social-autoposter 1.6.91 → 1.6.92

package/mcp/dist/index.js

@@ -504,9 +504,13 @@ function renderDraftsTable(plan) {
     const candidates = plan.candidates || [];
     return candidates
         // Number by FULL-array index (matches post_drafts + the menu bar), then drop
-        // already-posted entries so the cards only show what's still pending.
+        // already-finished entries so the cards only show what's still pending.
         .map((c, i) => ({ c, n: i + 1 }))
-        .filter((e) => e.c.posted !== true)
+        .filter((e) => e.c.posted !== true && e.c.terminal !== true)
+        // The queue is append-only; newest drafts have the highest stable index.
+        // Show those first so review starts with likely-live tweets instead of stale
+        // low-number drafts that have been sitting around for hours.
+        .sort((a, b) => b.n - a.n)
         .map(({ c, n }) => {
         const author = c.thread_author ? `@${c.thread_author}` : "(unknown thread)";
         const style = c.engagement_style ?? "?";
@@ -532,6 +536,52 @@ function renderDraftsTable(plan) {
     })
         .join("\n\n");
 }
+function parsePostCandidateResults(stdout) {
+    const byId = new Map();
+    const upsert = (candidateId, outcome, reason, ourUrl) => {
+        const prev = byId.get(candidateId);
+        // A landed post wins over any earlier noisy line for the same candidate.
+        if (prev?.outcome === "posted" && outcome !== "posted")
+            return;
+        byId.set(candidateId, {
+            candidate_id: candidateId,
+            outcome,
+            ...(reason ? { reason } : {}),
+            ...(ourUrl ? { our_url: ourUrl } : {}),
+        });
+    };
+    for (const line of stdout.split("\n")) {
+        let m = /\[post\] candidate (\d+) posted as (\S+) \(post_id=/.exec(line);
+        if (m) {
+            upsert(m[1], "posted", undefined, m[2]);
+            continue;
+        }
+        m = /\[post\] candidate (\d+): pre-post dedup hit\b/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", "duplicate_thread_pre_post");
+            continue;
+        }
+        m = /\[post\] candidate (\d+) reply failed: ([A-Za-z0-9_:-]+)/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", m[2]);
+            continue;
+        }
+        m = /\[post\] candidate (\d+) reply succeeded but reply_url invalid:/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", "no_reply_url_captured");
+            continue;
+        }
+        m = /\[post\] candidate (\d+): empty reply_text; skipping/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", "empty_reply_text");
+            continue;
+        }
+        m = /\[post\] candidate (\d+) crashed:/.exec(line);
+        if (m)
+            upsert(m[1], "failed", "exception");
+    }
+    return [...byId.values()];
+}
 // Resolve the configured posting handle the SAME way account_resolver.py does:
 // AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
 // Returns the bare handle (no @) or null. The post preflight uses it so a missing
@@ -642,9 +692,13 @@ async function postApproved(batchId, plan) {
             });
         }
         finally {
-            // Always free the lock so a queued scan can proceed, even on throw/timeout.
+            // Don't free the lock immediately — hold it through a grace window so the
+            // NEXT approved card (a separate post_drafts call) reuses the same continuous
+            // hold, and a parked scan can't slip into the gap between cards. The timer
+            // releases it once posting truly stops (mirrors the plist holding the lock
+            // through the whole posting phase, then releasing at the end).
             if (heldShellLock)
-                releaseShellBrowserLock();
+                scheduleShellLockRelease();
         }
     })();
     // Persist the poster's own stdout/stderr to a dated log. Without this the post
@@ -680,11 +734,57 @@ async function postApproved(batchId, plan) {
         : res.code === 0 && !summObj
             ? approved.length
             : 0;
-    // Mark only candidates that ACTUALLY posted (cross-surface de-dup). When the
-    // summary is missing but the run exited clean, fall back to marking all.
-    if (realPosted > 0 || (res.code === 0 && !summObj)) {
+    // Mark candidates according to the poster's per-candidate outcome. This keeps
+    // the review queue honest: posted drafts disappear as posted, terminal skips
+    // (dedup, deleted tweet, no captured URL) disappear without being counted as
+    // posted, and multi-approval batches no longer smear one posted count across
+    // every approved draft.
+    const resultRowsFromSummary = Array.isArray(summObj?.candidate_results)
+        ? summObj?.candidate_results
+        : [];
+    const resultRows = resultRowsFromSummary.length
+        ? resultRowsFromSummary
+            .map((r) => ({
+            candidate_id: String(r.candidate_id ?? ""),
+            outcome: String(r.outcome || ""),
+            reason: typeof r.reason === "string" ? r.reason : undefined,
+            our_url: typeof r.our_url === "string" ? r.our_url : undefined,
+        }))
+            .filter((r) => r.candidate_id && ["posted", "skipped", "failed"].includes(r.outcome))
+        : parsePostCandidateResults(res.stdout);
+    const approvedById = new Map();
+    approved.forEach((c) => {
+        if (c.candidate_id !== undefined && c.candidate_id !== null)
+            approvedById.set(String(c.candidate_id), c);
+    });
+    let touchedPlan = false;
+    if (resultRows.length) {
+        resultRows.forEach((r, idx) => {
+            const c = approvedById.get(r.candidate_id) || approved[idx];
+            if (!c)
+                return;
+            if (r.outcome === "posted") {
+                c.posted = true;
+                c.terminal = false;
+                if (r.our_url)
+                    c.our_url = r.our_url;
+                touchedPlan = true;
+            }
+            else if (r.outcome === "skipped" || r.outcome === "failed") {
+                c.terminal = true;
+                c.terminal_reason = r.reason || r.outcome;
+                touchedPlan = true;
+            }
+        });
+    }
+    else if (realPosted > 0 || (res.code === 0 && !summObj)) {
+        // Legacy fallback for older poster output without parseable per-candidate
+        // lines. Mark only when we have no finer-grained signal.
         for (const c of approved)
             c.posted = true;
+        touchedPlan = true;
+    }
+    if (touchedPlan) {
         try {
             writePlan(batchId, plan);
         }
@@ -1984,6 +2084,11 @@ async function runScanCandidates(project, onProgress) {
     // long-poll doesn't leave it on a generic "working" (or flicker to idle between
     // re-calls). Cleared by the handler when the scan resolves.
     writeActivity("scanning", project ? `scanning X for ${project}` : "scanning X");
+    // Single-flight: kill any pre-existing run-twitter-cycle.sh (zombies that
+    // survived a prior preempt, or stale waiters parked behind a post) before
+    // launching, so only ONE scan ever exists. The plist gets this from
+    // run-twitter-cycle-singleton.sh; the MCP's direct launch must enforce it here.
+    sigkillAllScans();
     const res = await run("bash", ["skill/run-twitter-cycle.sh"], {
         env,
         timeoutMs: 900_000,
@@ -2126,68 +2231,140 @@ function rmShellLockDir() {
     }
 }
 const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
-// SIGTERM a live scan holding the shell browser lock so the post takes the
-// browser at once. Best-effort; only ever targets a run-twitter-cycle.sh.
+// SIGKILL a scan's WHOLE process tree (the bash + its browser-harness/tee
+// children). run-twitter-cycle.sh traps SIGTERM/INT/HUP (skill/lock.sh installs
+// `trap _sa_release_locks ... TERM`), so a SIGTERM runs the cleanup handler and
+// the script KEEPS GOING — the scan never dies, still drives Chrome, and the next
+// autopilot tick stacks another on top (the zombie pileup that stale-reclaimed the
+// lock mid-post). SIGKILL can't be trapped. Kill children first so the harness CDP
+// driver lets go of Chrome immediately.
+function sigkillScanTree(pid) {
+    try {
+        const out = execFileSync("pgrep", ["-P", String(pid)], { encoding: "utf-8", timeout: 4000 });
+        for (const cstr of out.split(/\s+/)) {
+            const c = parseInt(cstr, 10);
+            if (Number.isFinite(c) && c > 0) {
+                try {
+                    process.kill(c, "SIGKILL");
+                }
+                catch {
+                    /* gone */
+                }
+            }
+        }
+    }
+    catch {
+        /* no children / pgrep unavailable */
+    }
+    try {
+        process.kill(pid, "SIGKILL");
+    }
+    catch {
+        /* gone */
+    }
+}
+// Single-flight: SIGKILL every run-twitter-cycle.sh on the box before launching a
+// fresh scan, so a zombie that survived a prior SIGTERM (or a stale waiter parked
+// behind a post) can never accumulate. Mirrors the plist's run-twitter-cycle-
+// singleton.sh "one cycle at a time" guarantee, which the MCP's direct launch
+// bypassed. Best-effort; never throws.
+function sigkillAllScans() {
+    try {
+        const out = execFileSync("pgrep", ["-f", "skill/run-twitter-cycle.sh"], {
+            encoding: "utf-8",
+            timeout: 4000,
+        });
+        for (const pstr of out.split(/\s+/)) {
+            const p = parseInt(pstr, 10);
+            if (Number.isFinite(p) && p > 0)
+                sigkillScanTree(p);
+        }
+    }
+    catch {
+        /* none running */
+    }
+}
+// ---- Lock grace-hold: hold the /tmp lock CONTINUOUSLY across per-card posts ----
+// The plist pipeline acquires the browser lock ONCE and holds it through the whole
+// posting phase. The MCP posts per approved card (separate post_drafts calls), and
+// the old code acquired+released the lock PER CARD — leaving a release window
+// BETWEEN every card that a parked scan stale-reclaimed (the hijack). Instead we
+// keep the lock and only release it after SHELL_LOCK_GRACE_MS of no posting, so the
+// hold EXPANDS as more cards get approved and there is never a gap between cards.
+const SHELL_LOCK_GRACE_MS = Number(process.env.SAPS_POST_LOCK_GRACE_MS) || 60_000;
+let shellLockReleaseTimer = null;
+function cancelScheduledShellLockRelease() {
+    if (shellLockReleaseTimer) {
+        clearTimeout(shellLockReleaseTimer);
+        shellLockReleaseTimer = null;
+    }
+}
+function scheduleShellLockRelease() {
+    cancelScheduledShellLockRelease();
+    shellLockReleaseTimer = setTimeout(() => {
+        shellLockReleaseTimer = null;
+        releaseShellBrowserLock();
+    }, SHELL_LOCK_GRACE_MS);
+}
+// SIGKILL a live scan holding the shell browser lock so the post takes the browser
+// at once. Best-effort; only ever targets a run-twitter-cycle.sh.
 function preemptScanHoldingBrowser() {
     try {
         const pid = shellLockHolderPid();
         if (pid && pidAlive(pid) && pidIsScan(pid)) {
-            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid})`);
-            try {
-                process.kill(pid, "SIGTERM");
-            }
-            catch {
-                /* already gone */
-            }
+            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid}) — SIGKILL tree`);
+            sigkillScanTree(pid);
         }
     }
     catch {
         /* best effort */
     }
 }
-// Take the shell browser lock for the batch. Preempts a scan holder; never
-// steals from a live non-scan holder (a peer poster) — there it returns false
-// and posting proceeds unguarded (no worse than before). Best-effort.
+// Take (or extend) the shell browser lock for the batch. Preempts a scan holder
+// with SIGKILL; never steals from a live non-scan holder (a peer poster) — there
+// it returns false and posting proceeds unguarded (no worse than before).
 async function acquireShellBrowserLock() {
+    // A new post cancels any pending grace-release and EXTENDS the existing hold.
+    cancelScheduledShellLockRelease();
+    // Already ours? Refresh the pid + expiry and keep holding — this is the "expand
+    // the lock as more cards get approved" path: consecutive per-card posts reuse
+    // ONE continuous hold instead of churning the lock, which is what left a window
+    // a parked scan stale-reclaimed between cards.
+    if (shellLockHolderPid() === process.pid) {
+        try {
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
+        }
+        catch {
+            /* best effort */
+        }
+        return true;
+    }
     for (let attempt = 0; attempt < 8; attempt++) {
         try {
             fs.mkdirSync(TW_BROWSER_LOCK_DIR); // atomic mutex — only one winner
-            try {
-                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
-            }
-            catch {
-                /* best effort */
-            }
-            try {
-                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
-            }
-            catch {
-                /* best effort */
-            }
+            // Write the pid IMMEDIATELY (sync) so the dir is never observably pid-less.
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
             console.error(`[post] holding twitter-browser shell lock pid=${process.pid} — scans queue behind the post`);
             return true;
         }
         catch {
-            // Dir exists. Reclaim if the holder is dead; preempt if it's a scan;
+            // Dir exists. Reclaim if the holder is dead; SIGKILL-preempt if it's a scan;
             // otherwise (a live peer poster) leave it and post unguarded.
             const pid = shellLockHolderPid();
             if (!pid || !pidAlive(pid)) {
                 rmShellLockDir();
             }
             else if (pidIsScan(pid)) {
-                try {
-                    process.kill(pid, "SIGTERM");
-                }
-                catch {
-                    /* already gone */
-                }
-                await sleepMs(400);
+                sigkillScanTree(pid); // SIGKILL — scans trap SIGTERM and survive it
+                await sleepMs(300);
                 rmShellLockDir();
             }
             else {
                 return false; // a real peer holds it — don't steal; proceed
             }
-            await sleepMs(250);
+            await sleepMs(200);
         }
     }
     return false;
@@ -2213,13 +2390,8 @@ function releaseShellBrowserLock() {
 function preemptScanForPost() {
     try {
         if (scanChild && scanChild.pid && scanChild.exitCode === null) {
-            console.error(`[post] preempting in-flight plugin scan (pid ${scanChild.pid}) so the approved post takes the browser`);
-            try {
-                scanChild.kill("SIGTERM");
-            }
-            catch {
-                /* already gone */
-            }
+            console.error(`[post] preempting in-flight plugin scan (pid ${scanChild.pid}) so the approved post takes the browser — SIGKILL tree`);
+            sigkillScanTree(scanChild.pid); // SIGKILL — scan bash traps SIGTERM
         }
     }
     catch {

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.91",
-  "installedAt": "2026-06-23T19:56:23.942Z"
+  "version": "1.6.92",
+  "installedAt": "2026-06-23T20:21:02.288Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.91",
+  "version": "1.6.92",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -376,13 +376,17 @@ class S4LMenuBar(rumps.App):
         act = st.read_activity()
         label = act.get("label") if act else None
         if label:
+            # The update arrow must stay visible even while a tool runs, so the
+            # "update available" signal is never masked by activity. _tick skips the
+            # title repaint while the spinner owns it, so the arrow is injected here.
+            head = "S4L ⬆" if self._update_available else "S4L"
             # A "✓" label (e.g. "posted 3/10 ✓") is a momentary confirmation, not
             # ongoing work — show it without the spinner glyph so it reads as done.
             if "✓" in label:
-                self.title = f"S4L {label}"
+                self.title = f"{head} {label}"
             else:
                 self._spin_i = (self._spin_i + 1) % len(SPINNER)
-                self.title = f"S4L {label} {SPINNER[self._spin_i]}"
+                self.title = f"{head} {label} {SPINNER[self._spin_i]}"
             return
         try:
             if self._spinner is not None:
@@ -395,10 +399,12 @@ class S4LMenuBar(rumps.App):
 
     # ---- tick: read state, set title, (re)build menu ----------------------
     def _tick(self, _):
-        # While a tool is running, the spinner owns the title/menu; don't fight it
-        # or start a review mid-run.
-        if self._spinner is not None:
-            return
+        # The activity spinner owns the TITLE while a tool runs (we don't fight it at
+        # 0.12s), but the menu + update indicator must still refresh mid-run —
+        # otherwise the "Please update now" item never appears on a box that's always
+        # busy (continuous autopilot). So we no longer bail out wholesale when busy;
+        # we only skip the title repaint and the review pop-up.
+        busy = self._spinner is not None
         snap = st.snapshot()
         ob = snap.get("onboarding") or st.read_onboarding()
         runtime_ready = bool(snap.get("runtime_ready"))
@@ -414,7 +420,9 @@ class S4LMenuBar(rumps.App):
         blocker = (ob or {}).get("current_blocker")
         blocker_code = (blocker or {}).get("code")
 
-        self._render_title(setup_complete, ob, blocker)
+        # Spinner owns the title while busy; _spin already keeps the ⬆ visible there.
+        if not busy:
+            self._render_title(setup_complete, ob, blocker)
 
         # Blocker notification only on transition into a new blocker.
         if blocker and blocker_code != self._last_blocker_code:
@@ -431,6 +439,8 @@ class S4LMenuBar(rumps.App):
             if ob
             else 0
         )
+        # _update_available / _latest_version are in the signature so a freshly
+        # detected update rebuilds the menu (adding "Please update now") even mid-run.
         sig = (
             runtime_ready,
             setup_complete,
@@ -439,6 +449,8 @@ class S4LMenuBar(rumps.App):
             bool(snap.get("autopilot_on")),
             snap.get("version"),
             snap.get("update_available"),
+            self._update_available,
+            self._latest_version,
             snap.get("x_handle"),
             snap.get("projects_ready"),
             snap.get("projects_total"),
@@ -448,8 +460,9 @@ class S4LMenuBar(rumps.App):
             self._build_menu(runtime_ready, setup_complete, ob, blocker, snap)
 
         # Draft-review pop-ups: if a draft cycle left a review request, present the
-        # cards. Independent of the menu rebuild above.
-        self._maybe_start_review()
+        # cards. Don't start a review mid-run (the spinner means a tool is active).
+        if not busy:
+            self._maybe_start_review()
 
     # ---- draft review pop-ups ---------------------------------------------
     def _maybe_start_review(self):

package/mcp/menubar/s4l_state.py

@@ -320,10 +320,10 @@ def read_plan(plan_path):
 
 
 def review_drafts(plan):
-    """Flatten a plan into the card model: only candidates not already posted."""
+    """Flatten a plan into the card model: only unfinished candidates."""
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
-        if c.get("posted") is True:
+        if c.get("posted") is True or c.get("terminal") is True:
             continue
         out.append(
             {
@@ -334,6 +334,9 @@ def review_drafts(plan):
                 "link_url": c.get("link_url"),
             }
         )
+    # The review queue is append-only, so the highest stable index is newest and
+    # most likely to still be live on X.
+    out.sort(key=lambda d: d["n"], reverse=True)
     return out
 
 

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.91",
+  "version": "1.6.92",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.91",
+  "version": "1.6.92",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/active_users.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Who is actually using social-autoposter right now.
+
+Reads the `installations` heartbeat table (the only live per-install signal) and
+answers "how many real, external people are active" without the inflation that a
+raw install count carries:
+
+  * install_id is per identity.json, NOT per machine. A reinstall / reset / each
+    ephemeral mk0r E2B sandbox mints a fresh id. So we dedupe by `hardware_uuid`
+    (the stable per-machine key) and report MACHINES, not install rows.
+  * Our own infra (i@m13v.com operator Mac, the agent@mk0r.com / e2b.local VM
+    fleet) is filtered out by default so the roster is real customers. Pass
+    --all to include it.
+  * Cross-references the `posts` table so you can see the alive-but-not-posting
+    gap (the blind spot the Cloud Logging stream exists to explain).
+
+Usage:
+  python3 scripts/active_users.py                 # external machines, last 7d
+  python3 scripts/active_users.py --days 30        # different window
+  python3 scripts/active_users.py --all            # include our own infra
+  python3 scripts/active_users.py --json           # machine-readable
+
+Operator-local only: uses the direct-Postgres lane via scripts/db.py (absent in
+the shipped npm package), reading DATABASE_URL from ~/social-autoposter/.env.
+"""
+
+import argparse
+import json
+import os
+import sys
+from urllib.parse import unquote
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from db import load_env, get_conn  # noqa: E402
+
+# Our own installs, hidden by default so the roster is real external users.
+INTERNAL_EMAILS = {"i@m13v.com", "agent@mk0r.com", "matt@mediar.ai"}
+INTERNAL_HOSTNAME_SUBSTR = ("e2b.local", "71522")  # mk0r E2B sandboxes; MacStadium QA box
+# MacStadium remote QA box (hostname "71522", no git_email). It actively runs the
+# pipeline and posts, so without this it masquerades as our only posting customer.
+INTERNAL_HARDWARE_UUIDS = {"07CB793D-6E32-5EF8-82E2-7CDEABD47FBC"}
+
+# Connected X handle resolves only from posts.our_account; drop scaffolding values.
+PLACEHOLDER_HANDLES = {"your-twitter-handle", "your_handle", "your-handle", "none", "null", ""}
+
+
+def parse_handles(raw):
+    out = []
+    for h in (raw or "").split(","):
+        h = h.strip().lstrip("@")
+        if h and h.lower() not in PLACEHOLDER_HANDLES and h not in out:
+            out.append(h)
+    return out
+
+
+def is_internal(emails, hostnames, hardware_uuids):
+    if any((e or "").lower() in INTERNAL_EMAILS for e in emails):
+        return True
+    if any(sub in (h or "") for h in hostnames for sub in INTERNAL_HOSTNAME_SUBSTR):
+        return True
+    if any((u or "") in INTERNAL_HARDWARE_UUIDS for u in hardware_uuids):
+        return True
+    return False
+
+
+def fetch(days):
+    # One row per MACHINE (hardware_uuid; fall back to a per-install key when the
+    # client never reported a hardware_uuid so those installs aren't all merged).
+    # `days` is an argparse int (injection-safe), inlined because the wrapper's
+    # SQL translation mangles %s placeholders.
+    days = int(days)
+    q = f"""
+    WITH win AS (
+      SELECT *,
+             COALESCE(NULLIF(git_email, ''), NULLIF(hardware_uuid, ''),
+                      'anon:' || install_id::text) AS entity_key
+      FROM installations
+      WHERE last_seen_at > now() - interval '{days} days'
+    ),
+    posted AS (
+      SELECT install_id, count(*) AS n
+      FROM posts
+      WHERE posted_at > now() - interval '{days} days' AND install_id IS NOT NULL
+      GROUP BY install_id
+    ),
+    handles AS (
+      -- The connected X handle is NOT in the heartbeat; it only reaches the
+      -- central DB via posts.our_account, so it exists ONLY for installs that
+      -- ever posted (all-time, not windowed: a handle is identity, not activity).
+      SELECT install_id, string_agg(DISTINCT our_account, ',') AS hs
+      FROM posts
+      WHERE our_account IS NOT NULL AND length(trim(our_account)) > 0
+      GROUP BY install_id
+    )
+    SELECT
+      w.entity_key,
+      count(DISTINCT w.install_id)                                            AS installs,
+      count(DISTINCT w.hardware_uuid)                                         AS machines,
+      array_remove(array_agg(DISTINCT w.hardware_uuid), NULL)                 AS hardware_uuids,
+      array_remove(array_agg(DISTINCT NULLIF(w.git_email, '')), NULL)         AS emails,
+      array_remove(array_agg(DISTINCT w.hostname), NULL)                      AS hostnames,
+      string_agg(DISTINCT h.hs, ',')                                          AS handles_raw,
+      max(w.os_version)                                                       AS os,
+      array_remove(array_agg(DISTINCT
+        w.last_country || '/' || COALESCE(w.last_city, '-')), NULL)           AS locations,
+      max(w.last_seen_at)                                                     AS last_seen,
+      COALESCE(sum(p.n), 0)                                                   AS posts
+    FROM win w
+    LEFT JOIN posted p  ON p.install_id = w.install_id
+    LEFT JOIN handles h ON h.install_id = w.install_id
+    GROUP BY w.entity_key
+    ORDER BY last_seen DESC;
+    """
+    conn = get_conn()
+    try:
+        cur = conn.execute(q)
+        cols = [c.name for c in cur.description]
+        return [dict(zip(cols, row)) for row in cur.fetchall()]
+    finally:
+        conn.close()
+
+
+def person(row):
+    if row["emails"]:
+        return row["emails"][0]
+    if row["hostnames"]:
+        return row["hostnames"][0]
+    return row["entity_key"][:12]
+
+
+def loc(row):
+    return ", ".join(unquote(x) for x in (row["locations"] or [])) or "?"
+
+
+def main():
+    ap = argparse.ArgumentParser(
+        description="Active social-autoposter users, deduped per person (email, else machine).")
+    ap.add_argument("--days", type=int, default=7, help="lookback window in days (default 7)")
+    ap.add_argument("--all", action="store_true", help="include our own infra (i@m13v / mk0r)")
+    ap.add_argument("--json", action="store_true", help="emit JSON")
+    args = ap.parse_args()
+
+    load_env()
+    rows = fetch(args.days)
+    for r in rows:
+        r["internal"] = is_internal(r["emails"], r["hostnames"], r["hardware_uuids"])
+        r["handles"] = parse_handles(r.get("handles_raw"))
+
+    external = [r for r in rows if not r["internal"]]
+    internal = [r for r in rows if r["internal"]]
+    shown = rows if args.all else external
+
+    if args.json:
+        out = [{
+            "person": person(r), "x_handles": r["handles"], "machines": r["machines"],
+            "installs": r["installs"], "hostnames": r["hostnames"], "emails": r["emails"],
+            "os": r["os"], "location": loc(r), "posts": int(r["posts"]),
+            "last_seen": r["last_seen"].isoformat() if r["last_seen"] else None,
+            "internal": r["internal"],
+        } for r in shown]
+        print(json.dumps({
+            "window_days": args.days,
+            "external_machines": len(external),
+            "external_people": len({e for r in external for e in r["emails"]}),
+            "internal_machines_hidden": 0 if args.all else len(internal),
+            "rows": out,
+        }, indent=2))
+        return
+
+    people = len({e for r in external for e in r["emails"]})
+    print(f"\nActive in last {args.days}d: {len(external)} external machines "
+          f"(~{people} identified people){'' if args.all else f', {len(internal)} internal hidden'}\n")
+    hdr = (f"{'PERSON':<30} {'X HANDLE':<16} {'HOST':<22} {'OS':<7} {'LOC':<16} "
+           f"{'INST':>4} {'POSTS':>6}  LAST SEEN")
+    print(hdr)
+    print("-" * len(hdr))
+    for r in shown:
+        tag = "  [internal]" if r["internal"] else ""
+        host = (r["hostnames"][0] if r["hostnames"] else "?")[:22]
+        handle = (", ".join(r["handles"]) or "-")[:16]
+        print(f"{person(r)[:30]:<30} {handle:<16} {host:<22} {(r['os'] or '?'):<7} "
+              f"{loc(r)[:16]:<16} {r['installs']:>4} {int(r['posts']):>6}  "
+              f"{r['last_seen']:%Y-%m-%d %H:%M}{tag}")
+    posting = sum(1 for r in external if r["posts"] > 0)
+    print(f"\n  of {len(external)} external machines, {posting} posted in the window, "
+          f"{len(external) - posting} are alive-but-not-posting.\n")
+
+
+if __name__ == "__main__":
+    main()