social-autoposter 1.6.85 → 1.6.86

package/mcp/dist/index.js

@@ -22,7 +22,7 @@ import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, ensurePipelineCurrent, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, captureError, flushSentry, startLogStreaming, flushLogs } from "./telemetry.js";
+import { initSentry, sendHeartbeat, captureError, flushSentry } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -616,7 +616,6 @@ async function postApproved(batchId, plan) {
         });
         void flushSentry(2000);
     }
-    void flushLogs();
     return {
         attempted: approved.length,
         posted: realPosted,
@@ -2384,11 +2383,6 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
 }));
 async function main() {
     initSentry();
-    // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
-    // backend so we can troubleshoot/rescue any user scenario (silent stalls,
-    // partial onboarding) without asking them to ship a log file. Best-effort;
-    // disabled with SAPS_LOG_STREAM=0.
-    startLogStreaming();
     // A plugin UPDATE refreshes this server (dist/) but not the materialized
     // pipeline. Re-extract the bundled pipeline.tgz when it's newer than what's on
     // disk, BEFORE serving, so the very first scan uses the shipped pipeline (not
@@ -2439,7 +2433,6 @@ async function main() {
 main().catch(async (err) => {
     console.error("[social-autoposter-mcp] fatal:", err);
     captureError(err, { component: "main" });
-    await flushLogs();
     await flushSentry();
     process.exit(1);
 });

package/mcp/dist/repo.js

@@ -30,27 +30,6 @@ export function repoDir() {
 // "No drafts in batch ...". Default to /tmp to match the script; allow an explicit
 // override for non-standard installs.
 export const TMP_DIR = process.env.SAPS_TMP_DIR || "/tmp";
-let lineSink = null;
-export function setLineSink(fn) {
-    lineSink = fn;
-}
-// Derive a short, stable context label for a spawned command so log lines can
-// be grouped by which script produced them (e.g. "scripts/seed_search_topics.py",
-// "skill/run-twitter-cycle.sh"). Best-effort; never throws.
-function deriveContext(cmd, args) {
-    try {
-        const base = cmd.split("/").pop() || cmd;
-        if (/python/i.test(base) || base === "bash" || base === "sh" || base === "node") {
-            const first = args.find((a) => !a.startsWith("-"));
-            if (first)
-                return first;
-        }
-        return [base, args[0] ?? ""].join(" ").trim();
-    }
-    catch {
-        return cmd;
-    }
-}
 // Spawn a process inside the repo, inheriting the repo env (API base + keys
 // come from the install's environment / .env loaded by the scripts themselves).
 //
@@ -94,29 +73,6 @@ export function run(cmd, args, opts = {}) {
             }
             return buf;
         };
-        // Parallel whole-line splitter that tees to the telemetry sink (if any),
-        // kept separate from the onLine pump so neither path can affect the other.
-        const logCtx = opts.logContext || deriveContext(cmd, args);
-        let sinkOutBuf = "";
-        let sinkErrBuf = "";
-        const sinkPump = (chunk, which, buf) => {
-            const sink = lineSink;
-            if (!sink)
-                return buf;
-            buf += chunk;
-            let nl;
-            while ((nl = buf.indexOf("\n")) !== -1) {
-                const line = buf.slice(0, nl);
-                buf = buf.slice(nl + 1);
-                try {
-                    sink(line, which, logCtx);
-                }
-                catch {
-                    /* the telemetry sink must never break the wrapped command */
-                }
-            }
-            return buf;
-        };
         let timer;
         if (opts.timeoutMs) {
             timer = setTimeout(() => {
@@ -127,13 +83,11 @@ export function run(cmd, args, opts = {}) {
             const s = d.toString();
             stdout += s;
             outBuf = pump(s, "stdout", outBuf);
-            sinkOutBuf = sinkPump(s, "stdout", sinkOutBuf);
         });
         child.stderr.on("data", (d) => {
             const s = d.toString();
             stderr += s;
             errBuf = pump(s, "stderr", errBuf);
-            sinkErrBuf = sinkPump(s, "stderr", sinkErrBuf);
         });
         child.on("close", (code) => {
             if (timer)
@@ -155,23 +109,6 @@ export function run(cmd, args, opts = {}) {
                         /* ignore */
                     }
             }
-            const sink = lineSink;
-            if (sink) {
-                if (sinkOutBuf)
-                    try {
-                        sink(sinkOutBuf, "stdout", logCtx);
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                if (sinkErrBuf)
-                    try {
-                        sink(sinkErrBuf, "stderr", logCtx);
-                    }
-                    catch {
-                        /* ignore */
-                    }
-            }
             resolve({ code: code ?? -1, stdout, stderr });
         });
         child.on("error", (err) => {

package/mcp/dist/telemetry.js

@@ -9,7 +9,7 @@
 import * as Sentry from "@sentry/node";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, setLineSink } from "./repo.js";
+import { repoDir, runPython } from "./repo.js";
 import { VERSION } from "./version.js";
 // Sentry DSN is a client-side identifier (safe to embed, same posture as Fazm's
 // hardcoded Swift DSN). Overridable via env for dev. Empty -> Sentry disabled.
@@ -102,129 +102,3 @@ export async function sendHeartbeat(reason) {
         console.error("[social-autoposter-mcp] heartbeat failed:", err?.message || err);
     }
 }
-// ---- Raw subprocess log streaming ------------------------------------------
-// Tees the verbatim stdout/stderr of every pipeline subprocess (via the
-// repo.ts run() boundary) to the s4l backend, so we can troubleshoot and
-// rescue any user scenario without asking them to ship a log file. Lines are
-// buffered in memory and flushed in small batches under the same X-Installation
-// identity the heartbeat uses. Best-effort: this NEVER throws into the server,
-// never blocks the child's I/O, and drops on overflow rather than growing
-// unbounded. Disable with SAPS_LOG_STREAM=0.
-const LOG_STREAM_ENABLED = process.env.SAPS_LOG_STREAM !== "0";
-const LOG_MAX_LINE_LEN = 8192; // mirror the backend cap
-const LOG_MAX_BUFFER = 1000; // drop oldest beyond this (overflow protection)
-const LOG_FLUSH_BATCH = 100; // flush eagerly once we have this many lines
-const LOG_MAX_PER_POST = 200; // backend accepts 1-200 per request
-const LOG_FLUSH_MS = 3000; // otherwise flush on this cadence
-const logBuffer = [];
-let logDropped = 0; // count of lines dropped on overflow (surfaced periodically)
-let logFlushing = false;
-let logTimer;
-let cachedInstallHeader = null;
-let logStreamingStarted = false;
-async function installHeader() {
-    if (cachedInstallHeader)
-        return cachedInstallHeader;
-    try {
-        const idScript = path.join(repoDir(), "scripts", "identity.py");
-        if (!fs.existsSync(idScript))
-            return null;
-        const res = await runPython("scripts/identity.py", ["header"], { timeoutMs: 10_000 });
-        const header = (res.stdout || "").trim();
-        if (res.code === 0 && header) {
-            cachedInstallHeader = header;
-            return header;
-        }
-    }
-    catch {
-        /* best-effort */
-    }
-    return null;
-}
-// Buffer one raw line. Called from the repo.ts line sink, so it must be cheap
-// and total non-throwing.
-export function logLine(stream, line, context) {
-    if (!LOG_STREAM_ENABLED)
-        return;
-    try {
-        logBuffer.push({
-            ts: new Date().toISOString(),
-            stream,
-            line: line.length > LOG_MAX_LINE_LEN ? line.slice(0, LOG_MAX_LINE_LEN) : line,
-            context: context || "",
-        });
-        if (logBuffer.length > LOG_MAX_BUFFER) {
-            // Drop oldest to bound memory; the newest lines are the most useful.
-            logDropped += logBuffer.length - LOG_MAX_BUFFER;
-            logBuffer.splice(0, logBuffer.length - LOG_MAX_BUFFER);
-        }
-        if (logBuffer.length >= LOG_FLUSH_BATCH)
-            void flushLogs();
-    }
-    catch {
-        /* never throw into the run() boundary */
-    }
-}
-export async function flushLogs() {
-    if (!LOG_STREAM_ENABLED)
-        return;
-    if (logFlushing || logBuffer.length === 0)
-        return;
-    logFlushing = true;
-    try {
-        const header = await installHeader();
-        if (!header)
-            return; // runtime not unpacked yet; keep buffering
-        const base = (process.env.AUTOPOSTER_API_BASE || "https://s4l.ai").replace(/\/+$/, "");
-        // Drain in <=200-line POSTs until the buffer empties (or a POST fails).
-        while (logBuffer.length > 0) {
-            const batch = logBuffer.splice(0, LOG_MAX_PER_POST);
-            const lines = batch.map((b) => ({
-                ts: b.ts,
-                stream: b.stream,
-                line: b.line,
-                context: b.context || undefined,
-            }));
-            try {
-                const resp = await fetch(`${base}/api/v1/installations/logs`, {
-                    method: "POST",
-                    headers: { "X-Installation": header, "content-type": "application/json" },
-                    body: JSON.stringify({ lines }),
-                    signal: AbortSignal.timeout(15_000),
-                });
-                if (!resp.ok) {
-                    // Drop this batch (don't re-buffer): a persistent 4xx/5xx would grow
-                    // the buffer unbounded. The raw stream is best-effort.
-                    console.error(`[social-autoposter-mcp] log flush http ${resp.status}`);
-                    break;
-                }
-            }
-            catch (err) {
-                // Network blip: drop this batch, stop draining, try again next tick.
-                console.error("[social-autoposter-mcp] log flush failed:", err?.message || err);
-                break;
-            }
-        }
-        if (logDropped > 0) {
-            console.error(`[social-autoposter-mcp] log stream dropped ${logDropped} line(s) on overflow`);
-            logDropped = 0;
-        }
-    }
-    finally {
-        logFlushing = false;
-    }
-}
-// Register the repo.ts line sink and start the periodic flush. Idempotent.
-export function startLogStreaming() {
-    if (!LOG_STREAM_ENABLED || logStreamingStarted)
-        return;
-    logStreamingStarted = true;
-    try {
-        setLineSink((line, stream, context) => logLine(stream, line, context));
-        logTimer = setInterval(() => void flushLogs(), LOG_FLUSH_MS);
-        logTimer.unref();
-    }
-    catch (err) {
-        console.error("[social-autoposter-mcp] log streaming start failed:", err?.message || err);
-    }
-}

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.84",
-  "installedAt": "2026-06-23T02:53:37.786Z"
+  "version": "1.6.86",
+  "installedAt": "2026-06-23T16:16:31.100Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.84",
+  "version": "1.6.86",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.84",
+  "version": "1.6.86",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.85",
+  "version": "1.6.86",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/release-mcpb.sh

@@ -1,21 +1,35 @@
 #!/usr/bin/env bash
-# One-command release pipeline for the social-autoposter .mcpb (Story B double-click install).
+# THE single release flow for social-autoposter. One command does EVERYTHING and
+# keeps the npm path (Story A) and the .mcpb double-click path (Story B) on one
+# version, because both derive from one bumped repo-root package.json.
 #
 # What it does, end to end:
-#   1. Resolve the release version from the repo-root package.json (or --tag override).
-#   2. Build the MCP bundle: vite (panel) + tsc (server) + bundle-pipeline (embeds npm tarball).
-#   3. Stamp mcp/dist/version.json so the bundle self-reports the right version.
+#   1. Bump the repo-root package.json (the SINGLE source of truth) and lockfile.
+#      Default: patch bump. --bump minor|major, or pin with --version / --tag,
+#      or --no-bump to re-release the current version as-is.
+#   2. Build the MCP bundle: vite (panel) + tsc (server) + bundle-pipeline. The
+#      embedded pipeline.tgz is `npm pack` of the (now-bumped) repo, so the shell
+#      and the bundled Python pipeline CANNOT diverge.
+#   3. Stamp dist/version.json + manifest.json + mcp/package.json(+lock) to match.
 #   4. Pack mcp/ into mcp/social-autoposter.mcpb via the mcpb CLI.
-#   5. Verify the bundle (size cap, embedded pipeline.tgz, stamped version, install tools).
-#   6. Create (or update) the GitHub release vX.Y.Z and upload the .mcpb as an asset.
+#   5. Verify: size cap, embedded pipeline.tgz present, version.json + manifest +
+#      the pipeline.tgz's OWN internal version all == VERSION (the guard that was
+#      missing when 1.6.84 shipped a 1.6.83 pipeline), install tools present.
+#   6. npm publish social-autoposter@VERSION (idempotent; skipped if already live).
+#   7. Create/update GitHub release vX.Y.Z and upload the .mcpb (--clobber).
 #
-# Re-running for the same version is idempotent: the asset is re-uploaded with --clobber.
+# Boxes self-update from the GitHub release: the menu-bar updater polls
+# releases/latest, pulls the new .mcpb, and on next server boot
+# ensurePipelineCurrent() re-extracts pipeline.tgz. No manual box step needed.
 #
 # Usage:
-#   bash scripts/release-mcpb.sh              # version from package.json
-#   bash scripts/release-mcpb.sh --tag v1.6.56
-#   bash scripts/release-mcpb.sh --no-release # build + pack + verify only, skip GitHub
-#   bash scripts/release-mcpb.sh --draft      # create the GitHub release as a draft
+#   bash scripts/release-mcpb.sh                 # patch bump, npm + .mcpb + GitHub
+#   bash scripts/release-mcpb.sh --bump minor
+#   bash scripts/release-mcpb.sh --version 1.7.0 # pin an exact version
+#   bash scripts/release-mcpb.sh --no-bump       # re-release current package.json version
+#   bash scripts/release-mcpb.sh --no-npm        # skip npm publish (only .mcpb + GitHub)
+#   bash scripts/release-mcpb.sh --no-release    # build + pack + verify only (no npm, no GitHub)
+#   bash scripts/release-mcpb.sh --draft         # GitHub release as a draft
 
 set -euo pipefail
 
@@ -29,38 +43,82 @@ GH_REPO="m13v/social-autoposter"
 SIZE_CAP_MB=180
 
 TAG_OVERRIDE=""
+VERSION_OVERRIDE=""
 DO_RELEASE=1
+DO_NPM=1
+DO_BUMP=1
+BUMP_LEVEL="patch"
 DRAFT_FLAG=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --tag) TAG_OVERRIDE="$2"; shift 2 ;;
     --tag=*) TAG_OVERRIDE="${1#*=}"; shift ;;
+    --version) VERSION_OVERRIDE="$2"; shift 2 ;;
+    --version=*) VERSION_OVERRIDE="${1#*=}"; shift ;;
+    --bump) BUMP_LEVEL="$2"; shift 2 ;;
+    --bump=*) BUMP_LEVEL="${1#*=}"; shift ;;
+    --no-bump) DO_BUMP=0; shift ;;
+    --no-npm) DO_NPM=0; shift ;;
     --no-release) DO_RELEASE=0; shift ;;
     --draft) DRAFT_FLAG="--draft"; shift ;;
-    -h|--help) sed -n '2,30p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,38p' "$0"; exit 0 ;;
     *) echo "unknown arg: $1" >&2; exit 2 ;;
   esac
 done
 
+case "$BUMP_LEVEL" in
+  patch|minor|major) ;;
+  *) echo "invalid --bump level: $BUMP_LEVEL (want patch|minor|major)" >&2; exit 2 ;;
+esac
+
 say() { printf '\n\033[1m==> %s\033[0m\n' "$*"; }
 die() { printf '\033[1mERROR:\033[0m %s\n' "$*" >&2; exit 1; }
 
 command -v node >/dev/null || die "node not found on PATH"
 command -v mcpb >/dev/null || die "mcpb CLI not found (npm i -g @anthropic-ai/mcpb)"
 
-# ---- 1. Resolve version -----------------------------------------------------
+# ---- 1. Resolve + WRITE version into the repo-root package.json -------------
+# The repo-root package.json is the SINGLE source of truth: `npm pack` reads it
+# to build the embedded pipeline.tgz, so the bundle shell and the bundled
+# pipeline cannot diverge as long as we bump it BEFORE building (step 2). This
+# closes the 1.6.84-class bug where the shell said X but pipeline.tgz carried
+# the prior version because only the satellites were stamped.
 PKG_VERSION="$(node -p "require('$REPO_ROOT/package.json').version")"
-if [[ -n "$TAG_OVERRIDE" ]]; then
-  TAG="$TAG_OVERRIDE"
-  VERSION="${TAG#v}"
+if [[ -n "$VERSION_OVERRIDE" ]]; then
+  VERSION="${VERSION_OVERRIDE#v}"
+elif [[ -n "$TAG_OVERRIDE" ]]; then
+  VERSION="${TAG_OVERRIDE#v}"
+elif [[ "$DO_BUMP" == "1" ]]; then
+  # Compute the next version without writing a git tag; we own the write below.
+  VERSION="$(node -e "
+    let [a,b,c]='$PKG_VERSION'.split('.').map(Number);
+    const lvl='$BUMP_LEVEL';
+    if(lvl==='major'){a++;b=0;c=0;} else if(lvl==='minor'){b++;c=0;} else {c++;}
+    console.log(a+'.'+b+'.'+c);
+  ")"
 else
   VERSION="$PKG_VERSION"
-  TAG="v$VERSION"
 fi
-say "Releasing social-autoposter .mcpb $TAG (package.json=$PKG_VERSION)"
+TAG="v$VERSION"
+
+# Write the resolved version into the repo-root package.json + lockfile so the
+# pipeline tarball, npm publish, and all satellites share one number.
 if [[ "$VERSION" != "$PKG_VERSION" ]]; then
-  echo "  note: tag version ($VERSION) differs from package.json ($PKG_VERSION)"
+  say "Bumping repo-root package.json $PKG_VERSION -> $VERSION"
+  node -e "
+    const fs=require('fs');
+    for (const p of ['$REPO_ROOT/package.json','$REPO_ROOT/package-lock.json']) {
+      if (!fs.existsSync(p)) continue;
+      const j=JSON.parse(fs.readFileSync(p,'utf8'));
+      j.version='$VERSION';
+      if (j.packages && j.packages['']) j.packages[''].version='$VERSION';
+      fs.writeFileSync(p, JSON.stringify(j,null,2)+'\n');
+      console.log('  '+p.replace('$REPO_ROOT/','')+' -> '+j.version);
+    }
+  "
+else
+  say "Releasing $TAG (repo-root package.json already $VERSION)"
 fi
 
 # ---- 2. Build the bundle ----------------------------------------------------
@@ -128,6 +186,14 @@ MANIFEST_VER=$(unzip -p "$BUNDLE" manifest.json 2>/dev/null | node -p "JSON.pars
 [[ "$MANIFEST_VER" == "$VERSION" ]] || die "bundle manifest.json=$MANIFEST_VER != $VERSION (Desktop Details panel would show the wrong version)"
 echo "  manifest.json: $MANIFEST_VER ok"
 
+# THE guard that was missing when 1.6.84 shipped a 1.6.83 pipeline: assert the
+# version INSIDE the embedded pipeline.tgz matches the bundle. ensurePipelineCurrent()
+# on the box trusts version.json to decide whether to re-extract; if the tarball's
+# own package.json lags, the box materializes stale Python and never knows.
+PIPELINE_VER=$(unzip -p "$BUNDLE" dist/pipeline.tgz 2>/dev/null | tar -xzO package/package.json 2>/dev/null | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version" 2>/dev/null || echo "?")
+[[ "$PIPELINE_VER" == "$VERSION" ]] || die "embedded pipeline.tgz version=$PIPELINE_VER != $VERSION (box would materialize a STALE pipeline; bump repo-root package.json BEFORE build)"
+echo "  pipeline.tgz internal version: $PIPELINE_VER ok"
+
 for f in "dist/index.js" "dist/runtime.js" "manifest.json"; do
   # grep -c reads all input (no SIGPIPE); anchor on the time column + 3-space
   # gutter so node_modules/.../dist/index.js does not false-match the top-level.
@@ -141,7 +207,30 @@ if [[ "$DO_RELEASE" == "0" ]]; then
   exit 0
 fi
 
-# ---- 6. GitHub release ------------------------------------------------------
+# ---- 6. npm publish (Story A: `npx social-autoposter@<v> init`) -------------
+# Same VERSION as the bundle, from the SAME bumped repo-root package.json, so the
+# npm install path and the .mcpb path can never disagree. Idempotent: a version
+# already on the registry is skipped, not failed.
+if [[ "$DO_NPM" == "1" ]]; then
+  command -v npm >/dev/null || die "npm not found on PATH"
+  NPM_HTTP=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/social-autoposter/$VERSION" || echo "000")
+  if [[ "$NPM_HTTP" == "200" ]]; then
+    say "npm: social-autoposter@$VERSION already published — skipping"
+  else
+    say "Publishing social-autoposter@$VERSION to npm"
+    ( cd "$REPO_ROOT" && npm publish ) || die "npm publish failed"
+    # Confirm it actually landed (granular-token whoami lies; a version fetch doesn't).
+    for _ in 1 2 3 4 5; do
+      sleep 2
+      [[ "$(curl -s -o /dev/null -w '%{http_code}' "https://registry.npmjs.org/social-autoposter/$VERSION")" == "200" ]] && break
+    done
+    echo "  npm: social-autoposter@$VERSION live"
+  fi
+else
+  say "npm publish skipped (--no-npm)"
+fi
+
+# ---- 7. GitHub release ------------------------------------------------------
 command -v gh >/dev/null || die "gh CLI not found"
 gh auth status >/dev/null 2>&1 || die "gh not authenticated (run: gh auth login)"