social-autoposter 1.6.70 → 1.6.71

package/bin/cli.js

@@ -367,123 +367,6 @@ function applyAppMakerMcpConfigOverrides() {
 // uv installed and broke Phase 1's Claude scan (the MCP server's `command:
 // /root/.local/bin/uv` resolved to ENOENT, Claude got no tools, returned an
 // empty envelope).
-// AppMaker VM self-bootstrap. Single entry point that the appmaker template
-// startup.sh calls on every fresh sandbox boot. Reads the stable sessionKey
-// from /run/mk0r-session.json (which the appmaker bridge rewrites on every
-// session bind, and which survives E2B sandbox substitution — only the
-// sandboxId changes), then asks the social-autoposter HTTP API which Twitter
-// account this VM is bound to (handle + stored login cookies, keyed by
-// social_accounts.vm_session_key). With that single DB answer it sets up
-// everything: env file (with the DB-sourced handle), profile symlink, MCP
-// config (BH_PORT=9222), uuid-runtime, then restores the Twitter login by
-// re-injecting the stored cookies via CDP.
-//
-// This is the "one proper fix" for sandbox substitution: the VM holds no
-// per-VM state on disk — the DB does, keyed by the stable sessionKey. So
-// any fresh sandbox can rebuild itself by reading /run/mk0r-session.json
-// and calling one route.
-function bootstrapVm() {
-  if (!isAppMakerVm()) {
-    console.error('bootstrap-vm: not an AppMaker VM (no /opt/startup.sh + CDP :9222). Use `init` or `update` on dev boxes.');
-    process.exit(2);
-  }
-  // Persist VM mode so subsequent `update` runs on this sandbox keep the
-  // AppMaker tweaks without re-passing --vm/SA_VM.
-  enableVmMode();
-  console.log('  AppMaker VM bootstrap: resolving identity from DB by sessionKey...');
-
-  let sessionKey;
-  try {
-    const raw = fs.readFileSync('/run/mk0r-session.json', 'utf8');
-    sessionKey = (JSON.parse(raw) || {}).sessionKey;
-  } catch (err) {
-    console.error(`bootstrap-vm: cannot read /run/mk0r-session.json: ${err.message}`);
-    process.exit(3);
-  }
-  if (!sessionKey) {
-    console.error('bootstrap-vm: /run/mk0r-session.json has no sessionKey');
-    process.exit(3);
-  }
-  console.log(`    sessionKey=${sessionKey}`);
-
-  // Get the X-Installation header via identity.py (same Python helper http_api.py
-  // uses, so auth stays single-sourced).
-  const identityPath = path.join(PKG_ROOT, 'scripts', 'identity.py');
-  const headerRes = spawnSync('/usr/bin/python3', [identityPath, 'header'], {
-    encoding: 'utf8',
-  });
-  if (headerRes.status !== 0) {
-    console.error(`bootstrap-vm: identity.py header failed: ${headerRes.stderr || headerRes.error}`);
-    process.exit(4);
-  }
-  const installHeader = (headerRes.stdout || '').trim();
-
-  const base = (process.env.AUTOPOSTER_API_BASE || 'https://s4l.ai').replace(/\/+$/, '');
-  const url = `${base}/api/v1/twitter/vm-session?session_key=${encodeURIComponent(sessionKey)}`;
-  console.log(`    GET ${url}`);
-
-  // Use curl (always present on the appmaker template) so we don't pull in
-  // a Node HTTP dep here.
-  const curl = spawnSync('curl', [
-    '-sS', '--max-time', '15',
-    '-H', `X-Installation: ${installHeader}`,
-    '-H', 'Content-Type: application/json',
-    url,
-  ], { encoding: 'utf8' });
-  if (curl.status !== 0) {
-    console.error(`bootstrap-vm: curl failed: ${curl.stderr || curl.error}`);
-    process.exit(5);
-  }
-  let payload;
-  try {
-    payload = JSON.parse(curl.stdout || '{}');
-  } catch (err) {
-    console.error(`bootstrap-vm: bad JSON from API: ${curl.stdout.slice(0, 300)}`);
-    process.exit(6);
-  }
-  if (!payload.ok || !payload.data) {
-    console.error(`bootstrap-vm: API error: ${JSON.stringify(payload).slice(0, 300)}`);
-    process.exit(7);
-  }
-  const { handle, cookies, vm_project_id } = payload.data;
-  if (!handle) {
-    console.error('bootstrap-vm: API returned no handle. social_accounts.vm_session_key may be unset for this VM.');
-    process.exit(8);
-  }
-  console.log(`    bound to @${handle} (vm_project_id=${vm_project_id || 'none'}, cookies=${(cookies || []).length})`);
-
-  // Write env file with DB-sourced handle (durable across `social-autoposter update`).
-  writeAppMakerEnvFile(handle);
-
-  // Existing setup steps. installBrowserHarness already installs uuid-runtime,
-  // symlinks the profile, and patches the MCP config — call it directly.
-  installBrowserHarness();
-
-  // Install Python deps from requirements.txt. installBrowserHarness only
-  // installs uv + mcp; it does NOT read requirements.txt, so without this the
-  // VM is missing websocket-client (restore_twitter_session.py aborts on
-  // import) plus playwright that the cycle scripts need.
-  installPythonDeps();
-
-  // Restore the Twitter login if we have stored cookies and the Chrome is
-  // up. No-op when Chrome isn't reachable yet (startup ordering); the cycle
-  // preflight will run restore_twitter_session.py on its next tick.
-  if ((cookies || []).length > 0) {
-    const restorePath = path.join(HOME, 'social-autoposter', 'scripts', 'restore_twitter_session.py');
-    if (fs.existsSync(restorePath)) {
-      console.log('    invoking restore_twitter_session.py to re-inject cookies...');
-      // Source the env file so AUTOPOSTER_TWITTER_HANDLE / TWITTER_CDP_URL are set.
-      const r = spawnSync('bash', ['-lc',
-        `source ${HOME}/.social-autoposter-env 2>/dev/null; /usr/bin/python3 ${restorePath} || true`,
-      ], { stdio: 'inherit' });
-      void r;
-    }
-  } else {
-    console.log('    no stored cookies; manual login still required this once.');
-  }
-
-  console.log('  bootstrap-vm: done.');
-}
 
 function installBrowserHarness() {
   const onAppMaker = vmModeEnabled();
@@ -1137,8 +1020,6 @@ if (cmd === 'init') {
   update();
 } else if (cmd === 'doctor') {
   doctor();
-} else if (cmd === 'bootstrap-vm') {
-  bootstrapVm();
 } else if (cmd === 'install-runtime') {
   installRuntime();
 } else if (cmd === 'reset' || cmd === 'uninstall') {
@@ -1171,7 +1052,6 @@ if (cmd === 'init') {
   console.log('  npx social-autoposter init          first-time setup');
   console.log('  npx social-autoposter update        update scripts, preserve config');
   console.log('  npx social-autoposter doctor [--json] [--phase pre_connect|full]');
-  console.log('  npx social-autoposter bootstrap-vm  AppMaker VM self-bootstrap (DB-driven)');
   console.log('  npx social-autoposter install-runtime  provision owned Python + Chromium (panel-free)');
   console.log('  npx social-autoposter export-cookies [dir]  export browser cookies');
   console.log('  npx social-autoposter import-cookies [dir]  import browser cookies');

package/mcp/dist/index.js

@@ -16,7 +16,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, scanResultPath, } from "./repo.js";
 import { applySetup, resolveProject, listManagedProjectStatus, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, } from "./runtime.js";
@@ -190,9 +190,31 @@ const baseRegisterTool = server.registerTool.bind(server);
 // same input-schema -> callback-arg inference it had before; the body is `any`
 // and just additionally stashes the callback by name. `appTool` drops the
 // leading `server` arg of registerAppTool (its callback takes no typed args).
+// Tools that take a while: writing activity.json around them makes the menu bar
+// show a spinner + label while they run (either invocation path). draft_cycle is
+// NOT here — it writes finer scanning/drafting phases itself (see produceDrafts).
+const TOOL_ACTIVITY = {
+    post_drafts: "posting",
+    get_stats: "loading stats",
+};
+function withActivity(name, cb) {
+    const label = TOOL_ACTIVITY[name];
+    if (!label)
+        return cb;
+    return async (args, extra) => {
+        writeActivity("working", label);
+        try {
+            return await cb(args, extra);
+        }
+        finally {
+            clearActivity();
+        }
+    };
+}
 const tool = ((name, config, cb) => {
-    TOOL_HANDLERS[name] = cb;
-    return baseRegisterTool(name, config, cb);
+    const h = withActivity(name, cb);
+    TOOL_HANDLERS[name] = h;
+    return baseRegisterTool(name, config, h);
 });
 const appTool = ((name, config, cb) => {
     // Wrap every tool handler so any thrown error is reported to Sentry. Single
@@ -208,8 +230,9 @@ const appTool = ((name, config, cb) => {
             throw e;
         }
     });
-    TOOL_HANDLERS[name] = wrapped;
-    return registerAppTool(server, name, config, wrapped);
+    const h = withActivity(name, wrapped);
+    TOOL_HANDLERS[name] = h;
+    return registerAppTool(server, name, config, h);
 });
 function jsonContent(obj) {
     return { content: [{ type: "text", text: JSON.stringify(obj, null, 2) }] };
@@ -371,6 +394,9 @@ async function produceDrafts(project, onProgress) {
     }
     appendLog(`\n===== draft_cycle start ${new Date().toISOString()} ` +
         `project=${project ?? "(default)"} =====\n`);
+    // Menu-bar status: scanning first, then drafting once the prep phase begins
+    // (switched in onLine below). Cleared before every return.
+    writeActivity("scanning", "scanning X");
     const res = await run("bash", ["skill/run-twitter-cycle.sh"], {
         env,
         timeoutMs: 900_000, // scan+draft can take several minutes
@@ -386,6 +412,8 @@ async function produceDrafts(project, onProgress) {
                 appendLog(`${t}\n`);
                 console.error(`[draft_cycle] ${t}`);
             }
+            if (/Phase 2b-prep/.test(t))
+                writeActivity("drafting", "drafting replies");
             if (!onProgress)
                 return;
             const msg = cycleProgressMessage(t);
@@ -399,13 +427,16 @@ async function produceDrafts(project, onProgress) {
     appendLog(`===== draft_cycle end ${new Date().toISOString()} exit=${res.code} =====\n`);
     // Prefer the explicit marker; fall back to the newest plan file on disk.
     const marker = /DRAFT_ONLY_PLAN=\/tmp\/twitter_cycle_plan_(.+)\.json/.exec(res.stdout + "\n" + res.stderr);
-    if (marker && marker[1])
+    if (marker && marker[1]) {
+        clearActivity();
         return { batchId: marker[1] };
+    }
     // A real prep-step failure (e.g. the background claude CLI isn't logged in)
     // emits DRAFT_ONLY_BLOCKED=<reason>. Surface that instead of silently falling
     // back to a stale/empty batch and mis-reporting "no fresh candidates".
     const blockedMarker = /DRAFT_ONLY_BLOCKED=([a-z0-9_]+)/.exec(res.stdout + "\n" + res.stderr);
     if (blockedMarker && blockedMarker[1]) {
+        clearActivity();
         return { batchId: null, blocked: blockedReasonMessage(blockedMarker[1]) };
     }
     // No `DRAFT_ONLY_PLAN=` marker from THIS run => this run produced no drafts.
@@ -413,6 +444,7 @@ async function produceDrafts(project, onProgress) {
     // that's a *previous* run's batch, so a 5-second empty cycle would echo an old
     // 7-draft batch and report phantom success. Report 0 drafts honestly, with the
     // pipeline's own reason (e.g. cold-start project with no seeded queries).
+    clearActivity();
     return {
         batchId: null,
         blocked: `This run produced no drafts (exit ${res.code}). The scan found no fresh ` +
@@ -1602,6 +1634,27 @@ function sapsStateDir() {
     return (process.env.SAPS_STATE_DIR ||
         path.join(process.env.HOME || os.homedir(), ".social-autoposter-mcp"));
 }
+// activity.json: a tiny "what's running right now" signal the menu bar reads to
+// show a loading spinner + label (scanning / drafting / posting / …). Written by
+// long-running tools, cleared when they finish. Best-effort; absence == idle.
+function writeActivity(state, label) {
+    try {
+        const dir = sapsStateDir();
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, "activity.json"), JSON.stringify({ state, label, since: new Date().toISOString() }) + "\n", "utf-8");
+    }
+    catch {
+        /* best effort: a status write must never break the work it's narrating */
+    }
+}
+function clearActivity() {
+    try {
+        fs.rmSync(path.join(sapsStateDir(), "activity.json"), { force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
 // Signal the menu bar that a fresh draft batch is ready for pop-up review. The
 // chat-table review path is unchanged and still works; this just ALSO lets the
 // corner cards drive review (both surfaces de-dup via the plan's `posted` flag).
@@ -1636,6 +1689,178 @@ async function openInBrowser(url) {
         console.error("[social-autoposter-mcp] openInBrowser failed:", e?.message || e);
     }
 }
+async function runScanCandidates(project, onProgress) {
+    // SCAN_ONLY=1: run scan -> score -> top-N select, then STOP before drafting.
+    // No DRAFT_ONLY, no `claude -p` drafting. TWITTER_PHASE1_LLM_DRAFT=0 forces the
+    // deterministic query bank so the whole scan is claude-free (the agent does ALL
+    // the AI). Off-screen by default (no BH_WINDOW_* / overlay): a scheduled run has
+    // no human watching the Chrome.
+    const env = {
+        SCAN_ONLY: "1",
+        TWITTER_PHASE1_LLM_DRAFT: "0",
+        SAPS_REPO_DIR: repoDir(),
+        PATH: pipelinePath(),
+    };
+    if (project)
+        env.SAPS_FORCE_PROJECT = project;
+    const chrome = resolveChrome();
+    if (chrome)
+        env.BH_CHROME_BIN = chrome;
+    let step = 0;
+    let lastMsg = "";
+    const res = await run("bash", ["skill/run-twitter-cycle.sh"], {
+        env,
+        timeoutMs: 900_000,
+        onLine: (line) => {
+            const t = line.replace(/\s+$/, "");
+            if (t.trim())
+                console.error(`[scan_candidates] ${t}`);
+            if (!onProgress)
+                return;
+            const msg = cycleProgressMessage(t);
+            if (msg && msg !== lastMsg) {
+                lastMsg = msg;
+                onProgress(msg, ++step);
+            }
+        },
+    });
+    const marker = /SCAN_ONLY_RESULT=(\/\S+\.json)/.exec(res.stdout + "\n" + res.stderr);
+    if (marker && marker[1]) {
+        try {
+            const data = JSON.parse(fs.readFileSync(marker[1], "utf-8"));
+            return {
+                batchId: data.batch_id ?? null,
+                candidates: (data.candidates ?? []),
+            };
+        }
+        catch (e) {
+            return {
+                batchId: null,
+                candidates: [],
+                blocked: `Scan finished but its result file was unreadable: ${e?.message || e}`,
+            };
+        }
+    }
+    // If query-gen (when enabled) hits a real failure, the cycle still emits
+    // DRAFT_ONLY_BLOCKED=<reason>. Surface it rather than "no candidates".
+    const blockedMarker = /DRAFT_ONLY_BLOCKED=([a-z0-9_]+)/.exec(res.stdout + "\n" + res.stderr);
+    if (blockedMarker && blockedMarker[1]) {
+        return { batchId: null, candidates: [], blocked: blockedReasonMessage(blockedMarker[1]) };
+    }
+    return {
+        batchId: null,
+        candidates: [],
+        blocked: `This scan produced no candidates (exit ${res.code}). Usually a cold-start ` +
+            `project with no seeded search topics, or nothing fresh on-theme right now. Tail:\n` +
+            res.stderr.split("\n").slice(-12).join("\n"),
+    };
+}
+tool("scan_candidates", {
+    title: "Scan X for reply candidates (no drafting, no posting)",
+    description: "Step 1 of a hands-free / scheduled autopilot run. Runs the scan+score half of the pipeline " +
+        "and returns the top scored X/Twitter threads worth replying to — WITHOUT drafting or posting, " +
+        "and without spending any `claude -p` budget. You (this session) then draft an on-brand reply " +
+        "for each good candidate YOURSELF and submit them with `submit_drafts`. Each candidate includes " +
+        "its candidate_id (pass it back), the thread text/author, the matched project, and engagement " +
+        "metrics. Optional `project` scopes the scan to one configured project.",
+    inputSchema: { project: z.string().optional() },
+}, async (args) => {
+    const scan = await runScanCandidates(args?.project);
+    if (!scan.batchId) {
+        return textContent(scan.blocked || "No candidates found.");
+    }
+    return jsonContent({
+        batch_id: scan.batchId,
+        count: scan.candidates.length,
+        candidates: scan.candidates,
+        next_step: `Draft an on-brand reply (<=250 chars, match the thread's language) for each candidate you ` +
+            `judge genuinely worth engaging; skip the rest. Then call submit_drafts with batch_id ` +
+            `"${scan.batchId}" and one entry per drafted reply ({candidate_id, reply_text}). Nothing posts ` +
+            `until the user approves.`,
+    });
+});
+tool("submit_drafts", {
+    title: "Submit drafted replies for review",
+    description: "Step 2 of a hands-free / scheduled autopilot run. Hand back the replies you drafted for the " +
+        "candidates returned by scan_candidates. Writes them into the SAME review plan the menu-bar " +
+        "approval UI and post_drafts already use — nothing is posted until the user approves. Provide " +
+        "batch_id (from scan_candidates) and a `drafts` array; each entry needs candidate_id and " +
+        "reply_text (engagement_style, language, link_keyword optional).",
+    inputSchema: {
+        batch_id: z.string(),
+        drafts: z
+            .array(z.object({
+            candidate_id: z.union([z.string(), z.number()]),
+            reply_text: z.string(),
+            engagement_style: z.string().optional(),
+            language: z.string().optional(),
+            link_keyword: z.string().optional(),
+        }))
+            .min(1),
+    },
+}, async (args) => {
+    // Reload the scan candidates for thread metadata (url / author / text /
+    // project / topic). If the scan file is gone (e.g. /tmp cleared), we still
+    // build a plan from the drafts alone; the review cards just lack context.
+    const scanById = new Map();
+    try {
+        const raw = JSON.parse(fs.readFileSync(scanResultPath(args.batch_id), "utf-8"));
+        for (const c of (raw.candidates ?? [])) {
+            scanById.set(String(c.id), c);
+        }
+    }
+    catch {
+        /* scan file missing — proceed with draft-only context */
+    }
+    const candidates = args.drafts.map((d) => {
+        const sc = scanById.get(String(d.candidate_id));
+        return {
+            candidate_id: d.candidate_id,
+            candidate_url: sc?.tweet_url,
+            thread_author: sc?.author_handle,
+            thread_text: sc?.tweet_text,
+            reply_text: d.reply_text,
+            engagement_style: d.engagement_style,
+            language: d.language,
+            link_keyword: d.link_keyword,
+            search_topic: sc?.search_topic,
+            matched_project: sc?.matched_project,
+        };
+    });
+    const firstSc = scanById.get(String(args.drafts[0].candidate_id));
+    const project = (candidates.map((c) => c.matched_project).find((p) => !!p) ||
+        firstSc?.matched_project ||
+        "default");
+    const plan = { candidates };
+    writePlan(args.batch_id, plan);
+    // Bake link targets into the plan (sub-second at TWITTER_PAGE_GEN_RATE=0), the
+    // same prep step DRAFT_ONLY does before handing off. Best-effort: posting
+    // falls back to the plain project URL per-candidate if this is skipped.
+    try {
+        await runPython("scripts/twitter_gen_links.py", ["--plan", planPath(args.batch_id)], {
+            timeoutMs: 120_000,
+            env: { TWITTER_PAGE_GEN_RATE: "0", SAPS_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+    }
+    catch {
+        /* best effort — plan still posts with a plain-URL fallback */
+    }
+    const finalPlan = readPlan(args.batch_id) ?? plan;
+    const count = (finalPlan.candidates || []).length;
+    // Surface to the menu-bar review cards (same contract draft_cycle uses).
+    writeReviewRequest({
+        batch_id: args.batch_id,
+        project,
+        count,
+        plan_path: planPath(args.batch_id),
+        created_at: new Date().toISOString(),
+    });
+    return textContent(`${count} draft(s) queued for review (batch ${args.batch_id}). They're now in the menu-bar ` +
+        `approval cards and the table below; nothing posts until approved.\n\n` +
+        renderDraftsTable(finalPlan) +
+        `\n\nTo post the approved ones: the user approves in the menu bar, or call post_drafts with the ` +
+        `numbers to post.`);
+});
 appTool("dashboard", {
     title: "Social Autoposter dashboard",
     description: "Render the Social Autoposter dashboard in chat: a visual surface showing project setup, X " +

package/mcp/dist/repo.js

@@ -151,3 +151,8 @@ export function latestBatchId() {
         .sort((a, b) => b.mtime - a.mtime);
     return matches.length ? matches[0].batchId : null;
 }
+// Hardcoded under TMP_DIR to mirror the cycle script's SCAN_ONLY writer (same
+// coupling planPath has: run-twitter-cycle.sh writes the file to /tmp directly).
+export function scanResultPath(batchId) {
+    return path.join(TMP_DIR, `saps_scan_candidates_${batchId}.json`);
+}

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.70",
-  "installedAt": "2026-06-20T03:05:13.835Z"
+  "version": "1.6.71",
+  "installedAt": "2026-06-20T16:29:20.789Z"
 }

package/mcp/menubar/s4l_menubar.py

@@ -95,9 +95,8 @@ class S4LMenuBar(rumps.App):
         self._sig = None  # last rendered state signature; skip rebuild if unchanged
         self._review_active = False  # a review-card sequence is on screen
         self._reviewed_batches = set()  # batch_ids already handled this run
-        self._posting = False  # a post is in flight (drives the title spinner)
         self._spin_i = 0
-        self._spinner = None  # rumps.Timer animating the title while posting
+        self._spinner = None  # fast rumps.Timer animating the title while busy
         # Reliable self-check of our own Accessibility (TCC) grant — this is the
         # faithful reading (our launchd process identity, not a parent's). Logged
         # so menubar.err.log records whether keystroke posting will work.
@@ -107,6 +106,11 @@ class S4LMenuBar(rumps.App):
         sys.stderr.flush()
         self._timer = rumps.Timer(self._tick, POLL_SECONDS)
         self._timer.start()
+        # Light 1s poll for server activity (scanning/drafting/posting/…); it
+        # spins up the fast title-spinner on demand. Idle cost is one tiny file
+        # read per second.
+        self._act_poll = rumps.Timer(self._poll_activity, 1.0)
+        self._act_poll.start()
         self._tick(None)
 
     # ---- side effects -----------------------------------------------------
@@ -194,15 +198,24 @@ class S4LMenuBar(rumps.App):
         else:
             self._notify("S4L", "Open Claude Desktop to change autopilot.")
 
-    # ---- posting spinner --------------------------------------------------
-    # Runs on the main thread (rumps timer). While a post is in flight it cycles
-    # the title; once the background post clears self._posting it restores the
-    # normal title and stops itself. Cross-thread safe: the worker only flips the
-    # bool, never touches AppKit.
+    # ---- activity spinner -------------------------------------------------
+    # The server writes activity.json while a tool runs (scanning/drafting/
+    # posting/…). _poll_activity (1s) starts the fast spinner; _spin (0.12s)
+    # animates the title with the label and stops itself when activity clears.
+    # Both run on the main thread (rumps timers).
+    def _poll_activity(self, _):
+        act = st.read_activity()
+        if act and act.get("label") and self._spinner is None:
+            self._spin_i = 0
+            self._spinner = rumps.Timer(self._spin, 0.12)
+            self._spinner.start()
+
     def _spin(self, _):
-        if self._posting:
+        act = st.read_activity()
+        label = act.get("label") if act else None
+        if label:
             self._spin_i = (self._spin_i + 1) % len(SPINNER)
-            self.title = f"S4L posting {SPINNER[self._spin_i]}"
+            self.title = f"S4L {label} {SPINNER[self._spin_i]}"
             return
         try:
             if self._spinner is not None:
@@ -215,9 +228,9 @@ class S4LMenuBar(rumps.App):
 
     # ---- tick: read state, set title, (re)build menu ----------------------
     def _tick(self, _):
-        # While posting, the spinner owns the UI; don't fight it or start a new
-        # review mid-post.
-        if self._posting:
+        # While a tool is running, the spinner owns the title/menu; don't fight it
+        # or start a review mid-run.
+        if self._spinner is not None:
             return
         snap = st.snapshot()
         ob = snap.get("onboarding") or st.read_onboarding()
@@ -317,12 +330,8 @@ class S4LMenuBar(rumps.App):
             return
         self._notify("S4L", f"Posting {len(approved)} draft(s)…")
 
-        # Animate the menu-bar title until the post finishes.
-        self._posting = True
-        self._spin_i = 0
-        self._spinner = rumps.Timer(self._spin, 0.12)
-        self._spinner.start()
-
+        # The server's post_drafts writes "posting" activity, so the activity
+        # spinner shows automatically while this runs — no local spinner needed.
         def work():
             res = st.post_drafts(batch, post=post_nums, edits=edits)
             if res is None:
@@ -336,7 +345,6 @@ class S4LMenuBar(rumps.App):
                     f"Posted {posted if posted is not None else len(approved)} draft(s).",
                 )
             self._review_active = False
-            self._posting = False  # _spin (main thread) restores the title + stops
 
         threading.Thread(target=work, daemon=True).start()
 

package/mcp/menubar/s4l_state.py

@@ -314,6 +314,13 @@ def request_accessibility() -> bool:
 # produced), present the cards, then post the approved subset via the loopback
 # post_drafts tool. The chat-table review still works in parallel; both surfaces
 # de-dup on the plan's per-candidate `posted` flag.
+def read_activity():
+    """What the server is doing right now: {state, label} or None when idle.
+    Written by long-running tools (scanning/drafting/posting/…); drives the
+    menu-bar loading spinner."""
+    return read_json("activity.json")
+
+
 def read_review_request():
     return read_json("review-request.json")
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.70",
+  "version": "1.6.71",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/restore_twitter_session.py

@@ -9,8 +9,8 @@ an empty schema. The cycle preflight calls this to heal that automatically:
   1. Attach to the harness Chrome (TWITTER_CDP_URL, default 127.0.0.1:9555 —
      the Mac harness port; AppMaker VMs override it to :9222 via the env file).
   2. Navigate to x.com/home; if it redirects to /login, the session is gone.
-  3. Load cookies, mirror-first: the local 0600 mirror written on every connect
-     (keychain-independent), then the server store for machines with a handle.
+  3. Load cookies from the local 0600 mirror written on every connect
+     (keychain-independent).
   4. Inject them via CDP Network.setCookies and reload.
   5. Verify we land on /home (logged in).
 
@@ -29,11 +29,10 @@ import time
 import urllib.request
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from http_api import api_get  # noqa: E402
-from twitter_account import resolve_handle  # noqa: E402
 
-# Local 0600 cookie mirror — the keychain-independent restore source for
-# persistent machines (Gap B). Tried before the server store. Stdlib-only;
+# Local 0600 cookie mirror — the keychain-independent restore source (Gap B).
+# It is the ONLY cookie source; the VM-era server store
+# (/api/v1/twitter/session-cookies) was removed 2026-06-17. Stdlib-only;
 # guarded so a path quirk never breaks the cycle preflight.
 try:
     import twitter_cookie_mirror  # noqa: E402
@@ -125,10 +124,10 @@ def _inject(send, cookies) -> int:
 
 
 def _stored_cookies():
-    """Return (cookies, source). Tries the LOCAL mirror first — it's the only
-    durable source on a persistent machine, where the server store is skipped
-    for lack of a social_accounts row — then falls back to the server store
-    (the durable source on hourly-reseeded AppMaker VMs)."""
+    """Return (cookies, source) from the LOCAL 0600 mirror, or ([], None).
+
+    The mirror is the only cookie source; the VM-era server store
+    (/api/v1/twitter/session-cookies) was removed 2026-06-17."""
     if twitter_cookie_mirror is not None:
         try:
             mirrored = twitter_cookie_mirror.load_cookies()
@@ -136,20 +135,6 @@ def _stored_cookies():
             mirrored = []
         if mirrored:
             return mirrored, f"local mirror ({twitter_cookie_mirror.MIRROR_PATH.name})"
-
-    handle = None
-    try:
-        handle = resolve_handle()
-    except Exception:
-        handle = None
-    if handle:
-        try:
-            resp = api_get("/api/v1/twitter/session-cookies", query={"handle": handle})
-            cookies = ((resp or {}).get("data") or {}).get("cookies") or []
-            if cookies:
-                return cookies, f"server store (@{handle})"
-        except Exception as e:
-            print(f"restore_twitter_session: server store fetch failed ({e})", file=sys.stderr)
     return [], None
 
 
@@ -167,8 +152,8 @@ def main():
 
         cookies, source = _stored_cookies()
         if not cookies:
-            print("restore_twitter_session: no stored cookies (local mirror empty + no "
-                  "server store); manual connect_x required", file=sys.stderr)
+            print("restore_twitter_session: no stored cookies (local mirror empty); "
+                  "manual connect_x required", file=sys.stderr)
             return 1
 
         print(f"restore_twitter_session: logged out, restoring from {source}...")

package/scripts/setup_twitter_auth.py

@@ -60,15 +60,13 @@ except ImportError:
         "websocket-client not installed (needed for CDP). pip install websocket-client"
     )
 
-# Optional server-side session-cookie store (best-effort). Lets connect_x persist
-# the validated X cookies so restore_twitter_session.py can auto-re-inject them
-# after any logout. Guarded so a missing dep or offline API never breaks setup.
+# Live-handle resolver (best-effort). Lets connect_x record the real logged-in
+# @handle alongside the locally-mirrored cookies. Guarded so a missing dep never
+# breaks setup.
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 try:
-    from http_api import api_post  # noqa: E402
     from twitter_account import resolve_handle  # noqa: E402
 except Exception:
-    api_post = None
     resolve_handle = None
 
 # Local 0600 cookie mirror — the keychain-independent durability layer (Gap B).
@@ -386,16 +384,13 @@ def _write_handle_to_config(handle: "str | None") -> bool:
 
 def _persist_session() -> None:
     """Persist the validated live X session for auto-restore after ANY logout
-    (hard kill, crash, keychain re-lock wiping Chrome's Cookies DB, or AppMaker
-    VM reseed). One CDP attach feeds two sinks:
+    (hard kill, crash, or a keychain re-lock wiping Chrome's Cookies DB).
 
-      1. LOCAL 0600 mirror (twitter_cookie_mirror) — ALWAYS written. This is the
-         keychain-independent durability layer that fixes Gap B on a persistent
-         machine: restore_twitter_session.py re-injects from it on the next cycle
-         preflight even after Chrome wiped its own encrypted store.
-      2. Server-side session store (POST /api/v1/twitter/session-cookies) —
-         best-effort. Enables VM auto-restore where the profile is reseeded
-         hourly. No-op on a persistent machine with no social_accounts row.
+    Writes the validated x.com/twitter.com cookies to the LOCAL 0600 mirror
+    (twitter_cookie_mirror) — the keychain-independent durability layer that
+    fixes Gap B on a persistent machine: restore_twitter_session.py re-injects
+    from it on the next cycle preflight even after Chrome wiped its own
+    encrypted store.
 
     Non-fatal end-to-end: the local session is already valid; this only enables
     future auto-recovery, so nothing here may abort connect_x."""
@@ -437,7 +432,9 @@ def _persist_session() -> None:
         except Exception:
             handle = None
 
-    # 1. Local mirror — always, keychain-independent.
+    # Local mirror — keychain-independent durability. This is the only cookie
+    # store; the VM-era server store (/api/v1/twitter/session-cookies) was
+    # removed 2026-06-17 when we stopped running AppMaker VMs.
     if twitter_cookie_mirror is not None:
         try:
             n = twitter_cookie_mirror.save_cookies(cookies, handle=handle)
@@ -447,18 +444,6 @@ def _persist_session() -> None:
         except Exception as e:
             print(f"setup_twitter_auth: local mirror save skipped ({e})", file=sys.stderr)
 
-    # 2. Server store — best-effort, only when a handle resolves.
-    if api_post is not None and handle:
-        try:
-            api_post("/api/v1/twitter/session-cookies", {"handle": handle, "cookies": cookies})
-            print(f"setup_twitter_auth: saved {len(cookies)} session cookies for @{handle} "
-                  "(server auto-restore enabled)", file=sys.stderr)
-        # api_post raises SystemExit (BaseException, NOT Exception) on a 4xx/5xx —
-        # e.g. "no social_accounts row" on a persistent machine that never
-        # registered this handle. Best-effort: must never abort connect_x.
-        except (Exception, SystemExit) as e:
-            print(f"setup_twitter_auth: session-store save skipped ({e})", file=sys.stderr)
-
 
 def _show_window_and_open_login() -> bool:
     """Make the managed Chrome window VISIBLE + focused and land it on the X login

package/skill/run-twitter-cycle.sh

@@ -203,9 +203,20 @@ log "Length-control experiment concluded 2026-06-04; winner=control; LENGTH_ARM
 # spend the sysctl read for the next check.
 source "$REPO_DIR/scripts/preflight.sh"
 SA_PREFLIGHT_SCRIPT="run-twitter-cycle"
-preflight_skip_if_claude_blocked
-preflight_skip_if_jetsam_pressure
-preflight_acquire_slot_or_skip "twitter-cycle" 1
+if [ "${SCAN_ONLY:-0}" = "1" ]; then
+    # SCAN_ONLY (the Desktop-session autopilot's scan step) gets its OWN slot pool
+    # so it is NOT blocked by a live launchd autopilot cycle; the two then serialize
+    # on the twitter-browser lock (acquired in Phase 1) instead of being mutually
+    # exclusive. It also SKIPS the claude-blocked gate: SCAN_ONLY drives no
+    # `claude -p`, so a prior claude cap must not suppress a pure scan.
+    SA_PREFLIGHT_SCRIPT="run-twitter-cycle-scan"
+    preflight_skip_if_jetsam_pressure
+    preflight_acquire_slot_or_skip "twitter-scan" 1
+else
+    preflight_skip_if_claude_blocked
+    preflight_skip_if_jetsam_pressure
+    preflight_acquire_slot_or_skip "twitter-cycle" 1
+fi
 
 # Source lock helpers (functions only, no lock acquired here). Phase 0 + the
 # project/queries setup below run lock-free against DB and config files;
@@ -1520,6 +1531,57 @@ if [ -z "$CANDIDATES" ]; then
     exit 0
 fi
 
+# --- SCAN_ONLY gate: stop after scoring, emit candidates, skip drafting -------
+# When SCAN_ONLY=1 the cycle runs scan -> score -> top-N select, writes the chosen
+# candidates as JSON, and STOPS before the claude drafting step. The MCP
+# scan_candidates tool reads this so a Claude Desktop scheduled-task session can do
+# the drafting ITSELF (on the user's plan, no `claude -p`) and hand the drafts back
+# via submit_drafts. Candidates stay 'pending' (drafted+posted via submit_drafts ->
+# post_drafts, or salvaged by a later cycle). The browser lock was already released
+# at the Phase 1 handoff, so this exits clean via the EXIT trap. NO current caller
+# sets SCAN_ONLY, so the autopilot/draft_cycle paths are byte-for-byte unchanged.
+if [ "${SCAN_ONLY:-0}" = "1" ]; then
+    SCAN_FILE="/tmp/saps_scan_candidates_${BATCH_ID}.json"
+    # $CANDIDATES is the same pipe-separated top-N the drafting step consumes (cols
+    # documented in twitter_cycle_helper.py:cmd_candidates; tweet_text/draft fields
+    # are pipe+newline sanitized there, so a field split is safe). Batch id + out
+    # path travel via env so the single-quoted python needs no shell interpolation.
+    printf '%s\n' "$CANDIDATES" | SAPS_SCAN_FILE="$SCAN_FILE" SAPS_SCAN_BATCH="$BATCH_ID" python3 -c '
+import json, os, sys
+def _i(x):
+    try:
+        return int(float(x or 0))
+    except Exception:
+        return 0
+def _f(x):
+    try:
+        return float(x or 0)
+    except Exception:
+        return 0.0
+out = []
+for line in sys.stdin:
+    line = line.rstrip("\n")
+    if not line.strip():
+        continue
+    p = line.split("|")
+    if len(p) < 14 or not p[0].isdigit():
+        continue
+    out.append({
+        "id": int(p[0]), "tweet_url": p[1], "author_handle": p[2], "tweet_text": p[3],
+        "virality_score": _f(p[4]), "delta_score": _f(p[5]), "matched_project": p[6],
+        "search_topic": p[7], "likes": _i(p[8]), "retweets": _i(p[9]), "replies": _i(p[10]),
+        "views": _i(p[11]), "author_followers": _i(p[12]), "age_hours": _f(p[13]),
+        "existing_draft": p[14] if len(p) > 14 else "", "existing_draft_style": p[15] if len(p) > 15 else "",
+    })
+json.dump({"batch_id": os.environ["SAPS_SCAN_BATCH"], "candidates": out}, open(os.environ["SAPS_SCAN_FILE"], "w"))
+' 2>/dev/null || printf '{"batch_id": "%s", "candidates": []}' "$BATCH_ID" > "$SCAN_FILE"
+    SCAN_N=$(python3 -c "import json; print(len(json.load(open('$SCAN_FILE')).get('candidates') or []))" 2>/dev/null || echo 0)
+    log "SCAN_ONLY=1: $SCAN_N candidate(s) scored and written to $SCAN_FILE. Stopping before drafting (agent drafts next)."
+    _SA_RUN_SUMMARY_EMITTED=1
+    echo "SCAN_ONLY_RESULT=$SCAN_FILE"
+    exit 0
+fi
+
 CANDIDATE_COUNT=$(printf '%s\n' "$CANDIDATES" | grep -c '^[0-9]')
 log "Top $CANDIDATE_COUNT candidates by virality_score selected for post review."