social-autoposter 1.6.87 → 1.6.89

package/bin/cli.js

@@ -591,10 +591,9 @@ function generatePlists() {
       stderrLog: `${DEST}/skill/logs/launchd-self-update-stderr.log`,
     },
     {
-      // On-screen overlay watcher supervisor. The overlay (harness status banner;
-      // the interactive draft sidebar is OFF by default as of 2026-06-23, opt back
-      // in with SAPS_SIDEBAR=1) only renders WHILE harness_overlay.py watch runs.
-      // The supervisor is idempotent (pgrep guard), so a 60s StartInterval
+      // On-screen overlay watcher supervisor. The overlay (harness status banner)
+      // only renders WHILE harness_overlay.py watch runs. The supervisor is
+      // idempotent (pgrep guard), so a 60s StartInterval
       // is a no-op while the watcher is up and re-spawns it within a minute if it
       // ever dies. RunAtLoad starts it right after install. This is what makes the
       // overlay appear on headless / remote installs (Lane A); the MCP covers the

package/mcp/dist/index.js

@@ -11,6 +11,7 @@
 // stays in the Python/shell scripts; we only orchestrate and present.
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { execFileSync } from "node:child_process";
 import { z } from "zod";
 import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
@@ -346,9 +347,8 @@ function cycleProgressMessage(line) {
     return null;
 }
 // Start the twitter-harness on-screen overlay watcher if it isn't already up.
-// The overlay (status banner; the interactive draft sidebar is OFF by default as
-// of 2026-06-23, opt back in with SAPS_SIDEBAR=1) only renders WHILE
-// `harness_overlay.py watch` runs. The supervisor script is idempotent (pgrep
+// The overlay (status banner) only renders WHILE `harness_overlay.py watch`
+// runs. The supervisor script is idempotent (pgrep
 // guard), so calling this on every draft_cycle / autopilot-enable / show-browser
 // is safe: it spawns at most one detached watcher and is a fast no-op otherwise.
 //
@@ -540,6 +540,10 @@ async function postApproved(batchId, plan) {
     // approved post takes the browser immediately instead of waiting on the lock.
     // Plugin pipeline only — never affects the plist autopilot.
     preemptScanForPost();
+    // Hold the /tmp shell browser lock (the one the scanner respects) for the WHOLE
+    // batch so the every-minute autopilot scan queues behind the post instead of
+    // seizing Chrome mid-batch — the root cause of approved batches landing 0/N.
+    const heldShellLock = await acquireShellBrowserLock();
     const approvedBatch = `${batchId}_approved`;
     writePlan(approvedBatch, { ...plan, candidates: approved });
     // SAPS_SKIP_CAMPAIGN_SUFFIX=1: manual/reviewed posts from this MCP draft_cycle
@@ -547,28 +551,51 @@ async function postApproved(batchId, plan) {
     // twitter_browser.py's reply handler reads this env (inherited through
     // twitter_post_plan.py's subprocess). The cron pipeline doesn't set it, so the
     // A/B disclosure experiment keeps running on autopilot/cron and on Reddit.
-    const res = await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
-        timeoutMs: 900_000,
-        env: {
-            SAPS_SKIP_CAMPAIGN_SUFFIX: "1",
-            // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
-            // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
-            // ship link-less as an experiment arm. But when the user hand-reviews a
-            // draft, sees the link target in the table, and approves it, dropping the
-            // link is surprising and unwanted. Force 1.0 here so every approved draft
-            // carries its link. This wins over .env / process.env because run() spreads
-            // opts.env AFTER process.env, and twitter_post_plan.py never load_dotenv's
-            // with override, so nothing clobbers it. Cron is untouched (it never goes
-            // through this MCP path), so the 0.9 experiment keeps running there.
-            TWITTER_TAIL_LINK_RATE: "1.0",
-            // The poster attaches to the twitter-harness Chrome over CDP. The cron
-            // pipeline exports this from skill/lib/twitter-backend.sh; the MCP path
-            // must set it explicitly or twitter_browser.py fails with "No twitter-
-            // harness Chrome reachable". Honor an inherited value (AppMaker / VM
-            // BYO-Chrome), else default to the local harness on port 9555.
-            TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
-        },
-    });
+    const res = await (async () => {
+        try {
+            return await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
+                timeoutMs: 900_000,
+                env: {
+                    SAPS_SKIP_CAMPAIGN_SUFFIX: "1",
+                    // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
+                    // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
+                    // ship link-less as an experiment arm. But when the user hand-reviews a
+                    // draft, sees the link target in the table, and approves it, dropping the
+                    // link is surprising and unwanted. Force 1.0 here so every approved draft
+                    // carries its link. This wins over .env / process.env because run() spreads
+                    // opts.env AFTER process.env, and twitter_post_plan.py never load_dotenv's
+                    // with override, so nothing clobbers it. Cron is untouched (it never goes
+                    // through this MCP path), so the 0.9 experiment keeps running there.
+                    TWITTER_TAIL_LINK_RATE: "1.0",
+                    // The poster attaches to the twitter-harness Chrome over CDP. The cron
+                    // pipeline exports this from skill/lib/twitter-backend.sh; the MCP path
+                    // must set it explicitly or twitter_browser.py fails with "No twitter-
+                    // harness Chrome reachable". Honor an inherited value (AppMaker / VM
+                    // BYO-Chrome), else default to the local harness on port 9555.
+                    TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
+                },
+            });
+        }
+        finally {
+            // Always free the lock so a queued scan can proceed, even on throw/timeout.
+            if (heldShellLock)
+                releaseShellBrowserLock();
+        }
+    })();
+    // Persist the poster's own stdout/stderr to a dated log. Without this the post
+    // run was invisible: twitter_post_plan.py's output streamed to this MCP
+    // instance's stderr and was never tee'd anywhere on disk, so a 0/N batch left
+    // no on-box trace to debug. Best-effort; never breaks posting.
+    try {
+        const postLogDir = path.join(repoDir(), "skill", "logs");
+        fs.mkdirSync(postLogDir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        fs.writeFileSync(path.join(postLogDir, `post-${stamp}.log`), `# post_drafts batch=${batchId} approved=${approved.length} exit=${res.code} ` +
+            `shell_lock=${heldShellLock}\n\n=== stdout ===\n${res.stdout}\n\n=== stderr ===\n${res.stderr}\n`);
+    }
+    catch {
+        /* best effort */
+    }
     let summary = res.stdout.trim();
     try {
         const lines = res.stdout.trim().split("\n");
@@ -1969,13 +1996,154 @@ let currentScanJob = null;
 // immediately. Only ever references a scan the MCP server itself launched — never
 // the plist autopilot's launchd scan.
 let scanChild = null;
-// Posting takes priority over scanning (plugin pipeline only). When the user
-// approves a post, abort any in-flight plugin scan so the browser frees up at
-// once: killing the scan's bash leaves a dead lock-holder pid that the poster's
-// twitter_browser.py steals via its liveness check, so the post acquires the
-// browser without the 45s lock wait. The aborted scan just re-runs next cron
-// tick. Best-effort; never throws. Does NOT touch the plist autopilot (separate
-// process, no handle here) or any locked pipeline script.
+// ---- Cross-process browser-lock bridge (the REAL posting-priority fix) ------
+// The SCANNER (run-twitter-cycle.sh) serializes browser access on a mkdir-based
+// DIRECTORY lock at /tmp/social-autoposter-twitter-browser.lock (skill/lock.sh).
+// The POSTER (twitter_post_plan.py / twitter_browser.py) serializes on a totally
+// SEPARATE json file lock (~/.claude/twitter-browser-lock.json) with role:"post"
+// preemption. The two locks never reference each other, so a post launched from
+// THIS MCP (or a sibling MCP instance — every autopilot agent session spawns its
+// own) never actually excluded a live scan: both held "their" lock and drove the
+// one shared harness Chrome at once, so an approved batch landed 0/N while a scan
+// churned 118 queries for ~10min (proven live on the remote box 2026-06-23:
+// /tmp lock pid=scanner AND json lock python:poster role=post, simultaneously).
+//
+// preemptScanForPost's old body only killed scanChild — a process-LOCAL handle to
+// a scan THIS instance launched. The scan that actually holds the browser is
+// almost always a SIBLING instance's, which we have no ChildProcess for. So we
+// bridge to the lock the scanner truly respects: read its /tmp pid file, and if a
+// live run-twitter-cycle.sh holds it, signal it cross-process. Then the post
+// HOLDS that same /tmp lock for the whole batch so the every-minute autopilot
+// scan queues behind us (its acquire_lock waits on our live pid) instead of
+// seizing Chrome mid-post. skill/lock.sh's ownership guard + kill-0 liveness +
+// 3h stale-reclaim recover the dir if we ever leak it. Never touches a locked
+// pipeline script or the python json lock.
+const TW_BROWSER_LOCK_DIR = "/tmp/social-autoposter-twitter-browser.lock";
+function shellLockHolderPid() {
+    try {
+        const pid = parseInt(fs.readFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), "utf-8").trim(), 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null; // no dir / no pid file == lock is free
+    }
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// True ONLY when pid is a run-twitter-cycle.sh scan — the one holder a post is
+// allowed to preempt. Never preempt another poster or an unknown holder.
+function pidIsScan(pid) {
+    try {
+        const cmd = execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+            encoding: "utf-8",
+            timeout: 4000,
+        });
+        return /run-twitter-cycle\.sh/.test(cmd);
+    }
+    catch {
+        return false;
+    }
+}
+function rmShellLockDir() {
+    try {
+        fs.rmSync(TW_BROWSER_LOCK_DIR, { recursive: true, force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
+const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
+// SIGTERM a live scan holding the shell browser lock so the post takes the
+// browser at once. Best-effort; only ever targets a run-twitter-cycle.sh.
+function preemptScanHoldingBrowser() {
+    try {
+        const pid = shellLockHolderPid();
+        if (pid && pidAlive(pid) && pidIsScan(pid)) {
+            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid})`);
+            try {
+                process.kill(pid, "SIGTERM");
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+// Take the shell browser lock for the batch. Preempts a scan holder; never
+// steals from a live non-scan holder (a peer poster) — there it returns false
+// and posting proceeds unguarded (no worse than before). Best-effort.
+async function acquireShellBrowserLock() {
+    for (let attempt = 0; attempt < 8; attempt++) {
+        try {
+            fs.mkdirSync(TW_BROWSER_LOCK_DIR); // atomic mutex — only one winner
+            try {
+                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            }
+            catch {
+                /* best effort */
+            }
+            try {
+                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
+            }
+            catch {
+                /* best effort */
+            }
+            console.error(`[post] holding twitter-browser shell lock pid=${process.pid} — scans queue behind the post`);
+            return true;
+        }
+        catch {
+            // Dir exists. Reclaim if the holder is dead; preempt if it's a scan;
+            // otherwise (a live peer poster) leave it and post unguarded.
+            const pid = shellLockHolderPid();
+            if (!pid || !pidAlive(pid)) {
+                rmShellLockDir();
+            }
+            else if (pidIsScan(pid)) {
+                try {
+                    process.kill(pid, "SIGTERM");
+                }
+                catch {
+                    /* already gone */
+                }
+                await sleepMs(400);
+                rmShellLockDir();
+            }
+            else {
+                return false; // a real peer holds it — don't steal; proceed
+            }
+            await sleepMs(250);
+        }
+    }
+    return false;
+}
+// Release only if it's still OURS (mirror skill/lock.sh's ownership guard) so we
+// never wipe a scan that legitimately re-acquired after the batch finished.
+function releaseShellBrowserLock() {
+    try {
+        if (shellLockHolderPid() === process.pid) {
+            rmShellLockDir();
+            console.error(`[post] released twitter-browser shell lock pid=${process.pid}`);
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+// Posting takes priority over scanning. When the user approves a post, abort any
+// in-flight scan so the browser frees up at once. Two layers: (1) kill scanChild
+// if THIS instance launched the scan, and (2) cross-process — kill whoever holds
+// the /tmp shell lock if it's a scan (covers sibling MCP instances we have no
+// handle to). Best-effort; never throws; never touches a locked pipeline script.
 function preemptScanForPost() {
     try {
         if (scanChild && scanChild.pid && scanChild.exitCode === null) {
@@ -1995,6 +2163,9 @@ function preemptScanForPost() {
     // the next scan_candidates call starts fresh.
     currentScanJob = null;
     scanChild = null;
+    // Cross-process: the scan that actually holds the shared Chrome is usually a
+    // sibling MCP instance's, not ours. Kill it via the lock it truly respects.
+    preemptScanHoldingBrowser();
 }
 // Per-call long-poll window. Must stay under the ~60s MCP client request timeout
 // so every scan_candidates call returns a real response before the client gives
@@ -2409,7 +2580,7 @@ tool("show_browser_to_user", {
         return jsonContent({ ok: true, brought_to_front: true, port: res.port });
     }
     // If the user is about to watch the live browser, make sure the on-screen
-    // overlay watcher is up too so the harness window carries status + drafts.
+    // overlay watcher is up too so the harness window carries its status banner.
     if (action === "start")
         await ensureOverlayWatch();
     const ensured = await screencast.ensure(typeof args?.port === "number" ? args.port : undefined);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.87",
-  "installedAt": "2026-06-23T18:34:55.294Z"
+  "version": "1.6.89",
+  "installedAt": "2026-06-23T18:52:53.457Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.87",
+  "version": "1.6.89",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -173,7 +173,7 @@ class S4LMenuBar(rumps.App):
         # indicator + the "Please update now" menu item.
         self._update_available = False
         self._latest_version = None
-        self._upd_timer = rumps.Timer(self._check_update, 1800)  # every 30 min
+        self._upd_timer = rumps.Timer(self._check_update, 60)  # every 1 min
         self._upd_timer.start()
         self._check_update(None)
         self._tick(None)

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.87",
+  "version": "1.6.89",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.87",
+  "version": "1.6.89",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/skill/run-overlay-watch.sh

@@ -3,9 +3,7 @@
 #
 # WHAT: keeps exactly ONE `harness_overlay.py watch` process alive. That watcher
 # injects the status overlay into the twitter-harness Chrome window so a human
-# watching the harness sees what the pipeline is doing. (The interactive "Drafts
-# to post" sidebar is OFF by default as of 2026-06-23; opt back in with
-# SAPS_SIDEBAR=1.)
+# watching the harness sees what the pipeline is doing.
 #
 # WHY a supervisor: the overlay only renders WHILE the watch process runs. It was
 # previously a manual, local-only process, so it never appeared on headless /