social-autoposter 1.6.84 → 1.6.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.84",
+  "version": "1.6.85",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/_lock_preempt_test.py

@@ -0,0 +1,60 @@
+import json, os, sys, time, subprocess, signal
+sys.path.insert(0, os.path.join(os.path.dirname(__file__)))
+
+LOCK = os.path.expanduser("~/.claude/twitter-browser-lock.json")
+os.makedirs(os.path.dirname(LOCK), exist_ok=True)
+
+def write_lock(pid, role):
+    with open(LOCK, "w") as f:
+        json.dump({"session_id": f"python:{pid}", "timestamp": int(time.time()), "role": role}, f)
+
+def clean():
+    try: os.remove(LOCK)
+    except OSError: pass
+
+# ---- TEST 1: poster preempts a LIVE scan holder ----
+clean()
+victim = subprocess.Popen(["sleep", "120"])
+write_lock(victim.pid, "scan")
+os.environ["SAPS_LOCK_ROLE"] = "post"
+import importlib, twitter_browser
+importlib.reload(twitter_browser)
+t0 = time.time()
+twitter_browser._acquire_browser_lock()
+dt = time.time() - t0
+held = json.load(open(LOCK))
+victim_alive = victim.poll() is None
+print(f"TEST1 poster-preempts-scan: took={dt:.1f}s holder_now={held['session_id']} role={held.get('role')} victim_alive={victim_alive}")
+assert held["session_id"] == f"python:{os.getpid()}", "poster should hold lock"
+assert held.get("role") == "post"
+assert not victim_alive, "scan victim should be killed"
+assert dt < 10, "should preempt fast, not wait 45s"
+if victim.poll() is None: victim.kill()
+print("TEST1 PASS")
+
+# ---- TEST 2: scanner does NOT preempt a live POST holder (waits then gives up) ----
+clean()
+poster = subprocess.Popen(["sleep", "120"])
+write_lock(poster.pid, "post")
+os.environ["SAPS_LOCK_ROLE"] = "scan"
+twitter_browser.LOCK_WAIT_MAX = 4  # shorten the give-up window for the test
+twitter_browser.LOCK_ROLE = "scan"
+twitter_browser._LOCK_SESSION_ID = f"python:{os.getpid()}"
+twitter_browser._LOCK_INHERITED = False
+import io, contextlib
+t0 = time.time()
+rc = None
+try:
+    twitter_browser._acquire_browser_lock()
+    rc = "acquired"
+except SystemExit as e:
+    rc = f"exit:{e.code}"
+dt = time.time() - t0
+poster_alive = poster.poll() is None
+print(f"TEST2 scanner-vs-post: result={rc} took={dt:.1f}s poster_alive={poster_alive}")
+assert rc == "exit:1", "scanner must NOT take a live post holder; should give up"
+assert poster_alive, "scanner must NOT kill the poster"
+if poster.poll() is None: poster.kill()
+print("TEST2 PASS")
+clean()
+print("ALL PASS")

package/scripts/harness_overlay.py

@@ -173,7 +173,11 @@ window.__sapsPaint = function(payload){
       // coordinates (Input.dispatchMouseEvent) and by Playwright hit-testing,
       // both of which an opaque clickable card sitting over a target would eat.
       s.position="fixed"; s.top="50%"; s.left="50%"; s.transform="translate(-50%,-50%)";
-      s.zIndex="2147483647"; s.pointerEvents="none"; s.maxWidth="460px";
+      // Sit one below the announce modal (2147483647) so the one-time "S4L is
+      // running" notice + its OK button always stack ON TOP of this always-on
+      // status box. They're both screen-centered, so equal z-index would let
+      // whichever was appended last (this overlay) cover the OK button.
+      s.zIndex="2147483646"; s.pointerEvents="none"; s.maxWidth="460px";
       s.boxSizing="border-box"; s.padding="10px 14px"; s.borderRadius="12px";
       s.background="rgba(15,15,17,0.92)"; s.color="#fff";
       s.font="13px/1.35 -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif";

package/scripts/link_tail.py

@@ -42,6 +42,8 @@ Exit codes:
     2 — argparse / IO failure before we could write any JSON
 """
 
+from __future__ import annotations
+
 import argparse
 import json
 import os
@@ -56,6 +58,62 @@ REPO_DIR = os.path.expanduser("~/social-autoposter")
 RUN_CLAUDE_SH = os.path.join(REPO_DIR, "scripts", "run_claude.sh")
 CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
 
+# --- X/Twitter length budget -------------------------------------------------
+# X charges a FLAT 23 characters for any http/https URL (t.co wrapping),
+# regardless of the link's real length. So the budget is fixed: text + 23 <= 280
+# => at most 257 characters of text before the link. We only enforce this for
+# twitter; reddit/linkedin have far larger ceilings and need no tail trim.
+TWEET_LIMIT = 280
+URL_WEIGHT = 23
+TWITTER_TEXT_BUDGET = TWEET_LIMIT - URL_WEIGHT  # 257 chars for everything but the URL
+_URL_RE = re.compile(r"https?://\S+")
+
+
+def x_weighted_len(text: str) -> int:
+    """Character count the way X computes it: every URL counts as 23."""
+    if not text:
+        return 0
+    return len(_URL_RE.sub("x" * URL_WEIGHT, text))
+
+
+def _trim_to_chars(s: str, max_chars: int) -> str:
+    """Trim `s` to at most `max_chars`, backing off to a word boundary so we
+    never chop mid-word, then stripping trailing punctuation/space."""
+    s = s.strip()
+    if max_chars <= 0:
+        return ""
+    if len(s) <= max_chars:
+        return s
+    cut = s[:max_chars].rstrip()
+    sp = cut.rfind(" ")
+    # only back off to the word boundary when it doesn't gut more than half
+    if sp > max_chars * 0.5:
+        cut = cut[:sp]
+    return cut.rstrip(" ,;:-")
+
+
+def enforce_budget(text: str, link_url: str,
+                   limit: int = TWEET_LIMIT) -> tuple[str, bool]:
+    """Guarantee x_weighted_len(text) <= limit by trimming the BODY, never the
+    link. The link is the most important part of the reply and always stays at
+    the end. Returns (text, was_trimmed)."""
+    if x_weighted_len(text) <= limit:
+        return text, False
+    if link_url and link_url in text:
+        head, _, tail = text.rpartition(link_url)
+        head = head.rstrip()
+        tail = tail.strip()  # normally empty; the URL ends the reply
+        # Budget left for the body after reserving the URL (23) + a joining
+        # space + any (rare) trailing chars after the URL.
+        max_head = limit - URL_WEIGHT - 1 - len(tail)
+        trimmed_head = _trim_to_chars(head, max_head)
+        joined = (trimmed_head + " " + link_url).strip()
+        if tail:
+            joined = (joined + " " + tail).strip()
+        return joined, True
+    # No link present (shouldn't happen on the twitter path): hard word-trim.
+    return _trim_to_chars(text, limit), True
+
 
 def resolve_voice_relationship(project: str) -> str:
     """Look up the matched project's `voice_relationship` field in config.json.
@@ -151,6 +209,26 @@ def build_prompt(*, reply_text: str, link_url: str, thread_text: str,
             f"  - \"we ship the same recall-on-revisit pattern in {project}, scores against a 4-axis rubric, {link_url}\""
         )
 
+    # X-specific hard length budget. Pass the agent the current body length AND
+    # the budget so it self-fits by compressing the body, keeping the link at
+    # the end. Other platforms (reddit/linkedin) have far larger ceilings, so we
+    # add no tight cap there.
+    length_rule = ""
+    if platform == "twitter":
+        body_len = len(reply_text or "")
+        length_rule = (
+            f"HARD LENGTH LIMIT (X counts EVERY link as exactly 23 characters, "
+            f"no matter how long it looks):\n"
+            f"- The entire final reply must be \u2264 {TWEET_LIMIT} characters with "
+            f"the URL counted as {URL_WEIGHT}. That means everything EXCEPT the "
+            f"URL must total \u2264 {TWITTER_TEXT_BUDGET} characters.\n"
+            f"- The drafted body is currently {body_len} characters. If body + "
+            f"bridge would exceed {TWITTER_TEXT_BUDGET} chars of text, COMPRESS "
+            f"the body to make room: tighten wording, drop the weakest clause, "
+            f"but keep the single strongest claim and keep the URL at the very "
+            f"end. Never drop or move the link.\n"
+        )
+
     return f"""You are writing the FINAL bridge sentence that folds a product link into a social media reply we already drafted. This is a one-shot task. Output ONLY the bridge sentence (no preamble, no explanation, no quotes).
 
 PLATFORM: {platform}
@@ -159,6 +237,8 @@ LANDING PAGE URL: {link_url}
 
 {voice_rule}
 
+{length_rule}
+
 ORIGINAL THREAD WE ARE REPLYING TO:
 {thread_text}
 
@@ -289,7 +369,8 @@ THIRD_PARTY_VOICE_VIOLATIONS = (
 
 
 def passes_quality_gate(final_text: str, link_url: str,
-                        voice_relationship: str = "first_party"
+                        voice_relationship: str = "first_party",
+                        limit: int | None = None
                         ) -> tuple[bool, str]:
     """Return (passes, reason_if_not).
 
@@ -327,6 +408,12 @@ def passes_quality_gate(final_text: str, link_url: str,
     # Length sanity: model returning a 5-word stub is a fail.
     if len(final_text.split()) < 8:
         return (False, "too_short")
+    # Upper-length backstop (twitter): X-weighted length must fit the cap. The
+    # caller trims the body to fit BEFORE the gate, so this should only trip on
+    # a degenerate trim; on trip we fall back to the (also budget-enforced)
+    # mechanical concat.
+    if limit is not None and x_weighted_len(final_text) > limit:
+        return (False, f"too_long:{x_weighted_len(final_text)}>{limit}")
     return (True, "")
 
 
@@ -375,6 +462,8 @@ def main() -> int:
         return 0
 
     voice_relationship = args.voice_relationship or resolve_voice_relationship(args.project)
+    # Length cap is X-specific; reddit/linkedin pass None (no tail trim).
+    limit = TWEET_LIMIT if args.platform == "twitter" else None
     prompt = build_prompt(
         reply_text=reply_text, link_url=link_url,
         thread_text=(args.thread_text or "").strip()[:2000],
@@ -388,12 +477,16 @@ def main() -> int:
     elapsed = round(time.time() - started, 2)
 
     if not ok:
+        fb_text, fb_trim = enforce_budget(
+            mechanical_fallback(reply_text, link_url), link_url,
+            limit if limit is not None else TWEET_LIMIT * 100)
         out = {
             "ok": True,
-            "text": mechanical_fallback(reply_text, link_url),
+            "text": fb_text,
             "tail": link_url,
             "model_call_ok": False,
             "fallback_used": True,
+            "budget_trimmed": fb_trim,
             "error": err or "model_call_failed",
             "elapsed_sec": elapsed,
         }
@@ -401,15 +494,26 @@ def main() -> int:
         return 0
 
     cleaned = clean_output(raw)
+    # Trim the body to fit BEFORE the gate so a good model bridge is preserved
+    # (we trim the body, never the link) instead of being thrown away for being
+    # a few chars over. No-op on non-twitter (limit is None).
+    budget_trimmed = False
+    if limit is not None:
+        cleaned, budget_trimmed = enforce_budget(cleaned, link_url, limit)
     passes, reason = passes_quality_gate(cleaned, link_url,
-                                         voice_relationship=voice_relationship)
+                                         voice_relationship=voice_relationship,
+                                         limit=limit)
     if not passes:
+        fb_text, fb_trim = enforce_budget(
+            mechanical_fallback(reply_text, link_url), link_url,
+            limit if limit is not None else TWEET_LIMIT * 100)
         out = {
             "ok": True,
-            "text": mechanical_fallback(reply_text, link_url),
+            "text": fb_text,
             "tail": link_url,
             "model_call_ok": True,
             "fallback_used": True,
+            "budget_trimmed": fb_trim,
             "error": f"quality_gate_failed:{reason}",
             "raw_model_output": raw[:500],
             "elapsed_sec": elapsed,
@@ -436,6 +540,7 @@ def main() -> int:
         "tail": tail,
         "model_call_ok": True,
         "fallback_used": False,
+        "budget_trimmed": budget_trimmed,
         "elapsed_sec": elapsed,
     }
     print(json.dumps(out), flush=True)

package/scripts/log_post.py

@@ -122,30 +122,40 @@ def parse_urn_ids(*sources):
 
 VALID_PLATFORMS = ("reddit", "twitter", "linkedin", "github_issues", "moltbook")
 
-DEFAULT_ACCOUNTS = {
-    "reddit": "Deep_Ad1959",
-    "linkedin": "Matthew Diakonov",
-    "github_issues": "m13v",
-    "moltbook": "matthew-autoposter",
+# Maps log_post's platform strings to account_resolver's platform keys.
+# (log_post uses "github_issues"; account_resolver uses "github".)
+_RESOLVER_PLATFORM = {
+    "twitter": "twitter",
+    "reddit": "reddit",
+    "linkedin": "linkedin",
+    "github_issues": "github",
+    "moltbook": "moltbook",
 }
 
 
 def _resolve_default_account(platform: str) -> str:
-    """Return the canonical account handle for `platform` on this machine.
+    """Return the configured account handle for `platform` on this machine.
 
-    Twitter is multi-machine-aware: each machine declares its own handle via
-    `AUTOPOSTER_TWITTER_HANDLE` env or `accounts.twitter.handle` in
-    config.json, and `twitter_account.resolve_handle()` returns the
-    normalized form (no `@` prefix). Other platforms keep their static
-    defaults until each gets the same multi-machine treatment.
+    Resolved ONLY from env (`AUTOPOSTER_<PLATFORM>_*`) or config.json
+    (`accounts.<platform>.*`) via account_resolver. There are NO hardcoded
+    handle fallbacks: a misconfigured install must never silently post under
+    another person's identity. The old per-platform defaults
+    (m13v_/Deep_Ad1959/Matthew Diakonov/m13v/matthew-autoposter) did exactly
+    that, stamping every unconfigured install's rows with the repo owner's
+    handle and polluting the shared DB across accounts.
 
-    Returns empty string when nothing is configured; the caller's
+    Returns "" when nothing is configured; the caller's
     `args.account or _resolve_default_account(...)` chain still lets an
-    explicit `--account` flag win.
+    explicit `--account` flag win, and an empty value surfaces the misconfig
+    instead of impersonating someone.
     """
-    if platform == "twitter":
-        return resolve_twitter_handle() or ""
-    return DEFAULT_ACCOUNTS.get(platform, "")
+    try:
+        import account_resolver
+        return account_resolver.resolve(
+            _RESOLVER_PLATFORM.get(platform, platform)
+        ) or ""
+    except Exception:
+        return ""
 
 
 def coerce_engagement_style(args):

package/scripts/twitter_browser.py

@@ -33,6 +33,7 @@ import json
 import os
 import random
 import re
+import signal
 import subprocess
 import sys
 import time
@@ -40,27 +41,51 @@ import time
 
 LOCK_FILE = os.path.expanduser("~/.claude/twitter-browser-lock.json")
 LOCK_EXPIRY = 300  # process-level mutex TTL; refreshed during long ops
+# Posting-specific silence ceiling, DECOUPLED from the fleet-wide LOCK_EXPIRY.
+# A role:"post" holder (an approved batch, or a single reply) is reclaimed by a
+# peer once its lock has gone unrefreshed this long; a role:"scan" holder keeps
+# the 300s LOCK_EXPIRY untouched. Posting refreshes the lock at every candidate
+# boundary (twitter_post_plan holds it across the whole batch), so a healthy
+# poster never goes silent this long -- only a genuinely hung poster (e.g.
+# link_tail's `claude -p` wedged) trips it. Kept as its own knob so tuning the
+# scan TTL never moves the poster's hang ceiling and vice-versa. Must exceed the
+# worst-case single candidate step (one reply + the link_tail AI call), and stay
+# well under any value that would let a hung poster block the browser for long.
+POST_LOCK_EXPIRY = 180  # seconds; applies ONLY to a role:"post" holder
 LOCK_WAIT_MAX = 45  # seconds to wait for lock to free before giving up
 LOCK_POLL_INTERVAL = 2
+PREEMPT_KILL_WAIT = 5  # secs to wait for a preempted scan holder to die before SIGKILL
+
+# Lock role priority. A "post" holder is user-initiated (an approved reply) and
+# outranks any "scan" holder (the scan/draft cycle, autopilot or plugin). When a
+# poster finds a LIVE lower-priority holder it PREEMPTS it (SIGTERM + reclaim)
+# instead of waiting LOCK_WAIT_MAX and giving up. This is what makes "posting
+# takes priority over scanning" hold CROSS-PROCESS: the old in-process
+# preemptScanForPost only killed the plugin's own scan, never a scan spawned by a
+# separate autopilot agent / launchd cron, so an approved post kept losing the
+# 45s race to a live scan that held the browser. Default "scan" so any unmarked
+# browser op is preemptable; only the poster path sets SAPS_LOCK_ROLE=post.
+LOCK_ROLE = (os.environ.get("SAPS_LOCK_ROLE") or "scan").strip() or "scan"
 VIEWPORT = {"width": 911, "height": 1016}
 
 # Posting handle. Resolved at call time from AUTOPOSTER_TWITTER_HANDLE env
 # var (set by per-account launchd/systemd units) or config.json
-# accounts.twitter.handle. The "m13v_" fallback keeps the Mac default working
-# when neither source is set, but on the VMs the env var MUST be set so the
-# DOM scrape + CDP URL build target the right profile.
-_DEFAULT_HANDLE = "m13v_"
-
+# accounts.twitter.handle. Returns None when neither source is set.
+#
+# There is intentionally NO hardcoded fallback handle. The old "m13v_"
+# default meant any install with an unset handle silently posted under the
+# repo owner's identity: it stamped posts.our_account = m13v_ and built reply
+# permalinks as x.com/m13v_/status/<id> for tweets that actually belonged to a
+# different account, corrupting attribution in the shared DB. Callers that
+# build a URL or post under this identity MUST treat None as "account not
+# configured" and refuse, rather than impersonate someone.
 def our_handle():
     try:
         sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
         import account_resolver
-        h = account_resolver.resolve("twitter")
-        if h:
-            return h
+        return account_resolver.resolve("twitter")
     except Exception:
-        pass
-    return _DEFAULT_HANDLE
+        return None
 
 # DM encryption passcode from .env
 DM_PASSCODE = os.environ.get("TWITTER_DM_PASSCODE", "")
@@ -297,13 +322,45 @@ def _try_take_lock() -> bool:
         return False
     try:
         os.write(fd, json.dumps(
-            {"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time())}
+            {"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time()), "role": LOCK_ROLE}
         ).encode())
     finally:
         os.close(fd)
     return True
 
 
+def _preempt_holder(pid: int) -> bool:
+    """Preempt a live lock holder we outrank (a poster taking the browser from a
+    scan). SIGTERM it, wait PREEMPT_KILL_WAIT for it to die so its pid frees the
+    lock, then escalate to SIGKILL once. Returns True once the holder is gone
+    (or was already gone). Best-effort; never raises. The caller then removes the
+    stale lockfile and claims it via O_EXCL.
+    """
+    try:
+        os.kill(pid, signal.SIGTERM)
+    except ProcessLookupError:
+        return True            # already gone
+    except OSError:
+        return False           # not ours to signal / ambiguous -> don't claim
+    deadline = time.time() + PREEMPT_KILL_WAIT
+    while time.time() < deadline:
+        try:
+            os.kill(pid, 0)
+        except OSError:
+            return True        # ProcessLookupError or perm change -> dead enough
+        time.sleep(0.2)
+    # Still alive after the SIGTERM grace window -> escalate once.
+    try:
+        os.kill(pid, signal.SIGKILL)
+    except OSError:
+        pass
+    try:
+        os.kill(pid, 0)
+    except OSError:
+        return True
+    return False
+
+
 def _acquire_browser_lock():
     """Acquire the Twitter browser session mutex (~/.claude/twitter-browser-lock.json).
 
@@ -377,6 +434,7 @@ def _acquire_browser_lock():
             continue
         age = time.time() - lock.get("timestamp", 0)
         holder = lock.get("session_id", "")
+        holder_role = lock.get("role", "scan")  # legacy locks (no role) = preemptable
 
         # 1. Re-entrant: the lock is already ours (same process, or a stale lock
         # left by a previous process whose PID we have since reused). Refresh the
@@ -385,6 +443,29 @@ def _acquire_browser_lock():
             _refresh_browser_lock()
             break
 
+        # 1b. Batch-owner inherit (posting). The poster (twitter_post_plan.py)
+        # acquires this lock ONCE and holds it across the WHOLE approved batch,
+        # exporting its own session id as SAPS_LOCK_OWNER for the child
+        # twitter_browser.py reply subprocesses it spawns. Each child INHERITS the
+        # parent's hold instead of contending for it -- two role:"post" peers would
+        # otherwise both fall to the case-6 peer-wait and give up after
+        # LOCK_WAIT_MAX, breaking the post. The child refreshes the timestamp
+        # (proof of progress at this candidate boundary, so the POST_LOCK_EXPIRY
+        # failsafe only ever fires on a real hang) and, being _LOCK_INHERITED,
+        # leaves the lock in place for the PARENT to release at batch end. A DEAD
+        # owner is never inherited: the alive-probe fails here and we fall through
+        # to the dead_python reclaim below, so a crashed batch can't wedge the
+        # browser. This is what closes the inter-candidate gap (the link_tail
+        # claude -p call, ~5-20s) the every-60s autopilot scan used to slip into.
+        _batch_owner = os.environ.get("SAPS_LOCK_OWNER") or ""
+        if holder and holder == _batch_owner and _is_python_holder_alive(holder):
+            _LOCK_SESSION_ID = holder
+            _LOCK_INHERITED = True
+            _refresh_browser_lock()
+            print(f"[browser_lock] inherited batch owner={holder} "
+                  f"role={holder_role} -> pid={os.getpid()}", file=sys.stderr)
+            break
+
         # 2-4. Reclaim a holder we can prove is dead/expired. Remove-then-take so
         # the O_EXCL claim wins; if a peer reclaims at the same instant exactly
         # one of us creates the file and the other re-loops (never both).
@@ -393,7 +474,10 @@ def _acquire_browser_lock():
             reclaim_reason = "dead_uuid"
         elif holder.startswith("python:") and not _is_python_holder_alive(holder):
             reclaim_reason = "dead_python"
-        elif age >= LOCK_EXPIRY:
+        elif age >= (POST_LOCK_EXPIRY if holder_role == "post" else LOCK_EXPIRY):
+            # Role-aware failsafe: a hung poster self-clears on the posting-only
+            # POST_LOCK_EXPIRY, a scan on the fleet-wide LOCK_EXPIRY. Scan
+            # behaviour is unchanged; only the post ceiling is decoupled.
             reclaim_reason = "expired"
         if reclaim_reason:
             try:
@@ -415,6 +499,43 @@ def _acquire_browser_lock():
             _LOCK_INHERITED = True
             break
 
+        # 5b. POSTING PRIORITY (cross-process). A LIVE python:PID peer running a
+        # lower-priority op (role != "post": the scan/draft cycle, whether the
+        # plugin's own, a separate autopilot agent's, or the launchd cron's) must
+        # YIELD to an approved post. Preempt it by signal and reclaim, so the post
+        # takes the browser at once instead of waiting LOCK_WAIT_MAX and giving up
+        # while the scan holds it. The aborted scan just re-runs next cron tick;
+        # posting is the scarce, user-initiated action. Only a poster
+        # (LOCK_ROLE == "post") ever preempts, and only a non-post holder -- two
+        # posters fall through to the normal peer-wait below so neither kills the
+        # other. UUID holders are handled above (we inherit, never kill those).
+        if (
+            LOCK_ROLE == "post"
+            and holder.startswith("python:")
+            and holder_role != "post"
+            and _is_python_holder_alive(holder)
+        ):
+            try:
+                victim_pid = int(holder.split(":", 1)[1])
+            except (ValueError, IndexError):
+                victim_pid = 0
+            if victim_pid and _preempt_holder(victim_pid):
+                try:
+                    os.remove(LOCK_FILE)
+                except OSError:
+                    pass
+                if _try_take_lock():
+                    print(
+                        f"[browser_lock] post preempted holder={holder} "
+                        f"role={holder_role} age={int(age)}s -> pid={os.getpid()}",
+                        file=sys.stderr,
+                    )
+                    break
+            # Preempt didn't land (couldn't kill, or a peer reclaimed first) ->
+            # re-loop and re-evaluate rather than busy-spin.
+            time.sleep(LOCK_POLL_INTERVAL)
+            continue
+
         # 6. Live python:PID peer. Wait, then give up. Reaching the deadline now
         # means the holder is a genuinely LIVE peer (dead ones were reclaimed
         # above), i.e. real contention -- NOT the defect-a starvation. The
@@ -433,7 +554,7 @@ def _refresh_browser_lock():
     """Refresh the lock timestamp to prevent expiry during long operations."""
     try:
         with open(LOCK_FILE, "w") as f:
-            json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time())}, f)
+            json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time()), "role": LOCK_ROLE}, f)
     except OSError:
         pass
 
@@ -820,6 +941,18 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
     """
     print(f"[twitter_browser] reply_to_tweet called: {tweet_url}", file=sys.stderr)
 
+    # Identity gate: refuse to post when no account is configured. Without a
+    # resolved handle we cannot attribute the post or build a correct reply
+    # permalink, and the old behaviour silently impersonated the repo owner
+    # (handle "m13v_"). Fail fast and loud so the misconfiguration surfaces
+    # instead of polluting the shared DB under someone else's identity.
+    _handle = our_handle()
+    if not _handle:
+        print("[twitter_browser] no twitter account configured "
+              "(set AUTOPOSTER_TWITTER_HANDLE or accounts.twitter.handle in "
+              "config.json); refusing to post.", file=sys.stderr)
+        return {"ok": False, "error": "no_account_configured"}
+
     applied_campaigns = []
     if apply_campaigns:
         for cid, suffix, sample_rate in _load_active_twitter_campaigns():
@@ -946,7 +1079,17 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
                         page.goto(tweet_url, wait_until="domcontentloaded", timeout=60000)
                     except Exception:
                         pass
-                page.wait_for_timeout(15000 if nav_attempt == 1 else 8000)
+                # Was a blind 15s/8s settle here -> pure dead latency. SPA
+                # readiness is ALREADY gated actively below by
+                # wait_for_selector("main") (up to 20s) and
+                # _wait_for_reply_textbox (polls every 500ms up to 45s); both
+                # return the instant the composer mounts, so the blind sleep
+                # only delayed the start of that polling. Keep a short floor so
+                # the initial JS kicks off (and the deleted-tweet text check
+                # below has content to read), then let the active gates do the
+                # real waiting. Cuts ~12s off every happy-path reply.
+                # (optimized 2026-06-22: 15000/8000 -> 2500)
+                page.wait_for_timeout(2500)
 
                 # `wait_until="load"` fires before Twitter's SPA mounts the
                 # <main> app shell, so "loaded" != "rendered". Explicitly gate
@@ -1021,7 +1164,12 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
             except Exception:
                 page.keyboard.press("Meta+Enter")
 
-            page.wait_for_timeout(4000)
+            # Post-submit settle: lets the CDP network response (which carries
+            # the new tweet id -> reply_url, captured below) and the success
+            # interstitial arrive. Trimmed from 4000ms 2026-06-22; the DOM-diff
+            # fallback (3x2s, below) still covers a slow CDP response, so the
+            # reply_url is not lost if 2000ms is short on a given run.
+            page.wait_for_timeout(2000)
 
             # Verify: check if the reply box is empty (cleared after posting)
             try:
@@ -1050,7 +1198,7 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
 
             # Method 1: CDP network interception (most reliable)
             if _created_tweet_ids:
-                reply_url = f"https://x.com/{our_handle()}/status/{_created_tweet_ids[-1]}"
+                reply_url = f"https://x.com/{_handle}/status/{_created_tweet_ids[-1]}"
                 print(f"[reply_url] captured via CDP+response-listener: {reply_url}", file=sys.stderr)
 
             # Method 2: DOM diff (check if new reply links appeared)

package/scripts/twitter_post_plan.py

@@ -49,6 +49,14 @@ import time
 from datetime import datetime, timezone
 from pathlib import Path
 
+# This pipeline ONLY posts (never scans), so mark every twitter_browser.py reply
+# subprocess it spawns as the high-priority "post" lock role. run_subprocess
+# inherits this process env, so the child twitter_browser.py reads SAPS_LOCK_ROLE
+# at import and will PREEMPT a live scan holding the browser lock instead of
+# losing the 45s wait. Covers BOTH the MCP approve path and the cron post path,
+# since both shell out to this script. Set before any child is spawned.
+os.environ["SAPS_LOCK_ROLE"] = "post"
+
 REPO_DIR = os.path.expanduser("~/social-autoposter")
 TWITTER_BROWSER = os.path.join(REPO_DIR, "scripts", "twitter_browser.py")
 LOG_POST = os.path.join(REPO_DIR, "scripts", "log_post.py")
@@ -1009,11 +1017,58 @@ def main() -> int:
             return 3
 
     _total = len(candidates)
+
+    # ---- Batch-level browser-lock hold (cross-process posting priority) --------
+    # Hold the Twitter browser lock for the WHOLE approved batch instead of
+    # re-acquiring it per candidate. Per-candidate acquisition freed the lock in
+    # the gap between replies (dominated by link_tail's `claude -p` call, ~5-20s),
+    # and the autopilot scan fires every 60s, so a scan kept slipping into that gap
+    # and seizing the browser mid-batch -- the exact "posting gets cut off" symptom
+    # on the remote box. Acquiring ONCE here PREEMPTS any live scan (role:"post"
+    # priority) and, by exporting our session id as SAPS_LOCK_OWNER, makes every
+    # child twitter_browser.py reply INHERIT this hold rather than contend for it,
+    # closing the gap. The hold is bounded by the posting-specific POST_LOCK_EXPIRY
+    # failsafe in twitter_browser (a hung poster self-clears in <=180s; a crashed
+    # one frees instantly via dead-pid reclaim), so it can never wedge the browser
+    # indefinitely. Best-effort: if the import or acquire fails we simply fall back
+    # to the legacy per-candidate acquisition (children still preempt scans one by
+    # one), so posting degrades gracefully and is never blocked by this addition.
+    _tb = None
+    _batch_lock_held = False
+    if candidates:
+        try:
+            import twitter_browser as _tb  # SAPS_LOCK_ROLE=post already set above
+            _tb._acquire_browser_lock()    # preempts a live scan; sys.exit(1) if contended
+            os.environ["SAPS_LOCK_OWNER"] = _tb._LOCK_SESSION_ID
+            _batch_lock_held = True
+            print(f"[post] batch lock held by {_tb._LOCK_SESSION_ID} (role=post); "
+                  f"{_total} candidate(s) inherit it", flush=True)
+        except SystemExit:
+            # _acquire_browser_lock exits when a LIVE non-preemptable peer (another
+            # poster) holds the lock past LOCK_WAIT_MAX. Don't abort the whole run:
+            # drop to per-candidate acquisition (each child still preempts scans).
+            print("[post] batch lock contended; per-candidate acquisition in effect",
+                  flush=True)
+        except Exception as _e:
+            print(f"[post] batch lock setup skipped ({_e}); per-candidate "
+                  "acquisition in effect", flush=True)
+
     try:
         for _idx, c in enumerate(candidates, start=1):
             # Live per-post status for the S4L menu bar: "posting 3/10" while this
             # one is in flight, then "posted 3/10 ✓" once it lands. Cosmetic only.
             _write_activity(f"posting {_idx}/{_total}")
+            # Re-stamp the batch hold at each candidate boundary so the
+            # POST_LOCK_EXPIRY failsafe measures silence from the LAST real
+            # progress, not from batch start. Insurance on top of the child's own
+            # inherit-refresh: keeps the hold fresh even across a candidate that
+            # skips before ever spawning a reply subprocess (empty_reply_text,
+            # pre-post dedup). Cheap; never raises.
+            if _batch_lock_held and _tb is not None:
+                try:
+                    _tb._refresh_browser_lock()
+                except Exception:
+                    pass
             try:
                 outcome, reason = post_one(c, picker_assignment=picker_assignment)
             except Exception as e:
@@ -1039,6 +1094,17 @@ def main() -> int:
                     fail_reasons[reason] = fail_reasons.get(reason, 0) + 1
     finally:
         _clear_activity()
+        # Release the batch hold so the next scan/post can take the browser
+        # immediately (don't make peers wait out POST_LOCK_EXPIRY). _tb's atexit
+        # is a backstop if we somehow skip this; clearing SAPS_LOCK_OWNER stops a
+        # late child from re-inheriting a lock we just dropped.
+        if _batch_lock_held and _tb is not None:
+            try:
+                _tb._release_browser_lock()
+            except Exception:
+                pass
+            os.environ.pop("SAPS_LOCK_OWNER", None)
+            print("[post] batch lock released", flush=True)
 
     summary = {
         "posted": posted,