social-autoposter 1.7.2 → 1.7.3

package/mcp/dist/index.js

@@ -20,7 +20,7 @@ import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
 import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
-import { applySetup, resolveProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, normalizeStringList, } from "./setup.js";
+import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, normalizeStringList, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, menubarRunning, clearMenubarStop, ensurePipelineCurrent, ensureRuntimeProvisioned, retryProvisionIfStalled, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
@@ -1023,7 +1023,12 @@ async function postApproved(batchId, plan) {
                 };
             }
             return await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
-                timeoutMs: 900_000,
+                // Scale with batch size: a mass-approval drain runs ~15-20s per card,
+                // so a fixed 15min ceiling SIGTERMed any batch over ~50 cards mid-post
+                // (Karol 2026-07-09: 0/131 posted, exit=-1). 60s/card headroom covers
+                // slow candidates; the 2h cap bounds a hung poster (the browser-lock
+                // expiry and per-reply subprocess timeouts still fire underneath).
+                timeoutMs: Math.min(7_200_000, Math.max(900_000, approved.length * 60_000)),
                 env: ({
                     S4L_SKIP_CAMPAIGN_SUFFIX: "1",
                     // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
@@ -2418,19 +2423,33 @@ tool("get_stats", {
     title: "Get X/Twitter stats",
     description: "Read-only post + engagement stats for the X/Twitter rail over the last N days. " +
         "Wraps project_stats_json.py. Use to show the user how their posts are performing. " +
+        "With no `project` it reports EVERY configured lane, including the personal-brand " +
+        "persona (which usually carries most of the volume) — prefer that default. " +
         "After returning the numbers, call the `dashboard` tool so the user sees them rendered.",
     inputSchema: {
         days: z.number().int().min(1).max(90).default(7),
         project: z
             .string()
             .optional()
-            .describe("Which configured project to report on. Optional when only one project is set up; required when several are."),
+            .describe("Scope to one configured project (the persona lane's name works too). " +
+            "Omit to report all lanes — products AND the personal-brand persona."),
     },
 }, async ({ days, project }) => {
-    const r = resolveProject(project);
-    if (!r.ok)
+    // Explicit project: validate it (projectStatus is persona-aware, so the
+    // persona lane resolves). No project: report EVERY lane rather than
+    // resolving to a single product — the old single-project resolution made
+    // the persona lane (often 90% of activity) invisible in stats.
+    let proj;
+    if (project) {
+        const r = resolveProject(project);
+        if (!r.ok)
+            return textContent(r.message);
+        proj = r.project;
+    }
+    else if (!hasReadyProject() && !personaReady()) {
+        const r = resolveProject();
         return textContent(r.message);
-    const proj = r.project;
+    }
     const args = ["--posts-only", "--platform", "twitter", "--days", String(days)];
     if (proj)
         args.push("--project", proj);

package/mcp/dist/screencast.js

@@ -18,6 +18,20 @@
  */
 import { execFile } from "node:child_process";
 import { createRequire } from "node:module";
+import { logLine } from "./telemetry.js";
+// One structured relay line (context "browser-foreground", the same lane the
+// menubar's NSWorkspace observer emits on) every time THIS module raises the
+// managed Chrome. The observer records THAT the window came to the front;
+// these lines record WHY (screencast attach vs explicit front action), so the
+// two join on timestamp in Cloud Logging.
+function logBringToFront(source, extra) {
+    try {
+        logLine("stdout", JSON.stringify({ ev: "browser_bring_to_front", source, ...extra }), "browser-foreground");
+    }
+    catch {
+        /* telemetry must never break the screencast */
+    }
+}
 // Untyped indirection: Node ships a global WebSocket at runtime (>=21) but
 // @types/node doesn't always declare it as a value, and MessageEvent isn't typed
 // without the DOM lib. Reach for it dynamically and keep the event handlers `any`.
@@ -123,6 +137,14 @@ class Screencast {
             this.port = chosenPort;
             this.targetTitle = target.title || "";
             this.targetUrl = target.url || "";
+            // connect() just sent Page.bringToFront (Chrome won't stream frames for a
+            // background tab), which raises the harness window — record each raise.
+            // Reconnects happen silently on every frame poll after the attached tab
+            // dies, so this line is the ONLY attribution for reconnect-storm raises.
+            logBringToFront("screencast_attach", {
+                port: chosenPort,
+                url: (target.url || "").slice(0, 200),
+            });
             return { ok: true };
         }
         catch (e) {
@@ -333,5 +355,10 @@ export async function bringBrowserToFront(port) {
     if (process.platform === "darwin") {
         await raiseMacWindow(chosenPort);
     }
+    logBringToFront("front_action", {
+        port: chosenPort,
+        url: (target.url || "").slice(0, 200),
+        raised_os_window: process.platform === "darwin",
+    });
     return { ok: true, port: chosenPort };
 }

package/mcp/dist/setup.js

@@ -486,9 +486,15 @@ export function missingForProject(name, fields = REQUIRED_FIELDS) {
     }
 }
 export function projectStatus(name) {
-    const missing = missingForProject(name);
+    // The persona lane (persona:true) has no website/icp by design — validate it
+    // against PERSONA_REQUIRED_FIELDS like every other status surface, or an
+    // explicit request for it (e.g. get_stats project:'PersonalBrand') gets the
+    // misleading "still needs: website, icp" refusal.
+    const persona = findPersonaProject()?.name === name;
+    const required = persona ? PERSONA_REQUIRED_FIELDS : REQUIRED_FIELDS;
+    const missing = missingForProject(name, required);
     if (missing === null) {
-        return { name, in_config: false, ready: false, missing_required: [...REQUIRED_FIELDS] };
+        return { name, in_config: false, ready: false, missing_required: [...required] };
     }
     return { name, in_config: true, ready: missing.length === 0, missing_required: missing };
 }

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.2",
-  "installedAt": "2026-07-10T15:25:23.017Z"
+  "version": "1.7.3",
+  "installedAt": "2026-07-10T18:26:15.755Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_browser_foreground.py

@@ -0,0 +1,188 @@
+"""Ground-truth "the harness browser just went foreground" telemetry.
+
+Customers reported the managed Chrome popping over their work (1.7.x made the
+launchd kicker keep a harness Chrome alive all day, the screencast reconnect
+sends Page.bringToFront, and single-display Macs clamp the off-screen
+--window-position back on-screen). None of those moments were recorded
+anywhere: the causing sites had no logs and nothing observed the OS z-order.
+
+This module is the cause-agnostic observer. It subscribes to NSWorkspace
+activate/launch notifications and, whenever the app coming to the front is a
+Chrome/Chromium whose command line carries a MANAGED profile
+(~/.claude/browser-profiles/browser-harness*), emits one structured JSON line
+via s4l_log_relay.emit(..., context="browser-foreground"). The relay POSTs it
+to /api/v1/installations/logs under the install's X-Installation identity, so
+in Cloud Logging (project s4l-app-prod) the events are:
+
+    jsonPayload.context="browser-foreground"
+    AND jsonPayload.install_id="<uuid>"
+
+Payload fields: cause ("activated" fires on every raise, "launched" only on a
+fresh Chrome process = the launch-activation steal), pid, profile + CDP port +
+--window-position (parsed from the process command line; window-position
+80,80 = setup_twitter_auth's on-screen login, 3042,-1032 = the pipeline
+default), interrupted_app (the frontmost app the user lost), and
+suppressed_since_last (burst dedupe counter, so a bringToFront storm is
+countable without flooding the relay).
+
+Design constraints:
+  - The notification handler must never block the main run loop: it only
+    enqueues; a daemon worker does the `ps` classification + emit.
+  - Only harness-Chrome events are emitted. The user's own Chrome, and every
+    other app switch, produce zero relay traffic (we keep the last non-harness
+    app name in memory as interrupted_app context, nothing more).
+  - Strictly best-effort: install() returning False just means no telemetry.
+"""
+
+import json
+import os
+import queue
+import re
+import subprocess
+import threading
+import time
+
+import s4l_log_relay
+
+# A managed harness Chrome is one launched on a profile under this marker
+# (browser-harness = twitter 9555, browser-harness-linkedin = 9556, ...).
+_PROFILE_MARKER = os.path.join(".claude", "browser-profiles", "browser-harness")
+
+# Within this window, repeats of the same (cause, pid) are counted, not emitted.
+# A screencast-reconnect storm raises Chrome every few seconds; one line per
+# 30s with suppressed_since_last preserves the frequency without the flood.
+_DEDUPE_SECONDS = 30.0
+
+_events = queue.Queue()
+_started = False
+
+
+def _cmdline(pid):
+    try:
+        out = subprocess.run(
+            ["ps", "-p", str(pid), "-o", "command="],
+            capture_output=True, text=True, timeout=3,
+        )
+        return (out.stdout or "").strip()
+    except Exception:
+        return ""
+
+
+class _Worker(threading.Thread):
+    def __init__(self):
+        super().__init__(daemon=True, name="s4l-browser-foreground")
+        self._pid_cache = {}  # pid -> (is_harness, details dict)
+        self._prev_app = None  # last non-harness frontmost app name
+        self._last_key = None  # (cause, pid) of last emitted event
+        self._last_emit_at = 0.0
+        self._suppressed = 0
+
+    def _classify(self, pid):
+        cached = self._pid_cache.get(pid)
+        if cached is not None:
+            return cached
+        cmd = _cmdline(pid)
+        is_harness = _PROFILE_MARKER in cmd and "--remote-debugging-port=" in cmd
+        details = {}
+        if is_harness:
+            m = re.search(r"--user-data-dir=(\S+)", cmd)
+            details["profile"] = os.path.basename(m.group(1).rstrip("/")) if m else ""
+            m = re.search(r"--remote-debugging-port=(\d+)", cmd)
+            details["port"] = int(m.group(1)) if m else None
+            m = re.search(r"--window-position=(\S+)", cmd)
+            details["window_position"] = m.group(1) if m else None
+        result = (is_harness, details)
+        # pids recycle rarely; a tiny bounded cache is enough and self-clears.
+        if len(self._pid_cache) > 64:
+            self._pid_cache.clear()
+        self._pid_cache[pid] = result
+        return result
+
+    def _handle(self, cause, pid, name, low):
+        if "chrome" not in low and "chromium" not in low:
+            if cause == "activated" and name:
+                self._prev_app = name
+            return
+        is_harness, details = self._classify(pid)
+        if not is_harness:
+            # The user's own Chrome counts as their workspace too.
+            if cause == "activated" and name:
+                self._prev_app = name
+            return
+        now = time.time()
+        key = (cause, pid)
+        if key == self._last_key and now - self._last_emit_at < _DEDUPE_SECONDS:
+            self._suppressed += 1
+            return
+        payload = {
+            "ev": "harness_browser_foregrounded",
+            "cause": cause,  # "activated" | "launched"
+            "app": name,
+            "pid": pid,
+            "interrupted_app": self._prev_app,
+            "suppressed_since_last": self._suppressed,
+        }
+        payload.update(details)
+        self._last_key = key
+        self._last_emit_at = now
+        self._suppressed = 0
+        s4l_log_relay.emit(
+            "[browser-foreground] " + json.dumps(payload, ensure_ascii=False),
+            context="browser-foreground",
+        )
+
+    def run(self):
+        while True:
+            try:
+                cause, pid, name, low = _events.get()
+                self._handle(cause, pid, name, low)
+            except Exception:
+                # Never die: a bad event must not end foreground telemetry.
+                time.sleep(0.5)
+
+
+def install():
+    """Subscribe to NSWorkspace activate/launch notifications and start the
+    classifier worker. Call once at menubar boot (the AppKit run loop rumps
+    starts delivers the notifications). Returns True on success; never raises."""
+    global _started
+    if _started:
+        return True
+    try:
+        from AppKit import NSWorkspace
+
+        nc = NSWorkspace.sharedWorkspace().notificationCenter()
+
+        def _make(cause):
+            def _handler(note):
+                try:
+                    app = note.userInfo().objectForKey_("NSWorkspaceApplicationKey")
+                    if app is None:
+                        return
+                    name = str(app.localizedName() or "")
+                    bid = str(app.bundleIdentifier() or "")
+                    pid = int(app.processIdentifier())
+                    _events.put((cause, pid, name, (name + " " + bid).lower()))
+                except Exception:
+                    pass
+            return _handler
+
+        # Keep the block handlers referenced for the process lifetime: PyObjC
+        # does retain the blocks it wraps, but the observer tokens returned
+        # here are our only handle if we ever need to removeObserver_.
+        tokens = [
+            nc.addObserverForName_object_queue_usingBlock_(
+                "NSWorkspaceDidActivateApplicationNotification", None, None,
+                _make("activated"),
+            ),
+            nc.addObserverForName_object_queue_usingBlock_(
+                "NSWorkspaceDidLaunchApplicationNotification", None, None,
+                _make("launched"),
+            ),
+        ]
+        install._tokens = tokens  # noqa: SLF001 (lifetime anchor)
+        _Worker().start()
+        _started = True
+        return True
+    except Exception:
+        return False

package/mcp/menubar/s4l_card.py

@@ -13,9 +13,11 @@ The panel is NONACTIVATING and auto-presented cards never take keyboard focus
 field becomes editable on first click, and only a user-initiated open
 (present_review(focus=True), the menu bar's "Review N pending drafts")
 activates the app and seats the caret immediately. A title-bar "Snooze 1h"
-button sits opposite the close cross; it and the cross both just close the
-panel, and the menu bar interprets any close with undecided drafts as a
-snooze (drafts stay pending, re-present after REVIEW_SNOOZE_SECONDS).
+button sits top-left where the traffic lights would be (they're hidden: the
+panel can't minimize or zoom, and the cross duplicated Snooze); it just
+closes the panel, and the menu bar interprets any close with undecided
+drafts (including Cmd-W) as a snooze (drafts stay pending, re-present after
+REVIEW_SNOOZE_SECONDS).
 
 Decision shape: {"n": int, "approved": bool, "loved": bool, "text": str,
 "edited": bool, "drop_link": bool, "reject_category": str|None,
@@ -134,14 +136,30 @@ try:
     from AppKit import NSWindowStyleMaskNonactivatingPanel
 except Exception:
     NSWindowStyleMaskNonactivatingPanel = 0
-# Title-bar "Snooze 1h" button (sits opposite the close cross). Missing on
-# very old AppKit; the card then degrades to cross-only (closing still
-# snoozes, the label is just absent).
+# Title-bar "Snooze 1h" button (top-left, where the traffic lights would be;
+# those are hidden because minimize/zoom are disabled no-ops on this panel and
+# the close cross just duplicated Snooze). Missing on very old AppKit; the
+# card then degrades to the stock cross (closing still snoozes, the labeled
+# button is just absent) because the traffic lights are only hidden when the
+# accessory actually mounted.
 try:
-    from AppKit import NSTitlebarAccessoryViewController, NSLayoutAttributeRight
+    from AppKit import (
+        NSTitlebarAccessoryViewController,
+        NSLayoutAttributeLeft,
+        NSLayoutAttributeRight,
+    )
 except Exception:
     NSTitlebarAccessoryViewController = None
+    NSLayoutAttributeLeft = None
     NSLayoutAttributeRight = None
+try:
+    from AppKit import (
+        NSWindowCloseButton,
+        NSWindowMiniaturizeButton,
+        NSWindowZoomButton,
+    )
+except Exception:
+    NSWindowCloseButton = NSWindowMiniaturizeButton = NSWindowZoomButton = None
 try:
     from AppKit import NSBezelStyleInline
 except Exception:
@@ -889,41 +907,95 @@ class _ReviewController(NSObject):
 
     @objc.python_method
     def _add_snooze_accessory(self, panel):
-        """"Snooze 1h" in the title bar, opposite the close cross: the explicit
-        "not now" affordance. It just closes the panel; the menu bar treats any
-        close with undecided drafts as a snooze, so the cross and this button
-        are the same action, this one merely says so out loud."""
-        if NSTitlebarAccessoryViewController is None or NSLayoutAttributeRight is None:
+        """Title-bar controls, replacing the traffic lights: "Snooze 1h" at
+        the top-left (minimize/zoom were disabled no-op dots on this panel,
+        and the close cross meant snooze anyway, so one labeled button says
+        what the only dismissal actually does) and "Discard all…" at the
+        top-right (moved here from the menu bar dropdown 2026-07-10; the
+        ellipsis is honest, the handler opens a confirmation alert first).
+        Snooze just closes the panel; the menu bar treats any close with
+        undecided drafts as a snooze. The traffic lights are hidden ONLY once
+        the snooze accessory mounts, so a failure on old AppKit leaves the
+        stock cross as the fallback dismissal. Cmd-W keeps working either way
+        (the Closable mask stays on)."""
+        if NSTitlebarAccessoryViewController is None or NSLayoutAttributeLeft is None:
             return
         try:
-            btn = NSButton.alloc().initWithFrame_(NSMakeRect(0, 0, 80, 17))
-            btn.setTitle_(_snooze_title())
-            if NSBezelStyleInline is not None:
-                btn.setBezelStyle_(NSBezelStyleInline)
-            else:
-                btn.setBezelStyle_(NSBezelStyleRounded)
-            btn.setFont_(NSFont.systemFontOfSize_(10.0))
-            btn.setToolTip_(
-                "Put these drafts away for now. They stay pending and the "
-                "card comes back later (or sooner from the S4L menu)."
+            self._add_titlebar_button(
+                panel,
+                title=_snooze_title(),
+                action="snoozeClicked:",
+                tooltip=(
+                    "Put these drafts away for now. They stay pending and the "
+                    "card comes back later (or sooner from the S4L menu)."
+                ),
+                layout=NSLayoutAttributeLeft,
             )
-            btn.setTarget_(self)
-            btn.setAction_("snoozeClicked:")
-            btn.sizeToFit()
-            bf = btn.frame()
-            holder = NSView.alloc().initWithFrame_(
-                NSMakeRect(0, 0, bf.size.width + 8, max(19, bf.size.height + 2))
-            )
-            btn.setFrameOrigin_(
-                (4, max(0, (holder.frame().size.height - bf.size.height) / 2.0))
-            )
-            holder.addSubview_(btn)
-            acc = NSTitlebarAccessoryViewController.alloc().init()
-            acc.setView_(holder)
-            acc.setLayoutAttribute_(NSLayoutAttributeRight)
-            panel.addTitlebarAccessoryViewController_(acc)
+            self._hide_traffic_lights(panel)
         except Exception as e:
             _log(f"snooze accessory unavailable: {e}")
+        if _discard_all_handler is not None and NSLayoutAttributeRight is not None:
+            try:
+                self._add_titlebar_button(
+                    panel,
+                    title="Discard all…",
+                    action="discardAllClicked:",
+                    tooltip=(
+                        "Throw away every pending draft (asks first). Nothing "
+                        "posts, and unlike a per-card reject this sends no "
+                        "feedback signal to the AI."
+                    ),
+                    layout=NSLayoutAttributeRight,
+                )
+            except Exception as e:
+                _log(f"discard-all accessory unavailable: {e}")
+
+    @objc.python_method
+    def _add_titlebar_button(self, panel, title, action, tooltip, layout):
+        btn = NSButton.alloc().initWithFrame_(NSMakeRect(0, 0, 80, 17))
+        btn.setTitle_(title)
+        if NSBezelStyleInline is not None:
+            btn.setBezelStyle_(NSBezelStyleInline)
+        else:
+            btn.setBezelStyle_(NSBezelStyleRounded)
+        btn.setFont_(NSFont.systemFontOfSize_(10.0))
+        btn.setToolTip_(tooltip)
+        btn.setTarget_(self)
+        btn.setAction_(action)
+        btn.sizeToFit()
+        bf = btn.frame()
+        holder = NSView.alloc().initWithFrame_(
+            NSMakeRect(0, 0, bf.size.width + 8, max(19, bf.size.height + 2))
+        )
+        btn.setFrameOrigin_(
+            (4, max(0, (holder.frame().size.height - bf.size.height) / 2.0))
+        )
+        holder.addSubview_(btn)
+        acc = NSTitlebarAccessoryViewController.alloc().init()
+        acc.setView_(holder)
+        acc.setLayoutAttribute_(layout)
+        panel.addTitlebarAccessoryViewController_(acc)
+
+    @objc.python_method
+    def _hide_traffic_lights(self, panel):
+        """Hide close/minimize/zoom once the Snooze accessory is up: minimize
+        and zoom are disabled dots (no Miniaturizable/Resizable in the mask)
+        and the cross duplicated Snooze. Hiding, not removing: performClose_
+        (Cmd-W and snoozeClicked_) still routes through the hidden close
+        button's machinery, and windowShouldClose_ still fires."""
+        if NSWindowCloseButton is None:
+            return
+        for which in (
+            NSWindowCloseButton,
+            NSWindowMiniaturizeButton,
+            NSWindowZoomButton,
+        ):
+            try:
+                b = panel.standardWindowButton_(which)
+                if b is not None:
+                    b.setHidden_(True)
+            except Exception:
+                pass
 
     def snoozeClicked_(self, sender):
         self._track("snooze")
@@ -933,6 +1005,20 @@ class _ReviewController(NSObject):
         except Exception:
             self._finish()
 
+    def discardAllClicked_(self, sender):
+        """Hand off to the menu bar's bulk-discard handler (registered via
+        set_discard_all_handler); it confirms with the user, flips the store,
+        and dismisses this panel via dismiss_active(), so nothing more happens
+        here. On cancel the card simply stays up."""
+        self._track("discard_all")
+        cb = _discard_all_handler
+        if cb is None:
+            return
+        try:
+            cb()
+        except Exception as e:
+            _log(f"discard-all handler failed: {e}")
+
     @objc.python_method
     def _eye_button(self, frame, kind):
         """Borderless SF-Symbol eye whose hover/click opens a popover. A plain
@@ -2122,6 +2208,21 @@ def set_feedback_handler(cb):
     _feedback_handler = cb
 
 
+# Bulk-discard hook for the title bar's "Discard all…" button, same
+# registration pattern as _feedback_handler above. The menu bar registers
+# _discard_all_pending here (it owns the confirmation alert, the store flip,
+# and dismissing the panel). Cards built while this is None simply don't get
+# the button.
+_discard_all_handler = None
+
+
+def set_discard_all_handler(cb):
+    """Register the title-bar "Discard all…" action. The menu bar calls this
+    before presenting cards with its bulk-discard handler."""
+    global _discard_all_handler
+    _discard_all_handler = cb
+
+
 def _feedback_frame():
     """Just below the open review card when there is one (so it never covers
     the card being reviewed), else the top-right corner of the pointer's

package/mcp/menubar/s4l_log_relay.py

@@ -165,6 +165,38 @@ def _loop():
             pass
 
 
+def emit(line, context="menubar"):
+    """Buffer ONE structured line for the relay under a caller-chosen context
+    (e.g. "browser-foreground"), and mirror it to the real stderr so the local
+    menubar.err.log keeps a copy. Bypasses the _Tee so the line is not ALSO
+    buffered under the default "menubar" context. Best-effort; never raises."""
+    try:
+        t = str(line).strip()
+        if not t or _BASE64_BLOB_RE.match(t):
+            return
+        real = sys.stderr._real if isinstance(sys.stderr, _Tee) else sys.stderr
+        try:
+            real.write(t + "\n")
+            real.flush()
+        except Exception:
+            pass
+        if not ENABLED:
+            return
+        with _lock:
+            _buf.append(
+                {
+                    "ts": _now_iso(),
+                    "stream": "stdout",
+                    "line": t[:MAX_LINE_LEN],
+                    "context": str(context or "menubar")[:200],
+                }
+            )
+            if len(_buf) > MAX_BUFFER:
+                del _buf[: len(_buf) - MAX_BUFFER]
+    except Exception:
+        pass
+
+
 def install():
     """Wrap sys.stderr with the relay tee and start the background flusher.
     Call once at menubar boot, after the S4L_REPO_DIR sys.path insertion."""

package/mcp/menubar/s4l_menubar.py

@@ -117,6 +117,19 @@ try:
 except Exception:
     pass
 
+# Ground-truth browser-foreground telemetry: whenever a MANAGED harness Chrome
+# becomes the frontmost app (fresh-launch activation, screencast bringToFront,
+# macOS clamping the off-screen window back on-screen, anything), ship one
+# structured line with context "browser-foreground" through the relay above.
+# Cause-agnostic OS-level observation; the causing sites (screencast.ts) log
+# their own attribution lines under the same context. Best-effort.
+try:
+    import s4l_browser_foreground  # noqa: E402
+
+    s4l_browser_foreground.install()
+except Exception:
+    pass
+
 
 def _capture(err, **tags):
     """Report a handled menu-bar error to Sentry (component=menubar) without ever
@@ -2800,8 +2813,11 @@ class S4LMenuBar(rumps.App):
 
             # present_feedback (the menu bar's feedback item) falls back to
             # the module-level default handler; register ours before any
-            # card shows.
+            # card shows. Same pattern for the title bar's "Discard all…"
+            # button (moved out of the dropdown 2026-07-10), which reuses the
+            # bulk-discard handler wholesale, confirmation alert included.
             s4l_card.set_feedback_handler(self._on_feedback_text)
+            s4l_card.set_discard_all_handler(self._discard_all_pending)
             s4l_card.present_review(
                 drafts,
                 on_decision=lambda d: self._on_card_decision(batch, d),
@@ -3531,12 +3547,9 @@ class S4LMenuBar(rumps.App):
                     )
                 )
             )
-        items.append(
-            rumps.MenuItem(
-                f"Discard {pending_count} pending draft{plural}…",
-                callback=self._discard_all_pending,
-            )
-        )
+        # No bulk-discard item here anymore: "Discard all…" lives in the
+        # review card's title bar (2026-07-10). Reaching it with no card open
+        # is "Review N pending drafts" -> Discard all, two clicks.
         return items
 
 

package/mcp/menubar/s4l_state.py

@@ -736,6 +736,37 @@ def _match_candidate(data, n, candidate_id):
     return None
 
 
+def candidate_state(c):
+    """Canonical lifecycle state of ONE review-queue candidate. Use this instead
+    of ad hoc flag checks — "not posted" is NOT "awaiting review".
+
+    The review queue (review-queue.json) is an APPEND-FOREVER LEDGER: handled
+    candidates are never removed, they are flag-stamped in place, so most rows
+    in an old queue are retired. States, in precedence order:
+
+      posted          — approved and successfully posted (our_url set).
+      terminal        — retired without a post; terminal_reason says why
+                        (rejected, human_rejected, human_discarded_all,
+                        duplicate_thread_pre_post, ...; None on older rows).
+      post_failed     — approved but the post attempt errored (post_error says
+                        why). Settled from the cards' point of view; the resume
+                        path retries only after a fresh approval clears it.
+      approved        — human approved, post not yet attempted/confirmed.
+      awaiting_review — none of the above. The ONLY state cards present, and
+                        the only honest "pending" count (review-request.json's
+                        .count mirrors it at merge time).
+    """
+    if c.get("posted") is True:
+        return "posted"
+    if c.get("terminal") is True:
+        return "terminal"
+    if c.get("post_failed"):
+        return "post_failed"
+    if c.get("approved") is True:
+        return "approved"
+    return "awaiting_review"
+
+
 def store_stamp_decision(batch, decision):
     """Write a card decision INTO the store the instant the user clicks. This is
     the durable record (the old approved-queue.json ledger is no longer
@@ -784,7 +815,7 @@ def discard_all_pending(drafts):
         done = 0
         for d in drafts:
             c = _match_candidate(data, d.get("n"), d.get("candidate_id"))
-            if c is None or c.get("posted") is True or c.get("terminal") is True:
+            if c is None or candidate_state(c) in ("posted", "terminal"):
                 continue
             c["terminal"] = True
             c["terminal_reason"] = "human_discarded_all"
@@ -865,7 +896,7 @@ def store_pending_posts(batch="review-queue"):
     plan = read_plan(store_path())
     out = []
     for i, c in enumerate((plan or {}).get("candidates") or []):
-        if not c.get("approved") or c.get("posted") or c.get("terminal") or c.get("post_failed"):
+        if candidate_state(c) != "approved":
             continue
         d = c.get("decision") or {}
         out.append(
@@ -932,7 +963,7 @@ def review_queue_posted_count():
     cands = (plan or {}).get("candidates")
     if not cands:
         return None
-    return sum(1 for c in cands if c.get("posted") is True)
+    return sum(1 for c in cands if candidate_state(c) == "posted")
 
 
 def _plan_generation(batch):
@@ -1008,7 +1039,9 @@ def review_drafts(plan, batch="review-queue"):
     settled_ns = {it.get("n") for it in items if it.get("candidate_id") is None}
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
-        if c.get("posted") is True or c.get("terminal") is True or c.get("approved") is True:
+        # Only awaiting_review rows become cards. This also skips post_failed
+        # rows (decided-but-failed is settled per the docstring above).
+        if candidate_state(c) != "awaiting_review":
             continue
         cid = c.get("candidate_id")
         if cid is not None and cid in settled_ids:

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "social-autoposter",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/merge_review_queue.py

@@ -19,6 +19,15 @@ Usage:
 
 State dir (for review-request.json) honors $S4L_STATE_DIR; the review-queue plan
 lives in $S4L_TMP_DIR or /tmp (matching the MCP's planPath()).
+
+LEDGER SEMANTICS (read this before counting anything in review-queue.json):
+the queue is APPEND-FOREVER — handled candidates are never removed, they are
+flag-stamped in place (posted / terminal+terminal_reason / post_failed /
+approved). "Not posted" is therefore NOT "awaiting review"; in an old queue
+most rows are retired. The canonical classifier is
+mcp/menubar/s4l_state.py::candidate_state(); the honest pending-cards count is
+its awaiting_review bucket, mirrored into review-request.json's .count here at
+merge time.
 """
 
 from __future__ import annotations
@@ -318,10 +327,21 @@ def main() -> int:
         _atomic_write(dst, plan_obj)
         ensure_store_symlink()
 
-        # Refresh the review-request marker the menu bar polls (count = pending,
-        # not posted, not terminal -- a just-pruned expired card must not still
-        # inflate the badge).
-        pending_count = len([c for c in merged if not c.get("posted") and not c.get("terminal")])
+        # Refresh the review-request marker the menu bar polls. count = cards
+        # actually awaiting review (mirrors s4l_state.candidate_state()'s
+        # awaiting_review bucket): approved-unposted and post_failed rows are
+        # settled decisions, counting them inflated the badge and misled every
+        # human/agent reading the marker.
+        pending_count = len(
+            [
+                c
+                for c in merged
+                if not c.get("posted")
+                and not c.get("terminal")
+                and not c.get("post_failed")
+                and not c.get("approved")
+            ]
+        )
         project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
         _atomic_write(
             review_request_path(),

package/scripts/pick_project.py

@@ -74,10 +74,17 @@ def recent_posts_by_project(platform=None, days=RECENT_WINDOW_DAYS):
 
 
 def _eligible_pool(config, platform=None, exclude=None):
-    """Projects eligible for selection: enabled, weight>0, platform-compatible."""
+    """Projects eligible for selection: enabled, weight>0, non-persona,
+    platform-compatible.
+
+    Persona entries (`persona: true`) are structurally excluded: they run ONLY
+    via the personal_brand lane's force-inject (s4l_mode.persona_name), never
+    via this promotion lottery, regardless of their `enabled` flag.
+    """
     pool = [
         p for p in config.get("projects", [])
         if p.get("enabled", True) and p.get("weight", 0) > 0
+        and p.get("persona") is not True
     ]
     if exclude:
         excluded = {n.lower() for n in exclude}
@@ -122,8 +129,10 @@ def pick_project(config, platform=None, exclude=None):
         return picks[0]
     if exclude:
         return None
-    # No eligible project at all: legacy fallback to any project in config.
-    projects = config.get("projects", [])
+    # No eligible project at all: legacy fallback to any non-persona project.
+    projects = [
+        p for p in config.get("projects", []) if p.get("persona") is not True
+    ]
     return random.choice(projects) if projects else None
 
 

package/scripts/release-mcpb.sh

@@ -460,7 +460,21 @@ if [[ "$DO_NPM" == "1" ]]; then
          fs.writeFileSync(p, JSON.stringify(j,null,2)+'\n');
          console.log('  temp copy renamed to $S4L_ALIAS_PKG@'+j.version+' (repo package.json untouched)');
        " \
-       && ( cd "$S4L_PUB_DIR/package" && npm publish --access=public ${NPM_TAG_ARGS[@]+"${NPM_TAG_ARGS[@]}"} ); then
+       && (
+            # The registry's large-upload path flakes (TLS bad record mac / EPIPE)
+            # often enough that one attempt let the alias lane silently drift for
+            # three rc's (rc.16/21/22, caught 2026-07-10). Retry, and between
+            # attempts check whether the upload actually landed despite the
+            # client-side error (EPIPE can be a false negative).
+            cd "$S4L_PUB_DIR/package" || exit 1
+            for _try in 1 2 3; do
+              npm publish --access=public ${NPM_TAG_ARGS[@]+"${NPM_TAG_ARGS[@]}"} && exit 0
+              sleep 3
+              [[ "$(curl -s -o /dev/null -w '%{http_code}' "$S4L_ALIAS_URL")" == "200" ]] && exit 0
+              echo "  dual-publish attempt $_try/3 failed" >&2
+            done
+            exit 1
+          ); then
       for _ in 1 2 3 4 5; do
         sleep 2
         [[ "$(curl -s -o /dev/null -w '%{http_code}' "$S4L_ALIAS_URL")" == "200" ]] && break

package/scripts/s4l_mode.py

@@ -58,14 +58,15 @@ Usage:
     s4l_mode.py split               # print the personal-brand share (0.0-1.0)
     s4l_mode.py split <value>       # set it; accepts 70, 70%, or 0.7
 
-Draft-only (2026-07-06): a third, independent flag in mode.json, DEFAULT ON.
-While ON (the normal state), every cycle stops before posting and its drafts
-become review cards. When an OPERATOR turns it off, run-draft-and-publish.sh
-runs promotion-lane cycles with DRAFT_ONLY=0 so they POST autonomously (the
-rolling virality bar is the quality gate). Persona-lane cycles ALWAYS stay
-draft-only (review cards) regardless. Deliberately NOT exposed on any user
-surface (no MCP tool param, no menubar toggle): this CLI and mode.json are the
-only way to flip it.
+Draft-only (2026-07-06, single global switch as of 2026-07-08): a third,
+independent flag in mode.json, DEFAULT ON. While ON (the normal state), every
+cycle stops before posting and its drafts become review cards. When an
+OPERATOR turns it off, run-draft-and-publish.sh runs EVERY lane (promotion AND
+personal_brand) with DRAFT_ONLY=0 so they POST autonomously (promotion
+additionally runs behind the rolling virality bar). This applies uniformly
+across lanes; persona-lane cycles do NOT stay draft-only when the flag is off.
+Deliberately NOT exposed on any user surface (no MCP tool param, no menubar
+toggle): this CLI and mode.json are the only way to flip it.
 `env` additionally exports S4L_CYCLE_LANE=<lane> for both lanes so the wrapper
 knows which lane this cycle is without re-deriving it.
 

package/scripts/twitter_post_plan.py

@@ -43,12 +43,59 @@ import json
 import os
 import random
 import re
+import signal
 import subprocess
 import sys
 import time
 from datetime import datetime, timezone
 from pathlib import Path
 
+
+def _neuter_stream(stream) -> None:
+    """Point a dead pipe's fd at /dev/null so later writes (including the
+    interpreter-shutdown flush) can't raise BrokenPipeError again."""
+    try:
+        devnull = os.open(os.devnull, os.O_WRONLY)
+        os.dup2(devnull, stream.fileno())
+        os.close(devnull)
+    except Exception:
+        pass
+
+
+_builtin_print = print
+
+
+def print(*args, **kwargs):  # noqa: A001 -- deliberate builtins.print shadow
+    # When the parent (cycle shell tree or MCP server) is killed mid-batch, our
+    # stdout/stderr pipes close and the next print raises BrokenPipeError. The
+    # old behavior unwound through excepthook (Sentry S4L-8), killing the batch
+    # BETWEEN posting a reply and recording it — which is how live tweets ended
+    # up unlogged and candidates re-feedable. Output to a dead parent is
+    # worthless; the bookkeeping (log_post, update_candidate, audit JSONL) is
+    # not. Swallow the error, neuter the fds, keep going.
+    try:
+        _builtin_print(*args, **kwargs)
+    except BrokenPipeError:
+        _neuter_stream(sys.stdout)
+        _neuter_stream(sys.stderr)
+
+
+# Graceful SIGTERM: the MCP post_drafts timeout (and anything else that asks
+# nicely before SIGKILL) sends SIGTERM. Dying instantly reopens the same
+# posted-but-unrecorded window as the broken pipe, so instead flag the loop to
+# stop at the next candidate boundary: current candidate finishes its
+# bookkeeping, the summary and audit line still get written, exit stays 0.
+_terminate_requested = False
+
+
+def _on_sigterm(signum, frame):
+    global _terminate_requested
+    _terminate_requested = True
+    print("[post] SIGTERM received; stopping after current candidate", flush=True)
+
+
+signal.signal(signal.SIGTERM, _on_sigterm)
+
 # This pipeline ONLY posts (never scans), so mark every twitter_browser.py reply
 # subprocess it spawns as the high-priority "post" lock role. run_subprocess
 # inherits this process env, so the child twitter_browser.py reads S4L_LOCK_ROLE
@@ -1150,6 +1197,10 @@ def main() -> int:
 
     try:
         for _idx, c in enumerate(candidates, start=1):
+            if _terminate_requested:
+                print(f"[post] stopping early on SIGTERM: {_idx - 1}/{_total} "
+                      f"candidates processed, posted={posted}", flush=True)
+                break
             # Live per-post status for the S4L menu bar. LEAD with `posted` (the
             # REAL count of replies that actually landed), not `_idx` (the loop
             # position). _idx races through already-posted / deleted cards as instant
@@ -1224,6 +1275,22 @@ def main() -> int:
                 "reason": reason or "",
                 "our_url": c.get("our_url") or "",
             })
+            # Per-candidate durable record: the run-level audit at the bottom of
+            # main() is lost if this process is SIGKILLed mid-batch (browser-lock
+            # hijack), leaving no local trace of what already posted. Separate
+            # file from post-results.jsonl on purpose: that one is run-level and
+            # the menu bar/dashboard parse it; don't mix schemas.
+            try:
+                _prog_path = os.path.join(
+                    REPO_DIR, "skill", "logs", "post-candidates.jsonl")
+                with open(_prog_path, "a", encoding="utf-8") as _pf:
+                    _pf.write(json.dumps({
+                        "at": datetime.now(timezone.utc).isoformat(),
+                        "plan": plan_path.name,
+                        **candidate_results[-1],
+                    }) + "\n")
+            except Exception:
+                pass
     finally:
         _clear_activity()
         # Release the batch hold so the next scan/post can take the browser

package/skill/run-draft-and-publish.sh

@@ -11,9 +11,10 @@
 #     review-queue cards the menu bar shows. Without this merge the cycle's
 #     plan would sit in a /tmp batch file nobody reads.
 #   - draft-only OFF (operator opt-out via `s4l_mode.py draft-only off`,
-#     promotion-lane cycles only): DRAFT_ONLY=0 — the cycle posts its top-1
-#     pick autonomously, gated by the rolling virality bar. Persona cycles
-#     keep making cards either way.
+#     single global switch across EVERY lane as of 2026-07-08): DRAFT_ONLY=0
+#     — the cycle posts its top-1 pick autonomously; promotion additionally
+#     gated by the rolling virality bar. Persona cycles also post
+#     autonomously when the flag is off; they no longer stay draft-only.
 set -uo pipefail
 
 # SAPS_->S4L_ env mirror (brand rename 2026-07-03): old plists/tasks still