews the exact same one highest-Virality draft the autopilot would post.
+# Override with SAPS_TWITTER_POST_TOP_N (default 1; 0 = no cap, env opt-out only).
+POST_TOP_N="${SAPS_TWITTER_POST_TOP_N:-1}"
 
 # Parse the prep envelope and write the plan to \$PLAN_FILE; also extract the
 # 'rejected' array into \$SKIP_FILE so log_twitter_skips.py can persist a
@@ -2065,7 +2116,8 @@ rejected   = so.get('rejected',   []) if isinstance(so, dict) else []
 # TOP-N POST CAP (2026-06-29): keep only the highest-Virality on-brand pick(s).
 # Build candidate_id -> virality_score from the pre-scored CANDIDATES block
 # (pipe cols: id|url|author|text|virality|delta|...), sort the model's picks by
-# it, and truncate. SAPS_POST_TOP_N=0 disables the cap (manual DRAFT_ONLY review).
+# it, and truncate. SAPS_POST_TOP_N=0 disables the cap (env opt-out only; the cap
+# applies to both autopilot and DRAFT_ONLY lanes as of 2026-06-30).
 # Truncated picks are simply dropped from the plan, so they stay status='pending'
 # (NOT added to 'rejected'); no thread is blacklisted and Phase 0 salvages them.
 _top_n = int(os.environ.get('SAPS_POST_TOP_N', '1') or '1')