social-autoposter 1.6.83 → 1.6.85

package/mcp/dist/index.js

@@ -22,7 +22,7 @@ import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, ensurePipelineCurrent, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, captureError, flushSentry } from "./telemetry.js";
+import { initSentry, sendHeartbeat, captureError, flushSentry, startLogStreaming, flushLogs } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -576,10 +576,20 @@ async function postApproved(batchId, plan) {
     catch {
         /* keep raw */
     }
-    // On a successful run, mark the posted candidates in the ORIGINAL plan so the
-    // other review surface (chat vs menu-bar pop-ups) skips them — cross-surface
-    // de-dup. Best-effort; the pipeline's own already-posted check is the backstop.
-    if (res.code === 0) {
+    // Real posted count from the pipeline summary — NOT the approved count. A run
+    // can exit 0 yet post nothing (every reply hit reply_box_not_found, etc.), so
+    // trusting approved.length here reported phantom successes ("posted: 1" when 0
+    // landed). Fall back to approved.length only when the summary is unparseable
+    // AND the process exited clean.
+    const summObj = (summary && typeof summary === "object") ? summary : null;
+    const realPosted = summObj && typeof summObj.posted === "number"
+        ? summObj.posted
+        : res.code === 0 && !summObj
+            ? approved.length
+            : 0;
+    // Mark only candidates that ACTUALLY posted (cross-surface de-dup). When the
+    // summary is missing but the run exited clean, fall back to marking all.
+    if (realPosted > 0 || (res.code === 0 && !summObj)) {
         for (const c of approved)
             c.posted = true;
         try {
@@ -589,8 +599,27 @@ async function postApproved(batchId, plan) {
             /* best effort */
         }
     }
+    // Post failures are HANDLED in the pipeline (it returns a count, never throws),
+    // so they never reach Sentry on their own. Capture an explicit event whenever
+    // the run exited non-zero OR fewer drafts posted than were approved. This is
+    // the only telemetry channel that reaches a customer .mcpb install (their cycle
+    // log lives on their machine). install_id/hostname are auto-tagged.
+    if (res.code !== 0 || realPosted < approved.length) {
+        captureError(new Error(`post_drafts: ${realPosted}/${approved.length} posted (exit=${res.code})`), {
+            component: "post",
+            exit_code: String(res.code),
+            attempted: String(approved.length),
+            posted: String(realPosted),
+            failure_reasons: String(summObj?.failure_reasons || ""),
+            skip_reasons: String(summObj?.skip_reasons || ""),
+            stderr_tail: res.stderr.split("\n").slice(-5).join(" | ").slice(0, 500),
+        });
+        void flushSentry(2000);
+    }
+    void flushLogs();
     return {
         attempted: approved.length,
+        posted: realPosted,
         exit_code: res.code,
         summary,
         stderr_tail: res.stderr.split("\n").slice(-8).join("\n"),
@@ -1210,11 +1239,20 @@ tool("post_drafts", {
         });
     }
     const result = await postApproved(batch_id, plan);
+    // Report the REAL posted count from the pipeline, not the approved count.
+    // A run can approve N yet land 0 (browser/session failure); reporting
+    // approve.size here told the agent "posted: N" on a total failure.
+    const actuallyPosted = typeof result.posted === "number" ? result.posted : approve.size;
+    if (actuallyPosted < approve.size) {
+        warnings.push(`only ${actuallyPosted}/${approve.size} actually posted (exit=${result.exit_code}); ` +
+            `see result.summary / result.stderr_tail for the reason`);
+    }
     return jsonContent({
         batch_id,
         drafted: total,
-        posted: approve.size,
-        skipped: total - approve.size,
+        posted: actuallyPosted,
+        approved: approve.size,
+        skipped: total - actuallyPosted,
         edited: editedCount,
         result,
         warnings,
@@ -2346,6 +2384,11 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
 }));
 async function main() {
     initSentry();
+    // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
+    // backend so we can troubleshoot/rescue any user scenario (silent stalls,
+    // partial onboarding) without asking them to ship a log file. Best-effort;
+    // disabled with SAPS_LOG_STREAM=0.
+    startLogStreaming();
     // A plugin UPDATE refreshes this server (dist/) but not the materialized
     // pipeline. Re-extract the bundled pipeline.tgz when it's newer than what's on
     // disk, BEFORE serving, so the very first scan uses the shipped pipeline (not
@@ -2396,6 +2439,7 @@ async function main() {
 main().catch(async (err) => {
     console.error("[social-autoposter-mcp] fatal:", err);
     captureError(err, { component: "main" });
+    await flushLogs();
     await flushSentry();
     process.exit(1);
 });

package/mcp/dist/repo.js

@@ -30,6 +30,27 @@ export function repoDir() {
 // "No drafts in batch ...". Default to /tmp to match the script; allow an explicit
 // override for non-standard installs.
 export const TMP_DIR = process.env.SAPS_TMP_DIR || "/tmp";
+let lineSink = null;
+export function setLineSink(fn) {
+    lineSink = fn;
+}
+// Derive a short, stable context label for a spawned command so log lines can
+// be grouped by which script produced them (e.g. "scripts/seed_search_topics.py",
+// "skill/run-twitter-cycle.sh"). Best-effort; never throws.
+function deriveContext(cmd, args) {
+    try {
+        const base = cmd.split("/").pop() || cmd;
+        if (/python/i.test(base) || base === "bash" || base === "sh" || base === "node") {
+            const first = args.find((a) => !a.startsWith("-"));
+            if (first)
+                return first;
+        }
+        return [base, args[0] ?? ""].join(" ").trim();
+    }
+    catch {
+        return cmd;
+    }
+}
 // Spawn a process inside the repo, inheriting the repo env (API base + keys
 // come from the install's environment / .env loaded by the scripts themselves).
 //
@@ -73,6 +94,29 @@ export function run(cmd, args, opts = {}) {
             }
             return buf;
         };
+        // Parallel whole-line splitter that tees to the telemetry sink (if any),
+        // kept separate from the onLine pump so neither path can affect the other.
+        const logCtx = opts.logContext || deriveContext(cmd, args);
+        let sinkOutBuf = "";
+        let sinkErrBuf = "";
+        const sinkPump = (chunk, which, buf) => {
+            const sink = lineSink;
+            if (!sink)
+                return buf;
+            buf += chunk;
+            let nl;
+            while ((nl = buf.indexOf("\n")) !== -1) {
+                const line = buf.slice(0, nl);
+                buf = buf.slice(nl + 1);
+                try {
+                    sink(line, which, logCtx);
+                }
+                catch {
+                    /* the telemetry sink must never break the wrapped command */
+                }
+            }
+            return buf;
+        };
         let timer;
         if (opts.timeoutMs) {
             timer = setTimeout(() => {
@@ -83,11 +127,13 @@ export function run(cmd, args, opts = {}) {
             const s = d.toString();
             stdout += s;
             outBuf = pump(s, "stdout", outBuf);
+            sinkOutBuf = sinkPump(s, "stdout", sinkOutBuf);
         });
         child.stderr.on("data", (d) => {
             const s = d.toString();
             stderr += s;
             errBuf = pump(s, "stderr", errBuf);
+            sinkErrBuf = sinkPump(s, "stderr", sinkErrBuf);
         });
         child.on("close", (code) => {
             if (timer)
@@ -109,6 +155,23 @@ export function run(cmd, args, opts = {}) {
                         /* ignore */
                     }
             }
+            const sink = lineSink;
+            if (sink) {
+                if (sinkOutBuf)
+                    try {
+                        sink(sinkOutBuf, "stdout", logCtx);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                if (sinkErrBuf)
+                    try {
+                        sink(sinkErrBuf, "stderr", logCtx);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+            }
             resolve({ code: code ?? -1, stdout, stderr });
         });
         child.on("error", (err) => {

package/mcp/dist/telemetry.js

@@ -9,7 +9,7 @@
 import * as Sentry from "@sentry/node";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython } from "./repo.js";
+import { repoDir, runPython, setLineSink } from "./repo.js";
 import { VERSION } from "./version.js";
 // Sentry DSN is a client-side identifier (safe to embed, same posture as Fazm's
 // hardcoded Swift DSN). Overridable via env for dev. Empty -> Sentry disabled.
@@ -102,3 +102,129 @@ export async function sendHeartbeat(reason) {
         console.error("[social-autoposter-mcp] heartbeat failed:", err?.message || err);
     }
 }
+// ---- Raw subprocess log streaming ------------------------------------------
+// Tees the verbatim stdout/stderr of every pipeline subprocess (via the
+// repo.ts run() boundary) to the s4l backend, so we can troubleshoot and
+// rescue any user scenario without asking them to ship a log file. Lines are
+// buffered in memory and flushed in small batches under the same X-Installation
+// identity the heartbeat uses. Best-effort: this NEVER throws into the server,
+// never blocks the child's I/O, and drops on overflow rather than growing
+// unbounded. Disable with SAPS_LOG_STREAM=0.
+const LOG_STREAM_ENABLED = process.env.SAPS_LOG_STREAM !== "0";
+const LOG_MAX_LINE_LEN = 8192; // mirror the backend cap
+const LOG_MAX_BUFFER = 1000; // drop oldest beyond this (overflow protection)
+const LOG_FLUSH_BATCH = 100; // flush eagerly once we have this many lines
+const LOG_MAX_PER_POST = 200; // backend accepts 1-200 per request
+const LOG_FLUSH_MS = 3000; // otherwise flush on this cadence
+const logBuffer = [];
+let logDropped = 0; // count of lines dropped on overflow (surfaced periodically)
+let logFlushing = false;
+let logTimer;
+let cachedInstallHeader = null;
+let logStreamingStarted = false;
+async function installHeader() {
+    if (cachedInstallHeader)
+        return cachedInstallHeader;
+    try {
+        const idScript = path.join(repoDir(), "scripts", "identity.py");
+        if (!fs.existsSync(idScript))
+            return null;
+        const res = await runPython("scripts/identity.py", ["header"], { timeoutMs: 10_000 });
+        const header = (res.stdout || "").trim();
+        if (res.code === 0 && header) {
+            cachedInstallHeader = header;
+            return header;
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    return null;
+}
+// Buffer one raw line. Called from the repo.ts line sink, so it must be cheap
+// and total non-throwing.
+export function logLine(stream, line, context) {
+    if (!LOG_STREAM_ENABLED)
+        return;
+    try {
+        logBuffer.push({
+            ts: new Date().toISOString(),
+            stream,
+            line: line.length > LOG_MAX_LINE_LEN ? line.slice(0, LOG_MAX_LINE_LEN) : line,
+            context: context || "",
+        });
+        if (logBuffer.length > LOG_MAX_BUFFER) {
+            // Drop oldest to bound memory; the newest lines are the most useful.
+            logDropped += logBuffer.length - LOG_MAX_BUFFER;
+            logBuffer.splice(0, logBuffer.length - LOG_MAX_BUFFER);
+        }
+        if (logBuffer.length >= LOG_FLUSH_BATCH)
+            void flushLogs();
+    }
+    catch {
+        /* never throw into the run() boundary */
+    }
+}
+export async function flushLogs() {
+    if (!LOG_STREAM_ENABLED)
+        return;
+    if (logFlushing || logBuffer.length === 0)
+        return;
+    logFlushing = true;
+    try {
+        const header = await installHeader();
+        if (!header)
+            return; // runtime not unpacked yet; keep buffering
+        const base = (process.env.AUTOPOSTER_API_BASE || "https://s4l.ai").replace(/\/+$/, "");
+        // Drain in <=200-line POSTs until the buffer empties (or a POST fails).
+        while (logBuffer.length > 0) {
+            const batch = logBuffer.splice(0, LOG_MAX_PER_POST);
+            const lines = batch.map((b) => ({
+                ts: b.ts,
+                stream: b.stream,
+                line: b.line,
+                context: b.context || undefined,
+            }));
+            try {
+                const resp = await fetch(`${base}/api/v1/installations/logs`, {
+                    method: "POST",
+                    headers: { "X-Installation": header, "content-type": "application/json" },
+                    body: JSON.stringify({ lines }),
+                    signal: AbortSignal.timeout(15_000),
+                });
+                if (!resp.ok) {
+                    // Drop this batch (don't re-buffer): a persistent 4xx/5xx would grow
+                    // the buffer unbounded. The raw stream is best-effort.
+                    console.error(`[social-autoposter-mcp] log flush http ${resp.status}`);
+                    break;
+                }
+            }
+            catch (err) {
+                // Network blip: drop this batch, stop draining, try again next tick.
+                console.error("[social-autoposter-mcp] log flush failed:", err?.message || err);
+                break;
+            }
+        }
+        if (logDropped > 0) {
+            console.error(`[social-autoposter-mcp] log stream dropped ${logDropped} line(s) on overflow`);
+            logDropped = 0;
+        }
+    }
+    finally {
+        logFlushing = false;
+    }
+}
+// Register the repo.ts line sink and start the periodic flush. Idempotent.
+export function startLogStreaming() {
+    if (!LOG_STREAM_ENABLED || logStreamingStarted)
+        return;
+    logStreamingStarted = true;
+    try {
+        setLineSink((line, stream, context) => logLine(stream, line, context));
+        logTimer = setInterval(() => void flushLogs(), LOG_FLUSH_MS);
+        logTimer.unref();
+    }
+    catch (err) {
+        console.error("[social-autoposter-mcp] log streaming start failed:", err?.message || err);
+    }
+}

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.83",
-  "installedAt": "2026-06-23T02:17:06.705Z"
+  "version": "1.6.84",
+  "installedAt": "2026-06-23T02:53:37.786Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.83",
+  "version": "1.6.84",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.83",
+  "version": "1.6.84",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.83",
+  "version": "1.6.85",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/_lock_preempt_test.py

@@ -0,0 +1,60 @@
+import json, os, sys, time, subprocess, signal
+sys.path.insert(0, os.path.join(os.path.dirname(__file__)))
+
+LOCK = os.path.expanduser("~/.claude/twitter-browser-lock.json")
+os.makedirs(os.path.dirname(LOCK), exist_ok=True)
+
+def write_lock(pid, role):
+    with open(LOCK, "w") as f:
+        json.dump({"session_id": f"python:{pid}", "timestamp": int(time.time()), "role": role}, f)
+
+def clean():
+    try: os.remove(LOCK)
+    except OSError: pass
+
+# ---- TEST 1: poster preempts a LIVE scan holder ----
+clean()
+victim = subprocess.Popen(["sleep", "120"])
+write_lock(victim.pid, "scan")
+os.environ["SAPS_LOCK_ROLE"] = "post"
+import importlib, twitter_browser
+importlib.reload(twitter_browser)
+t0 = time.time()
+twitter_browser._acquire_browser_lock()
+dt = time.time() - t0
+held = json.load(open(LOCK))
+victim_alive = victim.poll() is None
+print(f"TEST1 poster-preempts-scan: took={dt:.1f}s holder_now={held['session_id']} role={held.get('role')} victim_alive={victim_alive}")
+assert held["session_id"] == f"python:{os.getpid()}", "poster should hold lock"
+assert held.get("role") == "post"
+assert not victim_alive, "scan victim should be killed"
+assert dt < 10, "should preempt fast, not wait 45s"
+if victim.poll() is None: victim.kill()
+print("TEST1 PASS")
+
+# ---- TEST 2: scanner does NOT preempt a live POST holder (waits then gives up) ----
+clean()
+poster = subprocess.Popen(["sleep", "120"])
+write_lock(poster.pid, "post")
+os.environ["SAPS_LOCK_ROLE"] = "scan"
+twitter_browser.LOCK_WAIT_MAX = 4  # shorten the give-up window for the test
+twitter_browser.LOCK_ROLE = "scan"
+twitter_browser._LOCK_SESSION_ID = f"python:{os.getpid()}"
+twitter_browser._LOCK_INHERITED = False
+import io, contextlib
+t0 = time.time()
+rc = None
+try:
+    twitter_browser._acquire_browser_lock()
+    rc = "acquired"
+except SystemExit as e:
+    rc = f"exit:{e.code}"
+dt = time.time() - t0
+poster_alive = poster.poll() is None
+print(f"TEST2 scanner-vs-post: result={rc} took={dt:.1f}s poster_alive={poster_alive}")
+assert rc == "exit:1", "scanner must NOT take a live post holder; should give up"
+assert poster_alive, "scanner must NOT kill the poster"
+if poster.poll() is None: poster.kill()
+print("TEST2 PASS")
+clean()
+print("ALL PASS")

package/scripts/engage_github.py

@@ -36,6 +36,16 @@ CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
 REPLY_DB = os.path.join(REPO_DIR, "scripts", "reply_db.py")
 SKILL_FILE = os.path.join(REPO_DIR, "SKILL.md")
 
+# Interpreter every child subprocess must run under. A bare PYTHON resolved
+# to the user's system python, which lacks the pipeline deps that live only in
+# the owned uv runtime — the same fresh-box failure class that broke the Twitter
+# poster (Karol, 2026-06-22). The GitHub rail posts via the REST API (no browser,
+# so no Playwright dep), but its util/DB children still need the owned venv, so
+# pin the interpreter here too. Honor SAPS_PYTHON (set by the launchd plist),
+# else sys.executable; never the literal PYTHON.
+PYTHON = os.environ.get("SAPS_PYTHON") or sys.executable
+os.environ["SAPS_PYTHON"] = PYTHON
+
 # Cap the thread JSON we pass to Claude. Long issues with 100+ comments would
 # otherwise blow the prompt budget. 12k chars is ~3k tokens, enough for most
 # threads while leaving headroom for the rules and output.
@@ -444,7 +454,7 @@ def main():
 
         # Exclusion: author
         if (reply["their_author"] or "").lower() in excluded_authors:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "excluded_author"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "excluded_author"])
             print(f"[engage_github] #{reply['id']} skipped (excluded_author: {reply['their_author']})")
             skipped += 1
             processed += 1
@@ -453,7 +463,7 @@ def main():
         # Parse owner/repo/number from thread_url
         owner, repo, number = parse_issue_url(reply["thread_url"] or "")
         if not owner:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "bad_thread_url"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "bad_thread_url"])
             print(f"[engage_github] #{reply['id']} skipped (bad_thread_url: {reply['thread_url']})")
             skipped += 1
             processed += 1
@@ -462,7 +472,7 @@ def main():
         # Exclusion: repo
         repo_key = f"{owner}/{repo}".lower()
         if repo_key in excluded_repos or owner.lower() in excluded_repos:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "excluded_repo"])
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "excluded_repo"])
             print(f"[engage_github] #{reply['id']} skipped (excluded_repo: {repo_key})")
             skipped += 1
             processed += 1
@@ -472,7 +482,7 @@ def main():
         print(f"[engage_github] Fetching thread for {owner}/{repo}#{number}")
         thread = fetch_thread(owner, repo, number)
         if "_error" in thread:
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]),
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]),
                             f"fetch_error: {thread['_error']}"])
             print(f"[engage_github] #{reply['id']} skipped (fetch_error: {thread['_error'][:100]})")
             skipped += 1
@@ -499,7 +509,7 @@ def main():
         ok, output, usage = run_claude(prompt, timeout=args.per_reply_timeout, session_id=session_id)
         reply_elapsed = time.time() - reply_start
         session_ended_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z")
-        log_args = ["python3", os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
+        log_args = [PYTHON, os.path.join(REPO_DIR, "scripts", "log_claude_session.py"),
              "--session-id", session_id, "--script", "engage_github",
              "--started-at", session_started_at, "--ended-at", session_ended_at]
         orch_cost = usage.get("cost_usd")
@@ -514,7 +524,7 @@ def main():
             failed += 1
             consecutive_failures += 1
             # Mark as skipped so the loop advances to the next pending reply
-            subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "claude_error"],
+            subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "claude_error"],
                            capture_output=True)
             print(f"[engage_github] #{reply['id']} CLAUDE FAILED ({reply_elapsed:.0f}s): {output[:200]}")
         else:
@@ -540,7 +550,7 @@ def main():
                     classification = parts[2].strip() if len(parts) > 2 and parts[2].strip() in ("bot", "engagement_loop") else "bot"
                     if handle:
                         bl_cmd = [
-                            "python3", REPLY_DB, "blocklist", "add",
+                            PYTHON, REPLY_DB, "blocklist", "add",
                             "github_issues", handle,
                             "--reason", f"engage_llm judgment: {reason}",
                             "--classification", classification,
@@ -552,7 +562,7 @@ def main():
                             print(f"[engage_github] blocklist add github_issues/{handle} cls={classification}")
                         else:
                             print(f"[engage_github] blocklist add FAILED for {handle}: {bl_res.stderr[:200]}")
-                subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), reason])
+                subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), reason])
                 skipped += 1
                 print(f"[engage_github] #{reply['id']} SKIPPED: {reason} ({reply_elapsed:.0f}s) "
                       f"[${usage['cost_usd']:.4f}]")
@@ -560,14 +570,14 @@ def main():
                 reply_text = (decision.get("text") or "").strip()
                 project = decision.get("project")
                 if not reply_text:
-                    subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]), "empty_reply_text"])
+                    subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]), "empty_reply_text"])
                     failed += 1
                     print(f"[engage_github] #{reply['id']} empty reply text, marked skipped")
                 else:
-                    subprocess.run(["python3", REPLY_DB, "processing", str(reply["id"])])
+                    subprocess.run([PYTHON, REPLY_DB, "processing", str(reply["id"])])
                     ok_post, url_or_err = post_comment(owner, repo, number, reply_text)
                     if ok_post:
-                        cmd_args = ["python3", REPLY_DB, "replied", str(reply["id"]), reply_text]
+                        cmd_args = [PYTHON, REPLY_DB, "replied", str(reply["id"]), reply_text]
                         if url_or_err:
                             cmd_args.append(url_or_err)
                         style = decision.get("engagement_style", "")
@@ -578,14 +588,14 @@ def main():
                         subprocess.run(cmd_args)
                         if project:
                             subprocess.run(
-                                ["python3", REPLY_DB, "set_project", str(reply["id"]), project],
+                                [PYTHON, REPLY_DB, "set_project", str(reply["id"]), project],
                                 capture_output=True,
                             )
                         succeeded += 1
                         print(f"[engage_github] #{reply['id']} POSTED ({reply_elapsed:.0f}s) "
                               f"[${usage['cost_usd']:.4f}] -> {url_or_err or '(no url)'}")
                     else:
-                        subprocess.run(["python3", REPLY_DB, "skipped", str(reply["id"]),
+                        subprocess.run([PYTHON, REPLY_DB, "skipped", str(reply["id"]),
                                         f"post_error: {url_or_err}"])
                         failed += 1
                         print(f"[engage_github] #{reply['id']} POST FAILED: {url_or_err}")
@@ -623,7 +633,7 @@ def main():
         f" elapsed={int(total_elapsed)}"
     )
 
-    subprocess.run(["python3", REPLY_DB, "status"])
+    subprocess.run([PYTHON, REPLY_DB, "status"])
 
 
 if __name__ == "__main__":