social-autoposter 1.6.88 → 1.6.89

package/mcp/dist/index.js

@@ -11,6 +11,7 @@
 // stays in the Python/shell scripts; we only orchestrate and present.
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { execFileSync } from "node:child_process";
 import { z } from "zod";
 import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
@@ -539,6 +540,10 @@ async function postApproved(batchId, plan) {
     // approved post takes the browser immediately instead of waiting on the lock.
     // Plugin pipeline only — never affects the plist autopilot.
     preemptScanForPost();
+    // Hold the /tmp shell browser lock (the one the scanner respects) for the WHOLE
+    // batch so the every-minute autopilot scan queues behind the post instead of
+    // seizing Chrome mid-batch — the root cause of approved batches landing 0/N.
+    const heldShellLock = await acquireShellBrowserLock();
     const approvedBatch = `${batchId}_approved`;
     writePlan(approvedBatch, { ...plan, candidates: approved });
     // SAPS_SKIP_CAMPAIGN_SUFFIX=1: manual/reviewed posts from this MCP draft_cycle
@@ -546,28 +551,51 @@ async function postApproved(batchId, plan) {
     // twitter_browser.py's reply handler reads this env (inherited through
     // twitter_post_plan.py's subprocess). The cron pipeline doesn't set it, so the
     // A/B disclosure experiment keeps running on autopilot/cron and on Reddit.
-    const res = await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
-        timeoutMs: 900_000,
-        env: {
-            SAPS_SKIP_CAMPAIGN_SUFFIX: "1",
-            // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
-            // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
-            // ship link-less as an experiment arm. But when the user hand-reviews a
-            // draft, sees the link target in the table, and approves it, dropping the
-            // link is surprising and unwanted. Force 1.0 here so every approved draft
-            // carries its link. This wins over .env / process.env because run() spreads
-            // opts.env AFTER process.env, and twitter_post_plan.py never load_dotenv's
-            // with override, so nothing clobbers it. Cron is untouched (it never goes
-            // through this MCP path), so the 0.9 experiment keeps running there.
-            TWITTER_TAIL_LINK_RATE: "1.0",
-            // The poster attaches to the twitter-harness Chrome over CDP. The cron
-            // pipeline exports this from skill/lib/twitter-backend.sh; the MCP path
-            // must set it explicitly or twitter_browser.py fails with "No twitter-
-            // harness Chrome reachable". Honor an inherited value (AppMaker / VM
-            // BYO-Chrome), else default to the local harness on port 9555.
-            TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
-        },
-    });
+    const res = await (async () => {
+        try {
+            return await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
+                timeoutMs: 900_000,
+                env: {
+                    SAPS_SKIP_CAMPAIGN_SUFFIX: "1",
+                    // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
+                    // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
+                    // ship link-less as an experiment arm. But when the user hand-reviews a
+                    // draft, sees the link target in the table, and approves it, dropping the
+                    // link is surprising and unwanted. Force 1.0 here so every approved draft
+                    // carries its link. This wins over .env / process.env because run() spreads
+                    // opts.env AFTER process.env, and twitter_post_plan.py never load_dotenv's
+                    // with override, so nothing clobbers it. Cron is untouched (it never goes
+                    // through this MCP path), so the 0.9 experiment keeps running there.
+                    TWITTER_TAIL_LINK_RATE: "1.0",
+                    // The poster attaches to the twitter-harness Chrome over CDP. The cron
+                    // pipeline exports this from skill/lib/twitter-backend.sh; the MCP path
+                    // must set it explicitly or twitter_browser.py fails with "No twitter-
+                    // harness Chrome reachable". Honor an inherited value (AppMaker / VM
+                    // BYO-Chrome), else default to the local harness on port 9555.
+                    TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
+                },
+            });
+        }
+        finally {
+            // Always free the lock so a queued scan can proceed, even on throw/timeout.
+            if (heldShellLock)
+                releaseShellBrowserLock();
+        }
+    })();
+    // Persist the poster's own stdout/stderr to a dated log. Without this the post
+    // run was invisible: twitter_post_plan.py's output streamed to this MCP
+    // instance's stderr and was never tee'd anywhere on disk, so a 0/N batch left
+    // no on-box trace to debug. Best-effort; never breaks posting.
+    try {
+        const postLogDir = path.join(repoDir(), "skill", "logs");
+        fs.mkdirSync(postLogDir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        fs.writeFileSync(path.join(postLogDir, `post-${stamp}.log`), `# post_drafts batch=${batchId} approved=${approved.length} exit=${res.code} ` +
+            `shell_lock=${heldShellLock}\n\n=== stdout ===\n${res.stdout}\n\n=== stderr ===\n${res.stderr}\n`);
+    }
+    catch {
+        /* best effort */
+    }
     let summary = res.stdout.trim();
     try {
         const lines = res.stdout.trim().split("\n");
@@ -1968,13 +1996,154 @@ let currentScanJob = null;
 // immediately. Only ever references a scan the MCP server itself launched — never
 // the plist autopilot's launchd scan.
 let scanChild = null;
-// Posting takes priority over scanning (plugin pipeline only). When the user
-// approves a post, abort any in-flight plugin scan so the browser frees up at
-// once: killing the scan's bash leaves a dead lock-holder pid that the poster's
-// twitter_browser.py steals via its liveness check, so the post acquires the
-// browser without the 45s lock wait. The aborted scan just re-runs next cron
-// tick. Best-effort; never throws. Does NOT touch the plist autopilot (separate
-// process, no handle here) or any locked pipeline script.
+// ---- Cross-process browser-lock bridge (the REAL posting-priority fix) ------
+// The SCANNER (run-twitter-cycle.sh) serializes browser access on a mkdir-based
+// DIRECTORY lock at /tmp/social-autoposter-twitter-browser.lock (skill/lock.sh).
+// The POSTER (twitter_post_plan.py / twitter_browser.py) serializes on a totally
+// SEPARATE json file lock (~/.claude/twitter-browser-lock.json) with role:"post"
+// preemption. The two locks never reference each other, so a post launched from
+// THIS MCP (or a sibling MCP instance — every autopilot agent session spawns its
+// own) never actually excluded a live scan: both held "their" lock and drove the
+// one shared harness Chrome at once, so an approved batch landed 0/N while a scan
+// churned 118 queries for ~10min (proven live on the remote box 2026-06-23:
+// /tmp lock pid=scanner AND json lock python:poster role=post, simultaneously).
+//
+// preemptScanForPost's old body only killed scanChild — a process-LOCAL handle to
+// a scan THIS instance launched. The scan that actually holds the browser is
+// almost always a SIBLING instance's, which we have no ChildProcess for. So we
+// bridge to the lock the scanner truly respects: read its /tmp pid file, and if a
+// live run-twitter-cycle.sh holds it, signal it cross-process. Then the post
+// HOLDS that same /tmp lock for the whole batch so the every-minute autopilot
+// scan queues behind us (its acquire_lock waits on our live pid) instead of
+// seizing Chrome mid-post. skill/lock.sh's ownership guard + kill-0 liveness +
+// 3h stale-reclaim recover the dir if we ever leak it. Never touches a locked
+// pipeline script or the python json lock.
+const TW_BROWSER_LOCK_DIR = "/tmp/social-autoposter-twitter-browser.lock";
+function shellLockHolderPid() {
+    try {
+        const pid = parseInt(fs.readFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), "utf-8").trim(), 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null; // no dir / no pid file == lock is free
+    }
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// True ONLY when pid is a run-twitter-cycle.sh scan — the one holder a post is
+// allowed to preempt. Never preempt another poster or an unknown holder.
+function pidIsScan(pid) {
+    try {
+        const cmd = execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+            encoding: "utf-8",
+            timeout: 4000,
+        });
+        return /run-twitter-cycle\.sh/.test(cmd);
+    }
+    catch {
+        return false;
+    }
+}
+function rmShellLockDir() {
+    try {
+        fs.rmSync(TW_BROWSER_LOCK_DIR, { recursive: true, force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
+const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
+// SIGTERM a live scan holding the shell browser lock so the post takes the
+// browser at once. Best-effort; only ever targets a run-twitter-cycle.sh.
+function preemptScanHoldingBrowser() {
+    try {
+        const pid = shellLockHolderPid();
+        if (pid && pidAlive(pid) && pidIsScan(pid)) {
+            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid})`);
+            try {
+                process.kill(pid, "SIGTERM");
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+// Take the shell browser lock for the batch. Preempts a scan holder; never
+// steals from a live non-scan holder (a peer poster) — there it returns false
+// and posting proceeds unguarded (no worse than before). Best-effort.
+async function acquireShellBrowserLock() {
+    for (let attempt = 0; attempt < 8; attempt++) {
+        try {
+            fs.mkdirSync(TW_BROWSER_LOCK_DIR); // atomic mutex — only one winner
+            try {
+                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            }
+            catch {
+                /* best effort */
+            }
+            try {
+                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
+            }
+            catch {
+                /* best effort */
+            }
+            console.error(`[post] holding twitter-browser shell lock pid=${process.pid} — scans queue behind the post`);
+            return true;
+        }
+        catch {
+            // Dir exists. Reclaim if the holder is dead; preempt if it's a scan;
+            // otherwise (a live peer poster) leave it and post unguarded.
+            const pid = shellLockHolderPid();
+            if (!pid || !pidAlive(pid)) {
+                rmShellLockDir();
+            }
+            else if (pidIsScan(pid)) {
+                try {
+                    process.kill(pid, "SIGTERM");
+                }
+                catch {
+                    /* already gone */
+                }
+                await sleepMs(400);
+                rmShellLockDir();
+            }
+            else {
+                return false; // a real peer holds it — don't steal; proceed
+            }
+            await sleepMs(250);
+        }
+    }
+    return false;
+}
+// Release only if it's still OURS (mirror skill/lock.sh's ownership guard) so we
+// never wipe a scan that legitimately re-acquired after the batch finished.
+function releaseShellBrowserLock() {
+    try {
+        if (shellLockHolderPid() === process.pid) {
+            rmShellLockDir();
+            console.error(`[post] released twitter-browser shell lock pid=${process.pid}`);
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+// Posting takes priority over scanning. When the user approves a post, abort any
+// in-flight scan so the browser frees up at once. Two layers: (1) kill scanChild
+// if THIS instance launched the scan, and (2) cross-process — kill whoever holds
+// the /tmp shell lock if it's a scan (covers sibling MCP instances we have no
+// handle to). Best-effort; never throws; never touches a locked pipeline script.
 function preemptScanForPost() {
     try {
         if (scanChild && scanChild.pid && scanChild.exitCode === null) {
@@ -1994,6 +2163,9 @@ function preemptScanForPost() {
     // the next scan_candidates call starts fresh.
     currentScanJob = null;
     scanChild = null;
+    // Cross-process: the scan that actually holds the shared Chrome is usually a
+    // sibling MCP instance's, not ours. Kill it via the lock it truly respects.
+    preemptScanHoldingBrowser();
 }
 // Per-call long-poll window. Must stay under the ~60s MCP client request timeout
 // so every scan_candidates call returns a real response before the client gives

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.88",
-  "installedAt": "2026-06-23T18:40:27.430Z"
+  "version": "1.6.89",
+  "installedAt": "2026-06-23T18:52:53.457Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.88",
+  "version": "1.6.89",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.88",
+  "version": "1.6.89",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.88",
+  "version": "1.6.89",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"