x.com

{
  "domain": "x.com",
  "name": "X (Twitter) Daily Driver",
  "version": "0.2.0",
  "author": "VibeDNA / Mariano",
  "license": "one-time purchase",
  "tier": "starter",
  "source_url": "https://x.com/home",
  "framework": "react+draftjs",
  "frameworks_detected": [
    "react",
    "draftjs"
  ],
  "anti_bot_verdict": "watch",
  "anti_bot_signals": [
    {
      "type": "transaction-id-header",
      "confidence": "high"
    },
    {
      "type": "device-id",
      "confidence": "high"
    },
    {
      "type": "draftjs-editorstate-source-of-truth",
      "confidence": "high"
    }
  ],
  "default_strategy": "events-only",
  "category_hint": "daily_driver",
  "notes": [
    "X composer is Draft.js, NOT Lexical. Default lexical_set_text fails (no editor handle). Pass strategy='events-only' explicitly — it dispatches synthetic InputEvents that Draft.js DOES respect.",
    "Two posting paths exist: (a) UI path via events-only + post-button click, (b) XHR replay path via captured CreateTweet GraphQL. Use (a) for human-cadence daily posts. Use (b) for batch / scheduled drops.",
    "XHR replay REQUIRES x-client-transaction-id header (alongside authorization + x-csrf-token + x-twitter-auth-type + x-twitter-active-user). Missing transaction-id returns 200 + empty tweet_results: {} = silent black-hole.",
    "Transaction-id IS reusable across replays in the same session. One manual seed tweet by the user populates the capture and buys N replays.",
    "DO NOT use document.execCommand or paste events — Draft.js explicitly ignores both. Composer DOM may show text but EditorState stays empty and post button stays disabled.",
    "Once Draft.js state is corrupted by external DOM writes, the tab is unusable until full close. If automation breaks the composer, close the tab and relaunch a fresh session.",
    "Daily post limit is ~50 for unverified accounts, 200 for Blue. Stay under half of that.",
    "Follow/unfollow above ~30 per hour triggers a 'restricted' state for 24h.",
    "Replies to non-followers are heavily de-amplified — focus on engaging your own community first."
  ],
  "preflight": [
    {
      "name": "logged_in",
      "kind": "dom",
      "probe": "[data-testid='SideNav_AccountSwitcher_Button']",
      "expected": "present"
    },
    {
      "name": "compose_box",
      "kind": "dom",
      "probe": "[data-testid='tweetTextarea_0']",
      "expected": "present"
    },
    {
      "name": "post_button",
      "kind": "dom",
      "probe": "[data-testid='tweetButtonInline']",
      "expected": "present"
    }
  ],
  "proven_actions": [
    {
      "descriptor": "Post tweet via UI (events-only)",
      "strategy": "events-only",
      "successes": 1,
      "last_at": 1779361974,
      "steps": [
        "lexical_set_text on [data-testid='tweetTextarea_0'] with strategy='events-only' and text",
        "click on [data-testid='tweetButtonInline'] with strategy='cdp'"
      ],
      "best_for": "human cadence, 1-5 tweets a day, lowest anti-bot signature"
    },
    {
      "descriptor": "Post tweet via XHR replay (CreateTweet GraphQL)",
      "strategy": "xhr_replay",
      "successes": 1,
      "last_at": 1779600000,
      "prereq": "one manual seed tweet per session to capture headers",
      "steps": [
        "On page load, inject XMLHttpRequest.prototype interceptor capturing requests matching /CreateTweet/ — store full url, method, headers, body in window.__xhrCaptures",
        "User posts one tweet manually to seed the capture",
        "For each subsequent tweet: take window.__xhrCaptures.at(-1), JSON.parse(body), replace variables.tweet_text, fetch(url, {method:'POST', credentials:'include', headers, body: JSON.stringify(body)})",
        "Success = response status 200 AND tweet_results.result populated. Empty tweet_results:{} = silent reject (missing x-client-transaction-id)"
      ],
      "required_headers": [
        "authorization",
        "x-csrf-token",
        "x-twitter-auth-type",
        "x-twitter-active-user",
        "x-client-transaction-id",
        "content-type"
      ],
      "best_for": "batch posting, scheduled drops, content factory output (5+ tweets per session)"
    },
    {
      "descriptor": "Reply to tweet (UI events-only on reply composer)",
      "strategy": "events-only",
      "successes": 0
    },
    {
      "descriptor": "Post threaded sequence",
      "strategy": "events-only",
      "successes": 0,
      "notes": "in_reply_to_tweet_id chains them in the XHR replay variant"
    },
    {
      "descriptor": "Like tweet",
      "strategy": "cdp",
      "successes": 0
    },
    {
      "descriptor": "Retweet",
      "strategy": "cdp",
      "successes": 0
    },
    {
      "descriptor": "Follow user",
      "strategy": "cdp",
      "successes": 0
    }
  ],
  "snippets": {
    "xhr_interceptor": "(() => { const oO=XMLHttpRequest.prototype.open, oS=XMLHttpRequest.prototype.send, oH=XMLHttpRequest.prototype.setRequestHeader; XMLHttpRequest.prototype.open=function(m,u,...r){this.__url=u;this.__method=m;this.__headers={};return oO.apply(this,[m,u,...r])}; XMLHttpRequest.prototype.setRequestHeader=function(k,v){if(this.__headers)this.__headers[k]=v;return oH.apply(this,[k,v])}; XMLHttpRequest.prototype.send=function(b){if(this.__url?.includes('CreateTweet')){window.__xhrCaptures=window.__xhrCaptures||[];window.__xhrCaptures.push({url:this.__url,method:this.__method,headers:this.__headers,body:b})}return oS.apply(this,[b])}; return 'ok'; })()",
    "replay_last": "(async (newText) => { const c=window.__xhrCaptures?.at(-1); if(!c) return {ok:false,reason:'no capture'}; const body=JSON.parse(c.body); body.variables.tweet_text=newText; const r=await fetch(c.url,{method:'POST',credentials:'include',headers:c.headers,body:JSON.stringify(body)}); const data=await r.json(); const ok=r.status===200 && data?.data?.create_tweet?.tweet_results?.result; return {ok,status:r.status,data}; })"
  },
  "captured_endpoints": [
    {
      "url": "https://x.com/i/api/graphql/{hash}/CreateTweet",
      "type": "graphql",
      "method": "POST"
    }
  ],
  "page_indicators": {
    "has_password_input": true,
    "has_file_input": true,
    "has_label_wrapped_file": false,
    "has_drop_zone": true,
    "iframe_count": 0
  },
  "risk_grade": "high",
  "policy": "single-account, human-cadence only",
  "created_at": 1779600000,
  "updated_at": 1779700000,
  "created_by": "manual_seed",
  "discovered_by": [
    "MARSTUDIO WARMER",
    "WEBLOOM"
  ]
}