social-autoposter 1.6.83 → 1.6.84

package/mcp/dist/index.js

@@ -22,7 +22,7 @@ import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, ensurePipelineCurrent, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, captureError, flushSentry } from "./telemetry.js";
+import { initSentry, sendHeartbeat, captureError, flushSentry, startLogStreaming, flushLogs } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -576,10 +576,20 @@ async function postApproved(batchId, plan) {
     catch {
         /* keep raw */
     }
-    // On a successful run, mark the posted candidates in the ORIGINAL plan so the
-    // other review surface (chat vs menu-bar pop-ups) skips them — cross-surface
-    // de-dup. Best-effort; the pipeline's own already-posted check is the backstop.
-    if (res.code === 0) {
+    // Real posted count from the pipeline summary — NOT the approved count. A run
+    // can exit 0 yet post nothing (every reply hit reply_box_not_found, etc.), so
+    // trusting approved.length here reported phantom successes ("posted: 1" when 0
+    // landed). Fall back to approved.length only when the summary is unparseable
+    // AND the process exited clean.
+    const summObj = (summary && typeof summary === "object") ? summary : null;
+    const realPosted = summObj && typeof summObj.posted === "number"
+        ? summObj.posted
+        : res.code === 0 && !summObj
+            ? approved.length
+            : 0;
+    // Mark only candidates that ACTUALLY posted (cross-surface de-dup). When the
+    // summary is missing but the run exited clean, fall back to marking all.
+    if (realPosted > 0 || (res.code === 0 && !summObj)) {
         for (const c of approved)
             c.posted = true;
         try {
@@ -589,8 +599,27 @@ async function postApproved(batchId, plan) {
             /* best effort */
         }
     }
+    // Post failures are HANDLED in the pipeline (it returns a count, never throws),
+    // so they never reach Sentry on their own. Capture an explicit event whenever
+    // the run exited non-zero OR fewer drafts posted than were approved. This is
+    // the only telemetry channel that reaches a customer .mcpb install (their cycle
+    // log lives on their machine). install_id/hostname are auto-tagged.
+    if (res.code !== 0 || realPosted < approved.length) {
+        captureError(new Error(`post_drafts: ${realPosted}/${approved.length} posted (exit=${res.code})`), {
+            component: "post",
+            exit_code: String(res.code),
+            attempted: String(approved.length),
+            posted: String(realPosted),
+            failure_reasons: String(summObj?.failure_reasons || ""),
+            skip_reasons: String(summObj?.skip_reasons || ""),
+            stderr_tail: res.stderr.split("\n").slice(-5).join(" | ").slice(0, 500),
+        });
+        void flushSentry(2000);
+    }
+    void flushLogs();
     return {
         attempted: approved.length,
+        posted: realPosted,
         exit_code: res.code,
         summary,
         stderr_tail: res.stderr.split("\n").slice(-8).join("\n"),
@@ -1210,11 +1239,20 @@ tool("post_drafts", {
         });
     }
     const result = await postApproved(batch_id, plan);
+    // Report the REAL posted count from the pipeline, not the approved count.
+    // A run can approve N yet land 0 (browser/session failure); reporting
+    // approve.size here told the agent "posted: N" on a total failure.
+    const actuallyPosted = typeof result.posted === "number" ? result.posted : approve.size;
+    if (actuallyPosted < approve.size) {
+        warnings.push(`only ${actuallyPosted}/${approve.size} actually posted (exit=${result.exit_code}); ` +
+            `see result.summary / result.stderr_tail for the reason`);
+    }
     return jsonContent({
         batch_id,
         drafted: total,
-        posted: approve.size,
-        skipped: total - approve.size,
+        posted: actuallyPosted,
+        approved: approve.size,
+        skipped: total - actuallyPosted,
         edited: editedCount,
         result,
         warnings,
@@ -2346,6 +2384,11 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
 }));
 async function main() {
     initSentry();
+    // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
+    // backend so we can troubleshoot/rescue any user scenario (silent stalls,
+    // partial onboarding) without asking them to ship a log file. Best-effort;
+    // disabled with SAPS_LOG_STREAM=0.
+    startLogStreaming();
     // A plugin UPDATE refreshes this server (dist/) but not the materialized
     // pipeline. Re-extract the bundled pipeline.tgz when it's newer than what's on
     // disk, BEFORE serving, so the very first scan uses the shipped pipeline (not
@@ -2396,6 +2439,7 @@ async function main() {
 main().catch(async (err) => {
     console.error("[social-autoposter-mcp] fatal:", err);
     captureError(err, { component: "main" });
+    await flushLogs();
     await flushSentry();
     process.exit(1);
 });

package/mcp/dist/repo.js

@@ -30,6 +30,27 @@ export function repoDir() {
 // "No drafts in batch ...". Default to /tmp to match the script; allow an explicit
 // override for non-standard installs.
 export const TMP_DIR = process.env.SAPS_TMP_DIR || "/tmp";
+let lineSink = null;
+export function setLineSink(fn) {
+    lineSink = fn;
+}
+// Derive a short, stable context label for a spawned command so log lines can
+// be grouped by which script produced them (e.g. "scripts/seed_search_topics.py",
+// "skill/run-twitter-cycle.sh"). Best-effort; never throws.
+function deriveContext(cmd, args) {
+    try {
+        const base = cmd.split("/").pop() || cmd;
+        if (/python/i.test(base) || base === "bash" || base === "sh" || base === "node") {
+            const first = args.find((a) => !a.startsWith("-"));
+            if (first)
+                return first;
+        }
+        return [base, args[0] ?? ""].join(" ").trim();
+    }
+    catch {
+        return cmd;
+    }
+}
 // Spawn a process inside the repo, inheriting the repo env (API base + keys
 // come from the install's environment / .env loaded by the scripts themselves).
 //
@@ -73,6 +94,29 @@ export function run(cmd, args, opts = {}) {
             }
             return buf;
         };
+        // Parallel whole-line splitter that tees to the telemetry sink (if any),
+        // kept separate from the onLine pump so neither path can affect the other.
+        const logCtx = opts.logContext || deriveContext(cmd, args);
+        let sinkOutBuf = "";
+        let sinkErrBuf = "";
+        const sinkPump = (chunk, which, buf) => {
+            const sink = lineSink;
+            if (!sink)
+                return buf;
+            buf += chunk;
+            let nl;
+            while ((nl = buf.indexOf("\n")) !== -1) {
+                const line = buf.slice(0, nl);
+                buf = buf.slice(nl + 1);
+                try {
+                    sink(line, which, logCtx);
+                }
+                catch {
+                    /* the telemetry sink must never break the wrapped command */
+                }
+            }
+            return buf;
+        };
         let timer;
         if (opts.timeoutMs) {
             timer = setTimeout(() => {
@@ -83,11 +127,13 @@ export function run(cmd, args, opts = {}) {
             const s = d.toString();
             stdout += s;
             outBuf = pump(s, "stdout", outBuf);
+            sinkOutBuf = sinkPump(s, "stdout", sinkOutBuf);
         });
         child.stderr.on("data", (d) => {
             const s = d.toString();
             stderr += s;
             errBuf = pump(s, "stderr", errBuf);
+            sinkErrBuf = sinkPump(s, "stderr", sinkErrBuf);
         });
         child.on("close", (code) => {
             if (timer)
@@ -109,6 +155,23 @@ export function run(cmd, args, opts = {}) {
                         /* ignore */
                     }
             }
+            const sink = lineSink;
+            if (sink) {
+                if (sinkOutBuf)
+                    try {
+                        sink(sinkOutBuf, "stdout", logCtx);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                if (sinkErrBuf)
+                    try {
+                        sink(sinkErrBuf, "stderr", logCtx);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+            }
             resolve({ code: code ?? -1, stdout, stderr });
         });
         child.on("error", (err) => {

package/mcp/dist/telemetry.js

@@ -9,7 +9,7 @@
 import * as Sentry from "@sentry/node";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython } from "./repo.js";
+import { repoDir, runPython, setLineSink } from "./repo.js";
 import { VERSION } from "./version.js";
 // Sentry DSN is a client-side identifier (safe to embed, same posture as Fazm's
 // hardcoded Swift DSN). Overridable via env for dev. Empty -> Sentry disabled.
@@ -102,3 +102,129 @@ export async function sendHeartbeat(reason) {
         console.error("[social-autoposter-mcp] heartbeat failed:", err?.message || err);
     }
 }
+// ---- Raw subprocess log streaming ------------------------------------------
+// Tees the verbatim stdout/stderr of every pipeline subprocess (via the
+// repo.ts run() boundary) to the s4l backend, so we can troubleshoot and
+// rescue any user scenario without asking them to ship a log file. Lines are
+// buffered in memory and flushed in small batches under the same X-Installation
+// identity the heartbeat uses. Best-effort: this NEVER throws into the server,
+// never blocks the child's I/O, and drops on overflow rather than growing
+// unbounded. Disable with SAPS_LOG_STREAM=0.
+const LOG_STREAM_ENABLED = process.env.SAPS_LOG_STREAM !== "0";
+const LOG_MAX_LINE_LEN = 8192; // mirror the backend cap
+const LOG_MAX_BUFFER = 1000; // drop oldest beyond this (overflow protection)
+const LOG_FLUSH_BATCH = 100; // flush eagerly once we have this many lines
+const LOG_MAX_PER_POST = 200; // backend accepts 1-200 per request
+const LOG_FLUSH_MS = 3000; // otherwise flush on this cadence
+const logBuffer = [];
+let logDropped = 0; // count of lines dropped on overflow (surfaced periodically)
+let logFlushing = false;
+let logTimer;
+let cachedInstallHeader = null;
+let logStreamingStarted = false;
+async function installHeader() {
+    if (cachedInstallHeader)
+        return cachedInstallHeader;
+    try {
+        const idScript = path.join(repoDir(), "scripts", "identity.py");
+        if (!fs.existsSync(idScript))
+            return null;
+        const res = await runPython("scripts/identity.py", ["header"], { timeoutMs: 10_000 });
+        const header = (res.stdout || "").trim();
+        if (res.code === 0 && header) {
+            cachedInstallHeader = header;
+            return header;
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    return null;
+}
+// Buffer one raw line. Called from the repo.ts line sink, so it must be cheap
+// and total non-throwing.
+export function logLine(stream, line, context) {
+    if (!LOG_STREAM_ENABLED)
+        return;
+    try {
+        logBuffer.push({
+            ts: new Date().toISOString(),
+            stream,
+            line: line.length > LOG_MAX_LINE_LEN ? line.slice(0, LOG_MAX_LINE_LEN) : line,
+            context: context || "",
+        });
+        if (logBuffer.length > LOG_MAX_BUFFER) {
+            // Drop oldest to bound memory; the newest lines are the most useful.
+            logDropped += logBuffer.length - LOG_MAX_BUFFER;
+            logBuffer.splice(0, logBuffer.length - LOG_MAX_BUFFER);
+        }
+        if (logBuffer.length >= LOG_FLUSH_BATCH)
+            void flushLogs();
+    }
+    catch {
+        /* never throw into the run() boundary */
+    }
+}
+export async function flushLogs() {
+    if (!LOG_STREAM_ENABLED)
+        return;
+    if (logFlushing || logBuffer.length === 0)
+        return;
+    logFlushing = true;
+    try {
+        const header = await installHeader();
+        if (!header)
+            return; // runtime not unpacked yet; keep buffering
+        const base = (process.env.AUTOPOSTER_API_BASE || "https://s4l.ai").replace(/\/+$/, "");
+        // Drain in <=200-line POSTs until the buffer empties (or a POST fails).
+        while (logBuffer.length > 0) {
+            const batch = logBuffer.splice(0, LOG_MAX_PER_POST);
+            const lines = batch.map((b) => ({
+                ts: b.ts,
+                stream: b.stream,
+                line: b.line,
+                context: b.context || undefined,
+            }));
+            try {
+                const resp = await fetch(`${base}/api/v1/installations/logs`, {
+                    method: "POST",
+                    headers: { "X-Installation": header, "content-type": "application/json" },
+                    body: JSON.stringify({ lines }),
+                    signal: AbortSignal.timeout(15_000),
+                });
+                if (!resp.ok) {
+                    // Drop this batch (don't re-buffer): a persistent 4xx/5xx would grow
+                    // the buffer unbounded. The raw stream is best-effort.
+                    console.error(`[social-autoposter-mcp] log flush http ${resp.status}`);
+                    break;
+                }
+            }
+            catch (err) {
+                // Network blip: drop this batch, stop draining, try again next tick.
+                console.error("[social-autoposter-mcp] log flush failed:", err?.message || err);
+                break;
+            }
+        }
+        if (logDropped > 0) {
+            console.error(`[social-autoposter-mcp] log stream dropped ${logDropped} line(s) on overflow`);
+            logDropped = 0;
+        }
+    }
+    finally {
+        logFlushing = false;
+    }
+}
+// Register the repo.ts line sink and start the periodic flush. Idempotent.
+export function startLogStreaming() {
+    if (!LOG_STREAM_ENABLED || logStreamingStarted)
+        return;
+    logStreamingStarted = true;
+    try {
+        setLineSink((line, stream, context) => logLine(stream, line, context));
+        logTimer = setInterval(() => void flushLogs(), LOG_FLUSH_MS);
+        logTimer.unref();
+    }
+    catch (err) {
+        console.error("[social-autoposter-mcp] log streaming start failed:", err?.message || err);
+    }
+}

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.83",
-  "installedAt": "2026-06-23T02:17:06.705Z"
+  "version": "1.6.84",
+  "installedAt": "2026-06-23T02:53:37.786Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.83",
+  "version": "1.6.84",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.83",
+  "version": "1.6.84",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.83",
+  "version": "1.6.84",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/engage_github.py

@@ -36,6 +36,16 @@ CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
 REPLY_DB = os.path.join(REPO_DIR, "scripts", "reply_db.py")
 SKILL_FILE = os.path.join(REPO_DIR, "SKILL.md")
 
+# Interpreter every child subprocess must run under. A bare PYTHON resolved
+# to the user's system python, which lacks the pipeline deps that live only in
+# the owned uv runtime — the same fresh-box failure class that broke the Twitter
+# poster (Karol, 2026-06-22). The GitHub rail posts via the REST API (no browser,
+# so no Playwright dep), but its util/DB children still need the owned venv, so
+# pin the interpreter here too. Honor SAPS_PYTHON (set by the launchd plist),
+# else sys.executable; never the literal PYTHON.
+PYTHON = os.environ.get("SAPS_PYTHON") or sys.executable
+os.environ["SAPS_PYTHON"] = PYTHON
+
 # Cap the thread JSON we pass to Claude. Long issues with 100+ comments would
 # otherwise blow the prompt budget. 12k chars is ~3k tokens, enough for most
 # threads while leaving headroom for the rules and output.
@@ -444,7 +454,7 @@ def main():
 
         # Exclusion: author
         if (reply["their_author"] or "").lower() in excluded_authors:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "excluded_author"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "excluded_author"])
             print(f"[engage_github] #{reply['id']} skipped (excluded_author: {reply['their_author']})")
             skipped += 1
             processed += 1
@@ -453,7 +463,7 @@ def main():
         # Parse owner/repo/number from thread_url
         owner, repo, number = parse_issue_url(reply["thread_url"] or "")
         if not owner:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "bad_thread_url"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "bad_thread_url"])
             print(f"[engage_github] #{reply['id']} skipped (bad_thread_url: {reply['thread_url']})")
             skipped += 1
             processed += 1
@@ -462,7 +472,7 @@ def main():
         # Exclusion: repo
         repo_key = f"{owner}/{repo}".lower()
         if repo_key in excluded_repos or owner.lower() in excluded_repos:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "excluded_repo"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "excluded_repo"])
             print(f"[engage_github] #{reply['id']} skipped (excluded_repo: {repo_key})")
             skipped += 1
             processed += 1
@@ -472,7 +482,7 @@ def main():
         print(f"[engage_github] Fetching thread for {owner}/{repo}#{number}")
         thread = fetch_thread(owner, repo, number)
         if "_error" in thread:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]),
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]),
                             f"fetch_error: {thread['_error']}"])
             print(f"[engage_github] #{reply['id']} skipped (fetch_error: {thread['_error'][:100]})")
             skipped += 1
@@ -499,7 +509,7 @@ def main():
         ok, output, usage = run_claude(prompt, timeout=args.per_reply_timeout, session_id=session_id)
         reply_elapsed = time.time() - reply_start
         session_ended_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z")
-        log_args = ["python3", os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
+        log_args = [PYTHON, os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
              "--session-id", session_id, "--script", "engage_github",
              "--started-at", session_started_at, "--ended-at", session_ended_at]
         orch_cost = usage.get("cost_usd")
@@ -514,7 +524,7 @@ def main():
             failed += 1
             consecutive_failures += 1
             # Mark as skipped so the loop advances to the next pending reply
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "claude_error"],
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "claude_error"],
                            capture_output=True)
             print(f"[engage_github] #{reply['id']} CLAUDE FAILED ({reply_elapsed:.0f}s): {output[:200]}")
         else:
@@ -540,7 +550,7 @@ def main():
                     classification = parts[2].strip() if len(parts) > 2 and parts[2].strip() in ("bot", "engagement_loop") else "bot"
                     if handle:
                         bl_cmd = [
-                            "python3", REPLY_DB, "blocklist", "add",
+                            PYTHON, REPLY_DB, "blocklist", "add",
                             "github_issues", handle,
                             "--reason", f"engage_llm judgment: {reason}",
                             "--classification", classification,
@@ -552,7 +562,7 @@ def main():
                             print(f"[engage_github] blocklist add github_issues/{handle} cls={classification}")
                         else:
                             print(f"[engage_github] blocklist add FAILED for {handle}: {bl_res.stderr[:200]}")
-                subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), reason])
+                subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), reason])
                 skipped += 1
                 print(f"[engage_github] #{reply['id']} SKIPPED: {reason} ({reply_elapsed:.0f}s) "
                       f"[${usage['cost_usd']:.4f}]")
@@ -560,14 +570,14 @@ def main():
                 reply_text = (decision.get("text") or "").strip()
                 project = decision.get("project")
                 if not reply_text:
-                    subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "empty_reply_text"])
+                    subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "empty_reply_text"])
                     failed += 1
                     print(f"[engage_github] #{reply['id']} empty reply text, marked skipped")
                 else:
-                    subprocess.run(["python3", REPLY_DB, "processing", str(reply["id"])])
+                    subprocess.run([PYTHON, REPLY_DB, "processing", str(reply["id"])])
                     ok_post, url_or_err = post_comment(owner, repo, number, reply_text)
                     if ok_post:
-                        cmd_args = ["python3", REPLY_DB, "replied", str(reply["id"]), reply_text]
+                        cmd_args = [PYTHON, REPLY_DB, "replied", str(reply["id"]), reply_text]
                         if url_or_err:
                             cmd_args.append(url_or_err)
                         style = decision.get("engagement_style", "")
@@ -578,14 +588,14 @@ def main():
                         subprocess.run(cmd_args)
                         if project:
                             subprocess.run(
-                                ["python3", REPLY_DB, "set_project", str(reply["id"]), project],
+                                [PYTHON, REPLY_DB, "set_project", str(reply["id"]), project],
                                 capture_output=True,
                             )
                         succeeded += 1
                         print(f"[engage_github] #{reply['id']} POSTED ({reply_elapsed:.0f}s) "
                               f"[${usage['cost_usd']:.4f}] -> {url_or_err or '(no url)'}")
                     else:
-                        subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]),
+                        subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]),
                                         f"post_error: {url_or_err}"])
                         failed += 1
                         print(f"[engage_github] #{reply['id']} POST FAILED: {url_or_err}")
@@ -623,7 +633,7 @@ def main():
         f" elapsed={int(total_elapsed)}"
     )
 
-    subprocess.run(["python3", REPLY_DB, "status"])
+    subprocess.run([PYTHON, REPLY_DB, "status"])
 
 
 if __name__ == "__main__":

package/scripts/engage_reddit.py

@@ -33,6 +33,17 @@ CAMPAIGN_BUMP = os.path.join(REPO_DIR, "scripts", "campaign_bump.py")
 REDDIT_MCP_CONFIG = os.path.expanduser("~/.claude/browser-agent-configs/reddit-agent-mcp.json")
 REDDIT_BROWSER_LOCK = os.path.join(REPO_DIR, "scripts", "reddit_browser_lock.py")
 
+# Interpreter every child subprocess must run under. A bare PYTHON resolved
+# to the user's system python, which lacks the pipeline deps (Playwright and
+# friends) that live only in the owned uv runtime — so on a fresh box every
+# reddit_browser.py reply died (the same class as the Karol/Twitter bug,
+# 2026-06-22). Honor the authoritative SAPS_PYTHON pin (set by the launchd
+# plist), else sys.executable (the owned interpreter the MCP launches us under).
+# Never the literal PYTHON: that re-rolls the PATH dice. Re-exported so
+# grandchildren inherit it.
+PYTHON = os.environ.get("SAPS_PYTHON") or sys.executable
+os.environ["SAPS_PYTHON"] = PYTHON
+
 from engagement_styles import (
     REPLY_STYLES as VALID_STYLES,
     get_styles_prompt,
@@ -65,7 +76,7 @@ def _acquire_browser_lease(timeout: int = 600, ttl: int = 90):
     """
     try:
         r = subprocess.run(
-            ["python3", REDDIT_BROWSER_LOCK, "acquire",
+            [PYTHON, REDDIT_BROWSER_LOCK, "acquire",
              "--timeout", str(timeout), "--ttl", str(ttl)],
             capture_output=True, text=True, timeout=timeout + 30,
         )
@@ -84,7 +95,7 @@ def _release_browser_lease() -> None:
     """Release the reddit-browser lease. Idempotent (NOT_HELD is fine)."""
     try:
         subprocess.run(
-            ["python3", REDDIT_BROWSER_LOCK, "release"],
+            [PYTHON, REDDIT_BROWSER_LOCK, "release"],
             capture_output=True, text=True, timeout=10,
         )
     except Exception:
@@ -162,7 +173,7 @@ def bump_campaigns(table, row_id, campaign_ids):
     for cid in campaign_ids:
         try:
             subprocess.run(
-                ["python3", CAMPAIGN_BUMP,
+                [PYTHON, CAMPAIGN_BUMP,
                  "--table", table, "--id", str(row_id), "--campaign-id", str(cid)],
                 capture_output=True, text=True, timeout=15,
             )
@@ -649,11 +660,28 @@ def main():
     config = load_config()
     excluded_authors = config.get("exclusions", {}).get("authors", [])
 
+    # Hard preflight: the reddit rail posts replies via reddit_browser.py, the
+    # only Playwright importer here (Moltbook uses its own poster). If the
+    # resolved interpreter can't import Playwright the owned runtime is missing
+    # or half-provisioned and every reply would die with CDP_ERROR. Fail LOUD
+    # with a distinct signal instead. Moltbook is exempt (no browser path).
+    if args.platform == "reddit":
+        _chk = subprocess.run(
+            [PYTHON, "-c", "import playwright"],
+            capture_output=True, text=True,
+        )
+        if _chk.returncode != 0:
+            print(f"[engage_reddit] FATAL runtime_incomplete: interpreter {PYTHON!r} "
+                  f"cannot import playwright — the owned Python runtime is missing or "
+                  f"unprovisioned. Run the `runtime` install (action:'install') before "
+                  f"engaging. stderr: {(_chk.stderr or '').strip()[:300]}", file=sys.stderr)
+            sys.exit(3)
+
     reset_stuck_processing(args.platform)
 
     try:
         top_report = subprocess.check_output(
-            ["python3", os.path.join(REPO_DIR, "scripts", "top_performers.py"), "--platform", args.platform],
+            [PYTHON, os.path.join(REPO_DIR, "scripts", "top_performers.py"), "--platform", args.platform],
             text=True, stderr=subprocess.DEVNULL, timeout=30,
         )
     except Exception:
@@ -690,7 +718,7 @@ def main():
 
         # Check exclusion before spawning Claude
         if reply["their_author"].lower() in {a.lower() for a in excluded_authors}:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "excluded_author"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "excluded_author"])
             print(f"[engage_reddit] #{reply['id']} skipped (excluded_author: {reply['their_author']})")
             skipped += 1
             skip_reasons["excluded_author"] += 1
@@ -711,7 +739,7 @@ def main():
                 f":interest={same_post_disengage['interest_level']}"
                 f":status={same_post_disengage['conversation_status']}"
             )
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), reason])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), reason])
             print(f"[engage_reddit] #{reply['id']} skipped ({reason})")
             skipped += 1
             skip_reasons["cross_pipeline_disengage"] += 1
@@ -775,7 +803,7 @@ def main():
                 # reset_stuck_processing's 2h cap brings it back to pending.
                 try:
                     subprocess.run(
-                        ["python3", REPLY_DB, "processing", str(reply["id"])],
+                        [PYTHON, REPLY_DB, "processing", str(reply["id"])],
                         capture_output=True, timeout=10,
                     )
                 except Exception:
@@ -796,7 +824,7 @@ def main():
         ok, output, usage = run_claude(prompt, timeout=args.per_reply_timeout, session_id=session_id)
         reply_elapsed = time.time() - reply_start
         session_ended_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z")
-        log_args = ["python3", os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
+        log_args = [PYTHON, os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
              "--session-id", session_id, "--script", "engage_reddit",
              "--started-at", session_started_at, "--ended-at", session_ended_at]
         orch_cost = usage.get("cost_usd")
@@ -853,7 +881,7 @@ def main():
             reason_key = "timeout" if output == "TIMEOUT" else "claude_failed"
             skip_reasons[reason_key] += 1
             try:
-                subprocess.run(["python3", REPLY_DB, "processing", str(reply["id"])],
+                subprocess.run([PYTHON, REPLY_DB, "processing", str(reply["id"])],
                                capture_output=True, timeout=10)
             except Exception:
                 pass
@@ -877,14 +905,14 @@ def main():
                 # Same loop-prevention as the not-ok branch: mark processing
                 # so the next iteration moves to a different pending row.
                 try:
-                    subprocess.run(["python3", REPLY_DB, "processing", str(reply["id"])],
+                    subprocess.run([PYTHON, REPLY_DB, "processing", str(reply["id"])],
                                    capture_output=True, timeout=10)
                 except Exception:
                     pass
                 print(f"[engage_reddit] #{reply['id']} BAD OUTPUT ({reply_elapsed:.0f}s): {output[:200]}")
             elif decision.get("action") == "skip":
                 reason = decision.get("reason", "unknown")
-                subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), reason])
+                subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), reason])
                 skipped += 1
                 skip_reasons[f"llm:{reason[:48]}"] += 1
                 print(f"[engage_reddit] #{reply['id']} skipped: {reason} ({reply_elapsed:.0f}s) "
@@ -924,7 +952,7 @@ def main():
                     # entire run on any non-zero exit so the row stays untouched and
                     # no platform side-effect occurs.
                     proc_result = subprocess.run(
-                        ["python3", REPLY_DB, "processing", str(reply["id"])],
+                        [PYTHON, REPLY_DB, "processing", str(reply["id"])],
                         capture_output=True,
                     )
                     if proc_result.returncode != 0:
@@ -1012,7 +1040,7 @@ def main():
                             for attempt in range(3):
                                 try:
                                     out = subprocess.check_output(
-                                        ["python3", os.path.join(REPO_DIR, "scripts", "moltbook_post.py"),
+                                        [PYTHON, os.path.join(REPO_DIR, "scripts", "moltbook_post.py"),
                                          "comment",
                                          "--post-id", post_uuid,
                                          "--parent-id", parent_id,
@@ -1034,7 +1062,7 @@ def main():
                         for attempt in range(3):
                             try:
                                 cdp_out = subprocess.check_output(
-                                    ["python3", os.path.join(REPO_DIR, "scripts", "reddit_browser.py"),
+                                    [PYTHON, os.path.join(REPO_DIR, "scripts", "reddit_browser.py"),
                                      "reply", reply["their_comment_url"], reply_text],
                                     text=True, timeout=120, stderr=subprocess.DEVNULL,
                                 )
@@ -1051,7 +1079,7 @@ def main():
                         if post_result.get("already_replied"):
                             existing = post_result.get("existing_text", "")
                             existing_url = post_result.get("existing_url", "")
-                            cmd_args = ["python3", REPLY_DB, "replied", str(reply["id"]), existing]
+                            cmd_args = [PYTHON, REPLY_DB, "replied", str(reply["id"]), existing]
                             if existing_url:
                                 cmd_args.append(existing_url)
                             patch_replied_with_retry(cmd_args, reply["id"])
@@ -1070,7 +1098,7 @@ def main():
                         # 'processing' (which 2h reset_stuck_processing would flip
                         # back to 'pending' and cause a duplicate post).
                         reply_url = post_result.get("url", "")
-                        cmd_args = ["python3", REPLY_DB, "replied", str(reply["id"]), reply_text, reply_url]
+                        cmd_args = [PYTHON, REPLY_DB, "replied", str(reply["id"]), reply_text, reply_url]
                         if engagement_style:
                             cmd_args.append(engagement_style)
                         patch_replied_with_retry(cmd_args, reply["id"])
@@ -1097,7 +1125,7 @@ def main():
                         if reply["platform"] == "reddit":
                             try:
                                 subprocess.run(
-                                    ["python3",
+                                    [PYTHON,
                                      os.path.join(REPO_DIR, "scripts", "dm_conversation.py"),
                                      "ensure-dm",
                                      "--platform", "reddit",
@@ -1114,7 +1142,7 @@ def main():
                         # mutations.
                         if project:
                             subprocess.run(
-                                ["python3", REPLY_DB, "set_project",
+                                [PYTHON, REPLY_DB, "set_project",
                                  str(reply["id"]), project],
                                 capture_output=True,
                             )
@@ -1123,7 +1151,7 @@ def main():
                               f"[${usage['cost_usd']:.4f}]")
                     else:
                         err = post_result.get("error", "unknown") if post_result else "no_response"
-                        subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), f"CDP_ERROR: {err}"])
+                        subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), f"CDP_ERROR: {err}"])
                         skip_reasons[f"cdp_error:{(err or 'unknown')[:32]}"] += 1
                         failed += 1
                         print(f"[engage_reddit] #{reply['id']} CDP FAILED: {err} ({reply_elapsed:.0f}s)")
@@ -1200,7 +1228,7 @@ def main():
 
     # Print final status (per-platform counts) via reply_db.py status helper,
     # which now reads /api/v1/replies/counts under the hood.
-    subprocess.run(["python3", REPLY_DB, "status", args.platform])
+    subprocess.run([PYTHON, REPLY_DB, "status", args.platform])
 
 
 if __name__ == "__main__":

package/scripts/post_github.py

@@ -88,7 +88,7 @@ def _emit_run_summary_oneshot():
     try:
         subprocess.run(
             [
-                "python3", os.path.join(os.path.dirname(os.path.abspath(__file__)), "log_run.py"),
+                PYTHON, os.path.join(os.path.dirname(os.path.abspath(__file__)), "log_run.py"),
                 "--script", "post_github",
                 "--posted", str(_RUN_STATE["posted"]),
                 "--skipped", str(_RUN_STATE["skipped"]),
@@ -143,6 +143,16 @@ SKILL_FILE = os.path.join(REPO_DIR, "SKILL.md")
 GITHUB_TOOLS = os.path.join(SCRIPTS, "github_tools.py")
 RUN_CLAUDE = os.path.join(SCRIPTS, "run_claude.sh")
 
+# Interpreter every child subprocess must run under. A bare PYTHON resolved
+# to the user's system python, which lacks the pipeline deps that live only in
+# the owned uv runtime — the same fresh-box failure class that broke the Twitter
+# poster (Karol, 2026-06-22). The GitHub rail posts via the REST API (no browser,
+# so no Playwright dep), but its util/DB children still need the owned venv, so
+# pin the interpreter here too. Honor SAPS_PYTHON (set by the launchd plist),
+# else sys.executable; never the literal PYTHON.
+PYTHON = os.environ.get("SAPS_PYTHON") or sys.executable
+os.environ["SAPS_PYTHON"] = PYTHON
+
 # Momentum tunables. Edit here, not at call sites.
 DELTA_THRESHOLD = 1.0
 HIGH_DELTA_BUMP = 3
@@ -178,7 +188,7 @@ def load_config():
 def get_top_performers(project_name, platform="github"):
     try:
         result = subprocess.run(
-            ["python3", os.path.join(SCRIPTS, "top_performers.py"),
+            [PYTHON, os.path.join(SCRIPTS, "top_performers.py"),
              "--platform", platform, "--project", project_name],
             capture_output=True, text=True, timeout=15,
         )
@@ -194,7 +204,7 @@ def get_top_search_topics(project_name, platform="github", limit=8, window_days=
     Empty string if no data yet. Mirrors post_reddit.get_top_search_topics."""
     try:
         result = subprocess.run(
-            ["python3", os.path.join(SCRIPTS, "top_search_topics.py"),
+            [PYTHON, os.path.join(SCRIPTS, "top_search_topics.py"),
              "--project", project_name, "--platform", platform,
              "--window-days", str(window_days), "--limit", str(limit)],
             capture_output=True, text=True, timeout=15,
@@ -287,7 +297,7 @@ def build_content_angle(project, config):
 def gh_search(query, limit=SEARCH_PER_TOPIC):
     try:
         out = subprocess.check_output(
-            ["python3", GITHUB_TOOLS, "search", query, "--limit", str(limit)],
+            [PYTHON, GITHUB_TOOLS, "search", query, "--limit", str(limit)],
             text=True, timeout=45,
         )
         items = json.loads(out)
@@ -727,7 +737,7 @@ def log_post(thread_url, our_url, text, project_name, thread_author, thread_titl
     curated landing-page hits from generic homepage links.
     """
     try:
-        cmd = ["python3", GITHUB_TOOLS, "log-post",
+        cmd = [PYTHON, GITHUB_TOOLS, "log-post",
                thread_url, our_url or "", text, project_name,
                thread_author or "unknown", thread_title or "",
                "--account", github_username]
@@ -1018,7 +1028,7 @@ def main():
         log(f"Claude FAILED: {output[:300]}")
         _RUN_STATE["failed"] = 1
         subprocess.run([
-            "python3", os.path.join(SCRIPTS, "log_run.py"),
+            PYTHON, os.path.join(SCRIPTS, "log_run.py"),
             "--script", "post_github",
             "--posted", "0", "--skipped", "0", "--failed", "1",
             "--cost", f"{usage['cost_usd']:.4f}",
@@ -1286,7 +1296,7 @@ def main():
     _RUN_STATE["skipped"] = len(skipped)
     _RUN_STATE["cost"] = usage["cost_usd"]
     subprocess.run([
-        "python3", os.path.join(SCRIPTS, "log_run.py"),
+        PYTHON, os.path.join(SCRIPTS, "log_run.py"),
         "--script", "post_github",
         "--posted", str(posted),
         "--skipped", str(len(skipped)),

package/scripts/sentry_init.py

@@ -90,6 +90,30 @@ def capture_exception(err, tags=None) -> None:
         return
 
 
+def capture_message(message, level="error", tags=None) -> None:
+    """Report a handled, non-exception condition to Sentry (e.g. a post that
+    failed gracefully and returned a reason instead of raising). The global
+    excepthook only catches UNHANDLED exceptions, so operational failures that
+    are caught + reported as a result count would otherwise never reach Sentry.
+    Safe to call even if init() never ran or sentry-sdk is missing (no-op)."""
+    if not _initialized:
+        return
+    try:
+        import sentry_sdk
+    except Exception:
+        return
+    try:
+        if tags:
+            with sentry_sdk.push_scope() as scope:
+                for k, v in tags.items():
+                    scope.set_tag(str(k), str(v))
+                sentry_sdk.capture_message(str(message), level=level)
+        else:
+            sentry_sdk.capture_message(str(message), level=level)
+    except Exception:
+        return
+
+
 def flush(timeout: float = 2.0) -> None:
     """Block until queued events are sent (best-effort). Call before a short-lived
     or about-to-crash process exits so a just-captured event isn't dropped on

package/scripts/twitter_post_plan.py

@@ -97,6 +97,18 @@ try:
 except Exception:
     validate_or_register = None  # type: ignore[assignment]
 
+# Reasons that signal an OPERATIONAL post failure (browser/session/API broke),
+# as opposed to a content-judgment skip ("off-topic ..."). Some of these are
+# bucketed as `skipped` in the run summary (e.g. reply_box_not_found) so they do
+# not pollute the dashboard "failed" pill, but for remote observability they ARE
+# the signal that a user "approved but couldn't post" — so we capture them to
+# Sentry regardless of which summary bucket they land in.
+MACHINE_FAIL_REASONS = {
+    "no_reply_json", "reply_failed", "timeout", "unknown", "exception",
+    "log_post_no_id", "reply_box_not_found", "rate_limited", "tweet_not_found",
+    "no_reply_url_captured", "empty_reply_text", "session_invalid",
+}
+
 REPLY_URL_RE = re.compile(r"^https?://(?:x\.com|twitter\.com)/[^/]+/status/\d+")
 TOP_LEVEL_OBJ_RE = re.compile(r"\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}", re.DOTALL)
 
@@ -1035,6 +1047,37 @@ def main() -> int:
         "failure_reasons": ",".join(f"{k}:{v}" for k, v in fail_reasons.items()),
         "skip_reasons":    ",".join(f"{k}:{v}" for k, v in skip_reasons.items()),
     }
+    # Remote observability: a handled post failure returns a reason instead of
+    # raising, so the global Sentry excepthook never sees it. On customer .mcpb
+    # installs the cycle log lives only on their machine, so an explicit capture
+    # here is the ONLY channel that surfaces "approved but didn't post" to us.
+    # Fires only on operational/machine reasons (content-judgment skips like
+    # "off-topic ..." are excluded), so it never alerts on a healthy dedup cycle.
+    try:
+        machine = dict(fail_reasons)
+        for _k, _v in skip_reasons.items():
+            if _k in MACHINE_FAIL_REASONS:
+                machine[_k] = machine.get(_k, 0) + _v
+        if machine:
+            import sentry_init
+            _top = max(machine, key=machine.get)
+            sentry_init.capture_message(
+                "twitter post pipeline issues: "
+                f"posted={posted} failed={failed} attempted={len(candidates)} "
+                f"reasons={','.join(f'{k}:{v}' for k, v in machine.items())}",
+                level=("error" if (failed > 0 or posted == 0) else "warning"),
+                tags={
+                    "component": "twitter_post",
+                    "posted": str(posted),
+                    "failed": str(failed),
+                    "attempted": str(len(candidates)),
+                    "top_reason": _top,
+                },
+            )
+            sentry_init.flush(2.0)
+    except Exception:
+        pass
+
     # Persist a durable audit line so "did it post, and how many — and where?" is
     # answerable after the fact. The shell harvests the json on stdout, but when
     # the menu bar launches this directly it captures-then-discards stdout, leaving