social-autoposter 1.6.81 → 1.6.83

package/mcp/dist/index.js

@@ -1424,6 +1424,96 @@ async function autopilotLoaded() {
     }
     return { autopilot_on, auto_update_on };
 }
+// ---- Autopilot prompt: keep the scheduled task's SKILL.md current ------------
+// The scheduled task's prompt (SKILL.md) is owned by the host and does NOT update
+// when the plugin updates. So a behavior change (the no-improvise / voice-inline /
+// stop-cleanly rules) would never reach an already-scheduled task. We close that
+// gap by REWRITING the task's SKILL.md on server boot when its embedded prompt
+// version is older than what this build ships. The host reads the file fresh on
+// each run, so the next fire picks up the new prompt — no host tool, no user
+// action. Bump AUTOPILOT_PROMPT_VERSION whenever the prompt below changes.
+const AUTOPILOT_PROMPT_VERSION = 1;
+const AUTOPILOT_PROMPT_MARKER = "saps_autopilot_prompt_version";
+function autopilotSkillPath() {
+    const cfg = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+    return path.join(cfg, "scheduled-tasks", AUTOPILOT_TASK_ID, "SKILL.md");
+}
+// The canonical draft-only autopilot prompt: uses ONLY scan_candidates +
+// submit_drafts, drafts from the INLINE project_voices, improvises nothing, and
+// stops cleanly if its tools aren't available.
+function autopilotSkillMd(project) {
+    const body = [
+        `You are running the Social Autoposter draft-only autopilot for the project "${project}". ` +
+            `Run ONE cycle, then stop. DRAFT-ONLY: you must NEVER post to X/Twitter — you only queue ` +
+            `drafts for the user's approval. Use ONLY two tools — scan_candidates and submit_drafts — ` +
+            `and IMPROVISE NOTHING ELSE.`,
+        ``,
+        `Steps:`,
+        `1. Call scan_candidates with project "${project}". It long-polls: if it returns a "Scan in ` +
+            `progress" status, call scan_candidates again (same args) and keep re-calling until it ` +
+            `returns candidates. Never sleep or use background waits. If it returns no candidates, stop ` +
+            `cleanly — nothing to do this cycle.`,
+        `2. The result includes a project_voices field — the brand voice + guardrails for each ` +
+            `candidate's project. Draft from project_voices[<matched_project>] (voice, description, ` +
+            `differentiator, content_guardrails). NEVER read config files, call project_config, or run ` +
+            `Bash/Read to find the voice — everything you need is already in the scan result.`,
+        `3. For each candidate you judge genuinely worth engaging, write ONE on-brand reply (<=250 ` +
+            `chars, match the thread's language, genuinely helpful — not spammy, no hard selling). Skip ` +
+            `the rest.`,
+        `4. Call submit_drafts with the batch_id from scan_candidates and a drafts array of ` +
+            `{candidate_id, reply_text}. This queues them for the menu-bar approval UI. Do NOT call ` +
+            `post_drafts — posting is the user's decision.`,
+        ``,
+        `HARD GUARD: if scan_candidates is NOT available (ToolSearch returns no matching tool — can ` +
+            `happen when a run spawns before the extension's MCP server has reconnected), STOP immediately ` +
+            `and report "S4L tools unavailable, skipping this cycle." Do NOT search the connector registry, ` +
+            `do NOT call list_connectors, do NOT improvise any other tool.`,
+    ].join("\n");
+    return (`---\n` +
+        `name: ${AUTOPILOT_TASK_ID}\n` +
+        `description: Social Autoposter draft-only autopilot for project ${project} — scans X, drafts ` +
+        `on-brand replies (voice inline), queues them for approval. Never posts.\n` +
+        `---\n\n` +
+        body +
+        `\n\n<!-- ${AUTOPILOT_PROMPT_MARKER}: ${AUTOPILOT_PROMPT_VERSION} -->\n`);
+}
+// Read the project name back from an existing autopilot SKILL.md so a rewrite
+// keeps the same project. Null if it can't be determined (then leave it alone).
+function detectAutopilotProject(skillMd) {
+    const m1 = /project[s]?\s+"([^"]+)"/i.exec(skillMd);
+    if (m1)
+        return m1[1];
+    const m2 = /for project\s+([A-Za-z0-9_-]+)/i.exec(skillMd);
+    if (m2)
+        return m2[1];
+    return null;
+}
+// Refresh the scheduled task's SKILL.md when this build ships a newer prompt than
+// what's on disk. Best-effort, synchronous, never throws. Only touches an EXISTING
+// task (onboarding creates the first one), only when stale, and only when the
+// project reads back, so we never write a wrong/blank project.
+function ensureAutopilotPromptCurrent() {
+    try {
+        const skillPath = autopilotSkillPath();
+        if (!fs.existsSync(skillPath))
+            return; // no scheduled task yet
+        const cur = fs.readFileSync(skillPath, "utf-8");
+        const m = new RegExp(`${AUTOPILOT_PROMPT_MARKER}:\\s*(\\d+)`).exec(cur);
+        const curVer = m ? parseInt(m[1], 10) : 0;
+        if (curVer >= AUTOPILOT_PROMPT_VERSION)
+            return; // already current
+        const project = detectAutopilotProject(cur);
+        if (!project) {
+            console.error(`[autopilot] prompt is stale (v${curVer}) but project unreadable from SKILL.md; leaving it`);
+            return;
+        }
+        fs.writeFileSync(skillPath, autopilotSkillMd(project), "utf-8");
+        console.error(`[autopilot] refreshed scheduled-task prompt -> v${AUTOPILOT_PROMPT_VERSION} (was v${curVer}), project=${project}`);
+    }
+    catch (e) {
+        console.error(`[autopilot] ensureAutopilotPromptCurrent error: ${e?.message || e}`);
+    }
+}
 // Assemble everything the panel needs in one shot (projects + X + autopilot +
 // version). Resilient: any probe that throws degrades to a safe default rather
 // than failing the whole snapshot.
@@ -2261,6 +2351,11 @@ async function main() {
     // disk, BEFORE serving, so the very first scan uses the shipped pipeline (not
     // the version first materialized at install). Synchronous + best-effort.
     ensurePipelineCurrent();
+    // Same problem for the scheduled task's prompt: the host owns its SKILL.md and
+    // a plugin update never touches it. Rewrite it on boot when this build ships a
+    // newer prompt version, so behavior changes (no-improvise / voice-inline /
+    // stop-cleanly) reach an already-scheduled task on its next fire. Best-effort.
+    ensureAutopilotPromptCurrent();
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error(`[social-autoposter-mcp] connected. v=${VERSION} repo=${repoDir()}`);
@@ -2274,8 +2369,22 @@ async function main() {
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.
     void ensureMenubar()
-        .then((r) => console.error(`[social-autoposter-mcp] menubar: ${r.skipped ? "skip" : r.ok ? "ok" : "fail"} (${r.detail})`))
-        .catch((e) => console.error("[social-autoposter-mcp] menubar ensure failed:", e?.message || e));
+        .then((r) => {
+        console.error(`[social-autoposter-mcp] menubar: ${r.skipped ? "skip" : r.ok ? "ok" : "fail"} (${r.detail})`);
+        // A non-skipped failure here is the boot-time "menu bar didn't come up"
+        // path (e.g. uv missing, rumps reinstall failed on an existing install).
+        // Report it; a skip (non-macOS / runtime not ready) is expected, not an error.
+        if (!r.ok && !r.skipped) {
+            captureError(new Error(`menubar ensure failed: ${r.detail}`), {
+                component: "menubar",
+                phase: "ensure",
+            });
+        }
+    })
+        .catch((e) => {
+        console.error("[social-autoposter-mcp] menubar ensure failed:", e?.message || e);
+        captureError(e, { component: "menubar", phase: "ensure" });
+    });
     // Phone home so this .mcpb install is visible in the install-lane digest
     // (parity with the npx launchd heartbeat). Once on startup, then every 15m
     // while the desktop app keeps the server alive. unref() so it never holds the

package/mcp/dist/runtime.js

@@ -22,6 +22,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { captureError } from "./telemetry.js";
 // Pin the standalone CPython series the venv is built from. Bump deliberately.
 const PYTHON_VERSION = "3.12";
 // The CDP scan engine the twitter cycle shells out to (~/.local/bin/browser-harness).
@@ -378,6 +379,15 @@ async function provision(progress) {
         progress.ok = false;
         progress.error = msg;
         writeProgress(progress);
+        // Every fatal install-step failure (repo unpack, uv, python, venv, deps,
+        // chromium, harness, chrome) was previously only written to the local
+        // install-progress.json, invisible to us. Report it so a failed runtime
+        // install becomes a real Sentry event, tagged with the step that failed.
+        const failedStep = progress.steps.find((s) => s.status === "running");
+        captureError(new Error(msg), {
+            component: "install",
+            ...(failedStep ? { step: failedStep.id } : {}),
+        });
         return progress;
     };
     fs.mkdirSync(RUNTIME_DIR, { recursive: true });
@@ -499,6 +509,19 @@ async function provision(progress) {
         if (r.code !== 0) {
             return fail(`playwright install chromium failed (exit ${r.code}). ${r.out.slice(-400)}`);
         }
+        // Smoke-test the EXACT gate the pipeline's post path runs at use time
+        // (twitter_post_plan.py preflight): the owned interpreter must import
+        // playwright. The reply step is the only Playwright importer, so a deps
+        // sync that left it unimportable was invisible until the first real post
+        // died with no_reply_json in production (Karol, 2026-06-22). Fail the
+        // install LOUDLY here instead.
+        const smoke = await sh(VENV_PYTHON, ["-c", "import playwright"], {
+            timeoutMs: 60000,
+        });
+        if (smoke.code !== 0) {
+            return fail(`runtime smoke test failed: ${VENV_PYTHON} cannot import playwright ` +
+                `(exit ${smoke.code}). ${smoke.out.slice(-400)}`);
+        }
     }
     setStep("chromium", "done");
     // --- Step 6: browser-harness CLI -----------------------------------------
@@ -607,6 +630,15 @@ async function provision(progress) {
     if (process.platform === "darwin") {
         const mb = await installMenubar(uv, uvEnv, VENV_PYTHON);
         setStep("menubar", mb.ok ? "done" : "error", mb.detail);
+        // Non-fatal step, so the only prior signal of a menu bar install failure was
+        // a local install-progress.json entry (invisible to us). Report it so "menu
+        // bar didn't start" becomes a real Sentry event with the failing detail.
+        if (!mb.ok) {
+            captureError(new Error(`menubar install failed: ${mb.detail}`), {
+                component: "menubar",
+                phase: "install",
+            });
+        }
     }
     else {
         setStep("menubar", "done", "skipped (macOS only)");

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.81",
-  "installedAt": "2026-06-22T19:29:05.014Z"
+  "version": "1.6.83",
+  "installedAt": "2026-06-23T02:17:06.705Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.81",
+  "version": "1.6.83",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -24,9 +24,58 @@ import tempfile
 import threading
 import time
 
-import rumps
-
-import s4l_state as st
+# --- Sentry bootstrap --------------------------------------------------------
+# The menu bar runs as a standalone KeepAlive LaunchAgent off the owned venv,
+# a separate process from the MCP server, so it was a Sentry blind spot: a crash
+# (most often rumps missing/broken in the venv -> "menu bar didn't start") only
+# ever landed in the local menubar.err.log. Wire it in BEFORE importing rumps so
+# even an import-time failure of the menu bar's heaviest dependency is reported.
+# sentry_init lives in the pipeline's scripts/ dir (SAPS_REPO_DIR is exported by
+# the launchd plist) and sentry-sdk is in the owned venv (requirements.txt). All
+# best-effort: a missing repo path or SDK degrades to a silent no-op.
+_sentry = None
+try:
+    _repo = os.environ.get("SAPS_REPO_DIR")
+    if _repo:
+        _scripts = os.path.join(_repo, "scripts")
+        if _scripts not in sys.path:
+            sys.path.insert(0, _scripts)
+    import sentry_init as _sentry  # noqa: E402
+
+    _sentry.init()
+except Exception:
+    _sentry = None
+
+
+def _capture(err, **tags):
+    """Report a handled menu-bar error to Sentry (component=menubar) without ever
+    raising into the caller. No-op if the Sentry bootstrap above failed."""
+    try:
+        if _sentry is not None:
+            tags.setdefault("component", "menubar")
+            _sentry.capture_exception(err, tags=tags)
+    except Exception:
+        pass
+
+
+def _flush():
+    try:
+        if _sentry is not None:
+            _sentry.flush()
+    except Exception:
+        pass
+
+
+try:
+    import rumps  # noqa: E402
+except Exception as _import_err:
+    # rumps missing/broken in the owned venv is THE "menu bar didn't start" case.
+    # Report it explicitly, flush, then re-raise so launchd records the crash too.
+    _capture(_import_err, phase="import_rumps")
+    _flush()
+    raise
+
+import s4l_state as st  # noqa: E402
 
 CLAUDE_APP = "Claude"
 POLL_SECONDS = 5
@@ -47,7 +96,6 @@ SETUP_PROMPT = (
     "must interactively sign in or no product can be identified."
 )
 DRAFT_PROMPT = "Run a social-autoposter draft cycle and show me the drafts to review."
-POST_PROMPT = "Post my approved social-autoposter drafts."
 UPDATE_PROMPT = "Update social-autoposter to the latest version."
 
 
@@ -183,9 +231,6 @@ class S4LMenuBar(rumps.App):
     def _draft(self, _=None):
         self._send_to_claude(DRAFT_PROMPT)
 
-    def _post(self, _=None):
-        self._send_to_claude(POST_PROMPT)
-
     def _update(self, _=None):
         self._send_to_claude(UPDATE_PROMPT)
 
@@ -319,8 +364,13 @@ class S4LMenuBar(rumps.App):
         act = st.read_activity()
         label = act.get("label") if act else None
         if label:
-            self._spin_i = (self._spin_i + 1) % len(SPINNER)
-            self.title = f"S4L {label} {SPINNER[self._spin_i]}"
+            # A "✓" label (e.g. "posted 3/10 ✓") is a momentary confirmation, not
+            # ongoing work — show it without the spinner glyph so it reads as done.
+            if "✓" in label:
+                self.title = f"S4L {label}"
+            else:
+                self._spin_i = (self._spin_i + 1) % len(SPINNER)
+                self.title = f"S4L {label} {SPINNER[self._spin_i]}"
             return
         try:
             if self._spinner is not None:
@@ -431,6 +481,7 @@ class S4LMenuBar(rumps.App):
             self._review_active = False
             sys.stderr.write(f"[s4l-menubar] review cards failed: {e}\n")
             sys.stderr.flush()
+            _capture(e, phase="review_cards")
 
     def _on_review_done(self, batch, decisions):
         # Runs on the main thread (from the card controller). Translate decisions
@@ -589,11 +640,19 @@ class S4LMenuBar(rumps.App):
         out.append(
             rumps.MenuItem("Run draft cycle in Claude", callback=self._draft)
         )
-        out.append(
-            rumps.MenuItem("Post approved drafts in Claude", callback=self._post)
-        )
+        # No "Post approved drafts" item: approving a review card already posts
+        # directly + programmatically (_on_review_done -> st.post_drafts -> the
+        # CDP poster). A menu button that types a prompt into the chat to do the
+        # same thing was a redundant detour through the model, so it's gone.
         return out
 
 
 if __name__ == "__main__":
-    S4LMenuBar().run()
+    try:
+        S4LMenuBar().run()
+    except Exception as _run_err:
+        # The run loop dying is the other "menu bar didn't start / vanished" case.
+        # Report + flush before the KeepAlive relaunch so it isn't lost on teardown.
+        _capture(_run_err, phase="run")
+        _flush()
+        raise

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.81",
+  "version": "1.6.83",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.81",
+  "version": "1.6.83",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/post_reddit.py

@@ -36,6 +36,17 @@ CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
 REDDIT_BROWSER = os.path.join(REPO_DIR, "scripts", "reddit_browser.py")
 REDDIT_BROWSER_LOCK = os.path.join(REPO_DIR, "scripts", "reddit_browser_lock.py")
 REDDIT_TOOLS = os.path.join(REPO_DIR, "scripts", "reddit_tools.py")
+
+# Interpreter every child subprocess must run under. A bare PYTHON resolved
+# to the user's system python, which lacks the pipeline deps (Playwright and
+# friends) that live only in the owned uv runtime — so on a fresh box every
+# reddit_browser.py reply died (the same class as the Karol/Twitter bug,
+# 2026-06-22). Honor the authoritative SAPS_PYTHON pin (set by the launchd
+# plist), else sys.executable (the owned interpreter the MCP launches us under).
+# Never the literal PYTHON: that re-rolls the PATH dice. Re-exported so
+# grandchildren inherit it.
+PYTHON = os.environ.get("SAPS_PYTHON") or sys.executable
+os.environ["SAPS_PYTHON"] = PYTHON
 RATELIMIT_FILE = "/tmp/reddit_ratelimit.json"
 PREFLIGHT_WAIT_BUDGET_SECONDS = 180
 
@@ -619,7 +630,7 @@ def load_config():
 
 def pick_project(platform="reddit", exclude=None):
     try:
-        cmd = ["python3", os.path.join(REPO_DIR, "scripts", "pick_project.py"),
+        cmd = [PYTHON, os.path.join(REPO_DIR, "scripts", "pick_project.py"),
                "--platform", platform, "--json"]
         if exclude:
             cmd.extend(["--exclude", ",".join(exclude)])
@@ -641,7 +652,7 @@ def get_top_performers(project_name, platform="reddit", style=None):
     callers that have not flipped to the picker yet).
     """
     try:
-        cmd = ["python3", os.path.join(REPO_DIR, "scripts", "top_performers.py"),
+        cmd = [PYTHON, os.path.join(REPO_DIR, "scripts", "top_performers.py"),
                "--platform", platform, "--project", project_name]
         if style:
             cmd.extend(["--style", style])
@@ -660,7 +671,7 @@ def get_top_search_topics(project_name, platform="reddit", limit=8, window_days=
     project on this platform, or '' if no data yet. See top_search_topics.py."""
     try:
         result = subprocess.run(
-            ["python3", os.path.join(REPO_DIR, "scripts", "top_search_topics.py"),
+            [PYTHON, os.path.join(REPO_DIR, "scripts", "top_search_topics.py"),
              "--project", project_name, "--platform", platform,
              "--window-days", str(window_days), "--limit", str(limit)],
             capture_output=True, text=True, timeout=15,
@@ -684,7 +695,7 @@ def get_omitted_reddit_topics(project_name, limit=10, window_hours=168, min_omit
     """
     try:
         result = subprocess.run(
-            ["python3", os.path.join(REPO_DIR, "scripts", "top_omitted_reddit_topics.py"),
+            [PYTHON, os.path.join(REPO_DIR, "scripts", "top_omitted_reddit_topics.py"),
              "--project", project_name,
              "--window-hours", str(window_hours),
              "--limit", str(limit),
@@ -709,7 +720,7 @@ def get_dud_reddit_queries(project_name, limit=15, window_hours=168):
     """
     try:
         result = subprocess.run(
-            ["python3", os.path.join(REPO_DIR, "scripts", "top_dud_reddit_queries.py"),
+            [PYTHON, os.path.join(REPO_DIR, "scripts", "top_dud_reddit_queries.py"),
              "--project", project_name,
              "--window-hours", str(window_hours),
              "--limit", str(limit)],
@@ -1451,7 +1462,7 @@ def run_claude(prompt, timeout=600):
         text_output = "\n".join(all_text_parts) if all_text_parts else "".join(collected)
         stderr_out = proc.stderr.read() if proc.stderr else ""
         try:
-            log_args = ["python3", os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
+            log_args = [PYTHON, os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
                  "--session-id", session_id, "--script", "post_reddit"]
             orch_cost = usage.get("cost_usd")
             if isinstance(orch_cost, (int, float)) and orch_cost > 0:
@@ -1487,7 +1498,7 @@ def _acquire_browser_lease(timeout: int = 600, ttl: int = 90):
     """
     try:
         r = subprocess.run(
-            ["python3", REDDIT_BROWSER_LOCK, "acquire",
+            [PYTHON, REDDIT_BROWSER_LOCK, "acquire",
              "--timeout", str(timeout), "--ttl", str(ttl)],
             capture_output=True, text=True, timeout=timeout + 30,
         )
@@ -1512,7 +1523,7 @@ def _release_browser_lease() -> None:
     """
     try:
         subprocess.run(
-            ["python3", REDDIT_BROWSER_LOCK, "release"],
+            [PYTHON, REDDIT_BROWSER_LOCK, "release"],
             capture_output=True, text=True, timeout=10,
         )
     except Exception:
@@ -1529,7 +1540,7 @@ def post_via_cdp(thread_url, reply_to_url, text):
     for attempt in range(MAX_ATTEMPTS):
         try:
             target = reply_to_url or thread_url
-            cmd = ["python3", REDDIT_BROWSER, "reply" if reply_to_url else "post-comment", target, text]
+            cmd = [PYTHON, REDDIT_BROWSER, "reply" if reply_to_url else "post-comment", target, text]
             proc = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
             cdp_out = proc.stdout.strip()
             if not cdp_out:
@@ -1585,7 +1596,7 @@ def log_post(thread_url, permalink, text, project_name, thread_author, thread_ti
     (if any) Claude baked into the reply text.
     """
     try:
-        cmd = ["python3", REDDIT_TOOLS, "log-post",
+        cmd = [PYTHON, REDDIT_TOOLS, "log-post",
              thread_url, permalink or "", text, project_name,
              thread_author, thread_title,
              "--account", reddit_username]
@@ -1616,7 +1627,7 @@ def bump_campaigns(table, row_id, campaign_ids):
     for cid in campaign_ids:
         try:
             subprocess.run(
-                ["python3", bump,
+                [PYTHON, bump,
                  "--table", table, "--id", str(row_id), "--campaign-id", str(cid)],
                 capture_output=True, text=True, timeout=15,
             )
@@ -2623,6 +2634,22 @@ def main():
             sys.exit(2)
         with open(args.in_path) as f:
             plan = json.load(f)
+        # Hard preflight: _post_iteration shells to reddit_browser.py, the only
+        # Playwright importer on this rail. If the resolved interpreter can't
+        # import it the owned runtime is missing/half-provisioned and every post
+        # would die with CDP_ERROR. Fail LOUD with a distinct signal instead.
+        # Gated on real decisions so an empty plan still exits clean.
+        if plan.get("decisions"):
+            _chk = subprocess.run(
+                [PYTHON, "-c", "import playwright"],
+                capture_output=True, text=True,
+            )
+            if _chk.returncode != 0:
+                print(f"[post_reddit] FATAL runtime_incomplete: interpreter {PYTHON!r} "
+                      f"cannot import playwright — the owned Python runtime is missing or "
+                      f"unprovisioned. Run the `runtime` install (action:'install') before "
+                      f"posting. stderr: {(_chk.stderr or '').strip()[:300]}", file=sys.stderr)
+                sys.exit(3)
         try:
             posted, failed = _post_iteration(plan, reddit_username)
             print(f"[post_reddit] phase=post project={plan.get('project_name')} posted={posted} failed={failed}")

package/scripts/seed_search_queries.py

@@ -433,4 +433,21 @@ def main() -> int:
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
+    try:
+        _rc = main()
+    except BrokenPipeError:
+        # The MCP setup hook (our parent) closes stdout once it has read the
+        # sentinel ===QUERIES_JSON=== block; the trailing summary prints then hit
+        # a dead pipe and raise BrokenPipeError. All persistence already happened
+        # earlier in main(), so this is BENIGN. Previously it propagated as an
+        # uncaught exception and Sentry logged it as a "seeding failed" event
+        # (Karol, 2026-06-22) — a false positive that buried the real signal.
+        # Redirect stdout to devnull so interpreter shutdown doesn't re-raise on
+        # the final flush, then exit clean.
+        try:
+            _devnull = os.open(os.devnull, os.O_WRONLY)
+            os.dup2(_devnull, sys.stdout.fileno())
+        except Exception:
+            pass
+        _rc = 0
+    raise SystemExit(_rc)

package/scripts/sentry_init.py

@@ -65,3 +65,40 @@ def _tag_install(sentry_sdk) -> None:
             sentry_sdk.set_tag("hostname", str(host))
     except Exception:
         pass
+
+
+def capture_exception(err, tags=None) -> None:
+    """Explicitly report an exception to Sentry with optional tags. Safe to call
+    even if init() was never run or sentry-sdk is missing (silent no-op). Use for
+    swallowed/handled errors that would otherwise never reach Sentry (the global
+    excepthook only catches UNHANDLED ones)."""
+    if not _initialized:
+        return
+    try:
+        import sentry_sdk
+    except Exception:
+        return
+    try:
+        if tags:
+            with sentry_sdk.push_scope() as scope:
+                for k, v in tags.items():
+                    scope.set_tag(str(k), str(v))
+                sentry_sdk.capture_exception(err)
+        else:
+            sentry_sdk.capture_exception(err)
+    except Exception:
+        return
+
+
+def flush(timeout: float = 2.0) -> None:
+    """Block until queued events are sent (best-effort). Call before a short-lived
+    or about-to-crash process exits so a just-captured event isn't dropped on
+    teardown."""
+    if not _initialized:
+        return
+    try:
+        import sentry_sdk
+
+        sentry_sdk.flush(timeout)
+    except Exception:
+        return

package/scripts/twitter_post_plan.py

@@ -45,6 +45,7 @@ import random
 import re
 import subprocess
 import sys
+import time
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -54,6 +55,18 @@ LOG_POST = os.path.join(REPO_DIR, "scripts", "log_post.py")
 CAMPAIGN_BUMP = os.path.join(REPO_DIR, "scripts", "campaign_bump.py")
 LINK_TAIL = os.path.join(REPO_DIR, "scripts", "link_tail.py")
 
+# Interpreter every child subprocess (twitter_browser.py reply, log_post.py,
+# campaign_bump.py, link_tail.py) must run under. The reply path is the only
+# Playwright importer in the pipeline, so a bare "python3" here silently
+# resolved to the user's system python (no Playwright) and every post died
+# with no_reply_json (Karol, 2026-06-22). Honor the authoritative pin the rest
+# of the runtime uses — SAPS_PYTHON (set by the launchd plist) — then fall back
+# to sys.executable (the interpreter THIS process already runs under, which the
+# MCP's runPython resolves to the owned uv runtime). Never the literal
+# "python3": that re-rolls the PATH dice. Re-exported so grandchildren inherit.
+PYTHON = os.environ.get("SAPS_PYTHON") or sys.executable
+os.environ["SAPS_PYTHON"] = PYTHON
+
 # DATABASE_URL was previously used to issue ad-hoc `psql -c "..."` calls for
 # the pre-post dedup probe and the candidate status updates. As of the
 # 2026-05-18 routes migration both lanes go through the s4l.ai HTTP API
@@ -526,7 +539,7 @@ def post_one(c: dict, picker_assignment: dict | None = None) -> tuple[str, str]:
     link_tail_outcome = "skipped_no_link"
     if _add_tail_link:
         rc, out, err = run_subprocess(
-            ["python3", LINK_TAIL,
+            [PYTHON, LINK_TAIL,
              "--reply-text", reply_text,
              "--link-url", link_url,
              "--thread-text", thread_text or "",
@@ -590,7 +603,7 @@ def post_one(c: dict, picker_assignment: dict | None = None) -> tuple[str, str]:
 
     print(f"[post] candidate {cid} -> posting (link={link_url!r})", flush=True)
     rc, out, err = run_subprocess(
-        ["python3", TWITTER_BROWSER, "reply", candidate_url, full_text],
+        [PYTHON, TWITTER_BROWSER, "reply", candidate_url, full_text],
         timeout_sec=600,
     )
     if err:
@@ -667,7 +680,7 @@ def post_one(c: dict, picker_assignment: dict | None = None) -> tuple[str, str]:
     from twitter_account import resolve_handle as _resolve_twitter_handle
 
     log_args = [
-        "python3", LOG_POST,
+        PYTHON, LOG_POST,
         "--platform", "twitter",
         "--thread-url", candidate_url,
         "--our-url", reply_url,
@@ -765,7 +778,7 @@ def post_one(c: dict, picker_assignment: dict | None = None) -> tuple[str, str]:
     # Campaign attribution.
     for ccid in applied_campaigns:
         rc, out, err = run_subprocess(
-            ["python3", CAMPAIGN_BUMP, "--table", "posts",
+            [PYTHON, CAMPAIGN_BUMP, "--table", "posts",
              "--id", str(post_id), "--campaign-id", str(ccid)],
             timeout_sec=30,
         )
@@ -777,7 +790,7 @@ def post_one(c: dict, picker_assignment: dict | None = None) -> tuple[str, str]:
     # Mark link_edited_at: link is embedded in primary reply, no self-reply
     # will follow. Prevents link-edit-twitter sweep from re-attempting.
     rc, out, err = run_subprocess(
-        ["python3", LOG_POST,
+        [PYTHON, LOG_POST,
          "--mark-self-reply",
          "--post-id", str(post_id),
          "--self-reply-url", reply_url,
@@ -845,6 +858,39 @@ def post_one(c: dict, picker_assignment: dict | None = None) -> tuple[str, str]:
     return ("posted", "")
 
 
+def _saps_state_dir() -> str:
+    return os.environ.get("SAPS_STATE_DIR") or os.path.join(
+        os.path.expanduser("~"), ".social-autoposter-mcp")
+
+
+def _write_activity(label: str) -> None:
+    """Best-effort live status for the S4L menu bar, which polls
+    <state_dir>/activity.json. Mirrors the Node server's writeActivity shape so
+    the menu-bar spinner renders our per-post progress ("posting 3/10", then
+    "posted 3/10 ✓"). Purely cosmetic: a failure here never affects posting."""
+    try:
+        sd = _saps_state_dir()
+        os.makedirs(sd, exist_ok=True)
+        payload = {"state": "working", "label": label,
+                   "since": datetime.now(timezone.utc).isoformat()}
+        with open(os.path.join(sd, "activity.json"), "w", encoding="utf-8") as f:
+            f.write(json.dumps(payload) + "\n")
+    except Exception:
+        pass
+
+
+def _clear_activity() -> None:
+    """Remove our status so neither an early exit nor the cron path (which does
+    NOT go through the MCP runTool's clear) leaves a stale 'posting/posted' stuck
+    in the menu bar. Double-clearing with runTool is harmless."""
+    try:
+        p = os.path.join(_saps_state_dir(), "activity.json")
+        if os.path.exists(p):
+            os.remove(p)
+    except Exception:
+        pass
+
+
 def main() -> int:
     ap = argparse.ArgumentParser()
     ap.add_argument("--plan", required=True,
@@ -924,26 +970,63 @@ def main() -> int:
                   f"approved in plan (pass --post-unapproved to override)", flush=True)
         candidates = _kept
 
-    for c in candidates:
-        try:
-            outcome, reason = post_one(c, picker_assignment=picker_assignment)
-        except Exception as e:
-            print(f"[post] candidate {c.get('candidate_id')} crashed: {e}",
-                  flush=True)
-            outcome, reason = ("failed", "exception")
-            cid = c.get("candidate_id")
-            if isinstance(cid, int):
-                update_candidate(cid, "skipped", "exception")
-        if outcome == "posted":
-            posted += 1
-        elif outcome == "skipped":
-            skipped += 1
-            if reason:
-                skip_reasons[reason] = skip_reasons.get(reason, 0) + 1
-        else:
-            failed += 1
-            if reason:
-                fail_reasons[reason] = fail_reasons.get(reason, 0) + 1
+    # Hard preflight: the reply path (twitter_browser.py) imports Playwright,
+    # the only such importer in the pipeline. If the resolved interpreter can't
+    # import it, EVERY post dies with no_reply_json because the owned runtime is
+    # missing or half-provisioned (Karol, 2026-06-22). Fail LOUD here with a
+    # distinct signal instead of attempting posts that silently no-op. Gated on
+    # there being real work, so a no-op / all-skipped plan still exits clean.
+    if candidates:
+        _chk = subprocess.run(
+            [PYTHON, "-c", "import playwright"],
+            capture_output=True, text=True,
+        )
+        if _chk.returncode != 0:
+            print(f"[post] FATAL runtime_incomplete: interpreter {PYTHON!r} cannot "
+                  f"import playwright — the owned Python runtime is missing or "
+                  f"unprovisioned. Run the `runtime` install (action:'install') "
+                  f"before posting. stderr: {(_chk.stderr or '').strip()[:300]}",
+                  file=sys.stderr, flush=True)
+            print(json.dumps({
+                "posted": 0,
+                "skipped": 0,
+                "failed": len(candidates),
+                "failure_reasons": "runtime_incomplete",
+                "skip_reasons": "",
+            }), flush=True)
+            return 3
+
+    _total = len(candidates)
+    try:
+        for _idx, c in enumerate(candidates, start=1):
+            # Live per-post status for the S4L menu bar: "posting 3/10" while this
+            # one is in flight, then "posted 3/10 ✓" once it lands. Cosmetic only.
+            _write_activity(f"posting {_idx}/{_total}")
+            try:
+                outcome, reason = post_one(c, picker_assignment=picker_assignment)
+            except Exception as e:
+                print(f"[post] candidate {c.get('candidate_id')} crashed: {e}",
+                      flush=True)
+                outcome, reason = ("failed", "exception")
+                cid = c.get("candidate_id")
+                if isinstance(cid, int):
+                    update_candidate(cid, "skipped", "exception")
+            if outcome == "posted":
+                posted += 1
+                # Flash the confirmation with a short dwell so the menu bar shows
+                # it before the next iteration's "posting" overwrites the label.
+                _write_activity(f"posted {_idx}/{_total} ✓")
+                time.sleep(0.6)
+            elif outcome == "skipped":
+                skipped += 1
+                if reason:
+                    skip_reasons[reason] = skip_reasons.get(reason, 0) + 1
+            else:
+                failed += 1
+                if reason:
+                    fail_reasons[reason] = fail_reasons.get(reason, 0) + 1
+    finally:
+        _clear_activity()
 
     summary = {
         "posted": posted,

package/skill/run-twitter-cycle.sh

@@ -2070,7 +2070,7 @@ log "twitter-browser lock held (pid=$$) Phase 2b-post"
 ensure_twitter_browser_for_backend 2>&1 | tee -a "$LOG_FILE"
 
 log "Phase 2b-post: posting $PLAN_COUNT candidate(s)..."
-POST_OUTPUT=$(python3 "$REPO_DIR/scripts/twitter_post_plan.py" --plan "$PLAN_FILE" 2>&1)
+POST_OUTPUT=$("${SAPS_PYTHON:-python3}" "$REPO_DIR/scripts/twitter_post_plan.py" --plan "$PLAN_FILE" 2>&1)
 echo "$POST_OUTPUT" >> "$LOG_FILE"
 
 # The post helper prints a JSON summary on its last stdout line.