social-autoposter 1.6.39 → 1.6.41

package/bin/cli.js

@@ -26,20 +26,6 @@ const COPY_TARGETS = [
   'mcp',
 ];
 
-const ENV_TEMPLATE = `# social-autoposter environment variables
-# Fill in your values below.
-
-# Moltbook API key (required for Moltbook posting/scanning)
-# Get it from: https://www.moltbook.com/settings/api
-MOLTBOOK_API_KEY=
-
-# s4l.ai HTTP API. The pipelines read and write all state through this API
-# (no Postgres required). Defaults to https://s4l.ai when unset; set
-# AUTOPOSTER_API_KEY only if your install uses a bearer token.
-# AUTOPOSTER_API_BASE=https://s4l.ai
-# AUTOPOSTER_API_KEY=
-`;
-
 // Never overwrite these user files during update
 const USER_FILES = new Set(['config.json', '.env', 'SKILL.md']);
 
@@ -843,15 +829,12 @@ function init() {
     console.log('  config.json exists — skipping');
   }
 
-  // .env — only if it doesn't exist. Written from an in-package template so
-  // the NPM tarball no longer ships a credential-bearing .env.example file.
-  const envDest = path.join(DEST, '.env');
-  if (!fs.existsSync(envDest)) {
-    fs.writeFileSync(envDest, ENV_TEMPLATE);
-    console.log('  created .env from template (fill in MOLTBOOK_API_KEY; AUTOPOSTER_API_KEY only if your install uses one)');
-  } else {
-    console.log('  .env exists — skipping');
-  }
+  // No .env is created. X/Twitter and the rest of the pipeline run with zero
+  // keys — state syncs through the s4l.ai HTTP API and the browser session
+  // lives in the harness Chrome profile. Optional integrations read their keys
+  // straight from the environment when set (MOLTBOOK_API_KEY for Moltbook,
+  // AUTOPOSTER_API_KEY only if your s4l.ai install uses a bearer token); every
+  // script guards `.env` with `[ -f .env ]`, so its absence is a no-op.
 
   installPythonDeps();
   removeLegacyEngagementStylesSidecar();

package/config.example.json

@@ -8,8 +8,9 @@
       "login_method": "browser"
     },
     "twitter": {
-      "handle": "@your-twitter-handle",
-      "login_method": "browser"
+      "handle": "",
+      "login_method": "browser",
+      "_handle_note": "Leave empty. connect_x auto-detects and writes your real @handle here on first connect. A non-empty placeholder would poison our_account (attribution / own-reply dedup)."
     },
     "linkedin": {
       "name": "Your Name",
@@ -26,23 +27,8 @@
 
   "content_angle": "Describe your unique experience/perspective that gives you authentic angles for comments. Example: 'Building a macOS desktop AI agent. Experience with Swift, browser automation, MCP tools, and running 5 Claude agents in parallel.'",
 
-  "projects": [
-    {
-      "name": "My Main Project",
-      "description": "One-line description of what it does",
-      "website": "https://example.com",
-      "github": "",
-      "topics": ["desktop automation", "AI agents", "browser control"],
-      "_comment": "Topics are keywords that trigger mentioning this project in replies. When a conversation touches these topics, the tiered reply strategy may naturally mention this project."
-    },
-    {
-      "name": "My Open Source Tool",
-      "description": "What the tool does",
-      "website": "",
-      "github": "https://github.com/you/your-repo",
-      "topics": ["macOS automation", "accessibility APIs"]
-    }
-  ],
+  "projects": [],
+  "_projects_help": "Projects are created via the social-autoposter MCP `setup` tool, not by hand. setup collects name, website, description, icp, voice, and search_topics, writes them here, and seeds search_topics into the DB (project_search_topics) that the draft cycle reads. Leave this empty on a fresh install: a hand-added project with no seeded search_topics is skipped by the cycle (and used to crash it to an empty result).",
 
   "exclusions": {
     "authors": ["spambot123", "annoying_user"],

package/mcp/dist/index.js

@@ -151,6 +151,15 @@ function blockedReasonMessage(reason) {
         case "rate_limit_5h":
             return (`The drafting step hit an Anthropic usage limit (${reason}), so no replies were drafted. ` +
                 "Wait for the limit to reset, then run draft_cycle again.");
+        case "no_search_topics":
+            return ("This project has no search topics yet, so there was nothing to scan. Topics live in the " +
+                "DB (project_search_topics) and are seeded from your project's `search_topics` during setup. " +
+                "Re-run the `setup` tool for this project with a `search_topics` list (comma-separated keywords/" +
+                "phrases your buyers tweet about); setup seeds them automatically, then run draft_cycle again.");
+        case "topics_api_unreachable":
+            return ("Couldn't reach the search-topics service to load this project's topics, so the cycle stopped " +
+                "before scanning. This is usually a transient backend/network issue. Try draft_cycle again in a " +
+                "moment; if it persists, check connectivity to the autoposter backend.");
         case "credit_balance":
             return ("The drafting step failed because the Anthropic account is out of credits. " +
                 "Add credits, then run draft_cycle again.");
@@ -482,15 +491,37 @@ server.registerTool("setup", {
     // named project, then report whether it's now ready or still missing fields.
     try {
         const result = applySetup(args);
+        // Seed this project's search_topics into the DB universe the cycle reads
+        // (project_search_topics). Without this a freshly-configured project has
+        // topics in config.json but ZERO rows in the DB, so draft_cycle's topic
+        // picker raises and the cycle silently returns nothing. Best-effort: a
+        // seed hiccup never fails setup — the cycle's fail-loud path still tells
+        // the user if topics are missing. Only runs once the project is ready
+        // (i.e. it actually has search_topics to seed). (2026-06-02)
+        let seedNote = "";
+        if (result.ready) {
+            const seed = await runPython("scripts/seed_search_topics.py", ["--project", result.project], { timeoutMs: 60_000 });
+            if (seed.code === 0) {
+                const m = /planned=(\d+)\s+inserted=(\d+)\s+updated=(\d+)/.exec(seed.stdout);
+                seedNote = m
+                    ? ` Seeded ${m[1]} search topic(s) into the DB (new: ${m[2]}, updated: ${m[3]}), so draft_cycle has a topic universe to work with.`
+                    : " Seeded search topics into the DB so draft_cycle has a topic universe to work with.";
+            }
+            else {
+                const tail = (seed.stderr || seed.stdout).trim().split("\n").slice(-1)[0] || "unknown error";
+                seedNote = ` (Heads up: couldn't seed search topics into the DB yet — ${tail}. draft_cycle will tell you clearly if topics are missing.)`;
+            }
+        }
         return jsonContent({
             ok: true,
             project: result.project,
             action: result.created ? "created" : "updated",
             ready: result.ready,
             missing_required: result.missing_required,
+            topics_seeded: result.ready,
             config_path: CONFIG_PATH,
             note: result.ready
-                ? `Project '${result.project}' is fully set up. Next: connect X so the autoposter can post — ` +
+                ? `Project '${result.project}' is fully set up.${seedNote} Next: connect X so the autoposter can post — ` +
                     `call setup with action:'connect_x' (it explains itself, then run again with confirm:true). ` +
                     `Once X is connected you can run draft_cycle, autopilot, and get_stats.`
                 : `Saved what you provided for '${result.project}'. Still need: ${result.missing_required.join(", ")}. ` +

package/mcp/dist/setup.js

@@ -26,10 +26,14 @@ export const REQUIRED_FIELDS = [
     "description",
     "icp",
     "voice",
+    // search_topics is required: the cycle's topic picker reads the DB universe
+    // (project_search_topics) seeded FROM these on setup. With zero topics the
+    // picker raises and the whole draft cycle silently returns nothing, so a
+    // project is NOT ready until it has at least one topic to seed. (2026-06-02)
+    "search_topics",
 ];
 export const RECOMMENDED_FIELDS = [
     "differentiator",
-    "search_topics",
     "get_started_link",
     "content_guardrails",
 ];

package/mcp/dist/version.json

@@ -0,0 +1 @@
+{"version":"1.6.40"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.39",
+  "version": "1.6.41",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/log_post.py

@@ -58,6 +58,29 @@ import sys
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import http_api
+
+# --- API error-envelope helpers (2026-06-02) -------------------------------
+# The API returns failures as a NESTED object: {"ok": false, "error": {"code",
+# "message", "details"}} (see social-autoposter-website response.ts). http_api
+# may also surface a FLAT {"error": "conflict"} on a 409 it couldn't parse. The
+# old `resp.get("error") in (...)` string check missed the nested shape, so a
+# duplicate_thread 409 fell through and printed {"logged": true, "post_id":
+# null} -- a false success that looked like a logging gap. These helpers read
+# either shape so dedups are recognized and reported correctly.
+def _api_error_code(resp):
+    e = (resp or {}).get("error")
+    if isinstance(e, dict):
+        return e.get("code")
+    return e  # flat string or None
+
+def _api_error_detail(resp, key):
+    e = (resp or {}).get("error")
+    if isinstance(e, dict):
+        d = e.get("details")
+        if isinstance(d, dict) and d.get(key) is not None:
+            return d.get(key)
+    return (resp or {}).get(key)
+
 import linkedin_url as li_url
 from db import load_env
 from twitter_account import resolve_handle as resolve_twitter_handle
@@ -283,11 +306,11 @@ def log_rejected(args):
         body["autoposter_version"] = autoposter_version
 
     resp = http_api.api_post("/api/v1/posts", body, ok_on_conflict=True)
-    if resp and resp.get("error") in ("duplicate_thread", "conflict"):
+    if resp and _api_error_code(resp) in ("duplicate_thread", "conflict"):
         print(json.dumps({
             "error": "DUPLICATE_THREAD",
             "message": "Already have a row for this thread",
-            "existing_post_id": resp.get("existing_post_id"),
+            "existing_post_id": _api_error_detail(resp, "existing_post_id"),
         }))
         return
     # See note in main() about the resp.data.post.id shape.
@@ -540,12 +563,12 @@ def main():
             }), file=sys.stderr)
 
     resp = http_api.api_post("/api/v1/posts", body, ok_on_conflict=True)
-    if resp and resp.get("error") in ("duplicate_thread", "conflict"):
+    if resp and _api_error_code(resp) in ("duplicate_thread", "conflict"):
         print(json.dumps({
             "error": "DUPLICATE_THREAD",
             "message": "Already posted in this thread",
-            "existing_post_id": resp.get("existing_post_id"),
-            "content_preview": resp.get("content_preview"),
+            "existing_post_id": _api_error_detail(resp, "existing_post_id"),
+            "content_preview": _api_error_detail(resp, "content_preview"),
         }))
         return
     # API response shape is {"ok":true,"data":{"post":{"id":N,...}}}.

package/scripts/setup_twitter_auth.py

@@ -303,6 +303,80 @@ def _collect_x_cookies(send) -> list:
     return [c for c in cks if any(w in (c.get("domain") or "") for w in wanted)]
 
 
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+_CONFIG_JSON = os.path.join(_REPO_ROOT, "config.json")
+_HANDLE_PLACEHOLDERS = {"", "your-twitter-handle", "@your-twitter-handle"}
+
+
+def _resolve_live_handle(send) -> "str | None":
+    """Read the logged-in @handle from the LIVE x.com session via CDP DOM.
+
+    resolve_handle() only reads config.json (which on a fresh install is the
+    template placeholder), so it can't discover the real account. This reads the
+    actual logged-in handle from the page so connect_x can persist it. Best
+    effort: returns None on any failure and never raises into the connect flow.
+    """
+    js = r"""(function(){
+      function fromHref(sel){var a=document.querySelector(sel);if(a){var h=a.getAttribute('href')||'';var m=h.match(/^\/([A-Za-z0-9_]{1,15})$/);if(m)return m[1];}return '';}
+      var h=fromHref('a[data-testid="AppTabBar_Profile_Link"]');
+      if(h)return h;
+      var b=document.querySelector('[data-testid="SideNav_AccountSwitcher_Button"]');
+      if(b){var m=(b.textContent||'').match(/@([A-Za-z0-9_]{1,15})/);if(m)return m[1];}
+      return '';
+    })()"""
+    try:
+        send("Page.enable")
+        u = _current_url(send)
+        if "x.com" not in u and "twitter.com" not in u:
+            send("Page.navigate", {"url": "https://x.com/home"})
+            time.sleep(3)
+        for _ in range(8):
+            r = send("Runtime.evaluate", {"expression": js, "returnByValue": True})
+            v = (r.get("result", {}).get("result", {}) or {}).get("value", "") or ""
+            v = v.strip().lstrip("@")
+            if v:
+                return v
+            time.sleep(1)
+    except Exception:
+        return None
+    return None
+
+
+def _write_handle_to_config(handle: "str | None") -> bool:
+    """Persist the discovered handle to config.json accounts.twitter.handle, but
+    ONLY when the configured value is empty or the template placeholder, so we
+    never clobber a handle the user set on purpose. Returns True if written.
+
+    This is what makes account_resolver.resolve('twitter') return the REAL
+    account, so our_account (attribution, own-reply skip, account-keyed ops) is
+    correct instead of the poisonous 'your-twitter-handle' default. (2026-06-02)
+    """
+    if not handle:
+        return False
+    try:
+        with open(_CONFIG_JSON, encoding="utf-8") as f:
+            cfg = json.load(f)
+    except Exception:
+        return False
+    accounts = cfg.setdefault("accounts", {})
+    if not isinstance(accounts, dict):
+        return False
+    tw = accounts.setdefault("twitter", {})
+    if not isinstance(tw, dict):
+        return False
+    cur = (tw.get("handle") or "").strip()
+    if cur.lower() not in _HANDLE_PLACEHOLDERS:
+        return False  # a real handle is already set; do not overwrite
+    tw["handle"] = "@" + handle.lstrip("@")
+    try:
+        with open(_CONFIG_JSON, "w", encoding="utf-8") as f:
+            json.dump(cfg, f, indent=2)
+            f.write("\n")
+        return True
+    except Exception:
+        return False
+
+
 def _persist_session() -> None:
     """Persist the validated live X session for auto-restore after ANY logout
     (hard kill, crash, keychain re-lock wiping Chrome's Cookies DB, or AppMaker
@@ -334,8 +408,16 @@ def _persist_session() -> None:
     if not cookies:
         return
 
-    handle = None
-    if resolve_handle is not None:
+    # Prefer the LIVE logged-in handle so a fresh install records the real
+    # account instead of the config.json placeholder; persist it so the cycle's
+    # account_resolver (our_account) is correct. Fall back to the configured
+    # handle. All best-effort: never abort connect_x.
+    handle = _resolve_live_handle(send)
+    if handle and _write_handle_to_config(handle):
+        print(f"setup_twitter_auth: recorded live X handle @{handle} in config.json "
+              "(accounts.twitter.handle); attribution + own-reply dedup now scoped "
+              "to the real account", file=sys.stderr)
+    if not handle and resolve_handle is not None:
         try:
             handle = resolve_handle()
         except Exception:

package/scripts/twitter_post_plan.py

@@ -242,13 +242,16 @@ def already_posted_to_thread(thread_url: str) -> tuple[bool, int | None]:
     that fires once per cycle. log_post.py's post-INSERT dedup is still
     the final backstop.
     """
-    # Scope per-account so the pre-post race guard only fires when THIS
-    # machine's handle already has a post in the thread. Otherwise the mk0r
-    # VM (@matt_diak) would skip every thread @m13v_ already touched.
+    # Scope MUST match the server-side insert dedup, which is keyed on
+    # (platform, thread_url) ONLY -- NOT our_account (see social-autoposter-
+    # website /api/v1/posts route: "Enforces dedup on (platform, thread_url)").
+    # The old per-account scoping here made the probe NARROWER than the server:
+    # it passed when a post existed under a different/placeholder our_account,
+    # so the cycle posted a SECOND reply to a thread the server then rejected
+    # with duplicate_thread -- after the reply was already live on X. Querying
+    # thread-only makes the pre-post guard catch exactly what the insert would
+    # reject, so we never burn that wasted second reply. (2026-06-02)
     dedupe_q = {"platform": "twitter", "thread_url": thread_url}
-    _twitter_handle = _resolve_account("twitter")
-    if _twitter_handle:
-        dedupe_q["our_account"] = _twitter_handle
     try:
         resp = api_get(
             "/api/v1/posts/lookup",

package/skill/run-twitter-cycle.sh

@@ -470,7 +470,8 @@ python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase p
 # mechanically append these as `-term` operators to whatever query it drafts
 # for the project. See scripts/project_excludes.py for proposal/activation/
 # decay rules.
-PROJECTS_JSON=$(python3 - <<'PY'
+_PJ_ERR="$(mktemp)"
+PROJECTS_JSON=$(python3 - 2>"$_PJ_ERR" <<'PY'
 import json, os, subprocess, sys
 REPO = os.path.expanduser('~/social-autoposter')
 sys.path.insert(0, os.path.join(REPO, 'scripts'))
@@ -549,6 +550,37 @@ for p in picked:
 print(json.dumps(chosen, indent=2))
 PY
 )
+_PJ_RC=$?
+# Fail loud when the project/topic universe can't be built. The heredoc above
+# exits non-zero (PROJECTS_JSON empty) when pick_topic_for_project finds zero
+# active rows in project_search_topics for the selected project, or the topics
+# API is unreachable; it also yields "[]" when no project is eligible. Without
+# this guard the empty PROJECTS_JSON silently falls through to "0 queries -> 0
+# tweets -> batch expired -> zero", which reads to the user as "nothing to post"
+# when the real cause is "this project was never seeded with search topics".
+# Seeding now happens in the MCP setup tool; this is the defense-in-depth net
+# so a missing universe is surfaced, never swallowed. (2026-06-02)
+if [ "$_PJ_RC" -ne 0 ] || ! printf '%s' "$PROJECTS_JSON" | python3 -c 'import json,sys; d=json.load(sys.stdin); sys.exit(0 if isinstance(d,list) and d else 1)' 2>/dev/null; then
+    _PJ_REASON="project_selection_failed"
+    if grep -q "no active search topics" "$_PJ_ERR" 2>/dev/null; then
+        _PJ_REASON="no_search_topics"
+    elif grep -qiE "project-search-topics API|API unreachable" "$_PJ_ERR" 2>/dev/null; then
+        _PJ_REASON="topics_api_unreachable"
+    fi
+    log "Project/topic universe build FAILED (reason=$_PJ_REASON); stopping cycle before scan. Last error lines:"
+    tail -15 "$_PJ_ERR" 2>/dev/null | sed 's/^/    /' | tee -a "$LOG_FILE"
+    rm -f "$_PJ_ERR"
+    # Surface the reason to the MCP draft_cycle wrapper (stdout marker) in manual mode.
+    if [ "${DRAFT_ONLY:-0}" = "1" ]; then
+        echo "DRAFT_ONLY_BLOCKED=$_PJ_REASON"
+    fi
+    # Record a dashboard-visible failure row (best-effort) and exit cleanly.
+    python3 "$REPO_DIR/scripts/log_run.py" --script "post_twitter" --posted 0 --skipped 0 --failed 1 \
+        --failure-reasons "${_PJ_REASON}:1" --cost "0.0000" --elapsed $(( $(date +%s) - RUN_START )) 2>/dev/null || true
+    _SA_RUN_SUMMARY_EMITTED=1
+    exit 0
+fi
+rm -f "$_PJ_ERR"
 
 log "Selected projects: $(echo "$PROJECTS_JSON" | python3 -c 'import json,sys; print(", ".join(p["name"] for p in json.load(sys.stdin)))')"
 EXCLUDES_TOTAL=$(echo "$PROJECTS_JSON" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(sum(len(p.get("excludes_for_search") or []) for p in d))')