social-autoposter 1.6.182 → 1.6.185

package/mcp/dist/index.js

@@ -22,7 +22,7 @@ import fs from "node:fs";
 import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
 import { applySetup, resolveProject, personaReady, listManagedProjectStatus, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, normalizeStringList, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
-import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, menubarRunning, ensurePipelineCurrent, ensureRuntimeProvisioned, } from "./runtime.js";
+import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, menubarRunning, clearMenubarStop, ensurePipelineCurrent, ensureRuntimeProvisioned, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
 import { initSentry, sendHeartbeat, captureError, flushSentry, startLogStreaming, flushLogs } from "./telemetry.js";
@@ -2101,10 +2101,14 @@ tool("restart_menubar", {
     title: "Restart the S4L menu bar app",
     description: "Relaunch the always-on S4L menu bar (tray) app after it was quit. Re-loads its " +
         "LaunchAgent (installing the menu bar first if needed). Use when the dashboard reports the menu " +
-        "bar is not running, or the user asks to bring the S4L tray icon back. Does NOT touch the draft " +
+        "bar is not running, or the user asks to start S4L, restart S4L, or bring the S4L tray icon " +
+        "back. Does NOT touch the draft " +
         "schedule, X connection, or any posting — it only restarts the tray UI.",
     inputSchema: {},
 }, async () => {
+    // Explicit user intent to start: lift the stop sentinel a tray Quit wrote,
+    // otherwise ensureMenubar() would no-op forever.
+    clearMenubarStop();
     const res = await ensureMenubar();
     const running = await menubarRunning();
     return jsonContent({
@@ -2145,6 +2149,11 @@ tool("queue_setup", {
     inputSchema: {},
 }, async () => {
     ensureQueueWorkerToolsAllowed();
+    // Re-arming the autopilot is an explicit "start S4L" action: lift a prior
+    // tray Quit so the review cards have a surface again. Best-effort and
+    // async — task specs must return regardless of tray state.
+    clearMenubarStop();
+    void ensureMenubar();
     // Write each worker's canonical SKILL.md to disk NOW, before the agent calls
     // create_scheduled_task. The host's create_scheduled_task can report a task
     // "already exists" (e.g. a stale Routines registration left after a reset) and

package/mcp/dist/runtime.js

@@ -84,6 +84,29 @@ const MENUBAR_DIR = path.join(STATE_DIR, "menubar");
 const MENUBAR_ENTRY = path.join(MENUBAR_DIR, "s4l_menubar.py");
 const MENUBAR_OUT_LOG = path.join(MENUBAR_DIR, "menubar.out.log");
 const MENUBAR_ERR_LOG = path.join(MENUBAR_DIR, "menubar.err.log");
+// Stop sentinel: the menu bar's Quit flow writes this file (and boots itself
+// out) to record that the USER explicitly stopped S4L. Every auto-start path
+// (boot-time ensureMenubar, runtime provision) must respect it, otherwise the
+// tray is guaranteed back on the next Claude restart — the exact bug users hit
+// after Quit. Only an explicit start action (restart_menubar tool, queue_setup
+// re-arm) clears it. KEEP the filename in sync with menubar/s4l_menubar.py.
+const MENUBAR_STOP_FLAG = path.join(STATE_DIR, "stopped.flag");
+export function menubarStopped() {
+    try {
+        return fs.existsSync(MENUBAR_STOP_FLAG);
+    }
+    catch {
+        return false;
+    }
+}
+export function clearMenubarStop() {
+    try {
+        fs.rmSync(MENUBAR_STOP_FLAG, { force: true });
+    }
+    catch {
+        /* best-effort */
+    }
+}
 // A directory is a usable pipeline clone only if it carries requirements.txt
 // (the deps manifest) AND scripts/ (the pipeline). Guards against pointing at an
 // empty extension dir or a half-deleted state dir.
@@ -656,7 +679,15 @@ async function provision(progress) {
     // Non-fatal: a menu bar failure must never block a usable runtime, so on any
     // problem we mark the step errored and still persist runtime.json below.
     setStep("menubar", "running");
-    if (process.platform === "darwin") {
+    if (process.platform !== "darwin") {
+        setStep("menubar", "done", "skipped (macOS only)");
+    }
+    else if (menubarStopped()) {
+        // A runtime repair/re-provision must not resurrect a tray the user
+        // explicitly quit; an explicit start clears the flag first.
+        setStep("menubar", "done", "skipped (user stopped the menu bar)");
+    }
+    else {
         const mb = await installMenubar(uv, uvEnv, VENV_PYTHON);
         setStep("menubar", mb.ok ? "done" : "error", mb.detail);
         // Non-fatal step, so the only prior signal of a menu bar install failure was
@@ -669,9 +700,6 @@ async function provision(progress) {
             });
         }
     }
-    else {
-        setStep("menubar", "done", "skipped (macOS only)");
-    }
     // --- Persist the result ---------------------------------------------------
     const info = {
         python: VENV_PYTHON,
@@ -790,6 +818,10 @@ export async function menubarRunning() {
         return true;
     if (!runtimeReady())
         return true;
+    // User explicitly quit the tray: it is down ON PURPOSE, so report "fine" —
+    // the dashboard banner must not nag about a state the user chose.
+    if (menubarStopped())
+        return true;
     try {
         return await menubarLoaded();
     }
@@ -846,6 +878,12 @@ export async function installMenubar(uv, uvEnv, python) {
 export async function ensureMenubar() {
     if (process.platform !== "darwin")
         return { ok: true, skipped: true, detail: "non-macOS" };
+    // The user clicked Quit in the tray: stay stopped across Claude restarts,
+    // regardless of runtime state. Explicit start paths (restart_menubar tool,
+    // queue_setup) clear the flag before calling this.
+    if (menubarStopped()) {
+        return { ok: true, skipped: true, detail: "user stopped the menu bar (stopped.flag)" };
+    }
     if (!runtimeReady())
         return { ok: false, skipped: true, detail: "runtime not ready" };
     if (fs.existsSync(MENUBAR_ENTRY) &&

package/mcp/dist/telemetry.js

@@ -92,17 +92,30 @@ export async function sendHeartbeat(reason) {
         // session pile-up that can balloon RAM to tens of GB) is visible centrally
         // without us SSHing in. Best-effort: any failure falls back to "{}" so the
         // heartbeat itself never depends on the sampler succeeding.
-        let body = "{}";
+        const bodyObj = {};
         try {
             const mem = await runPython("scripts/memory_snapshot.py", ["--summary"], { timeoutMs: 12_000 });
             const out = (mem.stdout || "").trim();
-            if (mem.code === 0 && out) {
-                body = JSON.stringify({ resource: JSON.parse(out) });
-            }
+            if (mem.code === 0 && out)
+                bodyObj.resource = JSON.parse(out);
+        }
+        catch {
+            /* omit resource */
+        }
+        // Also attach the S4L autopilot scheduled-task folder state so the server can
+        // tell, per install, whether the queue-worker tasks relocated to ~/.s4l-worker
+        // or are still mislocated (the menubar cwd-rewrite self-heal used to fire
+        // silently — no fleet-wide signal). Best-effort; independent of resource.
+        try {
+            const st = await runPython("scripts/scheduled_tasks_snapshot.py", ["--summary"], { timeoutMs: 10_000 });
+            const out = (st.stdout || "").trim();
+            if (st.code === 0 && out)
+                bodyObj.scheduled_tasks = JSON.parse(out);
         }
         catch {
-            /* keep body = "{}" */
+            /* omit scheduled_tasks */
         }
+        const body = Object.keys(bodyObj).length ? JSON.stringify(bodyObj) : "{}";
         const resp = await fetch(`${base}/api/v1/installations/heartbeat`, {
             method: "POST",
             headers: { "X-Installation": header, "content-type": "application/json" },

package/mcp/dist/twitterAuth.js

@@ -10,6 +10,7 @@
 // (restore_twitter_session.py for CDP login-check, ai_browser_profile.cookies
 // for Keychain-decrypt + CDP inject). Reusing them keeps this MCP a thin client.
 import { runPython } from "./repo.js";
+import { captureError } from "./telemetry.js";
 function parse(stdout, stderr, code) {
     try {
         return JSON.parse(stdout.trim().split("\n").slice(-50).join("\n"));
@@ -64,7 +65,15 @@ export async function xScanProfile(opts) {
     try {
         return JSON.parse(res.stdout.trim().split("\n").slice(-1).join("\n"));
     }
-    catch {
+    catch (e) {
+        // The X profile scan feeds handle detection + grounding for the draft lane; a
+        // silent no-JSON failure here means we scrape the wrong handle (or none) and
+        // never know. Surface it so we can see fleet-wide how often the scan breaks.
+        captureError(e, {
+            component: "twitter_auth",
+            phase: "scan_x_profile",
+            exit: String(res.code),
+        });
         return {
             ok: false,
             state: "error",
@@ -83,7 +92,14 @@ export async function xDetectSources() {
     try {
         return JSON.parse(res.stdout.trim().split("\n").slice(-200).join("\n"));
     }
-    catch {
+    catch (e) {
+        // detect-sources populates the panel's "import from" dropdown; a no-JSON failure
+        // leaves the user unable to connect X during setup with no server-side trace.
+        captureError(e, {
+            component: "twitter_auth",
+            phase: "detect_sources",
+            exit: String(res.code),
+        });
         return {
             ok: false,
             sources: [],

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.182",
-  "installedAt": "2026-07-01T18:31:17.834Z"
+  "version": "1.6.185",
+  "installedAt": "2026-07-01T21:48:09.463Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.182",
+  "version": "1.6.185",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -60,6 +60,20 @@ def _capture(err, **tags):
         pass
 
 
+def _capture_msg(message, level="warning", **tags):
+    """Report a handled menu-bar CONDITION (not an exception) to Sentry so we get
+    fleet-wide signal on operational states like an orphaned/disabled/rate-limited
+    draft schedule. capture_exception only covers thrown errors; this covers the
+    "nothing crashed but the autopilot isn't running" case. No-op if the Sentry
+    bootstrap failed."""
+    try:
+        if _sentry is not None:
+            tags.setdefault("component", "menubar")
+            _sentry.capture_message(message, level=level, tags=tags)
+    except Exception:
+        pass
+
+
 def _flush():
     try:
         if _sentry is not None:
@@ -104,6 +118,19 @@ def _activate_front():
 CLAUDE_APP = "Claude"
 POLL_SECONDS = 5
 
+# Our own LaunchAgent. Quit boots it out and deletes the plist so the tray is
+# genuinely gone (KeepAlive can't respawn it, RunAtLoad can't resurrect it at
+# next login). Keep the label in sync with MENUBAR_LABEL in mcp/src/runtime.ts.
+MENUBAR_LABEL = "com.m13v.social-autoposter.menubar"
+MENUBAR_PLIST = os.path.join(
+    os.path.expanduser("~"), "Library", "LaunchAgents", f"{MENUBAR_LABEL}.plist"
+)
+# Stop sentinel read by the MCP server's ensureMenubar()/provision paths: while
+# present, no auto-start path may reinstall the tray. Cleared only by explicit
+# start actions (restart_menubar tool, queue_setup re-arm). Keep the filename in
+# sync with MENUBAR_STOP_FLAG in mcp/src/runtime.ts.
+STOP_FLAG = os.path.join(st.state_dir(), "stopped.flag")
+
 # Autopilot scheduled tasks. The two queue workers must RUN in a dedicated folder
 # (~/.s4l-worker) so their once-a-minute sessions don't flood the user's
 # interactive Claude Code history (Claude buckets sessions by cwd). The single
@@ -690,22 +717,26 @@ class S4LMenuBar(rumps.App):
 
     def _quit_app(self, _=None):
         """The single Quit path. Quitting stops the autopilot completely: the
-        draft/query scheduled tasks are removed so they no longer fire. Claude
-        Desktop OWNS the live schedule and caches the registry in memory,
-        clobbering any live edit on the next fire — so the only reliable way to
-        disable them is to quit Claude, strip the tasks while it's down, then
-        relaunch. We warn the user with a modal FIRST that Claude Desktop will
-        restart, since the app window will close and reopen under them."""
+        draft/query scheduled tasks are removed so they no longer fire, AND the
+        tray itself goes away for good (stop flag + plist removal + self
+        bootout — see _quit_work). Claude Desktop OWNS the live schedule and
+        caches the registry in memory, clobbering any live edit on the next
+        fire — so the only reliable way to disable them is to quit Claude,
+        strip the tasks while it's down, then relaunch. We warn the user with a
+        modal FIRST that Claude Desktop will restart, since the app window will
+        close and reopen under them."""
         _activate_front()
         choice = rumps.alert(
             title="Quit the S4L autoposter?",
             message=(
                 "Quitting stops the autoposter completely: the draft + query "
-                "scheduled tasks are removed so nothing fires anymore.\n\n"
+                "scheduled tasks are removed so nothing fires anymore, and this "
+                "menu bar icon goes away and stays away.\n\n"
                 "Claude Desktop will quit and restart to apply this — its window "
                 "will close and reopen in a moment. Your X login, browser layer, "
-                "and config all stay; you can re-arm the schedule any time from "
-                "this menu."
+                "and config all stay.\n\n"
+                "To start S4L again later, open Claude and say \"start S4L\" "
+                "(or re-run setup)."
             ),
             ok="Quit & restart Claude", cancel="Cancel",
         )
@@ -754,10 +785,23 @@ class S4LMenuBar(rumps.App):
             pass
 
     def _quit_work(self):
-        """Quit/kill Claude, strip the scheduled tasks while it's down, relaunch.
-        Mirror of _relocate_restart_work's restart block. The menu bar is a separate
-        launchd process, so killing Claude does not kill us."""
+        """Quit/kill Claude, strip the scheduled tasks while it's down, relaunch
+        Claude, then take THIS tray down for good. Mirror of
+        _relocate_restart_work's restart block. The menu bar is a separate
+        launchd process, so killing Claude does not kill us.
+
+        The stop flag is written FIRST: the relaunched Claude boots the MCP
+        server, whose ensureMenubar() would otherwise reinstall the tray
+        unconditionally (the reappearing-icon bug). The plist is deleted so
+        RunAtLoad can't resurrect us at next login, and the final bootout
+        removes the KeepAlive job — which kills this process, so it must be
+        the last thing we do."""
         try:
+            try:
+                with open(STOP_FLAG, "w") as fh:
+                    fh.write(f"user quit via menu bar at {time.strftime('%Y-%m-%dT%H:%M:%S%z')}\n")
+            except Exception as e:
+                _capture(e, action="quit_stop_flag")
             subprocess.run(["osascript", "-e", 'tell application "Claude" to quit'],
                            capture_output=True, timeout=20)
             time.sleep(4)
@@ -766,11 +810,30 @@ class S4LMenuBar(rumps.App):
             subprocess.run(["killall", "-9", "Claude"], capture_output=True)
             time.sleep(1)
             self._remove_scheduled_tasks()
+            try:
+                os.remove(MENUBAR_PLIST)
+            except FileNotFoundError:
+                pass
+            except Exception as e:
+                _capture(e, action="quit_remove_plist")
             subprocess.run(["open", "-a", CLAUDE_APP], capture_output=True, timeout=20)
-            self._notify("S4L", "Autoposter stopped. Claude restarted.")
+            self._notify("S4L", "Autoposter stopped. Say \"start S4L\" in Claude to bring it back.")
         except Exception as e:
             _capture(e, action="quit_app")
             self._notify("S4L", "Couldn't fully stop the autoposter — see logs.")
+        finally:
+            # Boot out our own KeepAlive agent. launchd kills this process as
+            # part of the bootout, so nothing after this line is guaranteed to
+            # run. Runs even if the Claude restart above failed: the user asked
+            # for the tray to be gone.
+            subprocess.run(
+                ["launchctl", "bootout", f"gui/{os.getuid()}/{MENUBAR_LABEL}"],
+                capture_output=True, timeout=15,
+            )
+            # Only reached if bootout didn't kill us (e.g. dev run outside
+            # launchd). Exit 0: KeepAlive {SuccessfulExit: false} treats a clean
+            # exit as final. os._exit because we're on a background thread.
+            os._exit(0)
 
     def _update(self, _=None):
         self._send_to_claude(UPDATE_PROMPT)
@@ -1012,11 +1075,30 @@ class S4LMenuBar(rumps.App):
             if not self._scheduled_task_cwd_needs_fix():
                 self._cwd_healed = True
                 self._reloc_needed = False
+            # Push a fresh heartbeat now so the server/dashboard reflects the
+            # corrected scheduled-task folder state within seconds instead of
+            # waiting up to ~15 min for the next MCP heartbeat. Best-effort.
+            self._fire_heartbeat()
         except Exception:
             pass
         finally:
             self._relocating = False
 
+    def _fire_heartbeat(self):
+        """Best-effort: run the npx-lane heartbeat.sh once so the install's
+        scheduled_tasks sample updates centrally right after a relocation. Never
+        raises; a missing repo/script or network hiccup is silently ignored (the
+        MCP's own ~15-min heartbeat is the durable channel)."""
+        try:
+            repo = os.environ.get("SAPS_REPO_DIR") or ""
+            hb = os.path.join(repo, "scripts", "heartbeat.sh")
+            if not (repo and os.path.exists(hb)):
+                return
+            env = dict(os.environ, REPO_DIR=repo)
+            subprocess.run(["bash", hb], capture_output=True, timeout=30, env=env)
+        except Exception:
+            pass
+
     def _open_dashboard(self, _=None):
         # Prefer the LIVE MCP loopback panel (full interactivity — its buttons
         # reach the MCP tool handlers) when Claude is up. When it's NOT, fall back
@@ -1311,6 +1393,22 @@ class S4LMenuBar(rumps.App):
         self._last_blocker_code = blocker_code
         # Notify once per episode (the draft schedule isn't running for this account).
         if attention and not self._stall_notified:
+            # Fleet-wide telemetry: the draft autopilot needs attention on THIS
+            # install (orphaned by an account switch, disabled, rate-limited, or a
+            # stuck worker). Only channel that surfaces "customer's autopilot silently
+            # stopped drafting" to us; the cycle log lives only on their machine.
+            # Once per episode (gated by _stall_notified), so it never spams.
+            _reason = (
+                self._stall_reason_info[0]
+                or ("disabled" if schedule_state == "disabled" else "missing")
+            )
+            _capture_msg(
+                f"S4L draft autopilot needs attention: {_reason}",
+                level="warning",
+                phase="draft_schedule",
+                reason=_reason,
+                schedule_state=str(schedule_state),
+            )
             if self._stall_reason_info[0] == "rate_limited":
                 self._notify(
                     "S4L Claude rate-limited",

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.182",
+  "version": "1.6.185",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.182",
+  "version": "1.6.185",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/heartbeat.sh

@@ -28,12 +28,23 @@ HDR=$("$PYTHON_BIN" "$REPO_DIR/scripts/identity.py" header 2>>"$LOG_FILE") || {
   exit 1
 }
 
+# Attach the S4L autopilot scheduled-task folder state (parity with the .mcpb
+# heartbeat) so the server can tell centrally whether the queue-worker tasks are
+# running from ~/.s4l-worker or are still mislocated. Best-effort: any failure
+# falls back to an empty body so the heartbeat itself never depends on it.
+BODY='{}'
+if ST=$("$PYTHON_BIN" "$REPO_DIR/scripts/scheduled_tasks_snapshot.py" --summary 2>>"$LOG_FILE"); then
+  if [ -n "$ST" ]; then
+    BODY="{\"scheduled_tasks\":$ST}"
+  fi
+fi
+
 # POST so the server can refresh the volatile fields (last_ip, last_seen_at).
 RESP=$(curl -fsS -m 20 \
   -X POST \
   -H "X-Installation: $HDR" \
   -H "content-type: application/json" \
-  -d '{}' \
+  -d "$BODY" \
   -w "\n__HTTP__%{http_code}__%{time_total}s" \
   "$BASE_URL/api/v1/installations/heartbeat" 2>>"$LOG_FILE") || {
   log "FAIL curl exit=$?"

package/scripts/reap_stale_claude_sessions.py

@@ -594,4 +594,15 @@ if __name__ == "__main__":
         sys.exit(main())
     except Exception as e:  # never let the reaper itself crash the launchd job loudly
         print(f"[claude-reaper] error: {e}", file=sys.stderr)
+        # If the reaper itself dies, the queue-worker session leak resumes silently
+        # and the box climbs back toward OOM with no signal. This is the only channel
+        # that surfaces a dead reaper to us. The reaper doesn't import http_api, so
+        # Sentry was never init()'d; do it here. Best-effort, never re-raise.
+        try:
+            import sentry_init
+            sentry_init.init()
+            sentry_init.capture_exception(e, tags={"component": "claude_reaper"})
+            sentry_init.flush(2.0)
+        except Exception:
+            pass
         sys.exit(0)

package/scripts/release-mcpb.sh

@@ -7,14 +7,19 @@
 #   1. Bump the repo-root package.json (the SINGLE source of truth) and lockfile.
 #      Default: patch bump. --bump minor|major, or pin with --version / --tag,
 #      or --no-bump to re-release the current version as-is.
-#   2. Build the MCP bundle: vite (panel) + tsc (server) + bundle-pipeline. The
-#      embedded pipeline.tgz is `npm pack` of the (now-bumped) repo, so the shell
-#      and the bundled Python pipeline CANNOT diverge.
-#   3. Stamp dist/version.json + manifest.json + mcp/package.json(+lock) to match.
+#   2. Stamp EVERY version satellite from that one source, THEN build, so the
+#      embedded pipeline.tgz (an `npm pack` of the repo) captures an all-current
+#      mcp/ subtree. Order is load-bearing: satellites (manifest.json,
+#      mcp/package.json+lock, dist/version.json) are stamped BEFORE the pack, not
+#      after, or the tarball ships a stale mcp/ subtree (the 1.6.181-menu bug).
+#      Sub-steps: 2a stamp source satellites -> 2b build panel+server -> 2c stamp
+#      dist/version.json -> 2d pack pipeline.tgz.
+#   3. (Regenerate manifest.json `tools` from the server's registrations.)
 #   4. Pack mcp/ into mcp/social-autoposter.mcpb via the mcpb CLI.
 #   5. Verify: size cap, embedded pipeline.tgz present, version.json + manifest +
-#      the pipeline.tgz's OWN internal version all == VERSION (the guard that was
-#      missing when 1.6.84 shipped a 1.6.83 pipeline), install tools present.
+#      the pipeline.tgz's OWN internal version AND its mcp/ subtree (dist/version.json,
+#      mcp/package.json) all == VERSION (guards the 1.6.84 stale-pipeline and the
+#      1.6.181 stale-menu bugs), install tools present.
 #   6. npm publish social-autoposter@VERSION (idempotent; skipped if already live).
 #   7. Create/update GitHub release vX.Y.Z and upload the .mcpb (--clobber).
 #
@@ -130,23 +135,25 @@ else
   say "Releasing $TAG (repo-root package.json already $VERSION)"
 fi
 
-# ---- 2. Build the bundle ----------------------------------------------------
-say "Building MCP bundle (panel + server + embedded pipeline.tgz)"
-( cd "$MCP_DIR" && npm run build:bundle )
+# ---- 2. Stamp EVERY version satellite BEFORE packing, then build ------------
+# ONE source of truth (repo-root package.json, bumped in step 1); every other
+# file that carries a version is a SATELLITE stamped from it here. The ordering
+# is load-bearing: the embedded pipeline.tgz is `npm pack` of the repo root
+# (bundle-pipeline.mjs), so it captures mcp/package.json AND mcp/dist/version.json
+# AS THEY ARE ON DISK at pack time. If a satellite is stamped AFTER the pack, the
+# tarball ships a stale mcp/ subtree while its top-level package.json is current.
+# The menu bar resolves its version from mcp/dist/version.json FIRST
+# (scripts/snapshot.py::_resolve_version), so a late stamp shows the OLD version
+# in the menu bar even though the install is current (the 1.6.181-menu-on-a-
+# 1.6.182-box bug, 2026-07-01). So: stamp source-tree satellites (2a) -> build
+# panel + server (2b) -> stamp dist/version.json now that tsc emitted dist/ (2c)
+# -> pack pipeline.tgz, now capturing an all-$VERSION mcp/ subtree (2d).
 
-# ---- 3. Stamp version.json --------------------------------------------------
-say "Stamping mcp/dist/version.json -> $VERSION"
-node -e "
-const fs=require('fs'),p='$MCP_DIR/dist/version.json';
-fs.writeFileSync(p, JSON.stringify({version:'$VERSION',installedAt:new Date().toISOString()},null,2)+'\n');
-console.log('  '+fs.readFileSync(p,'utf8').trim());
-"
-
-# ---- 3b. Stamp manifest.json + mcp/package.json + lockfile version ----------
-# Claude Desktop's extension "Details" panel reads version from manifest.json,
-# so it must track the release version too (not the frozen 0.0.1 placeholder).
-# mcp/package.json and its lockfile are stamped in lockstep so the three stay
-# consistent (npm errors if package.json and package-lock.json disagree).
+# ---- 2a. Stamp manifest.json + mcp/package.json + lockfile (PRE-pack) --------
+# manifest.json feeds Claude Desktop's extension "Details" panel; mcp/package.json
+# + its lockfile are stamped in lockstep (npm errors if they disagree). All three
+# are inside the repo `files` allowlist, so they land in pipeline.tgz — they MUST
+# be current before 2d packs them.
 say "Stamping mcp/manifest.json + mcp/package.json + mcp/package-lock.json -> $VERSION"
 node -e "
 const fs=require('fs');
@@ -167,6 +174,25 @@ if (fs.existsSync(lp)) {
 }
 "
 
+# ---- 2b. Build panel + server (emits dist/) ---------------------------------
+# Split out of `build:bundle` so we can stamp dist/version.json (2c) AFTER tsc
+# emits dist/ but BEFORE the pipeline pack (2d). tsc does not touch dist/version.json
+# (it is JSON we author, not a TS output), so a 2c stamp survives to the pack.
+say "Building MCP panel + server"
+( cd "$MCP_DIR" && npm run build:panel && npm run build:server )
+
+# ---- 2c. Stamp mcp/dist/version.json (after tsc, before the pipeline pack) ---
+say "Stamping mcp/dist/version.json -> $VERSION"
+node -e "
+const fs=require('fs'),p='$MCP_DIR/dist/version.json';
+fs.writeFileSync(p, JSON.stringify({version:'$VERSION',installedAt:new Date().toISOString()},null,2)+'\n');
+console.log('  '+fs.readFileSync(p,'utf8').trim());
+"
+
+# ---- 2d. Pack embedded pipeline.tgz (now captures an all-$VERSION mcp/) ------
+say "Packing embedded pipeline.tgz"
+( cd "$MCP_DIR" && npm run bundle:pipeline )
+
 # ---- 3c. Regenerate manifest.json `tools` from the SERVER's registrations ---
 # Claude Desktop exposes a .mcpb extension's tools to agent chats from the
 # manifest's `tools` array. It was hand-written and drifted: it listed 5 old
@@ -226,6 +252,18 @@ PIPELINE_VER=$(unzip -p "$BUNDLE" dist/pipeline.tgz 2>/dev/null | tar -xzO packa
 [[ "$PIPELINE_VER" == "$VERSION" ]] || die "embedded pipeline.tgz version=$PIPELINE_VER != $VERSION (box would materialize a STALE pipeline; bump repo-root package.json BEFORE build)"
 echo "  pipeline.tgz internal version: $PIPELINE_VER ok"
 
+# The menu bar reads package/mcp/dist/version.json FIRST, then package/mcp/package.json
+# (scripts/snapshot.py::_resolve_version), both from the SAME pipeline.tgz the box
+# extracts into SAPS_REPO_DIR. Assert the whole mcp/ subtree matches so a satellite
+# stamped after the pack can't ship a menu that shows the wrong version on an
+# otherwise-current box (the 1.6.181-menu-on-a-1.6.182-box bug). Empty/missing =
+# fail: _resolve_version would fall through and could read a stale file.
+for sub in mcp/dist/version.json mcp/package.json; do
+  SUBV=$(unzip -p "$BUNDLE" dist/pipeline.tgz 2>/dev/null | tar -xzO "package/$sub" 2>/dev/null | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version" 2>/dev/null || echo "?")
+  [[ "$SUBV" == "$VERSION" ]] || die "embedded pipeline.tgz package/$sub=$SUBV != $VERSION (menu bar would show the wrong version; stamp satellites BEFORE the pipeline pack)"
+  echo "  pipeline.tgz $sub: $SUBV ok"
+done
+
 for f in "dist/index.js" "dist/runtime.js" "manifest.json"; do
   # grep -c reads all input (no SIGPIPE); anchor on the time column + 3-space
   # gutter so node_modules/.../dist/index.js does not false-match the top-level.

package/scripts/scheduled_tasks_snapshot.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Slim snapshot of the S4L autopilot scheduled-task registry state.
+
+Answers, per install, the question we were previously blind to: "are the
+queue-worker scheduled tasks actually running from the dedicated ~/.s4l-worker
+folder (so their once-a-minute sessions don't flood the user's project history),
+or are they still mislocated, and is the deprecated autopilot task lingering?"
+
+The heartbeat (scripts/heartbeat.sh + mcp/src/telemetry.ts) attaches the
+`--summary` output as the top-level `scheduled_tasks` field of the heartbeat
+body, so the state lands on the installations row centrally, keyed by
+install_id, with no SSH needed.
+
+Read-only: never edits a registry (that is the menubar's
+`_rewrite_scheduled_task_cwd` job). Stdlib only, /usr/bin/python3 compatible.
+
+Kept in sync with mcp/menubar/s4l_menubar.py (WORKER_TASK_IDS,
+DEPRECATED_TASK_IDS, WORKER_CWD, SCHED_REGISTRY_GLOB) and scripts/s4l_box_update.sh.
+"""
+
+from __future__ import annotations
+
+import argparse
+import glob
+import json
+import os
+import sys
+
+# --- Kept in sync with mcp/menubar/s4l_menubar.py ---------------------------
+WORKER_TASK_IDS = ("saps-phase1-query", "saps-phase2b-draft")
+DEPRECATED_TASK_IDS = ("social-autoposter-autopilot",)
+WORKER_CWD = os.path.join(os.path.expanduser("~"), ".s4l-worker")
+SCHED_REGISTRY_GLOB = os.path.join(
+    os.path.expanduser("~"), "Library", "Application Support", "Claude",
+    "claude-code-sessions", "*", "*", "scheduled-tasks.json",
+)
+
+
+def _cwd_tail(cwd: str) -> str:
+    """Last path component only, so we surface WHERE a mislocated task points
+    (e.g. 's4lsetup' vs '.s4l-worker') without shipping the full home path /
+    username off-box."""
+    if not cwd:
+        return ""
+    return os.path.basename(os.path.normpath(cwd))
+
+
+def build_summary() -> dict:
+    """Scan every scheduled-tasks.json registry and summarize the S4L worker
+    tasks' folder state. Never raises; a broken/absent registry yields an empty
+    (but well-formed) summary so the heartbeat body is always valid."""
+    tasks: list[dict] = []
+    registries = 0
+    deprecated_present = False
+    seen_ids: set[str] = set()
+
+    try:
+        files = glob.glob(SCHED_REGISTRY_GLOB)
+    except Exception:
+        files = []
+
+    for f in files:
+        try:
+            with open(f) as fh:
+                d = json.load(fh)
+        except Exception:
+            continue
+        registries += 1
+        for t in (d.get("scheduledTasks") or []):
+            tid = t.get("id")
+            if tid in DEPRECATED_TASK_IDS:
+                deprecated_present = True
+                continue
+            if tid not in WORKER_TASK_IDS:
+                continue
+            cwd = t.get("cwd") or ""
+            in_worker = os.path.normpath(cwd) == os.path.normpath(WORKER_CWD) if cwd else False
+            seen_ids.add(tid)
+            tasks.append({
+                "id": tid,
+                "enabled": bool(t.get("enabled")),
+                "in_worker_dir": in_worker,
+                "cwd_tail": _cwd_tail(cwd),
+                "last_run_at": t.get("lastRunAt"),
+            })
+
+    mislocated = sum(1 for t in tasks if not t["in_worker_dir"])
+    return {
+        "worker_dir_tail": _cwd_tail(WORKER_CWD),
+        "registries": registries,
+        "worker_tasks": len(tasks),
+        "missing_worker_tasks": sorted(set(WORKER_TASK_IDS) - seen_ids),
+        "mislocated": mislocated,
+        # all_in_worker_dir is False when there are zero worker tasks too, since
+        # "no autopilot registered" is itself a state worth seeing centrally.
+        "all_in_worker_dir": bool(tasks) and mislocated == 0,
+        "deprecated_present": deprecated_present,
+        "tasks": tasks,
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--summary",
+        action="store_true",
+        help="Print a slim JSON summary to stdout and exit. Used by the heartbeat.",
+    )
+    args = parser.parse_args()
+
+    summary = build_summary()
+    if args.summary:
+        sys.stdout.write(json.dumps(summary, separators=(",", ":")))
+    else:
+        sys.stdout.write(json.dumps(summary, indent=2) + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())