social-autoposter 1.6.88 → 1.6.90

package/mcp/dist/index.js

@@ -11,6 +11,7 @@
 // stays in the Python/shell scripts; we only orchestrate and present.
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { execFileSync } from "node:child_process";
 import { z } from "zod";
 import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
@@ -22,7 +23,7 @@ import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, ensurePipelineCurrent, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, captureError, flushSentry } from "./telemetry.js";
+import { initSentry, sendHeartbeat, captureError, flushSentry, startLogStreaming, flushLogs } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -531,14 +532,72 @@ function renderDraftsTable(plan) {
     })
         .join("\n\n");
 }
+// Resolve the configured posting handle the SAME way account_resolver.py does:
+// AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
+// Returns the bare handle (no @) or null. The post preflight uses it so a missing
+// handle fails ONCE, loudly, instead of as N silent per-reply no_account_configured
+// skips (twitter_browser.py refuses to post with no handle — no impersonation).
+function readConfiguredTwitterHandle() {
+    const env = (process.env.AUTOPOSTER_TWITTER_HANDLE || "").trim().replace(/^@/, "");
+    if (env)
+        return env;
+    try {
+        const cfg = JSON.parse(fs.readFileSync(path.join(repoDir(), "config.json"), "utf-8"));
+        const h = cfg?.accounts?.twitter?.handle;
+        const s = (typeof h === "string" ? h : "").trim().replace(/^@/, "");
+        return s || null;
+    }
+    catch {
+        return null;
+    }
+}
+// Self-heal a missing handle: read the live logged-in @handle from the managed
+// Chrome and persist it to config.json accounts.twitter.handle. This is ground
+// truth (the poster posts through that exact session), NOT a guess — so it's safe
+// where a hardcoded fallback would not be. Closes the onboarding gap where
+// connect_x's best-effort handle capture silently no-op'd and left posting dead.
+// Best-effort; never throws — the caller re-checks and refuses loudly if still unset.
+async function ensurePostingHandle() {
+    try {
+        await runPython("scripts/setup_twitter_auth.py", ["resolve-handle"], {
+            timeoutMs: 60_000,
+            env: { SAPS_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+    }
+    catch {
+        /* best effort */
+    }
+}
 async function postApproved(batchId, plan) {
     const approved = (plan.candidates || []).filter((c) => c.approved === true);
     if (approved.length === 0)
         return { attempted: 0, exit_code: 0, summary: "nothing approved" };
+    // PREFLIGHT: posting needs a configured @handle, or twitter_browser.py refuses
+    // EVERY reply with no_account_configured and the whole batch skips — invisibly.
+    // If onboarding never persisted it, self-heal from the live session; if even that
+    // can't determine it, refuse here with a clear reason rather than launching a
+    // poster that silently burns the whole batch.
+    if (!readConfiguredTwitterHandle())
+        await ensurePostingHandle();
+    if (!readConfiguredTwitterHandle()) {
+        return {
+            attempted: 0,
+            exit_code: 0,
+            posted: 0,
+            summary: "no_account_configured",
+            error: "X is connected but no posting @handle is configured, so every reply would be refused " +
+                "(no_account_configured). Re-run project_config action:'connect_x' to capture the handle, " +
+                "or set accounts.twitter.handle in config.json.",
+        };
+    }
     // Posting is a priority over scanning: abort any in-flight plugin scan so the
     // approved post takes the browser immediately instead of waiting on the lock.
     // Plugin pipeline only — never affects the plist autopilot.
     preemptScanForPost();
+    // Hold the /tmp shell browser lock (the one the scanner respects) for the WHOLE
+    // batch so the every-minute autopilot scan queues behind the post instead of
+    // seizing Chrome mid-batch — the root cause of approved batches landing 0/N.
+    const heldShellLock = await acquireShellBrowserLock();
     const approvedBatch = `${batchId}_approved`;
     writePlan(approvedBatch, { ...plan, candidates: approved });
     // SAPS_SKIP_CAMPAIGN_SUFFIX=1: manual/reviewed posts from this MCP draft_cycle
@@ -546,28 +605,62 @@ async function postApproved(batchId, plan) {
     // twitter_browser.py's reply handler reads this env (inherited through
     // twitter_post_plan.py's subprocess). The cron pipeline doesn't set it, so the
     // A/B disclosure experiment keeps running on autopilot/cron and on Reddit.
-    const res = await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
-        timeoutMs: 900_000,
-        env: {
-            SAPS_SKIP_CAMPAIGN_SUFFIX: "1",
-            // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
-            // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
-            // ship link-less as an experiment arm. But when the user hand-reviews a
-            // draft, sees the link target in the table, and approves it, dropping the
-            // link is surprising and unwanted. Force 1.0 here so every approved draft
-            // carries its link. This wins over .env / process.env because run() spreads
-            // opts.env AFTER process.env, and twitter_post_plan.py never load_dotenv's
-            // with override, so nothing clobbers it. Cron is untouched (it never goes
-            // through this MCP path), so the 0.9 experiment keeps running there.
-            TWITTER_TAIL_LINK_RATE: "1.0",
-            // The poster attaches to the twitter-harness Chrome over CDP. The cron
-            // pipeline exports this from skill/lib/twitter-backend.sh; the MCP path
-            // must set it explicitly or twitter_browser.py fails with "No twitter-
-            // harness Chrome reachable". Honor an inherited value (AppMaker / VM
-            // BYO-Chrome), else default to the local harness on port 9555.
-            TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
-        },
-    });
+    const res = await (async () => {
+        try {
+            return await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
+                timeoutMs: 900_000,
+                env: {
+                    SAPS_SKIP_CAMPAIGN_SUFFIX: "1",
+                    // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
+                    // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
+                    // ship link-less as an experiment arm. But when the user hand-reviews a
+                    // draft, sees the link target in the table, and approves it, dropping the
+                    // link is surprising and unwanted. Force 1.0 here so every approved draft
+                    // carries its link. This wins over .env / process.env because run() spreads
+                    // opts.env AFTER process.env, and twitter_post_plan.py never load_dotenv's
+                    // with override, so nothing clobbers it. Cron is untouched (it never goes
+                    // through this MCP path), so the 0.9 experiment keeps running there.
+                    TWITTER_TAIL_LINK_RATE: "1.0",
+                    // The poster attaches to the twitter-harness Chrome over CDP. The cron
+                    // pipeline exports this from skill/lib/twitter-backend.sh; the MCP path
+                    // must set it explicitly or twitter_browser.py fails with "No twitter-
+                    // harness Chrome reachable". Honor an inherited value (AppMaker / VM
+                    // BYO-Chrome), else default to the local harness on port 9555.
+                    TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
+                },
+                // Stream the poster's output live (like scan_candidates does) so HANDLED
+                // failures — e.g. every reply refused with no_account_configured, which
+                // returns a reason instead of throwing — surface in main.log + telemetry
+                // in real time. Without this the poster's stdout was buffered in-process
+                // and only flushed to post-*.log at the END, so a 0/N batch was invisible
+                // while the menu bar showed "posting N/89" climbing.
+                onLine: (line) => {
+                    const t = line.replace(/\s+$/, "");
+                    if (t.trim())
+                        console.error(`[post] ${t}`);
+                },
+            });
+        }
+        finally {
+            // Always free the lock so a queued scan can proceed, even on throw/timeout.
+            if (heldShellLock)
+                releaseShellBrowserLock();
+        }
+    })();
+    // Persist the poster's own stdout/stderr to a dated log. Without this the post
+    // run was invisible: twitter_post_plan.py's output streamed to this MCP
+    // instance's stderr and was never tee'd anywhere on disk, so a 0/N batch left
+    // no on-box trace to debug. Best-effort; never breaks posting.
+    try {
+        const postLogDir = path.join(repoDir(), "skill", "logs");
+        fs.mkdirSync(postLogDir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        fs.writeFileSync(path.join(postLogDir, `post-${stamp}.log`), `# post_drafts batch=${batchId} approved=${approved.length} exit=${res.code} ` +
+            `shell_lock=${heldShellLock}\n\n=== stdout ===\n${res.stdout}\n\n=== stderr ===\n${res.stderr}\n`);
+    }
+    catch {
+        /* best effort */
+    }
     let summary = res.stdout.trim();
     try {
         const lines = res.stdout.trim().split("\n");
@@ -616,6 +709,7 @@ async function postApproved(batchId, plan) {
         });
         void flushSentry(2000);
     }
+    void flushLogs();
     return {
         attempted: approved.length,
         posted: realPosted,
@@ -1968,13 +2062,154 @@ let currentScanJob = null;
 // immediately. Only ever references a scan the MCP server itself launched — never
 // the plist autopilot's launchd scan.
 let scanChild = null;
-// Posting takes priority over scanning (plugin pipeline only). When the user
-// approves a post, abort any in-flight plugin scan so the browser frees up at
-// once: killing the scan's bash leaves a dead lock-holder pid that the poster's
-// twitter_browser.py steals via its liveness check, so the post acquires the
-// browser without the 45s lock wait. The aborted scan just re-runs next cron
-// tick. Best-effort; never throws. Does NOT touch the plist autopilot (separate
-// process, no handle here) or any locked pipeline script.
+// ---- Cross-process browser-lock bridge (the REAL posting-priority fix) ------
+// The SCANNER (run-twitter-cycle.sh) serializes browser access on a mkdir-based
+// DIRECTORY lock at /tmp/social-autoposter-twitter-browser.lock (skill/lock.sh).
+// The POSTER (twitter_post_plan.py / twitter_browser.py) serializes on a totally
+// SEPARATE json file lock (~/.claude/twitter-browser-lock.json) with role:"post"
+// preemption. The two locks never reference each other, so a post launched from
+// THIS MCP (or a sibling MCP instance — every autopilot agent session spawns its
+// own) never actually excluded a live scan: both held "their" lock and drove the
+// one shared harness Chrome at once, so an approved batch landed 0/N while a scan
+// churned 118 queries for ~10min (proven live on the remote box 2026-06-23:
+// /tmp lock pid=scanner AND json lock python:poster role=post, simultaneously).
+//
+// preemptScanForPost's old body only killed scanChild — a process-LOCAL handle to
+// a scan THIS instance launched. The scan that actually holds the browser is
+// almost always a SIBLING instance's, which we have no ChildProcess for. So we
+// bridge to the lock the scanner truly respects: read its /tmp pid file, and if a
+// live run-twitter-cycle.sh holds it, signal it cross-process. Then the post
+// HOLDS that same /tmp lock for the whole batch so the every-minute autopilot
+// scan queues behind us (its acquire_lock waits on our live pid) instead of
+// seizing Chrome mid-post. skill/lock.sh's ownership guard + kill-0 liveness +
+// 3h stale-reclaim recover the dir if we ever leak it. Never touches a locked
+// pipeline script or the python json lock.
+const TW_BROWSER_LOCK_DIR = "/tmp/social-autoposter-twitter-browser.lock";
+function shellLockHolderPid() {
+    try {
+        const pid = parseInt(fs.readFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), "utf-8").trim(), 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null; // no dir / no pid file == lock is free
+    }
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// True ONLY when pid is a run-twitter-cycle.sh scan — the one holder a post is
+// allowed to preempt. Never preempt another poster or an unknown holder.
+function pidIsScan(pid) {
+    try {
+        const cmd = execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+            encoding: "utf-8",
+            timeout: 4000,
+        });
+        return /run-twitter-cycle\.sh/.test(cmd);
+    }
+    catch {
+        return false;
+    }
+}
+function rmShellLockDir() {
+    try {
+        fs.rmSync(TW_BROWSER_LOCK_DIR, { recursive: true, force: true });
+    }
+    catch {
+        /* best effort */
+    }
+}
+const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
+// SIGTERM a live scan holding the shell browser lock so the post takes the
+// browser at once. Best-effort; only ever targets a run-twitter-cycle.sh.
+function preemptScanHoldingBrowser() {
+    try {
+        const pid = shellLockHolderPid();
+        if (pid && pidAlive(pid) && pidIsScan(pid)) {
+            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid})`);
+            try {
+                process.kill(pid, "SIGTERM");
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+// Take the shell browser lock for the batch. Preempts a scan holder; never
+// steals from a live non-scan holder (a peer poster) — there it returns false
+// and posting proceeds unguarded (no worse than before). Best-effort.
+async function acquireShellBrowserLock() {
+    for (let attempt = 0; attempt < 8; attempt++) {
+        try {
+            fs.mkdirSync(TW_BROWSER_LOCK_DIR); // atomic mutex — only one winner
+            try {
+                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            }
+            catch {
+                /* best effort */
+            }
+            try {
+                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
+            }
+            catch {
+                /* best effort */
+            }
+            console.error(`[post] holding twitter-browser shell lock pid=${process.pid} — scans queue behind the post`);
+            return true;
+        }
+        catch {
+            // Dir exists. Reclaim if the holder is dead; preempt if it's a scan;
+            // otherwise (a live peer poster) leave it and post unguarded.
+            const pid = shellLockHolderPid();
+            if (!pid || !pidAlive(pid)) {
+                rmShellLockDir();
+            }
+            else if (pidIsScan(pid)) {
+                try {
+                    process.kill(pid, "SIGTERM");
+                }
+                catch {
+                    /* already gone */
+                }
+                await sleepMs(400);
+                rmShellLockDir();
+            }
+            else {
+                return false; // a real peer holds it — don't steal; proceed
+            }
+            await sleepMs(250);
+        }
+    }
+    return false;
+}
+// Release only if it's still OURS (mirror skill/lock.sh's ownership guard) so we
+// never wipe a scan that legitimately re-acquired after the batch finished.
+function releaseShellBrowserLock() {
+    try {
+        if (shellLockHolderPid() === process.pid) {
+            rmShellLockDir();
+            console.error(`[post] released twitter-browser shell lock pid=${process.pid}`);
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+// Posting takes priority over scanning. When the user approves a post, abort any
+// in-flight scan so the browser frees up at once. Two layers: (1) kill scanChild
+// if THIS instance launched the scan, and (2) cross-process — kill whoever holds
+// the /tmp shell lock if it's a scan (covers sibling MCP instances we have no
+// handle to). Best-effort; never throws; never touches a locked pipeline script.
 function preemptScanForPost() {
     try {
         if (scanChild && scanChild.pid && scanChild.exitCode === null) {
@@ -1994,6 +2229,9 @@ function preemptScanForPost() {
     // the next scan_candidates call starts fresh.
     currentScanJob = null;
     scanChild = null;
+    // Cross-process: the scan that actually holds the shared Chrome is usually a
+    // sibling MCP instance's, not ours. Kill it via the lock it truly respects.
+    preemptScanHoldingBrowser();
 }
 // Per-call long-poll window. Must stay under the ~60s MCP client request timeout
 // so every scan_candidates call returns a real response before the client gives
@@ -2458,6 +2696,11 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
 }));
 async function main() {
     initSentry();
+    // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
+    // Cloud Run relay (-> Cloud Logging) so we can troubleshoot/rescue any user
+    // scenario (silent stalls, partial onboarding) without asking them to ship a
+    // log file. Best-effort; disabled with SAPS_LOG_STREAM=0.
+    startLogStreaming();
     // A plugin UPDATE refreshes this server (dist/) but not the materialized
     // pipeline. Re-extract the bundled pipeline.tgz when it's newer than what's on
     // disk, BEFORE serving, so the very first scan uses the shipped pipeline (not
@@ -2512,6 +2755,7 @@ async function main() {
 main().catch(async (err) => {
     console.error("[social-autoposter-mcp] fatal:", err);
     captureError(err, { component: "main" });
+    await flushLogs();
     await flushSentry();
     process.exit(1);
 });

package/mcp/dist/repo.js

@@ -30,6 +30,27 @@ export function repoDir() {
 // "No drafts in batch ...". Default to /tmp to match the script; allow an explicit
 // override for non-standard installs.
 export const TMP_DIR = process.env.SAPS_TMP_DIR || "/tmp";
+let lineSink = null;
+export function setLineSink(fn) {
+    lineSink = fn;
+}
+// Derive a short, stable context label for a spawned command so log lines can
+// be grouped by which script produced them (e.g. "scripts/seed_search_topics.py",
+// "skill/run-twitter-cycle.sh"). Best-effort; never throws.
+function deriveContext(cmd, args) {
+    try {
+        const base = cmd.split("/").pop() || cmd;
+        if (/python/i.test(base) || base === "bash" || base === "sh" || base === "node") {
+            const first = args.find((a) => !a.startsWith("-"));
+            if (first)
+                return first;
+        }
+        return [base, args[0] ?? ""].join(" ").trim();
+    }
+    catch {
+        return cmd;
+    }
+}
 // Spawn a process inside the repo, inheriting the repo env (API base + keys
 // come from the install's environment / .env loaded by the scripts themselves).
 //
@@ -73,6 +94,29 @@ export function run(cmd, args, opts = {}) {
             }
             return buf;
         };
+        // Parallel whole-line splitter that tees to the telemetry sink (if any),
+        // kept separate from the onLine pump so neither path can affect the other.
+        const logCtx = opts.logContext || deriveContext(cmd, args);
+        let sinkOutBuf = "";
+        let sinkErrBuf = "";
+        const sinkPump = (chunk, which, buf) => {
+            const sink = lineSink;
+            if (!sink)
+                return buf;
+            buf += chunk;
+            let nl;
+            while ((nl = buf.indexOf("\n")) !== -1) {
+                const line = buf.slice(0, nl);
+                buf = buf.slice(nl + 1);
+                try {
+                    sink(line, which, logCtx);
+                }
+                catch {
+                    /* the telemetry sink must never break the wrapped command */
+                }
+            }
+            return buf;
+        };
         let timer;
         if (opts.timeoutMs) {
             timer = setTimeout(() => {
@@ -83,11 +127,13 @@ export function run(cmd, args, opts = {}) {
             const s = d.toString();
             stdout += s;
             outBuf = pump(s, "stdout", outBuf);
+            sinkOutBuf = sinkPump(s, "stdout", sinkOutBuf);
         });
         child.stderr.on("data", (d) => {
             const s = d.toString();
             stderr += s;
             errBuf = pump(s, "stderr", errBuf);
+            sinkErrBuf = sinkPump(s, "stderr", sinkErrBuf);
         });
         child.on("close", (code) => {
             if (timer)
@@ -109,6 +155,23 @@ export function run(cmd, args, opts = {}) {
                         /* ignore */
                     }
             }
+            const sink = lineSink;
+            if (sink) {
+                if (sinkOutBuf)
+                    try {
+                        sink(sinkOutBuf, "stdout", logCtx);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                if (sinkErrBuf)
+                    try {
+                        sink(sinkErrBuf, "stderr", logCtx);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+            }
             resolve({ code: code ?? -1, stdout, stderr });
         });
         child.on("error", (err) => {

package/mcp/dist/telemetry.js

@@ -9,7 +9,7 @@
 import * as Sentry from "@sentry/node";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython } from "./repo.js";
+import { repoDir, runPython, setLineSink } from "./repo.js";
 import { VERSION } from "./version.js";
 // Sentry DSN is a client-side identifier (safe to embed, same posture as Fazm's
 // hardcoded Swift DSN). Overridable via env for dev. Empty -> Sentry disabled.
@@ -102,3 +102,168 @@ export async function sendHeartbeat(reason) {
         console.error("[social-autoposter-mcp] heartbeat failed:", err?.message || err);
     }
 }
+// ---- Raw subprocess log streaming ------------------------------------------
+// Tees the verbatim stdout/stderr of every pipeline subprocess (via the
+// repo.ts run() boundary) to the s4l Cloud Run relay, which simply
+// console.log()s each line so Cloud Run's runtime ships it to Cloud Logging.
+// No database, no service-account key on the client — the relay is the only
+// thing authenticated to GCP, and it authenticates implicitly via its Cloud
+// Run runtime identity. Lines are buffered in memory and flushed in small
+// batches under the same X-Installation identity the heartbeat uses.
+//
+// Best-effort: NEVER throws into the server, never blocks the child's I/O, and
+// drops on overflow rather than growing unbounded. Disable with
+// SAPS_LOG_STREAM=0.
+//
+// IMPORTANT: logs go to the CLOUD RUN host (AUTOPOSTER_LOG_BASE, default
+// app.s4l.ai), NOT the Vercel host (AUTOPOSTER_API_BASE / s4l.ai) the heartbeat
+// and onboarding-events use. Cloud Run's native stdout -> Cloud Logging path is
+// the whole point of this lane.
+const LOG_STREAM_ENABLED = process.env.SAPS_LOG_STREAM !== "0";
+const LOG_MAX_LINE_LEN = 8192; // mirror the relay cap
+const LOG_MAX_BUFFER = 1000; // drop oldest beyond this (overflow protection)
+const LOG_FLUSH_BATCH = 100; // flush eagerly once we have this many lines
+const LOG_MAX_PER_POST = 200; // relay accepts 1-200 per request
+const LOG_FLUSH_MS = 3000; // otherwise flush on this cadence
+// Drop genuinely useless high-volume lines before they ever buffer, so a chatty
+// run doesn't crowd out the signal (and to keep Cloud Logging volume sane).
+// Empty/whitespace-only lines plus an env-extensible regex of obvious dump
+// signatures. Deliberately conservative: real pipeline output is the value, so
+// we only filter clear noise. Extend via SAPS_LOG_NOISE_RE (a JS regex source).
+let logNoiseRe = null;
+try {
+    const extra = (process.env.SAPS_LOG_NOISE_RE || "").trim();
+    // Default signatures: a bare `ps`/`launchctl`-style table dump row is rare in
+    // pipeline output but floods when an agent shells one in. Keep this tight.
+    const sources = [
+        extra,
+    ].filter(Boolean);
+    logNoiseRe = sources.length ? new RegExp(sources.join("|")) : null;
+}
+catch {
+    logNoiseRe = null;
+}
+function isNoise(line) {
+    if (!line || !line.trim())
+        return true; // blank / whitespace-only
+    if (logNoiseRe && logNoiseRe.test(line))
+        return true;
+    return false;
+}
+const logBuffer = [];
+let logDropped = 0; // count of lines dropped on overflow (surfaced periodically)
+let logFlushing = false;
+let logTimer;
+let cachedInstallHeader = null;
+let logStreamingStarted = false;
+async function installHeader() {
+    if (cachedInstallHeader)
+        return cachedInstallHeader;
+    try {
+        const idScript = path.join(repoDir(), "scripts", "identity.py");
+        if (!fs.existsSync(idScript))
+            return null;
+        const res = await runPython("scripts/identity.py", ["header"], { timeoutMs: 10_000 });
+        const header = (res.stdout || "").trim();
+        if (res.code === 0 && header) {
+            cachedInstallHeader = header;
+            return header;
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    return null;
+}
+// Buffer one raw line. Called from the repo.ts line sink, so it must be cheap
+// and total non-throwing.
+export function logLine(stream, line, context) {
+    if (!LOG_STREAM_ENABLED)
+        return;
+    try {
+        if (isNoise(line))
+            return;
+        logBuffer.push({
+            ts: new Date().toISOString(),
+            stream,
+            line: line.length > LOG_MAX_LINE_LEN ? line.slice(0, LOG_MAX_LINE_LEN) : line,
+            context: context || "",
+        });
+        if (logBuffer.length > LOG_MAX_BUFFER) {
+            // Drop oldest to bound memory; the newest lines are the most useful.
+            logDropped += logBuffer.length - LOG_MAX_BUFFER;
+            logBuffer.splice(0, logBuffer.length - LOG_MAX_BUFFER);
+        }
+        if (logBuffer.length >= LOG_FLUSH_BATCH)
+            void flushLogs();
+    }
+    catch {
+        /* never throw into the run() boundary */
+    }
+}
+export async function flushLogs() {
+    if (!LOG_STREAM_ENABLED)
+        return;
+    if (logFlushing || logBuffer.length === 0)
+        return;
+    logFlushing = true;
+    try {
+        const header = await installHeader();
+        if (!header)
+            return; // runtime not unpacked yet; keep buffering
+        // Cloud Run relay host (NOT the Vercel API host). app.s4l.ai serves
+        // bin/server.js, whose POST /api/v1/installations/logs console.log()s each
+        // line into Cloud Logging.
+        const base = (process.env.AUTOPOSTER_LOG_BASE || "https://app.s4l.ai").replace(/\/+$/, "");
+        // Drain in <=200-line POSTs until the buffer empties (or a POST fails).
+        while (logBuffer.length > 0) {
+            const batch = logBuffer.splice(0, LOG_MAX_PER_POST);
+            const lines = batch.map((b) => ({
+                ts: b.ts,
+                stream: b.stream,
+                line: b.line,
+                context: b.context || undefined,
+            }));
+            try {
+                const resp = await fetch(`${base}/api/v1/installations/logs`, {
+                    method: "POST",
+                    headers: { "X-Installation": header, "content-type": "application/json" },
+                    body: JSON.stringify({ lines }),
+                    signal: AbortSignal.timeout(15_000),
+                });
+                if (!resp.ok) {
+                    // Drop this batch (don't re-buffer): a persistent 4xx/5xx would grow
+                    // the buffer unbounded. The raw stream is best-effort.
+                    console.error(`[social-autoposter-mcp] log flush http ${resp.status}`);
+                    break;
+                }
+            }
+            catch (err) {
+                // Network blip: drop this batch, stop draining, try again next tick.
+                console.error("[social-autoposter-mcp] log flush failed:", err?.message || err);
+                break;
+            }
+        }
+        if (logDropped > 0) {
+            console.error(`[social-autoposter-mcp] log stream dropped ${logDropped} line(s) on overflow`);
+            logDropped = 0;
+        }
+    }
+    finally {
+        logFlushing = false;
+    }
+}
+// Register the repo.ts line sink and start the periodic flush. Idempotent.
+export function startLogStreaming() {
+    if (!LOG_STREAM_ENABLED || logStreamingStarted)
+        return;
+    logStreamingStarted = true;
+    try {
+        setLineSink((line, stream, context) => logLine(stream, line, context));
+        logTimer = setInterval(() => void flushLogs(), LOG_FLUSH_MS);
+        logTimer.unref();
+    }
+    catch (err) {
+        console.error("[social-autoposter-mcp] log streaming start failed:", err?.message || err);
+    }
+}

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.88",
-  "installedAt": "2026-06-23T18:40:27.430Z"
+  "version": "1.6.90",
+  "installedAt": "2026-06-23T19:42:27.028Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.88",
+  "version": "1.6.90",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/menubar/s4l_card.py

@@ -1,10 +1,12 @@
 """Corner pop-up review cards for draft approval (AppKit / pyobjc).
 
-`present_review(drafts, on_complete)` shows one small floating panel per draft in
-the top-right corner: thread context, an EDITABLE reply field, a counter, and
-Reject / Approve (+ Reject all). Advancing through every card calls on_complete
-with the decisions. The whole AppKit surface is isolated behind that one
-function so the menu bar wiring doesn't depend on the windowing details.
+`present_review(drafts, on_decision, on_complete)` shows one small floating panel
+per draft in the top-right corner: thread context, an EDITABLE reply field, a
+counter, and Reject / Approve. `on_decision` fires the INSTANT each card is
+approved/rejected (so an approved draft can post right away), and `on_complete`
+fires once the last card is decided or the window is closed. The whole AppKit
+surface is isolated behind that one function so the menu bar wiring doesn't
+depend on the windowing details.
 
 Decision shape: {"n": int, "approved": bool, "text": str, "edited": bool}
 
@@ -70,11 +72,12 @@ def _label(frame, text, *, size=12, bold=False, muted=False):
 
 
 class _ReviewController(NSObject):
-    def initWithDrafts_onComplete_(self, drafts, on_complete):
+    def initWithDrafts_onDecision_onComplete_(self, drafts, on_decision, on_complete):
         self = objc.super(_ReviewController, self).init()
         if self is None:
             return None
         self._drafts = list(drafts)
+        self._on_decision = on_decision
         self._on_complete = on_complete
         self._idx = 0
         self._decisions = []
@@ -218,13 +221,29 @@ class _ReviewController(NSObject):
         else:
             self._render()
 
+    @objc.python_method
+    def _fire_decision(self):
+        # Fire the per-card callback the instant a decision is made, so an
+        # approved draft starts posting immediately instead of waiting for the
+        # whole batch to be reviewed. A throwing callback must never break the
+        # card flow (or the panel would wedge on the current card).
+        cb = self._on_decision
+        if cb is None or not self._decisions:
+            return
+        try:
+            cb(dict(self._decisions[-1]))
+        except Exception:
+            pass
+
     # ObjC selectors (trailing underscore -> "approve:" etc.)
     def approve_(self, sender):
         self._record(True)
+        self._fire_decision()
         self._advance()
 
     def reject_(self, sender):
         self._record(False)
+        self._fire_decision()
         self._advance()
 
     def windowShouldClose_(self, sender):
@@ -252,12 +271,17 @@ class _ReviewController(NSObject):
         _active = None
 
 
-def present_review(drafts, on_complete):
+def present_review(drafts, on_decision=None, on_complete=None):
     """Show the review cards (main thread only). drafts: list of
-    {n, thread_author, thread_text, reply_text, link_url}. on_complete(decisions)
-    fires on the main thread when the user finishes or closes the window."""
+    {n, thread_author, thread_text, reply_text, link_url}.
+    on_decision(decision) fires the instant each card is approved/rejected (so an
+    approved draft posts right away); on_complete(decisions) fires when the user
+    finishes the last card or closes the window. Both run on the main thread."""
     global _active
     if not drafts:
-        on_complete([])
+        if on_complete is not None:
+            on_complete([])
         return
-    _active = _ReviewController.alloc().initWithDrafts_onComplete_(drafts, on_complete)
+    _active = _ReviewController.alloc().initWithDrafts_onDecision_onComplete_(
+        drafts, on_decision, on_complete
+    )

package/mcp/menubar/s4l_menubar.py

@@ -18,6 +18,7 @@ rather than rumps.notification (which needs a bundle id).
 
 import json
 import os
+import queue
 import subprocess
 import sys
 import tempfile
@@ -152,6 +153,17 @@ class S4LMenuBar(rumps.App):
         # later batch for the life of this process (only a restart cleared it),
         # which is exactly the "drafts queued but no cards" bug.
         self._last_review_sig = None
+        # Per-card posting. Each approved card posts the INSTANT it's approved,
+        # serialized through one persistent worker so two posts never drive the
+        # shared harness Chrome at once (the poster lock fails a concurrent peer
+        # after 45s rather than queuing it, which would land the 2nd card 0/N).
+        # `_review_active` stays true while the panel is open OR posts are still
+        # draining, so a half-posted set is never re-presented as fresh cards.
+        self._post_q = queue.Queue()
+        self._post_worker = None
+        self._review_lock = threading.Lock()
+        self._panel_open = False
+        self._posts_outstanding = 0
         self._spin_i = 0
         self._spinner = None  # fast rumps.Timer animating the title while busy
         # Reliable self-check of our own Accessibility (TCC) grant — this is the
@@ -467,11 +479,14 @@ class S4LMenuBar(rumps.App):
         if sig == self._last_review_sig:
             return
         self._review_active = True
+        self._panel_open = True
         try:
             import s4l_card
 
             s4l_card.present_review(
-                drafts, lambda decisions: self._on_review_done(batch, decisions)
+                drafts,
+                on_decision=lambda d: self._on_card_decision(batch, d),
+                on_complete=lambda decisions: self._on_review_closed(batch, decisions),
             )
             # Record as shown only AFTER the cards are actually up, so a transient
             # card-UI failure never permanently suppresses this pending set.
@@ -479,41 +494,80 @@ class S4LMenuBar(rumps.App):
         except Exception as e:
             # Card UI unavailable — don't strand the batch; chat review still works.
             self._review_active = False
+            self._panel_open = False
             sys.stderr.write(f"[s4l-menubar] review cards failed: {e}\n")
             sys.stderr.flush()
             _capture(e, phase="review_cards")
 
-    def _on_review_done(self, batch, decisions):
-        # Runs on the main thread (from the card controller). Translate decisions
-        # into post_drafts args and post on a background thread so the UI stays
-        # responsive (posting can take minutes).
-        approved = [d for d in decisions if d.get("approved")]
-        post_nums = [d["n"] for d in approved if not d.get("edited")]
-        edits = [{"n": d["n"], "text": d["text"]} for d in approved if d.get("edited")]
+    def _on_card_decision(self, batch, decision):
+        # Runs on the main thread the INSTANT a card is approved/rejected. An
+        # approved card is enqueued for immediate posting; a rejected card does
+        # nothing. We never post inline here — posting can take minutes and would
+        # freeze the card UI while the user reviews the rest of the stack.
+        if not decision.get("approved"):
+            return
+        with self._review_lock:
+            self._posts_outstanding += 1
+            self._review_active = True
+        self._post_q.put((batch, decision))
+        self._ensure_post_worker()
+
+    def _on_review_closed(self, batch, decisions):
+        # Fires when the card sequence ends (last card decided or window closed).
+        # The panel is gone, but approved cards may still be draining — keep the
+        # review "active" until the queue empties so the not-yet-posted remainder
+        # isn't re-presented as a fresh batch.
+        with self._review_lock:
+            self._panel_open = False
+            if self._posts_outstanding <= 0:
+                self._review_active = False
         st.clear_review_request()
-        if not approved:
-            self._review_active = False
+        if not any(d.get("approved") for d in decisions):
             self._notify("S4L", "No drafts approved — nothing posted.")
-            return
-        self._notify("S4L", f"Posting {len(approved)} draft(s)…")
-
-        # The server's post_drafts writes "posting" activity, so the activity
-        # spinner shows automatically while this runs — no local spinner needed.
-        def work():
-            res = st.post_drafts(batch, post=post_nums, edits=edits)
-            if res is None:
-                self._notify(
-                    "S4L", "Couldn't post — open Claude Desktop and try the draft again."
-                )
-            else:
-                posted = res.get("posted") if isinstance(res, dict) else None
-                self._notify(
-                    "S4L",
-                    f"Posted {posted if posted is not None else len(approved)} draft(s).",
-                )
-            self._review_active = False
 
-        threading.Thread(target=work, daemon=True).start()
+    def _ensure_post_worker(self):
+        # One persistent daemon worker drains the approved-card queue. It never
+        # exits (avoids an enqueue-vs-exit race) — an idle parked thread is cheap.
+        if self._post_worker is not None and self._post_worker.is_alive():
+            return
+        self._post_worker = threading.Thread(target=self._post_worker_loop, daemon=True)
+        self._post_worker.start()
+
+    def _post_worker_loop(self):
+        # Serialized poster: one approved card at a time so two posts never drive
+        # the shared harness Chrome simultaneously. The server's post_drafts writes
+        # "posting" activity, so the menu-bar spinner shows automatically.
+        while True:
+            batch, decision = self._post_q.get()  # blocks until a card is approved
+            n = decision.get("n")
+            try:
+                self._notify("S4L", f"Posting draft {n}…")
+                if decision.get("edited"):
+                    res = st.post_drafts(
+                        batch, edits=[{"n": n, "text": decision.get("text") or ""}]
+                    )
+                else:
+                    res = st.post_drafts(batch, post=[n])
+                if res is None:
+                    self._notify(
+                        "S4L", "Couldn't post — open Claude Desktop and try the draft again."
+                    )
+                else:
+                    posted = res.get("posted") if isinstance(res, dict) else None
+                    if posted == 0:
+                        self._notify("S4L", f"Draft {n} didn't post — see the dashboard for why.")
+                    else:
+                        self._notify("S4L", f"Posted draft {n}.")
+            except Exception as e:
+                sys.stderr.write(f"[s4l-menubar] post draft {n} failed: {e}\n")
+                sys.stderr.flush()
+                _capture(e, phase="post_card")
+            finally:
+                with self._review_lock:
+                    self._posts_outstanding -= 1
+                    if self._posts_outstanding <= 0 and not self._panel_open:
+                        self._review_active = False
+                self._post_q.task_done()
 
     def _render_title(self, setup_complete, ob, blocker):
         if blocker:
@@ -641,9 +695,10 @@ class S4LMenuBar(rumps.App):
             rumps.MenuItem("Run draft cycle in Claude", callback=self._draft)
         )
         # No "Post approved drafts" item: approving a review card already posts
-        # directly + programmatically (_on_review_done -> st.post_drafts -> the
-        # CDP poster). A menu button that types a prompt into the chat to do the
-        # same thing was a redundant detour through the model, so it's gone.
+        # that card directly + programmatically (_on_card_decision -> queue ->
+        # _post_worker_loop -> st.post_drafts -> the CDP poster). A menu button
+        # that types a prompt into the chat to do the same thing was a redundant
+        # detour through the model, so it's gone.
         return out
 
 

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.88",
+  "version": "1.6.90",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.88",
+  "version": "1.6.90",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/s4l_box_update.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Programmatic equivalent of the menu-bar "Please update now" button
+# (mcp/menubar/s4l_menubar.py::_mcpb_update_work). Pulls the latest .mcpb from
+# GitHub releases, unzips it over the Claude Desktop extension dir in place, and
+# restarts Claude so the new MCP server loads. Designed to be run over SSH on a
+# .mcpb box (e.g. `ssh macstadium 'bash -s' < scripts/s4l_box_update.sh`), where
+# npm/npx is absent so the `runtime action:update` (npx) path is dead.
+#
+# Flags:
+#   --check        Print installed vs latest and exit (no download, no restart).
+#   --no-restart   Download + unpack the new .mcpb but do NOT restart Claude.
+#   (default)      Download + unpack + restart Claude.
+#
+# Exits: 0 ok / already current, 2 download failed, 3 unpack failed, 4 no install.
+set -euo pipefail
+
+EXT_DIR="$HOME/Library/Application Support/Claude/Claude Extensions/local.mcpb.m13v.social-autoposter"
+MCPB_URL="https://github.com/m13v/social-autoposter/releases/latest/download/social-autoposter.mcpb"
+RELEASE_API="https://api.github.com/repos/m13v/social-autoposter/releases/latest"
+PY="/usr/bin/python3"
+
+mode="run"
+case "${1:-}" in
+  --check)      mode="check" ;;
+  --no-restart) mode="no-restart" ;;
+  "")           mode="run" ;;
+  *) echo "unknown flag: $1" >&2; exit 64 ;;
+esac
+
+[ -f "$EXT_DIR/manifest.json" ] || { echo "no .mcpb install at $EXT_DIR" >&2; exit 4; }
+
+installed="$("$PY" -c "import json,sys;print((json.load(open(sys.argv[1])) or {}).get('version',''))" "$EXT_DIR/manifest.json" 2>/dev/null || true)"
+latest_tag="$(curl -fsSL -m 15 "$RELEASE_API" | "$PY" -c "import sys,json;print((json.load(sys.stdin) or {}).get('tag_name',''))" 2>/dev/null || true)"
+latest="${latest_tag#v}"
+echo "installed=$installed latest=$latest"
+
+if [ "$mode" = "check" ]; then
+  [ -n "$latest" ] && [ "$installed" != "$latest" ] && echo "update_available=true" || echo "update_available=false"
+  exit 0
+fi
+
+if [ -n "$latest" ] && [ "$installed" = "$latest" ]; then
+  echo "already on latest ($installed); re-applying anyway would just restart Claude. skipping."
+  # Comment the next line out if you want a forced re-unpack even when current.
+  exit 0
+fi
+
+tmpd="$(mktemp -d -t s4l-update-XXXXXX)"
+trap 'rm -rf "$tmpd"' EXIT
+mcpb="$tmpd/social-autoposter.mcpb"
+
+echo "downloading $MCPB_URL ..."
+curl -fLs -m 300 "$MCPB_URL" -o "$mcpb" || { echo "download failed" >&2; exit 2; }
+sz=$(stat -f%z "$mcpb" 2>/dev/null || echo 0)
+[ "$sz" -ge 100000 ] || { echo "download too small ($sz bytes), aborting" >&2; exit 2; }
+
+echo "unpacking into extension dir ..."
+unzip -oq "$mcpb" -d "$EXT_DIR" || { echo "unpack failed" >&2; exit 3; }
+new_ver="$("$PY" -c "import json,sys;print((json.load(open(sys.argv[1])) or {}).get('version',''))" "$EXT_DIR/manifest.json" 2>/dev/null || true)"
+echo "unpacked version=$new_ver"
+
+if [ "$mode" = "no-restart" ]; then
+  echo "done (no restart requested); restart Claude to load v$new_ver."
+  exit 0
+fi
+
+# Restart Claude. From an SSH session we skip the osascript graceful-quit the
+# menu bar uses (it can trip an Automation TCC prompt for sshd and block
+# unattended); killall sends SIGTERM and needs no automation grant.
+echo "restarting Claude ..."
+killall Claude 2>/dev/null || true
+sleep 4
+killall -9 Claude 2>/dev/null || true
+sleep 1
+open -a Claude 2>/dev/null || true
+echo "done; Claude restarting on v$new_ver."

package/scripts/s4l_ctl.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# s4l-ctl: programmatic control of the running social-autoposter (S4L) plugin via
+# its loopback tool server, for QA. Runs the same handlers as the in-chat MCP
+# tools (POST /tool/<name>). MUST run ON the box (the loopback is 127.0.0.1-only),
+# so over SSH use:  ssh macstadium 'bash -s -- <subcommand> [args]' < scripts/s4l_ctl.sh
+#
+# Subcommands:
+#   status                 Dashboard snapshot (read-only).
+#   count                  Number of pending (unposted) drafts (read-only).
+#   drafts                 List pending drafts with their 1-based numbers (read-only).
+#   approve <n> [n...]     Post the given card numbers. DESTRUCTIVE — requires --yes.
+#   approve-all            Post EVERY pending card. DESTRUCTIVE — requires --yes.
+#
+# DESTRUCTIVE note: "approve" really posts replies to live X/Twitter threads. The
+# write subcommands refuse to run unless --yes is present (no interactive prompt,
+# because over piped SSH there is no tty). For host-level plugin UPDATE use the
+# separate scripts/s4l_box_update.sh (different mechanism: works even when the
+# loopback is down, and it restarts Claude).
+set -euo pipefail
+
+BATCH="review-queue"
+PLAN="/tmp/twitter_cycle_plan_${BATCH}.json"
+EP="$HOME/.social-autoposter-mcp/panel-endpoint.json"
+PY="/usr/bin/python3"
+
+YES=0; ARGS=()
+for a in "$@"; do
+  case "$a" in --yes|-y) YES=1 ;; *) ARGS+=("$a") ;; esac
+done
+set -- ${ARGS[@]+"${ARGS[@]}"}
+cmd="${1:-}"; [ $# -gt 0 ] && shift || true
+
+[ -f "$EP" ] || { echo "no panel-endpoint.json — is Claude Desktop / the MCP running?" >&2; exit 1; }
+URL="$("$PY" -c "import json;print(json.load(open('$EP'))['url'])")"
+curl -s -m 3 "${URL}health" >/dev/null || { echo "loopback unreachable at $URL" >&2; exit 1; }
+
+tool() { curl -s -m "${2:-900}" -X POST "${URL}tool/$1" -H 'Content-Type: application/json' -d "${3:-{}}"; }
+
+pending_count() {
+  [ -f "$PLAN" ] || { echo 0; return; }
+  "$PY" -c "import json;d=json.load(open('$PLAN'));print(sum(1 for c in d.get('candidates',[]) if not c.get('posted')))"
+}
+
+case "$cmd" in
+  status)
+    tool dashboard 20 ; echo ;;
+  count)
+    echo "pending=$(pending_count)" ;;
+  drafts)
+    if [ ! -f "$PLAN" ]; then echo "no review-queue plan on box (0 drafts)"; exit 0; fi
+    "$PY" - "$PLAN" <<'PYEOF'
+import json,sys
+d=json.load(open(sys.argv[1]))
+for i,c in enumerate(d.get("candidates",[]),1):
+    if c.get("posted"): continue
+    txt=(c.get("reply_text") or "").replace("\n"," ")
+    print(f"#{i:<4} @{(c.get('thread_author') or '?'):<18} {txt[:90]}")
+PYEOF
+    echo "pending=$(pending_count)" ;;
+  approve)
+    [ $# -ge 1 ] || { echo "usage: approve <n> [n...] --yes" >&2; exit 64; }
+    nums="$(printf '%s\n' "$@" | paste -sd, -)"
+    if [ "$YES" != "1" ]; then
+      echo "REFUSING: 'approve $*' will POST those cards to live X. Re-run with --yes to confirm." >&2; exit 3; fi
+    echo "posting cards [$nums] ..."
+    tool post_drafts 900 "{\"batch_id\":\"$BATCH\",\"post\":[$nums]}" ; echo ;;
+  approve-all)
+    n="$(pending_count)"
+    if [ "$YES" != "1" ]; then
+      echo "REFUSING: approve-all will POST all $n pending cards to live X. Re-run with --yes to confirm." >&2; exit 3; fi
+    echo "posting all $n pending cards ..."
+    tool post_drafts 1800 "{\"batch_id\":\"$BATCH\",\"post_all\":true}" ; echo ;;
+  *)
+    echo "usage: s4l_ctl.sh {status|count|drafts|approve <n...>|approve-all} [--yes]" >&2; exit 64 ;;
+esac

package/scripts/setup_twitter_auth.py

@@ -1209,6 +1209,37 @@ def cmd_connect(args) -> dict:
     }
 
 
+def cmd_resolve_handle(args) -> dict:
+    """Read the live logged-in @handle from the managed Chrome and persist it to
+    config.json accounts.twitter.handle.
+
+    The MCP post preflight calls this to self-heal a missing handle — the onboarding
+    gap where connect_x's best-effort live-DOM read silently no-op'd, leaving the
+    install logged in but with accounts:null, so twitter_browser.py refused EVERY
+    reply with no_account_configured. Reading the handle from the SAME session the
+    poster posts through is ground truth, not a guess, so it's safe where a hardcoded
+    fallback would not be. Best-effort: returns state=browser_not_running / no_handle
+    on failure and never raises."""
+    try:
+        ws, send = _attach()
+    except Exception as e:
+        return {"ok": False, "state": "browser_not_running", "error": str(e)}
+    handle = None
+    try:
+        handle = _resolve_live_handle(send)
+    except Exception:
+        handle = None
+    finally:
+        try:
+            ws.close()
+        except Exception:
+            pass
+    if not handle:
+        return {"ok": False, "state": "no_handle"}
+    persisted = _write_handle_to_config(handle)
+    return {"ok": True, "state": "resolved", "handle": handle, "persisted": persisted}
+
+
 def main() -> int:
     ap = argparse.ArgumentParser(description="Twitter/X session bootstrap for MCP setup.")
     sub = ap.add_subparsers(dest="cmd", required=True)
@@ -1216,6 +1247,10 @@ def main() -> int:
     sub.add_parser("detect-sources",
                    help="List browsers/profiles to import the X session from "
                         "(JSON, for the panel dropdown). No keychain prompt.")
+    sub.add_parser("resolve-handle",
+                   help="Read the live logged-in @handle from the managed Chrome and "
+                        "persist it to config.json accounts.twitter.handle. Idempotent "
+                        "self-heal for the post preflight; never overwrites a real handle.")
     c = sub.add_parser("connect", help="Ensure browser + import/validate the X session.")
     c.add_argument("--source", default=None,
                    help="Browser profile to import from (e.g. chrome:Default, arc:Default), "
@@ -1244,6 +1279,8 @@ def main() -> int:
         out = {"ok": False, "state": "error", "error": _WEBSOCKET_IMPORT_ERROR}
     elif args.cmd == "status":
         out = cmd_status(args)
+    elif args.cmd == "resolve-handle":
+        out = cmd_resolve_handle(args)
     else:
         out = cmd_connect(args)
     print(json.dumps(out, indent=2))

package/scripts/test_percard_posting.py

@@ -0,0 +1,123 @@
+"""Headless logic test for per-card serialized posting in the menu bar.
+
+Stubs the heavy deps (rumps / sentry_init / s4l_state) so s4l_menubar imports
+without AppKit, then drives the REAL _on_card_decision + _post_worker_loop on an
+instance built via object.__new__ (bypassing rumps.App.__init__). Verifies:
+  1. posts run strictly one-at-a-time (no overlap on the shared browser)
+  2. order is preserved (FIFO)
+  3. plain approvals -> post=[n]; edited approvals -> edits=[{n,text}]
+  4. rejected cards never post
+  5. _posts_outstanding / _review_active settle to idle once drained
+"""
+import os
+import queue
+import sys
+import threading
+import time
+import types
+
+HERE = os.path.join(os.path.dirname(__file__), "..", "mcp", "menubar")
+sys.path.insert(0, os.path.abspath(HERE))
+
+# --- stub heavy deps so the import is headless --------------------------------
+rumps = types.ModuleType("rumps")
+class _App:
+    def __init__(self, *a, **k):
+        pass
+rumps.App = _App
+rumps.Timer = lambda *a, **k: types.SimpleNamespace(start=lambda: None, stop=lambda: None)
+rumps.MenuItem = lambda *a, **k: object()
+rumps.separator = object()
+rumps.notification = lambda *a, **k: None
+sys.modules["rumps"] = rumps
+
+sentry_init = types.ModuleType("sentry_init")
+sentry_init.init_sentry = lambda *a, **k: None
+sentry_init.capture = lambda *a, **k: None
+sys.modules["sentry_init"] = sentry_init
+
+# Track concurrency + record every post_drafts call.
+overlap_detected = []
+inflight = {"n": 0}
+inflight_lock = threading.Lock()
+calls = []
+
+def fake_post_drafts(batch_id, post=None, edits=None, timeout=900):
+    with inflight_lock:
+        inflight["n"] += 1
+        if inflight["n"] > 1:
+            overlap_detected.append(True)
+    calls.append({"batch": batch_id, "post": post or [], "edits": edits or []})
+    time.sleep(0.15)  # simulate a slow post so overlaps would be caught
+    with inflight_lock:
+        inflight["n"] -= 1
+    # mimic the real shape: posted count
+    n_posted = len(post or []) + len(edits or [])
+    return {"posted": n_posted}
+
+st = types.ModuleType("s4l_state")
+st.post_drafts = fake_post_drafts
+st.accessibility_trusted = lambda: True
+st.clear_review_request = lambda: None
+sys.modules["s4l_state"] = st
+
+import s4l_menubar  # noqa: E402
+
+# --- build an instance without running rumps.App.__init__ ---------------------
+app = object.__new__(s4l_menubar.S4LMenuBar)
+app._post_q = queue.Queue()
+app._post_worker = None
+app._review_lock = threading.Lock()
+app._panel_open = True
+app._posts_outstanding = 0
+app._review_active = False
+app._notify = lambda title, msg: None  # silence Notification Center
+
+BATCH = "review-queue"
+
+# Approve a quick burst (as if the user clicked Approve on several cards fast),
+# one edited, plus a rejected card that must NOT post.
+decisions = [
+    {"n": 1, "approved": True, "text": "reply one", "edited": False},
+    {"n": 2, "approved": True, "text": "edited two", "edited": True},
+    {"n": 3, "approved": False, "text": "skip", "edited": False},
+    {"n": 4, "approved": True, "text": "reply four", "edited": False},
+]
+for d in decisions:
+    app._on_card_decision(BATCH, d)
+    time.sleep(0.02)  # tight succession -> overlap would happen if not serialized
+
+# Panel closes while posts may still be draining.
+app._on_review_closed(BATCH, decisions)
+
+# Wait for the queue to drain.
+deadline = time.time() + 10
+while time.time() < deadline:
+    with app._review_lock:
+        if app._posts_outstanding == 0 and app._post_q.empty():
+            break
+    time.sleep(0.05)
+
+# --- assertions ---------------------------------------------------------------
+fail = []
+if overlap_detected:
+    fail.append(f"posts overlapped ({len(overlap_detected)} times) — not serialized")
+posted_ns = [(c["post"], c["edits"]) for c in calls]
+expected = [([1], []), ([], [{"n": 2, "text": "edited two"}]), ([4], [])]
+if posted_ns != expected:
+    fail.append(f"wrong calls/order: got {posted_ns}\n  expected {expected}")
+if any(c["post"] == [3] or any(e.get("n") == 3 for e in c["edits"]) for c in calls):
+    fail.append("rejected card #3 was posted")
+with app._review_lock:
+    if app._posts_outstanding != 0:
+        fail.append(f"_posts_outstanding leaked: {app._posts_outstanding}")
+    if app._review_active:
+        fail.append("_review_active stuck true after drain + panel closed")
+
+if fail:
+    print("FAIL:")
+    for f in fail:
+        print("  -", f)
+    sys.exit(1)
+print("PASS: 3 posts, serialized, FIFO order, #3 skipped, flags settled idle.")
+print("  calls:", posted_ns)