social-autoposter 1.6.84 → 1.6.86

package/mcp/dist/index.js

@@ -22,7 +22,7 @@ import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, ensurePipelineCurrent, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, captureError, flushSentry, startLogStreaming, flushLogs } from "./telemetry.js";
+import { initSentry, sendHeartbeat, captureError, flushSentry } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -616,7 +616,6 @@ async function postApproved(batchId, plan) {
         });
         void flushSentry(2000);
     }
-    void flushLogs();
     return {
         attempted: approved.length,
         posted: realPosted,
@@ -2384,11 +2383,6 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
 }));
 async function main() {
     initSentry();
-    // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
-    // backend so we can troubleshoot/rescue any user scenario (silent stalls,
-    // partial onboarding) without asking them to ship a log file. Best-effort;
-    // disabled with SAPS_LOG_STREAM=0.
-    startLogStreaming();
     // A plugin UPDATE refreshes this server (dist/) but not the materialized
     // pipeline. Re-extract the bundled pipeline.tgz when it's newer than what's on
     // disk, BEFORE serving, so the very first scan uses the shipped pipeline (not
@@ -2439,7 +2433,6 @@ async function main() {
 main().catch(async (err) => {
     console.error("[social-autoposter-mcp] fatal:", err);
     captureError(err, { component: "main" });
-    await flushLogs();
     await flushSentry();
     process.exit(1);
 });

package/mcp/dist/repo.js

@@ -30,27 +30,6 @@ export function repoDir() {
 // "No drafts in batch ...". Default to /tmp to match the script; allow an explicit
 // override for non-standard installs.
 export const TMP_DIR = process.env.SAPS_TMP_DIR || "/tmp";
-let lineSink = null;
-export function setLineSink(fn) {
-    lineSink = fn;
-}
-// Derive a short, stable context label for a spawned command so log lines can
-// be grouped by which script produced them (e.g. "scripts/seed_search_topics.py",
-// "skill/run-twitter-cycle.sh"). Best-effort; never throws.
-function deriveContext(cmd, args) {
-    try {
-        const base = cmd.split("/").pop() || cmd;
-        if (/python/i.test(base) || base === "bash" || base === "sh" || base === "node") {
-            const first = args.find((a) => !a.startsWith("-"));
-            if (first)
-                return first;
-        }
-        return [base, args[0] ?? ""].join(" ").trim();
-    }
-    catch {
-        return cmd;
-    }
-}
 // Spawn a process inside the repo, inheriting the repo env (API base + keys
 // come from the install's environment / .env loaded by the scripts themselves).
 //
@@ -94,29 +73,6 @@ export function run(cmd, args, opts = {}) {
             }
             return buf;
         };
-        // Parallel whole-line splitter that tees to the telemetry sink (if any),
-        // kept separate from the onLine pump so neither path can affect the other.
-        const logCtx = opts.logContext || deriveContext(cmd, args);
-        let sinkOutBuf = "";
-        let sinkErrBuf = "";
-        const sinkPump = (chunk, which, buf) => {
-            const sink = lineSink;
-            if (!sink)
-                return buf;
-            buf += chunk;
-            let nl;
-            while ((nl = buf.indexOf("\n")) !== -1) {
-                const line = buf.slice(0, nl);
-                buf = buf.slice(nl + 1);
-                try {
-                    sink(line, which, logCtx);
-                }
-                catch {
-                    /* the telemetry sink must never break the wrapped command */
-                }
-            }
-            return buf;
-        };
         let timer;
         if (opts.timeoutMs) {
             timer = setTimeout(() => {
@@ -127,13 +83,11 @@ export function run(cmd, args, opts = {}) {
             const s = d.toString();
             stdout += s;
             outBuf = pump(s, "stdout", outBuf);
-            sinkOutBuf = sinkPump(s, "stdout", sinkOutBuf);
         });
         child.stderr.on("data", (d) => {
             const s = d.toString();
             stderr += s;
             errBuf = pump(s, "stderr", errBuf);
-            sinkErrBuf = sinkPump(s, "stderr", sinkErrBuf);
         });
         child.on("close", (code) => {
             if (timer)
@@ -155,23 +109,6 @@ export function run(cmd, args, opts = {}) {
                         /* ignore */
                     }
             }
-            const sink = lineSink;
-            if (sink) {
-                if (sinkOutBuf)
-                    try {
-                        sink(sinkOutBuf, "stdout", logCtx);
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                if (sinkErrBuf)
-                    try {
-                        sink(sinkErrBuf, "stderr", logCtx);
-                    }
-                    catch {
-                        /* ignore */
-                    }
-            }
             resolve({ code: code ?? -1, stdout, stderr });
         });
         child.on("error", (err) => {

package/mcp/dist/telemetry.js

@@ -9,7 +9,7 @@
 import * as Sentry from "@sentry/node";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, setLineSink } from "./repo.js";
+import { repoDir, runPython } from "./repo.js";
 import { VERSION } from "./version.js";
 // Sentry DSN is a client-side identifier (safe to embed, same posture as Fazm's
 // hardcoded Swift DSN). Overridable via env for dev. Empty -> Sentry disabled.
@@ -102,129 +102,3 @@ export async function sendHeartbeat(reason) {
         console.error("[social-autoposter-mcp] heartbeat failed:", err?.message || err);
     }
 }
-// ---- Raw subprocess log streaming ------------------------------------------
-// Tees the verbatim stdout/stderr of every pipeline subprocess (via the
-// repo.ts run() boundary) to the s4l backend, so we can troubleshoot and
-// rescue any user scenario without asking them to ship a log file. Lines are
-// buffered in memory and flushed in small batches under the same X-Installation
-// identity the heartbeat uses. Best-effort: this NEVER throws into the server,
-// never blocks the child's I/O, and drops on overflow rather than growing
-// unbounded. Disable with SAPS_LOG_STREAM=0.
-const LOG_STREAM_ENABLED = process.env.SAPS_LOG_STREAM !== "0";
-const LOG_MAX_LINE_LEN = 8192; // mirror the backend cap
-const LOG_MAX_BUFFER = 1000; // drop oldest beyond this (overflow protection)
-const LOG_FLUSH_BATCH = 100; // flush eagerly once we have this many lines
-const LOG_MAX_PER_POST = 200; // backend accepts 1-200 per request
-const LOG_FLUSH_MS = 3000; // otherwise flush on this cadence
-const logBuffer = [];
-let logDropped = 0; // count of lines dropped on overflow (surfaced periodically)
-let logFlushing = false;
-let logTimer;
-let cachedInstallHeader = null;
-let logStreamingStarted = false;
-async function installHeader() {
-    if (cachedInstallHeader)
-        return cachedInstallHeader;
-    try {
-        const idScript = path.join(repoDir(), "scripts", "identity.py");
-        if (!fs.existsSync(idScript))
-            return null;
-        const res = await runPython("scripts/identity.py", ["header"], { timeoutMs: 10_000 });
-        const header = (res.stdout || "").trim();
-        if (res.code === 0 && header) {
-            cachedInstallHeader = header;
-            return header;
-        }
-    }
-    catch {
-        /* best-effort */
-    }
-    return null;
-}
-// Buffer one raw line. Called from the repo.ts line sink, so it must be cheap
-// and total non-throwing.
-export function logLine(stream, line, context) {
-    if (!LOG_STREAM_ENABLED)
-        return;
-    try {
-        logBuffer.push({
-            ts: new Date().toISOString(),
-            stream,
-            line: line.length > LOG_MAX_LINE_LEN ? line.slice(0, LOG_MAX_LINE_LEN) : line,
-            context: context || "",
-        });
-        if (logBuffer.length > LOG_MAX_BUFFER) {
-            // Drop oldest to bound memory; the newest lines are the most useful.
-            logDropped += logBuffer.length - LOG_MAX_BUFFER;
-            logBuffer.splice(0, logBuffer.length - LOG_MAX_BUFFER);
-        }
-        if (logBuffer.length >= LOG_FLUSH_BATCH)
-            void flushLogs();
-    }
-    catch {
-        /* never throw into the run() boundary */
-    }
-}
-export async function flushLogs() {
-    if (!LOG_STREAM_ENABLED)
-        return;
-    if (logFlushing || logBuffer.length === 0)
-        return;
-    logFlushing = true;
-    try {
-        const header = await installHeader();
-        if (!header)
-            return; // runtime not unpacked yet; keep buffering
-        const base = (process.env.AUTOPOSTER_API_BASE || "https://s4l.ai").replace(/\/+$/, "");
-        // Drain in <=200-line POSTs until the buffer empties (or a POST fails).
-        while (logBuffer.length > 0) {
-            const batch = logBuffer.splice(0, LOG_MAX_PER_POST);
-            const lines = batch.map((b) => ({
-                ts: b.ts,
-                stream: b.stream,
-                line: b.line,
-                context: b.context || undefined,
-            }));
-            try {
-                const resp = await fetch(`${base}/api/v1/installations/logs`, {
-                    method: "POST",
-                    headers: { "X-Installation": header, "content-type": "application/json" },
-                    body: JSON.stringify({ lines }),
-                    signal: AbortSignal.timeout(15_000),
-                });
-                if (!resp.ok) {
-                    // Drop this batch (don't re-buffer): a persistent 4xx/5xx would grow
-                    // the buffer unbounded. The raw stream is best-effort.
-                    console.error(`[social-autoposter-mcp] log flush http ${resp.status}`);
-                    break;
-                }
-            }
-            catch (err) {
-                // Network blip: drop this batch, stop draining, try again next tick.
-                console.error("[social-autoposter-mcp] log flush failed:", err?.message || err);
-                break;
-            }
-        }
-        if (logDropped > 0) {
-            console.error(`[social-autoposter-mcp] log stream dropped ${logDropped} line(s) on overflow`);
-            logDropped = 0;
-        }
-    }
-    finally {
-        logFlushing = false;
-    }
-}
-// Register the repo.ts line sink and start the periodic flush. Idempotent.
-export function startLogStreaming() {
-    if (!LOG_STREAM_ENABLED || logStreamingStarted)
-        return;
-    logStreamingStarted = true;
-    try {
-        setLineSink((line, stream, context) => logLine(stream, line, context));
-        logTimer = setInterval(() => void flushLogs(), LOG_FLUSH_MS);
-        logTimer.unref();
-    }
-    catch (err) {
-        console.error("[social-autoposter-mcp] log streaming start failed:", err?.message || err);
-    }
-}

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.84",
-  "installedAt": "2026-06-23T02:53:37.786Z"
+  "version": "1.6.86",
+  "installedAt": "2026-06-23T16:16:31.100Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.84",
+  "version": "1.6.86",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.84",
+  "version": "1.6.86",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.84",
+  "version": "1.6.86",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/_lock_preempt_test.py

@@ -0,0 +1,60 @@
+import json, os, sys, time, subprocess, signal
+sys.path.insert(0, os.path.join(os.path.dirname(__file__)))
+
+LOCK = os.path.expanduser("~/.claude/twitter-browser-lock.json")
+os.makedirs(os.path.dirname(LOCK), exist_ok=True)
+
+def write_lock(pid, role):
+    with open(LOCK, "w") as f:
+        json.dump({"session_id": f"python:{pid}", "timestamp": int(time.time()), "role": role}, f)
+
+def clean():
+    try: os.remove(LOCK)
+    except OSError: pass
+
+# ---- TEST 1: poster preempts a LIVE scan holder ----
+clean()
+victim = subprocess.Popen(["sleep", "120"])
+write_lock(victim.pid, "scan")
+os.environ["SAPS_LOCK_ROLE"] = "post"
+import importlib, twitter_browser
+importlib.reload(twitter_browser)
+t0 = time.time()
+twitter_browser._acquire_browser_lock()
+dt = time.time() - t0
+held = json.load(open(LOCK))
+victim_alive = victim.poll() is None
+print(f"TEST1 poster-preempts-scan: took={dt:.1f}s holder_now={held['session_id']} role={held.get('role')} victim_alive={victim_alive}")
+assert held["session_id"] == f"python:{os.getpid()}", "poster should hold lock"
+assert held.get("role") == "post"
+assert not victim_alive, "scan victim should be killed"
+assert dt < 10, "should preempt fast, not wait 45s"
+if victim.poll() is None: victim.kill()
+print("TEST1 PASS")
+
+# ---- TEST 2: scanner does NOT preempt a live POST holder (waits then gives up) ----
+clean()
+poster = subprocess.Popen(["sleep", "120"])
+write_lock(poster.pid, "post")
+os.environ["SAPS_LOCK_ROLE"] = "scan"
+twitter_browser.LOCK_WAIT_MAX = 4  # shorten the give-up window for the test
+twitter_browser.LOCK_ROLE = "scan"
+twitter_browser._LOCK_SESSION_ID = f"python:{os.getpid()}"
+twitter_browser._LOCK_INHERITED = False
+import io, contextlib
+t0 = time.time()
+rc = None
+try:
+    twitter_browser._acquire_browser_lock()
+    rc = "acquired"
+except SystemExit as e:
+    rc = f"exit:{e.code}"
+dt = time.time() - t0
+poster_alive = poster.poll() is None
+print(f"TEST2 scanner-vs-post: result={rc} took={dt:.1f}s poster_alive={poster_alive}")
+assert rc == "exit:1", "scanner must NOT take a live post holder; should give up"
+assert poster_alive, "scanner must NOT kill the poster"
+if poster.poll() is None: poster.kill()
+print("TEST2 PASS")
+clean()
+print("ALL PASS")

package/scripts/harness_overlay.py

@@ -173,7 +173,11 @@ window.__sapsPaint = function(payload){
       // coordinates (Input.dispatchMouseEvent) and by Playwright hit-testing,
       // both of which an opaque clickable card sitting over a target would eat.
       s.position="fixed"; s.top="50%"; s.left="50%"; s.transform="translate(-50%,-50%)";
-      s.zIndex="2147483647"; s.pointerEvents="none"; s.maxWidth="460px";
+      // Sit one below the announce modal (2147483647) so the one-time "S4L is
+      // running" notice + its OK button always stack ON TOP of this always-on
+      // status box. They're both screen-centered, so equal z-index would let
+      // whichever was appended last (this overlay) cover the OK button.
+      s.zIndex="2147483646"; s.pointerEvents="none"; s.maxWidth="460px";
       s.boxSizing="border-box"; s.padding="10px 14px"; s.borderRadius="12px";
       s.background="rgba(15,15,17,0.92)"; s.color="#fff";
       s.font="13px/1.35 -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif";

package/scripts/link_tail.py

@@ -42,6 +42,8 @@ Exit codes:
     2 — argparse / IO failure before we could write any JSON
 """
 
+from __future__ import annotations
+
 import argparse
 import json
 import os
@@ -56,6 +58,62 @@ REPO_DIR = os.path.expanduser("~/social-autoposter")
 RUN_CLAUDE_SH = os.path.join(REPO_DIR, "scripts", "run_claude.sh")
 CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
 
+# --- X/Twitter length budget -------------------------------------------------
+# X charges a FLAT 23 characters for any http/https URL (t.co wrapping),
+# regardless of the link's real length. So the budget is fixed: text + 23 <= 280
+# => at most 257 characters of text before the link. We only enforce this for
+# twitter; reddit/linkedin have far larger ceilings and need no tail trim.
+TWEET_LIMIT = 280
+URL_WEIGHT = 23
+TWITTER_TEXT_BUDGET = TWEET_LIMIT - URL_WEIGHT  # 257 chars for everything but the URL
+_URL_RE = re.compile(r"https?://\S+")
+
+
+def x_weighted_len(text: str) -> int:
+    """Character count the way X computes it: every URL counts as 23."""
+    if not text:
+        return 0
+    return len(_URL_RE.sub("x" * URL_WEIGHT, text))
+
+
+def _trim_to_chars(s: str, max_chars: int) -> str:
+    """Trim `s` to at most `max_chars`, backing off to a word boundary so we
+    never chop mid-word, then stripping trailing punctuation/space."""
+    s = s.strip()
+    if max_chars <= 0:
+        return ""
+    if len(s) <= max_chars:
+        return s
+    cut = s[:max_chars].rstrip()
+    sp = cut.rfind(" ")
+    # only back off to the word boundary when it doesn't gut more than half
+    if sp > max_chars * 0.5:
+        cut = cut[:sp]
+    return cut.rstrip(" ,;:-")
+
+
+def enforce_budget(text: str, link_url: str,
+                   limit: int = TWEET_LIMIT) -> tuple[str, bool]:
+    """Guarantee x_weighted_len(text) <= limit by trimming the BODY, never the
+    link. The link is the most important part of the reply and always stays at
+    the end. Returns (text, was_trimmed)."""
+    if x_weighted_len(text) <= limit:
+        return text, False
+    if link_url and link_url in text:
+        head, _, tail = text.rpartition(link_url)
+        head = head.rstrip()
+        tail = tail.strip()  # normally empty; the URL ends the reply
+        # Budget left for the body after reserving the URL (23) + a joining
+        # space + any (rare) trailing chars after the URL.
+        max_head = limit - URL_WEIGHT - 1 - len(tail)
+        trimmed_head = _trim_to_chars(head, max_head)
+        joined = (trimmed_head + " " + link_url).strip()
+        if tail:
+            joined = (joined + " " + tail).strip()
+        return joined, True
+    # No link present (shouldn't happen on the twitter path): hard word-trim.
+    return _trim_to_chars(text, limit), True
+
 
 def resolve_voice_relationship(project: str) -> str:
     """Look up the matched project's `voice_relationship` field in config.json.
@@ -151,6 +209,26 @@ def build_prompt(*, reply_text: str, link_url: str, thread_text: str,
             f"  - \"we ship the same recall-on-revisit pattern in {project}, scores against a 4-axis rubric, {link_url}\""
         )
 
+    # X-specific hard length budget. Pass the agent the current body length AND
+    # the budget so it self-fits by compressing the body, keeping the link at
+    # the end. Other platforms (reddit/linkedin) have far larger ceilings, so we
+    # add no tight cap there.
+    length_rule = ""
+    if platform == "twitter":
+        body_len = len(reply_text or "")
+        length_rule = (
+            f"HARD LENGTH LIMIT (X counts EVERY link as exactly 23 characters, "
+            f"no matter how long it looks):\n"
+            f"- The entire final reply must be \u2264 {TWEET_LIMIT} characters with "
+            f"the URL counted as {URL_WEIGHT}. That means everything EXCEPT the "
+            f"URL must total \u2264 {TWITTER_TEXT_BUDGET} characters.\n"
+            f"- The drafted body is currently {body_len} characters. If body + "
+            f"bridge would exceed {TWITTER_TEXT_BUDGET} chars of text, COMPRESS "
+            f"the body to make room: tighten wording, drop the weakest clause, "
+            f"but keep the single strongest claim and keep the URL at the very "
+            f"end. Never drop or move the link.\n"
+        )
+
     return f"""You are writing the FINAL bridge sentence that folds a product link into a social media reply we already drafted. This is a one-shot task. Output ONLY the bridge sentence (no preamble, no explanation, no quotes).
 
 PLATFORM: {platform}
@@ -159,6 +237,8 @@ LANDING PAGE URL: {link_url}
 
 {voice_rule}
 
+{length_rule}
+
 ORIGINAL THREAD WE ARE REPLYING TO:
 {thread_text}
 
@@ -289,7 +369,8 @@ THIRD_PARTY_VOICE_VIOLATIONS = (
 
 
 def passes_quality_gate(final_text: str, link_url: str,
-                        voice_relationship: str = "first_party"
+                        voice_relationship: str = "first_party",
+                        limit: int | None = None
                         ) -> tuple[bool, str]:
     """Return (passes, reason_if_not).
 
@@ -327,6 +408,12 @@ def passes_quality_gate(final_text: str, link_url: str,
     # Length sanity: model returning a 5-word stub is a fail.
     if len(final_text.split()) < 8:
         return (False, "too_short")
+    # Upper-length backstop (twitter): X-weighted length must fit the cap. The
+    # caller trims the body to fit BEFORE the gate, so this should only trip on
+    # a degenerate trim; on trip we fall back to the (also budget-enforced)
+    # mechanical concat.
+    if limit is not None and x_weighted_len(final_text) > limit:
+        return (False, f"too_long:{x_weighted_len(final_text)}>{limit}")
     return (True, "")
 
 
@@ -375,6 +462,8 @@ def main() -> int:
         return 0
 
     voice_relationship = args.voice_relationship or resolve_voice_relationship(args.project)
+    # Length cap is X-specific; reddit/linkedin pass None (no tail trim).
+    limit = TWEET_LIMIT if args.platform == "twitter" else None
     prompt = build_prompt(
         reply_text=reply_text, link_url=link_url,
         thread_text=(args.thread_text or "").strip()[:2000],
@@ -388,12 +477,16 @@ def main() -> int:
     elapsed = round(time.time() - started, 2)
 
     if not ok:
+        fb_text, fb_trim = enforce_budget(
+            mechanical_fallback(reply_text, link_url), link_url,
+            limit if limit is not None else TWEET_LIMIT * 100)
         out = {
             "ok": True,
-            "text": mechanical_fallback(reply_text, link_url),
+            "text": fb_text,
             "tail": link_url,
             "model_call_ok": False,
             "fallback_used": True,
+            "budget_trimmed": fb_trim,
             "error": err or "model_call_failed",
             "elapsed_sec": elapsed,
         }
@@ -401,15 +494,26 @@ def main() -> int:
         return 0
 
     cleaned = clean_output(raw)
+    # Trim the body to fit BEFORE the gate so a good model bridge is preserved
+    # (we trim the body, never the link) instead of being thrown away for being
+    # a few chars over. No-op on non-twitter (limit is None).
+    budget_trimmed = False
+    if limit is not None:
+        cleaned, budget_trimmed = enforce_budget(cleaned, link_url, limit)
     passes, reason = passes_quality_gate(cleaned, link_url,
-                                         voice_relationship=voice_relationship)
+                                         voice_relationship=voice_relationship,
+                                         limit=limit)
     if not passes:
+        fb_text, fb_trim = enforce_budget(
+            mechanical_fallback(reply_text, link_url), link_url,
+            limit if limit is not None else TWEET_LIMIT * 100)
         out = {
             "ok": True,
-            "text": mechanical_fallback(reply_text, link_url),
+            "text": fb_text,
             "tail": link_url,
             "model_call_ok": True,
             "fallback_used": True,
+            "budget_trimmed": fb_trim,
             "error": f"quality_gate_failed:{reason}",
             "raw_model_output": raw[:500],
             "elapsed_sec": elapsed,
@@ -436,6 +540,7 @@ def main() -> int:
         "tail": tail,
         "model_call_ok": True,
         "fallback_used": False,
+        "budget_trimmed": budget_trimmed,
         "elapsed_sec": elapsed,
     }
     print(json.dumps(out), flush=True)

package/scripts/log_post.py

@@ -122,30 +122,40 @@ def parse_urn_ids(*sources):
 
 VALID_PLATFORMS = ("reddit", "twitter", "linkedin", "github_issues", "moltbook")
 
-DEFAULT_ACCOUNTS = {
-    "reddit": "Deep_Ad1959",
-    "linkedin": "Matthew Diakonov",
-    "github_issues": "m13v",
-    "moltbook": "matthew-autoposter",
+# Maps log_post's platform strings to account_resolver's platform keys.
+# (log_post uses "github_issues"; account_resolver uses "github".)
+_RESOLVER_PLATFORM = {
+    "twitter": "twitter",
+    "reddit": "reddit",
+    "linkedin": "linkedin",
+    "github_issues": "github",
+    "moltbook": "moltbook",
 }
 
 
 def _resolve_default_account(platform: str) -> str:
-    """Return the canonical account handle for `platform` on this machine.
+    """Return the configured account handle for `platform` on this machine.
 
-    Twitter is multi-machine-aware: each machine declares its own handle via
-    `AUTOPOSTER_TWITTER_HANDLE` env or `accounts.twitter.handle` in
-    config.json, and `twitter_account.resolve_handle()` returns the
-    normalized form (no `@` prefix). Other platforms keep their static
-    defaults until each gets the same multi-machine treatment.
+    Resolved ONLY from env (`AUTOPOSTER_<PLATFORM>_*`) or config.json
+    (`accounts.<platform>.*`) via account_resolver. There are NO hardcoded
+    handle fallbacks: a misconfigured install must never silently post under
+    another person's identity. The old per-platform defaults
+    (m13v_/Deep_Ad1959/Matthew Diakonov/m13v/matthew-autoposter) did exactly
+    that, stamping every unconfigured install's rows with the repo owner's
+    handle and polluting the shared DB across accounts.
 
-    Returns empty string when nothing is configured; the caller's
+    Returns "" when nothing is configured; the caller's
     `args.account or _resolve_default_account(...)` chain still lets an
-    explicit `--account` flag win.
+    explicit `--account` flag win, and an empty value surfaces the misconfig
+    instead of impersonating someone.
     """
-    if platform == "twitter":
-        return resolve_twitter_handle() or ""
-    return DEFAULT_ACCOUNTS.get(platform, "")
+    try:
+        import account_resolver
+        return account_resolver.resolve(
+            _RESOLVER_PLATFORM.get(platform, platform)
+        ) or ""
+    except Exception:
+        return ""
 
 
 def coerce_engagement_style(args):

package/scripts/release-mcpb.sh

@@ -1,21 +1,35 @@
 #!/usr/bin/env bash
-# One-command release pipeline for the social-autoposter .mcpb (Story B double-click install).
+# THE single release flow for social-autoposter. One command does EVERYTHING and
+# keeps the npm path (Story A) and the .mcpb double-click path (Story B) on one
+# version, because both derive from one bumped repo-root package.json.
 #
 # What it does, end to end:
-#   1. Resolve the release version from the repo-root package.json (or --tag override).
-#   2. Build the MCP bundle: vite (panel) + tsc (server) + bundle-pipeline (embeds npm tarball).
-#   3. Stamp mcp/dist/version.json so the bundle self-reports the right version.
+#   1. Bump the repo-root package.json (the SINGLE source of truth) and lockfile.
+#      Default: patch bump. --bump minor|major, or pin with --version / --tag,
+#      or --no-bump to re-release the current version as-is.
+#   2. Build the MCP bundle: vite (panel) + tsc (server) + bundle-pipeline. The
+#      embedded pipeline.tgz is `npm pack` of the (now-bumped) repo, so the shell
+#      and the bundled Python pipeline CANNOT diverge.
+#   3. Stamp dist/version.json + manifest.json + mcp/package.json(+lock) to match.
 #   4. Pack mcp/ into mcp/social-autoposter.mcpb via the mcpb CLI.
-#   5. Verify the bundle (size cap, embedded pipeline.tgz, stamped version, install tools).
-#   6. Create (or update) the GitHub release vX.Y.Z and upload the .mcpb as an asset.
+#   5. Verify: size cap, embedded pipeline.tgz present, version.json + manifest +
+#      the pipeline.tgz's OWN internal version all == VERSION (the guard that was
+#      missing when 1.6.84 shipped a 1.6.83 pipeline), install tools present.
+#   6. npm publish social-autoposter@VERSION (idempotent; skipped if already live).
+#   7. Create/update GitHub release vX.Y.Z and upload the .mcpb (--clobber).
 #
-# Re-running for the same version is idempotent: the asset is re-uploaded with --clobber.
+# Boxes self-update from the GitHub release: the menu-bar updater polls
+# releases/latest, pulls the new .mcpb, and on next server boot
+# ensurePipelineCurrent() re-extracts pipeline.tgz. No manual box step needed.
 #
 # Usage:
-#   bash scripts/release-mcpb.sh              # version from package.json
-#   bash scripts/release-mcpb.sh --tag v1.6.56
-#   bash scripts/release-mcpb.sh --no-release # build + pack + verify only, skip GitHub
-#   bash scripts/release-mcpb.sh --draft      # create the GitHub release as a draft
+#   bash scripts/release-mcpb.sh                 # patch bump, npm + .mcpb + GitHub
+#   bash scripts/release-mcpb.sh --bump minor
+#   bash scripts/release-mcpb.sh --version 1.7.0 # pin an exact version
+#   bash scripts/release-mcpb.sh --no-bump       # re-release current package.json version
+#   bash scripts/release-mcpb.sh --no-npm        # skip npm publish (only .mcpb + GitHub)
+#   bash scripts/release-mcpb.sh --no-release    # build + pack + verify only (no npm, no GitHub)
+#   bash scripts/release-mcpb.sh --draft         # GitHub release as a draft
 
 set -euo pipefail
 
@@ -29,38 +43,82 @@ GH_REPO="m13v/social-autoposter"
 SIZE_CAP_MB=180
 
 TAG_OVERRIDE=""
+VERSION_OVERRIDE=""
 DO_RELEASE=1
+DO_NPM=1
+DO_BUMP=1
+BUMP_LEVEL="patch"
 DRAFT_FLAG=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --tag) TAG_OVERRIDE="$2"; shift 2 ;;
     --tag=*) TAG_OVERRIDE="${1#*=}"; shift ;;
+    --version) VERSION_OVERRIDE="$2"; shift 2 ;;
+    --version=*) VERSION_OVERRIDE="${1#*=}"; shift ;;
+    --bump) BUMP_LEVEL="$2"; shift 2 ;;
+    --bump=*) BUMP_LEVEL="${1#*=}"; shift ;;
+    --no-bump) DO_BUMP=0; shift ;;
+    --no-npm) DO_NPM=0; shift ;;
     --no-release) DO_RELEASE=0; shift ;;
     --draft) DRAFT_FLAG="--draft"; shift ;;
-    -h|--help) sed -n '2,30p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,38p' "$0"; exit 0 ;;
     *) echo "unknown arg: $1" >&2; exit 2 ;;
   esac
 done
 
+case "$BUMP_LEVEL" in
+  patch|minor|major) ;;
+  *) echo "invalid --bump level: $BUMP_LEVEL (want patch|minor|major)" >&2; exit 2 ;;
+esac
+
 say() { printf '\n\033[1m==> %s\033[0m\n' "$*"; }
 die() { printf '\033[1mERROR:\033[0m %s\n' "$*" >&2; exit 1; }
 
 command -v node >/dev/null || die "node not found on PATH"
 command -v mcpb >/dev/null || die "mcpb CLI not found (npm i -g @anthropic-ai/mcpb)"
 
-# ---- 1. Resolve version -----------------------------------------------------
+# ---- 1. Resolve + WRITE version into the repo-root package.json -------------
+# The repo-root package.json is the SINGLE source of truth: `npm pack` reads it
+# to build the embedded pipeline.tgz, so the bundle shell and the bundled
+# pipeline cannot diverge as long as we bump it BEFORE building (step 2). This
+# closes the 1.6.84-class bug where the shell said X but pipeline.tgz carried
+# the prior version because only the satellites were stamped.
 PKG_VERSION="$(node -p "require('$REPO_ROOT/package.json').version")"
-if [[ -n "$TAG_OVERRIDE" ]]; then
-  TAG="$TAG_OVERRIDE"
-  VERSION="${TAG#v}"
+if [[ -n "$VERSION_OVERRIDE" ]]; then
+  VERSION="${VERSION_OVERRIDE#v}"
+elif [[ -n "$TAG_OVERRIDE" ]]; then
+  VERSION="${TAG_OVERRIDE#v}"
+elif [[ "$DO_BUMP" == "1" ]]; then
+  # Compute the next version without writing a git tag; we own the write below.
+  VERSION="$(node -e "
+    let [a,b,c]='$PKG_VERSION'.split('.').map(Number);
+    const lvl='$BUMP_LEVEL';
+    if(lvl==='major'){a++;b=0;c=0;} else if(lvl==='minor'){b++;c=0;} else {c++;}
+    console.log(a+'.'+b+'.'+c);
+  ")"
 else
   VERSION="$PKG_VERSION"
-  TAG="v$VERSION"
 fi
-say "Releasing social-autoposter .mcpb $TAG (package.json=$PKG_VERSION)"
+TAG="v$VERSION"
+
+# Write the resolved version into the repo-root package.json + lockfile so the
+# pipeline tarball, npm publish, and all satellites share one number.
 if [[ "$VERSION" != "$PKG_VERSION" ]]; then
-  echo "  note: tag version ($VERSION) differs from package.json ($PKG_VERSION)"
+  say "Bumping repo-root package.json $PKG_VERSION -> $VERSION"
+  node -e "
+    const fs=require('fs');
+    for (const p of ['$REPO_ROOT/package.json','$REPO_ROOT/package-lock.json']) {
+      if (!fs.existsSync(p)) continue;
+      const j=JSON.parse(fs.readFileSync(p,'utf8'));
+      j.version='$VERSION';
+      if (j.packages && j.packages['']) j.packages[''].version='$VERSION';
+      fs.writeFileSync(p, JSON.stringify(j,null,2)+'\n');
+      console.log('  '+p.replace('$REPO_ROOT/','')+' -> '+j.version);
+    }
+  "
+else
+  say "Releasing $TAG (repo-root package.json already $VERSION)"
 fi
 
 # ---- 2. Build the bundle ----------------------------------------------------
@@ -128,6 +186,14 @@ MANIFEST_VER=$(unzip -p "$BUNDLE" manifest.json 2>/dev/null | node -p "JSON.pars
 [[ "$MANIFEST_VER" == "$VERSION" ]] || die "bundle manifest.json=$MANIFEST_VER != $VERSION (Desktop Details panel would show the wrong version)"
 echo "  manifest.json: $MANIFEST_VER ok"
 
+# THE guard that was missing when 1.6.84 shipped a 1.6.83 pipeline: assert the
+# version INSIDE the embedded pipeline.tgz matches the bundle. ensurePipelineCurrent()
+# on the box trusts version.json to decide whether to re-extract; if the tarball's
+# own package.json lags, the box materializes stale Python and never knows.
+PIPELINE_VER=$(unzip -p "$BUNDLE" dist/pipeline.tgz 2>/dev/null | tar -xzO package/package.json 2>/dev/null | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version" 2>/dev/null || echo "?")
+[[ "$PIPELINE_VER" == "$VERSION" ]] || die "embedded pipeline.tgz version=$PIPELINE_VER != $VERSION (box would materialize a STALE pipeline; bump repo-root package.json BEFORE build)"
+echo "  pipeline.tgz internal version: $PIPELINE_VER ok"
+
 for f in "dist/index.js" "dist/runtime.js" "manifest.json"; do
   # grep -c reads all input (no SIGPIPE); anchor on the time column + 3-space
   # gutter so node_modules/.../dist/index.js does not false-match the top-level.
@@ -141,7 +207,30 @@ if [[ "$DO_RELEASE" == "0" ]]; then
   exit 0
 fi
 
-# ---- 6. GitHub release ------------------------------------------------------
+# ---- 6. npm publish (Story A: `npx social-autoposter@<v> init`) -------------
+# Same VERSION as the bundle, from the SAME bumped repo-root package.json, so the
+# npm install path and the .mcpb path can never disagree. Idempotent: a version
+# already on the registry is skipped, not failed.
+if [[ "$DO_NPM" == "1" ]]; then
+  command -v npm >/dev/null || die "npm not found on PATH"
+  NPM_HTTP=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/social-autoposter/$VERSION" || echo "000")
+  if [[ "$NPM_HTTP" == "200" ]]; then
+    say "npm: social-autoposter@$VERSION already published — skipping"
+  else
+    say "Publishing social-autoposter@$VERSION to npm"
+    ( cd "$REPO_ROOT" && npm publish ) || die "npm publish failed"
+    # Confirm it actually landed (granular-token whoami lies; a version fetch doesn't).
+    for _ in 1 2 3 4 5; do
+      sleep 2
+      [[ "$(curl -s -o /dev/null -w '%{http_code}' "https://registry.npmjs.org/social-autoposter/$VERSION")" == "200" ]] && break
+    done
+    echo "  npm: social-autoposter@$VERSION live"
+  fi
+else
+  say "npm publish skipped (--no-npm)"
+fi
+
+# ---- 7. GitHub release ------------------------------------------------------
 command -v gh >/dev/null || die "gh CLI not found"
 gh auth status >/dev/null 2>&1 || die "gh not authenticated (run: gh auth login)"
 

package/scripts/twitter_browser.py

@@ -33,6 +33,7 @@ import json
 import os
 import random
 import re
+import signal
 import subprocess
 import sys
 import time
@@ -40,27 +41,51 @@ import time
 
 LOCK_FILE = os.path.expanduser("~/.claude/twitter-browser-lock.json")
 LOCK_EXPIRY = 300  # process-level mutex TTL; refreshed during long ops
+# Posting-specific silence ceiling, DECOUPLED from the fleet-wide LOCK_EXPIRY.
+# A role:"post" holder (an approved batch, or a single reply) is reclaimed by a
+# peer once its lock has gone unrefreshed this long; a role:"scan" holder keeps
+# the 300s LOCK_EXPIRY untouched. Posting refreshes the lock at every candidate
+# boundary (twitter_post_plan holds it across the whole batch), so a healthy
+# poster never goes silent this long -- only a genuinely hung poster (e.g.
+# link_tail's `claude -p` wedged) trips it. Kept as its own knob so tuning the
+# scan TTL never moves the poster's hang ceiling and vice-versa. Must exceed the
+# worst-case single candidate step (one reply + the link_tail AI call), and stay
+# well under any value that would let a hung poster block the browser for long.
+POST_LOCK_EXPIRY = 180  # seconds; applies ONLY to a role:"post" holder
 LOCK_WAIT_MAX = 45  # seconds to wait for lock to free before giving up
 LOCK_POLL_INTERVAL = 2
+PREEMPT_KILL_WAIT = 5  # secs to wait for a preempted scan holder to die before SIGKILL
+
+# Lock role priority. A "post" holder is user-initiated (an approved reply) and
+# outranks any "scan" holder (the scan/draft cycle, autopilot or plugin). When a
+# poster finds a LIVE lower-priority holder it PREEMPTS it (SIGTERM + reclaim)
+# instead of waiting LOCK_WAIT_MAX and giving up. This is what makes "posting
+# takes priority over scanning" hold CROSS-PROCESS: the old in-process
+# preemptScanForPost only killed the plugin's own scan, never a scan spawned by a
+# separate autopilot agent / launchd cron, so an approved post kept losing the
+# 45s race to a live scan that held the browser. Default "scan" so any unmarked
+# browser op is preemptable; only the poster path sets SAPS_LOCK_ROLE=post.
+LOCK_ROLE = (os.environ.get("SAPS_LOCK_ROLE") or "scan").strip() or "scan"
 VIEWPORT = {"width": 911, "height": 1016}
 
 # Posting handle. Resolved at call time from AUTOPOSTER_TWITTER_HANDLE env
 # var (set by per-account launchd/systemd units) or config.json
-# accounts.twitter.handle. The "m13v_" fallback keeps the Mac default working
-# when neither source is set, but on the VMs the env var MUST be set so the
-# DOM scrape + CDP URL build target the right profile.
-_DEFAULT_HANDLE = "m13v_"
-
+# accounts.twitter.handle. Returns None when neither source is set.
+#
+# There is intentionally NO hardcoded fallback handle. The old "m13v_"
+# default meant any install with an unset handle silently posted under the
+# repo owner's identity: it stamped posts.our_account = m13v_ and built reply
+# permalinks as x.com/m13v_/status/<id> for tweets that actually belonged to a
+# different account, corrupting attribution in the shared DB. Callers that
+# build a URL or post under this identity MUST treat None as "account not
+# configured" and refuse, rather than impersonate someone.
 def our_handle():
     try:
         sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
         import account_resolver
-        h = account_resolver.resolve("twitter")
-        if h:
-            return h
+        return account_resolver.resolve("twitter")
     except Exception:
-        pass
-    return _DEFAULT_HANDLE
+        return None
 
 # DM encryption passcode from .env
 DM_PASSCODE = os.environ.get("TWITTER_DM_PASSCODE", "")
@@ -297,13 +322,45 @@ def _try_take_lock() -> bool:
         return False
     try:
         os.write(fd, json.dumps(
-            {"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time())}
+            {"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time()), "role": LOCK_ROLE}
         ).encode())
     finally:
         os.close(fd)
     return True
 
 
+def _preempt_holder(pid: int) -> bool:
+    """Preempt a live lock holder we outrank (a poster taking the browser from a
+    scan). SIGTERM it, wait PREEMPT_KILL_WAIT for it to die so its pid frees the
+    lock, then escalate to SIGKILL once. Returns True once the holder is gone
+    (or was already gone). Best-effort; never raises. The caller then removes the
+    stale lockfile and claims it via O_EXCL.
+    """
+    try:
+        os.kill(pid, signal.SIGTERM)
+    except ProcessLookupError:
+        return True            # already gone
+    except OSError:
+        return False           # not ours to signal / ambiguous -> don't claim
+    deadline = time.time() + PREEMPT_KILL_WAIT
+    while time.time() < deadline:
+        try:
+            os.kill(pid, 0)
+        except OSError:
+            return True        # ProcessLookupError or perm change -> dead enough
+        time.sleep(0.2)
+    # Still alive after the SIGTERM grace window -> escalate once.
+    try:
+        os.kill(pid, signal.SIGKILL)
+    except OSError:
+        pass
+    try:
+        os.kill(pid, 0)
+    except OSError:
+        return True
+    return False
+
+
 def _acquire_browser_lock():
     """Acquire the Twitter browser session mutex (~/.claude/twitter-browser-lock.json).
 
@@ -377,6 +434,7 @@ def _acquire_browser_lock():
             continue
         age = time.time() - lock.get("timestamp", 0)
         holder = lock.get("session_id", "")
+        holder_role = lock.get("role", "scan")  # legacy locks (no role) = preemptable
 
         # 1. Re-entrant: the lock is already ours (same process, or a stale lock
         # left by a previous process whose PID we have since reused). Refresh the
@@ -385,6 +443,29 @@ def _acquire_browser_lock():
             _refresh_browser_lock()
             break
 
+        # 1b. Batch-owner inherit (posting). The poster (twitter_post_plan.py)
+        # acquires this lock ONCE and holds it across the WHOLE approved batch,
+        # exporting its own session id as SAPS_LOCK_OWNER for the child
+        # twitter_browser.py reply subprocesses it spawns. Each child INHERITS the
+        # parent's hold instead of contending for it -- two role:"post" peers would
+        # otherwise both fall to the case-6 peer-wait and give up after
+        # LOCK_WAIT_MAX, breaking the post. The child refreshes the timestamp
+        # (proof of progress at this candidate boundary, so the POST_LOCK_EXPIRY
+        # failsafe only ever fires on a real hang) and, being _LOCK_INHERITED,
+        # leaves the lock in place for the PARENT to release at batch end. A DEAD
+        # owner is never inherited: the alive-probe fails here and we fall through
+        # to the dead_python reclaim below, so a crashed batch can't wedge the
+        # browser. This is what closes the inter-candidate gap (the link_tail
+        # claude -p call, ~5-20s) the every-60s autopilot scan used to slip into.
+        _batch_owner = os.environ.get("SAPS_LOCK_OWNER") or ""
+        if holder and holder == _batch_owner and _is_python_holder_alive(holder):
+            _LOCK_SESSION_ID = holder
+            _LOCK_INHERITED = True
+            _refresh_browser_lock()
+            print(f"[browser_lock] inherited batch owner={holder} "
+                  f"role={holder_role} -> pid={os.getpid()}", file=sys.stderr)
+            break
+
         # 2-4. Reclaim a holder we can prove is dead/expired. Remove-then-take so
         # the O_EXCL claim wins; if a peer reclaims at the same instant exactly
         # one of us creates the file and the other re-loops (never both).
@@ -393,7 +474,10 @@ def _acquire_browser_lock():
             reclaim_reason = "dead_uuid"
         elif holder.startswith("python:") and not _is_python_holder_alive(holder):
             reclaim_reason = "dead_python"
-        elif age >= LOCK_EXPIRY:
+        elif age >= (POST_LOCK_EXPIRY if holder_role == "post" else LOCK_EXPIRY):
+            # Role-aware failsafe: a hung poster self-clears on the posting-only
+            # POST_LOCK_EXPIRY, a scan on the fleet-wide LOCK_EXPIRY. Scan
+            # behaviour is unchanged; only the post ceiling is decoupled.
             reclaim_reason = "expired"
         if reclaim_reason:
             try:
@@ -415,6 +499,43 @@ def _acquire_browser_lock():
             _LOCK_INHERITED = True
             break
 
+        # 5b. POSTING PRIORITY (cross-process). A LIVE python:PID peer running a
+        # lower-priority op (role != "post": the scan/draft cycle, whether the
+        # plugin's own, a separate autopilot agent's, or the launchd cron's) must
+        # YIELD to an approved post. Preempt it by signal and reclaim, so the post
+        # takes the browser at once instead of waiting LOCK_WAIT_MAX and giving up
+        # while the scan holds it. The aborted scan just re-runs next cron tick;
+        # posting is the scarce, user-initiated action. Only a poster
+        # (LOCK_ROLE == "post") ever preempts, and only a non-post holder -- two
+        # posters fall through to the normal peer-wait below so neither kills the
+        # other. UUID holders are handled above (we inherit, never kill those).
+        if (
+            LOCK_ROLE == "post"
+            and holder.startswith("python:")
+            and holder_role != "post"
+            and _is_python_holder_alive(holder)
+        ):
+            try:
+                victim_pid = int(holder.split(":", 1)[1])
+            except (ValueError, IndexError):
+                victim_pid = 0
+            if victim_pid and _preempt_holder(victim_pid):
+                try:
+                    os.remove(LOCK_FILE)
+                except OSError:
+                    pass
+                if _try_take_lock():
+                    print(
+                        f"[browser_lock] post preempted holder={holder} "
+                        f"role={holder_role} age={int(age)}s -> pid={os.getpid()}",
+                        file=sys.stderr,
+                    )
+                    break
+            # Preempt didn't land (couldn't kill, or a peer reclaimed first) ->
+            # re-loop and re-evaluate rather than busy-spin.
+            time.sleep(LOCK_POLL_INTERVAL)
+            continue
+
         # 6. Live python:PID peer. Wait, then give up. Reaching the deadline now
         # means the holder is a genuinely LIVE peer (dead ones were reclaimed
         # above), i.e. real contention -- NOT the defect-a starvation. The
@@ -433,7 +554,7 @@ def _refresh_browser_lock():
     """Refresh the lock timestamp to prevent expiry during long operations."""
     try:
         with open(LOCK_FILE, "w") as f:
-            json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time())}, f)
+            json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time()), "role": LOCK_ROLE}, f)
     except OSError:
         pass
 
@@ -820,6 +941,18 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
     """
     print(f"[twitter_browser] reply_to_tweet called: {tweet_url}", file=sys.stderr)
 
+    # Identity gate: refuse to post when no account is configured. Without a
+    # resolved handle we cannot attribute the post or build a correct reply
+    # permalink, and the old behaviour silently impersonated the repo owner
+    # (handle "m13v_"). Fail fast and loud so the misconfiguration surfaces
+    # instead of polluting the shared DB under someone else's identity.
+    _handle = our_handle()
+    if not _handle:
+        print("[twitter_browser] no twitter account configured "
+              "(set AUTOPOSTER_TWITTER_HANDLE or accounts.twitter.handle in "
+              "config.json); refusing to post.", file=sys.stderr)
+        return {"ok": False, "error": "no_account_configured"}
+
     applied_campaigns = []
     if apply_campaigns:
         for cid, suffix, sample_rate in _load_active_twitter_campaigns():
@@ -946,7 +1079,17 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
                         page.goto(tweet_url, wait_until="domcontentloaded", timeout=60000)
                     except Exception:
                         pass
-                page.wait_for_timeout(15000 if nav_attempt == 1 else 8000)
+                # Was a blind 15s/8s settle here -> pure dead latency. SPA
+                # readiness is ALREADY gated actively below by
+                # wait_for_selector("main") (up to 20s) and
+                # _wait_for_reply_textbox (polls every 500ms up to 45s); both
+                # return the instant the composer mounts, so the blind sleep
+                # only delayed the start of that polling. Keep a short floor so
+                # the initial JS kicks off (and the deleted-tweet text check
+                # below has content to read), then let the active gates do the
+                # real waiting. Cuts ~12s off every happy-path reply.
+                # (optimized 2026-06-22: 15000/8000 -> 2500)
+                page.wait_for_timeout(2500)
 
                 # `wait_until="load"` fires before Twitter's SPA mounts the
                 # <main> app shell, so "loaded" != "rendered". Explicitly gate
@@ -1021,7 +1164,12 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
             except Exception:
                 page.keyboard.press("Meta+Enter")
 
-            page.wait_for_timeout(4000)
+            # Post-submit settle: lets the CDP network response (which carries
+            # the new tweet id -> reply_url, captured below) and the success
+            # interstitial arrive. Trimmed from 4000ms 2026-06-22; the DOM-diff
+            # fallback (3x2s, below) still covers a slow CDP response, so the
+            # reply_url is not lost if 2000ms is short on a given run.
+            page.wait_for_timeout(2000)
 
             # Verify: check if the reply box is empty (cleared after posting)
             try:
@@ -1050,7 +1198,7 @@ def reply_to_tweet(tweet_url, text, apply_campaigns=True):
 
             # Method 1: CDP network interception (most reliable)
             if _created_tweet_ids:
-                reply_url = f"https://x.com/{our_handle()}/status/{_created_tweet_ids[-1]}"
+                reply_url = f"https://x.com/{_handle}/status/{_created_tweet_ids[-1]}"
                 print(f"[reply_url] captured via CDP+response-listener: {reply_url}", file=sys.stderr)
 
             # Method 2: DOM diff (check if new reply links appeared)

package/scripts/twitter_post_plan.py

@@ -49,6 +49,14 @@ import time
 from datetime import datetime, timezone
 from pathlib import Path
 
+# This pipeline ONLY posts (never scans), so mark every twitter_browser.py reply
+# subprocess it spawns as the high-priority "post" lock role. run_subprocess
+# inherits this process env, so the child twitter_browser.py reads SAPS_LOCK_ROLE
+# at import and will PREEMPT a live scan holding the browser lock instead of
+# losing the 45s wait. Covers BOTH the MCP approve path and the cron post path,
+# since both shell out to this script. Set before any child is spawned.
+os.environ["SAPS_LOCK_ROLE"] = "post"
+
 REPO_DIR = os.path.expanduser("~/social-autoposter")
 TWITTER_BROWSER = os.path.join(REPO_DIR, "scripts", "twitter_browser.py")
 LOG_POST = os.path.join(REPO_DIR, "scripts", "log_post.py")
@@ -1009,11 +1017,58 @@ def main() -> int:
             return 3
 
     _total = len(candidates)
+
+    # ---- Batch-level browser-lock hold (cross-process posting priority) --------
+    # Hold the Twitter browser lock for the WHOLE approved batch instead of
+    # re-acquiring it per candidate. Per-candidate acquisition freed the lock in
+    # the gap between replies (dominated by link_tail's `claude -p` call, ~5-20s),
+    # and the autopilot scan fires every 60s, so a scan kept slipping into that gap
+    # and seizing the browser mid-batch -- the exact "posting gets cut off" symptom
+    # on the remote box. Acquiring ONCE here PREEMPTS any live scan (role:"post"
+    # priority) and, by exporting our session id as SAPS_LOCK_OWNER, makes every
+    # child twitter_browser.py reply INHERIT this hold rather than contend for it,
+    # closing the gap. The hold is bounded by the posting-specific POST_LOCK_EXPIRY
+    # failsafe in twitter_browser (a hung poster self-clears in <=180s; a crashed
+    # one frees instantly via dead-pid reclaim), so it can never wedge the browser
+    # indefinitely. Best-effort: if the import or acquire fails we simply fall back
+    # to the legacy per-candidate acquisition (children still preempt scans one by
+    # one), so posting degrades gracefully and is never blocked by this addition.
+    _tb = None
+    _batch_lock_held = False
+    if candidates:
+        try:
+            import twitter_browser as _tb  # SAPS_LOCK_ROLE=post already set above
+            _tb._acquire_browser_lock()    # preempts a live scan; sys.exit(1) if contended
+            os.environ["SAPS_LOCK_OWNER"] = _tb._LOCK_SESSION_ID
+            _batch_lock_held = True
+            print(f"[post] batch lock held by {_tb._LOCK_SESSION_ID} (role=post); "
+                  f"{_total} candidate(s) inherit it", flush=True)
+        except SystemExit:
+            # _acquire_browser_lock exits when a LIVE non-preemptable peer (another
+            # poster) holds the lock past LOCK_WAIT_MAX. Don't abort the whole run:
+            # drop to per-candidate acquisition (each child still preempts scans).
+            print("[post] batch lock contended; per-candidate acquisition in effect",
+                  flush=True)
+        except Exception as _e:
+            print(f"[post] batch lock setup skipped ({_e}); per-candidate "
+                  "acquisition in effect", flush=True)
+
     try:
         for _idx, c in enumerate(candidates, start=1):
             # Live per-post status for the S4L menu bar: "posting 3/10" while this
             # one is in flight, then "posted 3/10 ✓" once it lands. Cosmetic only.
             _write_activity(f"posting {_idx}/{_total}")
+            # Re-stamp the batch hold at each candidate boundary so the
+            # POST_LOCK_EXPIRY failsafe measures silence from the LAST real
+            # progress, not from batch start. Insurance on top of the child's own
+            # inherit-refresh: keeps the hold fresh even across a candidate that
+            # skips before ever spawning a reply subprocess (empty_reply_text,
+            # pre-post dedup). Cheap; never raises.
+            if _batch_lock_held and _tb is not None:
+                try:
+                    _tb._refresh_browser_lock()
+                except Exception:
+                    pass
             try:
                 outcome, reason = post_one(c, picker_assignment=picker_assignment)
             except Exception as e:
@@ -1039,6 +1094,17 @@ def main() -> int:
                     fail_reasons[reason] = fail_reasons.get(reason, 0) + 1
     finally:
         _clear_activity()
+        # Release the batch hold so the next scan/post can take the browser
+        # immediately (don't make peers wait out POST_LOCK_EXPIRY). _tb's atexit
+        # is a backstop if we somehow skip this; clearing SAPS_LOCK_OWNER stops a
+        # late child from re-inheriting a lock we just dropped.
+        if _batch_lock_held and _tb is not None:
+            try:
+                _tb._release_browser_lock()
+            except Exception:
+                pass
+            os.environ.pop("SAPS_LOCK_OWNER", None)
+            print("[post] batch lock released", flush=True)
 
     summary = {
         "posted": posted,