social-autoposter 1.6.91 → 1.6.93

package/mcp/dist/index.js

@@ -235,11 +235,20 @@ const TOOL_ACTIVITY = {
     post_drafts: "posting",
     get_stats: "loading stats",
 };
+function toolActivityLabel(name, args) {
+    const fallback = TOOL_ACTIVITY[name];
+    if (!fallback)
+        return null;
+    const override = typeof args?.__saps_activity_label === "string"
+        ? args.__saps_activity_label.replace(/\s+/g, " ").trim().slice(0, 80)
+        : "";
+    return override || fallback;
+}
 function withActivity(name, cb) {
-    const label = TOOL_ACTIVITY[name];
-    if (!label)
+    if (!TOOL_ACTIVITY[name])
         return cb;
     return async (args, extra) => {
+        const label = toolActivityLabel(name, args) || TOOL_ACTIVITY[name];
         writeActivity("working", label);
         try {
             return await cb(args, extra);
@@ -504,9 +513,13 @@ function renderDraftsTable(plan) {
     const candidates = plan.candidates || [];
     return candidates
         // Number by FULL-array index (matches post_drafts + the menu bar), then drop
-        // already-posted entries so the cards only show what's still pending.
+        // already-finished entries so the cards only show what's still pending.
         .map((c, i) => ({ c, n: i + 1 }))
-        .filter((e) => e.c.posted !== true)
+        .filter((e) => e.c.posted !== true && e.c.terminal !== true)
+        // The queue is append-only; newest drafts have the highest stable index.
+        // Show those first so review starts with likely-live tweets instead of stale
+        // low-number drafts that have been sitting around for hours.
+        .sort((a, b) => b.n - a.n)
         .map(({ c, n }) => {
         const author = c.thread_author ? `@${c.thread_author}` : "(unknown thread)";
         const style = c.engagement_style ?? "?";
@@ -532,6 +545,52 @@ function renderDraftsTable(plan) {
     })
         .join("\n\n");
 }
+function parsePostCandidateResults(stdout) {
+    const byId = new Map();
+    const upsert = (candidateId, outcome, reason, ourUrl) => {
+        const prev = byId.get(candidateId);
+        // A landed post wins over any earlier noisy line for the same candidate.
+        if (prev?.outcome === "posted" && outcome !== "posted")
+            return;
+        byId.set(candidateId, {
+            candidate_id: candidateId,
+            outcome,
+            ...(reason ? { reason } : {}),
+            ...(ourUrl ? { our_url: ourUrl } : {}),
+        });
+    };
+    for (const line of stdout.split("\n")) {
+        let m = /\[post\] candidate (\d+) posted as (\S+) \(post_id=/.exec(line);
+        if (m) {
+            upsert(m[1], "posted", undefined, m[2]);
+            continue;
+        }
+        m = /\[post\] candidate (\d+): pre-post dedup hit\b/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", "duplicate_thread_pre_post");
+            continue;
+        }
+        m = /\[post\] candidate (\d+) reply failed: ([A-Za-z0-9_:-]+)/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", m[2]);
+            continue;
+        }
+        m = /\[post\] candidate (\d+) reply succeeded but reply_url invalid:/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", "no_reply_url_captured");
+            continue;
+        }
+        m = /\[post\] candidate (\d+): empty reply_text; skipping/.exec(line);
+        if (m) {
+            upsert(m[1], "skipped", "empty_reply_text");
+            continue;
+        }
+        m = /\[post\] candidate (\d+) crashed:/.exec(line);
+        if (m)
+            upsert(m[1], "failed", "exception");
+    }
+    return [...byId.values()];
+}
 // Resolve the configured posting handle the SAME way account_resolver.py does:
 // AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
 // Returns the bare handle (no @) or null. The post preflight uses it so a missing
@@ -590,6 +649,12 @@ async function postApproved(batchId, plan) {
                 "or set accounts.twitter.handle in config.json.",
         };
     }
+    // Mark posting active so scan_candidates DEFERS launching any scan for the
+    // duration of this batch (+ grace). This is the source-level mutual exclusion
+    // that actually fixes the hijack: the autopilot never launches a scan to race
+    // the post for the browser. Reset is guaranteed by scheduleShellLockRelease()
+    // in the finally below, so an early/failed post can't wedge scanning.
+    postingActive = true;
     // Posting is a priority over scanning: abort any in-flight plugin scan so the
     // approved post takes the browser immediately instead of waiting on the lock.
     // Plugin pipeline only — never affects the plist autopilot.
@@ -642,9 +707,12 @@ async function postApproved(batchId, plan) {
             });
         }
         finally {
-            // Always free the lock so a queued scan can proceed, even on throw/timeout.
-            if (heldShellLock)
-                releaseShellBrowserLock();
+            // Always schedule the grace release (even if the lock acquire failed): the
+            // timer both frees the lock AND clears postingActive, so scanning resumes
+            // SHELL_LOCK_GRACE_MS after the last card. Holding through the grace lets the
+            // NEXT approved card reuse one continuous hold (mirrors the plist holding the
+            // lock through the whole posting phase, then releasing at the end).
+            scheduleShellLockRelease();
         }
     })();
     // Persist the poster's own stdout/stderr to a dated log. Without this the post
@@ -680,11 +748,57 @@ async function postApproved(batchId, plan) {
         : res.code === 0 && !summObj
             ? approved.length
             : 0;
-    // Mark only candidates that ACTUALLY posted (cross-surface de-dup). When the
-    // summary is missing but the run exited clean, fall back to marking all.
-    if (realPosted > 0 || (res.code === 0 && !summObj)) {
+    // Mark candidates according to the poster's per-candidate outcome. This keeps
+    // the review queue honest: posted drafts disappear as posted, terminal skips
+    // (dedup, deleted tweet, no captured URL) disappear without being counted as
+    // posted, and multi-approval batches no longer smear one posted count across
+    // every approved draft.
+    const resultRowsFromSummary = Array.isArray(summObj?.candidate_results)
+        ? summObj?.candidate_results
+        : [];
+    const resultRows = resultRowsFromSummary.length
+        ? resultRowsFromSummary
+            .map((r) => ({
+            candidate_id: String(r.candidate_id ?? ""),
+            outcome: String(r.outcome || ""),
+            reason: typeof r.reason === "string" ? r.reason : undefined,
+            our_url: typeof r.our_url === "string" ? r.our_url : undefined,
+        }))
+            .filter((r) => r.candidate_id && ["posted", "skipped", "failed"].includes(r.outcome))
+        : parsePostCandidateResults(res.stdout);
+    const approvedById = new Map();
+    approved.forEach((c) => {
+        if (c.candidate_id !== undefined && c.candidate_id !== null)
+            approvedById.set(String(c.candidate_id), c);
+    });
+    let touchedPlan = false;
+    if (resultRows.length) {
+        resultRows.forEach((r, idx) => {
+            const c = approvedById.get(r.candidate_id) || approved[idx];
+            if (!c)
+                return;
+            if (r.outcome === "posted") {
+                c.posted = true;
+                c.terminal = false;
+                if (r.our_url)
+                    c.our_url = r.our_url;
+                touchedPlan = true;
+            }
+            else if (r.outcome === "skipped" || r.outcome === "failed") {
+                c.terminal = true;
+                c.terminal_reason = r.reason || r.outcome;
+                touchedPlan = true;
+            }
+        });
+    }
+    else if (realPosted > 0 || (res.code === 0 && !summObj)) {
+        // Legacy fallback for older poster output without parseable per-candidate
+        // lines. Mark only when we have no finer-grained signal.
         for (const c of approved)
             c.posted = true;
+        touchedPlan = true;
+    }
+    if (touchedPlan) {
         try {
             writePlan(batchId, plan);
         }
@@ -1984,6 +2098,11 @@ async function runScanCandidates(project, onProgress) {
     // long-poll doesn't leave it on a generic "working" (or flicker to idle between
     // re-calls). Cleared by the handler when the scan resolves.
     writeActivity("scanning", project ? `scanning X for ${project}` : "scanning X");
+    // Single-flight: kill any pre-existing run-twitter-cycle.sh (zombies that
+    // survived a prior preempt, or stale waiters parked behind a post) before
+    // launching, so only ONE scan ever exists. The plist gets this from
+    // run-twitter-cycle-singleton.sh; the MCP's direct launch must enforce it here.
+    sigkillAllScans();
     const res = await run("bash", ["skill/run-twitter-cycle.sh"], {
         env,
         timeoutMs: 900_000,
@@ -2126,68 +2245,150 @@ function rmShellLockDir() {
     }
 }
 const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
-// SIGTERM a live scan holding the shell browser lock so the post takes the
-// browser at once. Best-effort; only ever targets a run-twitter-cycle.sh.
+// SIGKILL a scan's WHOLE process tree (the bash + its browser-harness/tee
+// children). run-twitter-cycle.sh traps SIGTERM/INT/HUP (skill/lock.sh installs
+// `trap _sa_release_locks ... TERM`), so a SIGTERM runs the cleanup handler and
+// the script KEEPS GOING — the scan never dies, still drives Chrome, and the next
+// autopilot tick stacks another on top (the zombie pileup that stale-reclaimed the
+// lock mid-post). SIGKILL can't be trapped. Kill children first so the harness CDP
+// driver lets go of Chrome immediately.
+function sigkillScanTree(pid) {
+    try {
+        const out = execFileSync("pgrep", ["-P", String(pid)], { encoding: "utf-8", timeout: 4000 });
+        for (const cstr of out.split(/\s+/)) {
+            const c = parseInt(cstr, 10);
+            if (Number.isFinite(c) && c > 0) {
+                try {
+                    process.kill(c, "SIGKILL");
+                }
+                catch {
+                    /* gone */
+                }
+            }
+        }
+    }
+    catch {
+        /* no children / pgrep unavailable */
+    }
+    try {
+        process.kill(pid, "SIGKILL");
+    }
+    catch {
+        /* gone */
+    }
+}
+// Single-flight: SIGKILL every run-twitter-cycle.sh on the box before launching a
+// fresh scan, so a zombie that survived a prior SIGTERM (or a stale waiter parked
+// behind a post) can never accumulate. Mirrors the plist's run-twitter-cycle-
+// singleton.sh "one cycle at a time" guarantee, which the MCP's direct launch
+// bypassed. Best-effort; never throws.
+function sigkillAllScans() {
+    try {
+        const out = execFileSync("pgrep", ["-f", "skill/run-twitter-cycle.sh"], {
+            encoding: "utf-8",
+            timeout: 4000,
+        });
+        for (const pstr of out.split(/\s+/)) {
+            const p = parseInt(pstr, 10);
+            if (Number.isFinite(p) && p > 0)
+                sigkillScanTree(p);
+        }
+    }
+    catch {
+        /* none running */
+    }
+}
+// ---- Lock grace-hold: hold the /tmp lock CONTINUOUSLY across per-card posts ----
+// The plist pipeline acquires the browser lock ONCE and holds it through the whole
+// posting phase. The MCP posts per approved card (separate post_drafts calls), and
+// the old code acquired+released the lock PER CARD — leaving a release window
+// BETWEEN every card that a parked scan stale-reclaimed (the hijack). Instead we
+// keep the lock and only release it after SHELL_LOCK_GRACE_MS of no posting, so the
+// hold EXPANDS as more cards get approved and there is never a gap between cards.
+const SHELL_LOCK_GRACE_MS = Number(process.env.SAPS_POST_LOCK_GRACE_MS) || 60_000;
+let shellLockReleaseTimer = null;
+// True from the start of a post batch until SHELL_LOCK_GRACE_MS after the last
+// card. scan_candidates checks this and DEFERS launching a scan while it's set —
+// the real fix: posting and scanning are mutually exclusive at the SOURCE (both
+// are children of THIS one MCP), so we never even launch a scan that would race
+// the post for the browser lock. Having the post fight scans for the lock (the
+// prior approach) lost the race because the autopilot relaunches scans faster
+// than the post can hold the dir. Reset is guaranteed by the grace timer below,
+// so it can never wedge scanning permanently.
+let postingActive = false;
+function cancelScheduledShellLockRelease() {
+    if (shellLockReleaseTimer) {
+        clearTimeout(shellLockReleaseTimer);
+        shellLockReleaseTimer = null;
+    }
+}
+function scheduleShellLockRelease() {
+    cancelScheduledShellLockRelease();
+    shellLockReleaseTimer = setTimeout(() => {
+        shellLockReleaseTimer = null;
+        postingActive = false; // posting drained -> the autopilot may scan again
+        releaseShellBrowserLock();
+    }, SHELL_LOCK_GRACE_MS);
+}
+// SIGKILL a live scan holding the shell browser lock so the post takes the browser
+// at once. Best-effort; only ever targets a run-twitter-cycle.sh.
 function preemptScanHoldingBrowser() {
     try {
         const pid = shellLockHolderPid();
         if (pid && pidAlive(pid) && pidIsScan(pid)) {
-            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid})`);
-            try {
-                process.kill(pid, "SIGTERM");
-            }
-            catch {
-                /* already gone */
-            }
+            console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid}) — SIGKILL tree`);
+            sigkillScanTree(pid);
         }
     }
     catch {
         /* best effort */
     }
 }
-// Take the shell browser lock for the batch. Preempts a scan holder; never
-// steals from a live non-scan holder (a peer poster) — there it returns false
-// and posting proceeds unguarded (no worse than before). Best-effort.
+// Take (or extend) the shell browser lock for the batch. Preempts a scan holder
+// with SIGKILL; never steals from a live non-scan holder (a peer poster) — there
+// it returns false and posting proceeds unguarded (no worse than before).
 async function acquireShellBrowserLock() {
+    // A new post cancels any pending grace-release and EXTENDS the existing hold.
+    cancelScheduledShellLockRelease();
+    // Already ours? Refresh the pid + expiry and keep holding — this is the "expand
+    // the lock as more cards get approved" path: consecutive per-card posts reuse
+    // ONE continuous hold instead of churning the lock, which is what left a window
+    // a parked scan stale-reclaimed between cards.
+    if (shellLockHolderPid() === process.pid) {
+        try {
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
+        }
+        catch {
+            /* best effort */
+        }
+        return true;
+    }
     for (let attempt = 0; attempt < 8; attempt++) {
         try {
             fs.mkdirSync(TW_BROWSER_LOCK_DIR); // atomic mutex — only one winner
-            try {
-                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
-            }
-            catch {
-                /* best effort */
-            }
-            try {
-                fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
-            }
-            catch {
-                /* best effort */
-            }
+            // Write the pid IMMEDIATELY (sync) so the dir is never observably pid-less.
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "pid"), String(process.pid));
+            fs.writeFileSync(path.join(TW_BROWSER_LOCK_DIR, "expires_at"), String(Math.floor(Date.now() / 1000) + 1800));
             console.error(`[post] holding twitter-browser shell lock pid=${process.pid} — scans queue behind the post`);
             return true;
         }
         catch {
-            // Dir exists. Reclaim if the holder is dead; preempt if it's a scan;
+            // Dir exists. Reclaim if the holder is dead; SIGKILL-preempt if it's a scan;
             // otherwise (a live peer poster) leave it and post unguarded.
             const pid = shellLockHolderPid();
             if (!pid || !pidAlive(pid)) {
                 rmShellLockDir();
             }
             else if (pidIsScan(pid)) {
-                try {
-                    process.kill(pid, "SIGTERM");
-                }
-                catch {
-                    /* already gone */
-                }
-                await sleepMs(400);
+                sigkillScanTree(pid); // SIGKILL — scans trap SIGTERM and survive it
+                await sleepMs(300);
                 rmShellLockDir();
             }
             else {
                 return false; // a real peer holds it — don't steal; proceed
             }
-            await sleepMs(250);
+            await sleepMs(200);
         }
     }
     return false;
@@ -2213,13 +2414,8 @@ function releaseShellBrowserLock() {
 function preemptScanForPost() {
     try {
         if (scanChild && scanChild.pid && scanChild.exitCode === null) {
-            console.error(`[post] preempting in-flight plugin scan (pid ${scanChild.pid}) so the approved post takes the browser`);
-            try {
-                scanChild.kill("SIGTERM");
-            }
-            catch {
-                /* already gone */
-            }
+            console.error(`[post] preempting in-flight plugin scan (pid ${scanChild.pid}) so the approved post takes the browser — SIGKILL tree`);
+            sigkillScanTree(scanChild.pid); // SIGKILL — scan bash traps SIGTERM
         }
     }
     catch {
@@ -2247,6 +2443,14 @@ function scanBusy() {
         "twitter-cycle slot). This is CONTENTION, not an empty result. Call scan_candidates again in " +
         "~20s to retry — do NOT conclude there are no candidates, and do NOT sleep; just re-call.");
 }
+// A post batch is in progress: scanning is deferred so posting has exclusive use
+// of the one shared browser (mutual exclusion at the source). Not an error.
+function scanDeferredForPost() {
+    return textContent("A post is in progress on this machine, so scanning is deferred — only one task drives X at a " +
+        "time and posting has priority. This is EXPECTED, not an error or an empty result. Call " +
+        "scan_candidates again shortly; it runs as soon as the current post batch finishes. Do NOT " +
+        "sleep or conclude there are no candidates; just re-call.");
+}
 // Resolve to {done:true,value} the moment `p` settles, or {done:false} after
 // `ms` — whichever is first. The job promise keeps running either way, so a
 // later poll re-attaches to it.
@@ -2363,6 +2567,14 @@ tool("scan_candidates", {
         "re-calling until it returns candidates. Never sleep or use a background wait to bridge the gap.",
     inputSchema: { project: z.string().optional() },
 }, async (args) => {
+    // MUTUAL EXCLUSION (the real hijack fix): while a post batch is in progress
+    // (or its grace-hold is active), DEFER scanning entirely rather than launching
+    // a scan that races the post for the one shared browser. Both the scan and the
+    // post are children of THIS MCP, so this in-process gate is exact — the
+    // autopilot never even starts a scan to interrupt a post. Posting always wins;
+    // the autopilot just re-calls and runs once the batch drains.
+    if (postingActive)
+        return scanDeferredForPost();
     // Long-poll the single in-flight scan job (see the ScanJob registry above).
     // A finished-but-unconsumed job: hand back its result and clear the slot so a
     // later call starts a fresh scan.
@@ -2469,7 +2681,7 @@ tool("submit_drafts", {
     // drafts are appended; a thread already in the queue (by URL) is skipped (one
     // draft per thread). Posted entries are KEPT in place so the 1-based card
     // numbering stays stable across runs — the menu bar, the chat table, and
-    // post_drafts all index the full array and filter on the `posted` flag.
+    // post_drafts all index the full array and filter finished rows.
     const queue = [
         ...(readPlan(REVIEW_QUEUE_ID)?.candidates ?? []),
     ];
@@ -2484,7 +2696,7 @@ tool("submit_drafts", {
         added++;
     }
     writePlan(REVIEW_QUEUE_ID, { candidates: queue });
-    const pending = queue.filter((c) => c.posted !== true);
+    const pending = queue.filter((c) => c.posted !== true && c.terminal !== true);
     // Drafts queued = the pipeline verified end-to-end without posting. This is the
     // onboarding "draft_verified" terminal goal (formerly completed by draft_cycle).
     if (added > 0)

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.91",
-  "installedAt": "2026-06-23T19:56:23.942Z"
+  "version": "1.6.93",
+  "installedAt": "2026-06-23T20:32:39.303Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.91",
+  "version": "1.6.93",
   "description": "Draft, review, approve, and autopilot X/Twitter posts. Thin desktop client over the S4L pipeline.",
   "long_description": "A guided assistant that drafts, reviews, and autopilots X/Twitter posts.\nTo get started:\n1. Click **Configure** and set every tool permission to **Always Allow**.\n2. Copy this prompt: **Set me up on S4L end to end**.\n3. Quit fully with CMD+Q, restart Claude, and paste the prompt into a new chat.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -164,6 +164,8 @@ class S4LMenuBar(rumps.App):
         self._review_lock = threading.Lock()
         self._panel_open = False
         self._posts_outstanding = 0
+        self._posting_batch_total = 0
+        self._posting_batch_done = 0
         self._spin_i = 0
         self._spinner = None  # fast rumps.Timer animating the title while busy
         # Reliable self-check of our own Accessibility (TCC) grant — this is the
@@ -376,13 +378,17 @@ class S4LMenuBar(rumps.App):
         act = st.read_activity()
         label = act.get("label") if act else None
         if label:
+            # The update arrow must stay visible even while a tool runs, so the
+            # "update available" signal is never masked by activity. _tick skips the
+            # title repaint while the spinner owns it, so the arrow is injected here.
+            head = "S4L ⬆" if self._update_available else "S4L"
             # A "✓" label (e.g. "posted 3/10 ✓") is a momentary confirmation, not
             # ongoing work — show it without the spinner glyph so it reads as done.
             if "✓" in label:
-                self.title = f"S4L {label}"
+                self.title = f"{head} {label}"
             else:
                 self._spin_i = (self._spin_i + 1) % len(SPINNER)
-                self.title = f"S4L {label} {SPINNER[self._spin_i]}"
+                self.title = f"{head} {label} {SPINNER[self._spin_i]}"
             return
         try:
             if self._spinner is not None:
@@ -395,10 +401,12 @@ class S4LMenuBar(rumps.App):
 
     # ---- tick: read state, set title, (re)build menu ----------------------
     def _tick(self, _):
-        # While a tool is running, the spinner owns the title/menu; don't fight it
-        # or start a review mid-run.
-        if self._spinner is not None:
-            return
+        # The activity spinner owns the TITLE while a tool runs (we don't fight it at
+        # 0.12s), but the menu + update indicator must still refresh mid-run —
+        # otherwise the "Please update now" item never appears on a box that's always
+        # busy (continuous autopilot). So we no longer bail out wholesale when busy;
+        # we only skip the title repaint and the review pop-up.
+        busy = self._spinner is not None
         snap = st.snapshot()
         ob = snap.get("onboarding") or st.read_onboarding()
         runtime_ready = bool(snap.get("runtime_ready"))
@@ -414,7 +422,9 @@ class S4LMenuBar(rumps.App):
         blocker = (ob or {}).get("current_blocker")
         blocker_code = (blocker or {}).get("code")
 
-        self._render_title(setup_complete, ob, blocker)
+        # Spinner owns the title while busy; _spin already keeps the ⬆ visible there.
+        if not busy:
+            self._render_title(setup_complete, ob, blocker)
 
         # Blocker notification only on transition into a new blocker.
         if blocker and blocker_code != self._last_blocker_code:
@@ -431,6 +441,8 @@ class S4LMenuBar(rumps.App):
             if ob
             else 0
         )
+        # _update_available / _latest_version are in the signature so a freshly
+        # detected update rebuilds the menu (adding "Please update now") even mid-run.
         sig = (
             runtime_ready,
             setup_complete,
@@ -439,6 +451,8 @@ class S4LMenuBar(rumps.App):
             bool(snap.get("autopilot_on")),
             snap.get("version"),
             snap.get("update_available"),
+            self._update_available,
+            self._latest_version,
             snap.get("x_handle"),
             snap.get("projects_ready"),
             snap.get("projects_total"),
@@ -448,10 +462,37 @@ class S4LMenuBar(rumps.App):
             self._build_menu(runtime_ready, setup_complete, ob, blocker, snap)
 
         # Draft-review pop-ups: if a draft cycle left a review request, present the
-        # cards. Independent of the menu rebuild above.
-        self._maybe_start_review()
+        # cards. Don't start a review mid-run (the spinner means a tool is active).
+        if not busy:
+            self._maybe_start_review()
 
     # ---- draft review pop-ups ---------------------------------------------
+    def _posting_activity_label_locked(self):
+        """Progress for the current menu-bar approval burst.
+
+        The server receives one post_drafts call per approved card, so its native
+        view is always 1/1. The menu bar owns the burst queue and can show the
+        useful progress: current approved post / total approved so far.
+        """
+        if self._posts_outstanding <= 0:
+            return None
+        total = max(
+            self._posting_batch_total,
+            self._posting_batch_done + self._posts_outstanding,
+        )
+        current = min(total, self._posting_batch_done + 1)
+        return f"posting {current}/{total}"
+
+    def _write_posting_activity_locked(self):
+        label = self._posting_activity_label_locked()
+        if label:
+            st.write_activity("posting", label)
+        return label
+
+    def _reset_posting_progress_locked(self):
+        self._posting_batch_total = 0
+        self._posting_batch_done = 0
+
     def _maybe_start_review(self):
         if self._review_active:
             return
@@ -478,8 +519,10 @@ class S4LMenuBar(rumps.App):
         sig = tuple((d.get("n"), d.get("reply_text") or "") for d in drafts)
         if sig == self._last_review_sig:
             return
-        self._review_active = True
-        self._panel_open = True
+        with self._review_lock:
+            self._reset_posting_progress_locked()
+            self._review_active = True
+            self._panel_open = True
         try:
             import s4l_card
 
@@ -508,7 +551,9 @@ class S4LMenuBar(rumps.App):
             return
         with self._review_lock:
             self._posts_outstanding += 1
+            self._posting_batch_total += 1
             self._review_active = True
+            self._write_posting_activity_locked()
         self._post_q.put((batch, decision))
         self._ensure_post_worker()
 
@@ -521,6 +566,7 @@ class S4LMenuBar(rumps.App):
             self._panel_open = False
             if self._posts_outstanding <= 0:
                 self._review_active = False
+                self._reset_posting_progress_locked()
         st.clear_review_request()
         if not any(d.get("approved") for d in decisions):
             self._notify("S4L", "No drafts approved — nothing posted.")
@@ -535,19 +581,24 @@ class S4LMenuBar(rumps.App):
 
     def _post_worker_loop(self):
         # Serialized poster: one approved card at a time so two posts never drive
-        # the shared harness Chrome simultaneously. The server's post_drafts writes
-        # "posting" activity, so the menu-bar spinner shows automatically.
+        # the shared harness Chrome simultaneously. The menu bar passes a burst
+        # progress label into post_drafts, so the spinner shows e.g. "posting 17/95"
+        # even though each server call is still one approved draft.
         while True:
             batch, decision = self._post_q.get()  # blocks until a card is approved
             n = decision.get("n")
             try:
                 self._notify("S4L", f"Posting draft {n}…")
+                with self._review_lock:
+                    activity_label = self._posting_activity_label_locked()
                 if decision.get("edited"):
                     res = st.post_drafts(
-                        batch, edits=[{"n": n, "text": decision.get("text") or ""}]
+                        batch,
+                        edits=[{"n": n, "text": decision.get("text") or ""}],
+                        activity_label=activity_label,
                     )
                 else:
-                    res = st.post_drafts(batch, post=[n])
+                    res = st.post_drafts(batch, post=[n], activity_label=activity_label)
                 if res is None:
                     self._notify(
                         "S4L", "Couldn't post — open Claude Desktop and try the draft again."
@@ -564,9 +615,13 @@ class S4LMenuBar(rumps.App):
                 _capture(e, phase="post_card")
             finally:
                 with self._review_lock:
+                    self._posting_batch_done += 1
                     self._posts_outstanding -= 1
-                    if self._posts_outstanding <= 0 and not self._panel_open:
+                    if self._posts_outstanding > 0:
+                        self._write_posting_activity_locked()
+                    elif not self._panel_open:
                         self._review_active = False
+                        self._reset_posting_progress_locked()
                 self._post_q.task_done()
 
     def _render_title(self, setup_complete, ob, blocker):

package/mcp/menubar/s4l_state.py

@@ -299,6 +299,36 @@ def read_activity():
     return read_json("activity.json")
 
 
+def write_activity(state: str, label: str):
+    """Best-effort local activity update. The MCP server normally owns this file,
+    but the menu-bar posting queue knows the whole approved-card burst while the
+    server only sees one post_drafts call at a time."""
+    try:
+        p = Path(state_dir()) / "activity.json"
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(
+            json.dumps(
+                {
+                    "state": state,
+                    "label": label,
+                    "since": time_iso(),
+                }
+            )
+            + "\n"
+        )
+    except Exception:
+        pass
+
+
+def time_iso():
+    try:
+        import datetime
+
+        return datetime.datetime.now(datetime.timezone.utc).isoformat()
+    except Exception:
+        return ""
+
+
 def read_review_request():
     return read_json("review-request.json")
 
@@ -320,10 +350,10 @@ def read_plan(plan_path):
 
 
 def review_drafts(plan):
-    """Flatten a plan into the card model: only candidates not already posted."""
+    """Flatten a plan into the card model: only unfinished candidates."""
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
-        if c.get("posted") is True:
+        if c.get("posted") is True or c.get("terminal") is True:
             continue
         out.append(
             {
@@ -334,15 +364,17 @@ def review_drafts(plan):
                 "link_url": c.get("link_url"),
             }
         )
+    # The review queue is append-only, so the highest stable index is newest and
+    # most likely to still be live on X.
+    out.sort(key=lambda d: d["n"], reverse=True)
     return out
 
 
-def post_drafts(batch_id, post=None, edits=None, timeout=900):
+def post_drafts(batch_id, post=None, edits=None, timeout=900, activity_label=None):
     """Post approved drafts via the loopback tool. `post` = 1-based numbers to
     post as-is; `edits` = [{n, text}] to rewrite then post. Returns the parsed
     result, or None if the loopback is unreachable (Claude Desktop closed)."""
-    return loopback_tool(
-        "post_drafts",
-        {"batch_id": batch_id, "post": post or [], "edits": edits or []},
-        timeout=timeout,
-    )
+    args = {"batch_id": batch_id, "post": post or [], "edits": edits or []}
+    if activity_label:
+        args["__saps_activity_label"] = activity_label
+    return loopback_tool("post_drafts", args, timeout=timeout)

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/social-autoposter-mcp",
-  "version": "1.6.91",
+  "version": "1.6.93",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.6.91",
+  "version": "1.6.93",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js"

package/scripts/active_users.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Who is actually using social-autoposter right now.
+
+Reads the `installations` heartbeat table (the only live per-install signal) and
+answers "how many real, external people are active" without the inflation that a
+raw install count carries:
+
+  * install_id is per identity.json, NOT per machine. A reinstall / reset / each
+    ephemeral mk0r E2B sandbox mints a fresh id. So we dedupe by `hardware_uuid`
+    (the stable per-machine key) and report MACHINES, not install rows.
+  * Our own infra (i@m13v.com operator Mac, the agent@mk0r.com / e2b.local VM
+    fleet) is filtered out by default so the roster is real customers. Pass
+    --all to include it.
+  * Cross-references the `posts` table so you can see the alive-but-not-posting
+    gap (the blind spot the Cloud Logging stream exists to explain).
+
+Usage:
+  python3 scripts/active_users.py                 # external machines, last 7d
+  python3 scripts/active_users.py --days 30        # different window
+  python3 scripts/active_users.py --all            # include our own infra
+  python3 scripts/active_users.py --json           # machine-readable
+
+Operator-local only: uses the direct-Postgres lane via scripts/db.py (absent in
+the shipped npm package), reading DATABASE_URL from ~/social-autoposter/.env.
+"""
+
+import argparse
+import json
+import os
+import sys
+from urllib.parse import unquote
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from db import load_env, get_conn  # noqa: E402
+
+# Our own installs, hidden by default so the roster is real external users.
+INTERNAL_EMAILS = {"i@m13v.com", "agent@mk0r.com", "matt@mediar.ai"}
+INTERNAL_HOSTNAME_SUBSTR = ("e2b.local", "71522")  # mk0r E2B sandboxes; MacStadium QA box
+# MacStadium remote QA box (hostname "71522", no git_email). It actively runs the
+# pipeline and posts, so without this it masquerades as our only posting customer.
+INTERNAL_HARDWARE_UUIDS = {"07CB793D-6E32-5EF8-82E2-7CDEABD47FBC"}
+
+# Connected X handle resolves only from posts.our_account; drop scaffolding values.
+PLACEHOLDER_HANDLES = {"your-twitter-handle", "your_handle", "your-handle", "none", "null", ""}
+
+
+def parse_handles(raw):
+    out = []
+    for h in (raw or "").split(","):
+        h = h.strip().lstrip("@")
+        if h and h.lower() not in PLACEHOLDER_HANDLES and h not in out:
+            out.append(h)
+    return out
+
+
+def is_internal(emails, hostnames, hardware_uuids):
+    if any((e or "").lower() in INTERNAL_EMAILS for e in emails):
+        return True
+    if any(sub in (h or "") for h in hostnames for sub in INTERNAL_HOSTNAME_SUBSTR):
+        return True
+    if any((u or "") in INTERNAL_HARDWARE_UUIDS for u in hardware_uuids):
+        return True
+    return False
+
+
+def fetch(days):
+    # One row per MACHINE (hardware_uuid; fall back to a per-install key when the
+    # client never reported a hardware_uuid so those installs aren't all merged).
+    # `days` is an argparse int (injection-safe), inlined because the wrapper's
+    # SQL translation mangles %s placeholders.
+    days = int(days)
+    q = f"""
+    WITH win AS (
+      SELECT *,
+             COALESCE(NULLIF(git_email, ''), NULLIF(hardware_uuid, ''),
+                      'anon:' || install_id::text) AS entity_key
+      FROM installations
+      WHERE last_seen_at > now() - interval '{days} days'
+    ),
+    posted AS (
+      SELECT install_id, count(*) AS n
+      FROM posts
+      WHERE posted_at > now() - interval '{days} days' AND install_id IS NOT NULL
+      GROUP BY install_id
+    ),
+    handles AS (
+      -- The connected X handle is NOT in the heartbeat; it only reaches the
+      -- central DB via posts.our_account, so it exists ONLY for installs that
+      -- ever posted (all-time, not windowed: a handle is identity, not activity).
+      SELECT install_id, string_agg(DISTINCT our_account, ',') AS hs
+      FROM posts
+      WHERE our_account IS NOT NULL AND length(trim(our_account)) > 0
+      GROUP BY install_id
+    )
+    SELECT
+      w.entity_key,
+      count(DISTINCT w.install_id)                                            AS installs,
+      count(DISTINCT w.hardware_uuid)                                         AS machines,
+      array_remove(array_agg(DISTINCT w.hardware_uuid), NULL)                 AS hardware_uuids,
+      array_remove(array_agg(DISTINCT NULLIF(w.git_email, '')), NULL)         AS emails,
+      array_remove(array_agg(DISTINCT w.hostname), NULL)                      AS hostnames,
+      string_agg(DISTINCT h.hs, ',')                                          AS handles_raw,
+      max(w.os_version)                                                       AS os,
+      array_remove(array_agg(DISTINCT
+        w.last_country || '/' || COALESCE(w.last_city, '-')), NULL)           AS locations,
+      max(w.last_seen_at)                                                     AS last_seen,
+      COALESCE(sum(p.n), 0)                                                   AS posts
+    FROM win w
+    LEFT JOIN posted p  ON p.install_id = w.install_id
+    LEFT JOIN handles h ON h.install_id = w.install_id
+    GROUP BY w.entity_key
+    ORDER BY last_seen DESC;
+    """
+    conn = get_conn()
+    try:
+        cur = conn.execute(q)
+        cols = [c.name for c in cur.description]
+        return [dict(zip(cols, row)) for row in cur.fetchall()]
+    finally:
+        conn.close()
+
+
+def person(row):
+    if row["emails"]:
+        return row["emails"][0]
+    if row["hostnames"]:
+        return row["hostnames"][0]
+    return row["entity_key"][:12]
+
+
+def loc(row):
+    return ", ".join(unquote(x) for x in (row["locations"] or [])) or "?"
+
+
+def main():
+    ap = argparse.ArgumentParser(
+        description="Active social-autoposter users, deduped per person (email, else machine).")
+    ap.add_argument("--days", type=int, default=7, help="lookback window in days (default 7)")
+    ap.add_argument("--all", action="store_true", help="include our own infra (i@m13v / mk0r)")
+    ap.add_argument("--json", action="store_true", help="emit JSON")
+    args = ap.parse_args()
+
+    load_env()
+    rows = fetch(args.days)
+    for r in rows:
+        r["internal"] = is_internal(r["emails"], r["hostnames"], r["hardware_uuids"])
+        r["handles"] = parse_handles(r.get("handles_raw"))
+
+    external = [r for r in rows if not r["internal"]]
+    internal = [r for r in rows if r["internal"]]
+    shown = rows if args.all else external
+
+    if args.json:
+        out = [{
+            "person": person(r), "x_handles": r["handles"], "machines": r["machines"],
+            "installs": r["installs"], "hostnames": r["hostnames"], "emails": r["emails"],
+            "os": r["os"], "location": loc(r), "posts": int(r["posts"]),
+            "last_seen": r["last_seen"].isoformat() if r["last_seen"] else None,
+            "internal": r["internal"],
+        } for r in shown]
+        print(json.dumps({
+            "window_days": args.days,
+            "external_machines": len(external),
+            "external_people": len({e for r in external for e in r["emails"]}),
+            "internal_machines_hidden": 0 if args.all else len(internal),
+            "rows": out,
+        }, indent=2))
+        return
+
+    people = len({e for r in external for e in r["emails"]})
+    print(f"\nActive in last {args.days}d: {len(external)} external machines "
+          f"(~{people} identified people){'' if args.all else f', {len(internal)} internal hidden'}\n")
+    hdr = (f"{'PERSON':<30} {'X HANDLE':<16} {'HOST':<22} {'OS':<7} {'LOC':<16} "
+           f"{'INST':>4} {'POSTS':>6}  LAST SEEN")
+    print(hdr)
+    print("-" * len(hdr))
+    for r in shown:
+        tag = "  [internal]" if r["internal"] else ""
+        host = (r["hostnames"][0] if r["hostnames"] else "?")[:22]
+        handle = (", ".join(r["handles"]) or "-")[:16]
+        print(f"{person(r)[:30]:<30} {handle:<16} {host:<22} {(r['os'] or '?'):<7} "
+              f"{loc(r)[:16]:<16} {r['installs']:>4} {int(r['posts']):>6}  "
+              f"{r['last_seen']:%Y-%m-%d %H:%M}{tag}")
+    posting = sum(1 for r in external if r["posts"] > 0)
+    print(f"\n  of {len(external)} external machines, {posting} posted in the window, "
+          f"{len(external) - posting} are alive-but-not-posting.\n")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/test_percard_posting.py

@@ -8,6 +8,7 @@ instance built via object.__new__ (bypassing rumps.App.__init__). Verifies:
   3. plain approvals -> post=[n]; edited approvals -> edits=[{n,text}]
   4. rejected cards never post
   5. _posts_outstanding / _review_active settle to idle once drained
+  6. activity progress reflects the approved burst total, not each 1-item call
 """
 import os
 import queue
@@ -41,13 +42,21 @@ overlap_detected = []
 inflight = {"n": 0}
 inflight_lock = threading.Lock()
 calls = []
+activity_events = []
 
-def fake_post_drafts(batch_id, post=None, edits=None, timeout=900):
+def fake_post_drafts(batch_id, post=None, edits=None, timeout=900, activity_label=None):
     with inflight_lock:
         inflight["n"] += 1
         if inflight["n"] > 1:
             overlap_detected.append(True)
-    calls.append({"batch": batch_id, "post": post or [], "edits": edits or []})
+    calls.append(
+        {
+            "batch": batch_id,
+            "post": post or [],
+            "edits": edits or [],
+            "activity_label": activity_label,
+        }
+    )
     time.sleep(0.15)  # simulate a slow post so overlaps would be caught
     with inflight_lock:
         inflight["n"] -= 1
@@ -57,6 +66,7 @@ def fake_post_drafts(batch_id, post=None, edits=None, timeout=900):
 
 st = types.ModuleType("s4l_state")
 st.post_drafts = fake_post_drafts
+st.write_activity = lambda state, label: activity_events.append((state, label))
 st.accessibility_trusted = lambda: True
 st.clear_review_request = lambda: None
 sys.modules["s4l_state"] = st
@@ -70,6 +80,8 @@ app._post_worker = None
 app._review_lock = threading.Lock()
 app._panel_open = True
 app._posts_outstanding = 0
+app._posting_batch_total = 0
+app._posting_batch_done = 0
 app._review_active = False
 app._notify = lambda title, msg: None  # silence Notification Center
 
@@ -106,6 +118,13 @@ posted_ns = [(c["post"], c["edits"]) for c in calls]
 expected = [([1], []), ([], [{"n": 2, "text": "edited two"}]), ([4], [])]
 if posted_ns != expected:
     fail.append(f"wrong calls/order: got {posted_ns}\n  expected {expected}")
+labels = [c["activity_label"] for c in calls if c.get("activity_label")]
+if not any(label == "posting 2/3" for label in labels):
+    fail.append(f"second post did not carry burst progress 2/3: labels={labels}")
+if not any(label == "posting 3/3" for label in labels):
+    fail.append(f"third post did not carry burst progress 3/3: labels={labels}")
+if not any(event == ("posting", "posting 1/3") for event in activity_events):
+    fail.append(f"activity never expanded first post to 1/3: events={activity_events}")
 if any(c["post"] == [3] or any(e.get("n") == 3 for e in c["edits"]) for c in calls):
     fail.append("rejected card #3 was posted")
 with app._review_lock: