0.1 · Extended action map / خريطة الأفعال الممتدة

1.1 · What “auto-register” means here

1.2 · Registry shape (source of truth)

{
  "id": "twitter_dr_promedic1",
  "numericId": 15,
  "platform": "X (Twitter)",
  "handle": "@Dr_promedic1",
  "url": "https://x.com/Dr_promedic1",
  "cookieFile": "twitter-Dr_promedic1.js",
  "profileDir": "profiles/twitter_dr_promedic1"
}

1.3 · Follow changes (how updates flow)

1.4 · Modes (never confuse them)

قاعدة ذهبية / Golden rule: الأتمتة الحقيقية = Mode C فقط. البوابة العامة = Mode B للروابط فقط. · Live automation = Mode C only. Public portal = Mode B links only.

2.1 · Credential types (what AI may touch)

2.2 · AI credential cascade (HybridDispatcher)

1) Load accounts.registry.json by id
2) Resolve VPS from account_routing (one account → one IP forever)
3) Load EncryptedCookieManager → decrypt sessions/{id}.enc  OR  vault/{cookieFile}.js
4) sanitize_cookie: sameSite → Lax|Strict|None (Titlecase!)
5) Launch StealthBrowser persistent profile under profiles/{id}
6) context.add_cookies(cookies)  **BEFORE** any page.goto
7) goto(resolve_profile_url(acc))  // PROFILE not home
8) SessionHealth check (logged-in markers)
9) On success: re-save cookies + optional localStorage
10) On checkpoint/2FA: headful Rescue Window 5 min — human solves — then save
11) On shadowban/locked: quarantine, open circuit, stop

2.3 · What AI must never do

• Never put full cookie JSON into LLM prompts (leak + token waste).
• Never multi-account from Mac home IP for live grow/publish.
• Never captcha-bypass bots (ethics.yaml passive_only: true).
• Never “retry 50 times” on 429/checkpoint — map ErrorCode → L1/L2/L3.
• لا تستخدم كلمة مرور كنص داخل السكربتات؛ الكوكيز بعد دخول بشري.

3.1 · Three-state gate (anti false-positive)

3.2 · Validity chain by task type

3.3 · Canonical publish pipeline (Hybrid 4.7)

boot() → ServerRouter → HybridDispatcher → EngagementHook.warm_up()
→ PrePublishScorer + AlgorithmMapper → maybe_search() ONLY if --factual
→ CaptionTransformer → publish → first_60_minutes() → log_post()
→ CircuitBreaker / Incident L1–L3 if needed

3.4 · PhasedGrowth caps (accounts < 21 days)

3.5 · Incident map

• 301 → L1 reduce rate / cool down · خفض المعدل
• 308 → L2 re-export cookies on same IP · إعادة تصدير كوكيز على نفس IP
• 310 → L3 halt 48h (shadowban class) · توقف 48 ساعة

4.1 · Easy picture

4.2 · Coding methods and effects

4.3 · Python script rules

1. One job per invocation — enter OR publish OR scrape (orchestrator coordinates multi-step).
2. stdlib first — json, pathlib, argparse; Playwright only when browser needed.
3. No secrets in source — paths to vault only.
4. Always return structured dict — {ok, error, url, proof}.
5. Idempotent where possible — re-run should not double-post without guard.
6. Log to files + optional SQLite — agent_monitor.db per VPS.
7. Headless default, headful for 2FA.
8. chmod 600 on .enc cookies; delete plaintext after encrypt when policy says so.
9. Never raw page.click() in Hybrid path — Bezier only.

4.4 · Minimal enter skeleton

def enter(acc):
    cookies = load_and_sanitize(acc["cookieFile"])
    if not cookies:
        return {"ok": False, "error": "bad cookies"}
    with sync_playwright() as p:
        ctx = p.chromium.launch_persistent_context(profile_dir, headless=True, ...)
        ctx.add_cookies(cookies)           # BEFORE navigation
        page = ctx.pages[0] or ctx.new_page()
        target = resolve_profile_url(acc)  # NOT generic home
        page.goto(target, timeout=60_000)
        ok = session_health(page)
        if ok:
            save_state(ctx, acc)
        return {"ok": ok, "url": page.url, "title": page.title()}

تحذير / Warning: مستودعات mass follow/unfollow تضر الحساب. Hybrid يفضّل نمو مرحلي + NSRE. · Mass follow kits burn accounts.

7.1 · What MCP changes for the agent

7.2 · MCP rules that keep results valid

• Discover schema before calling (never invent args).
• Prefer specialized MCP over scraping private authenticated SaaS HTML.
• Treat MCP failures as INCONCLUSIVE then fall back to SSH/shell — do not fake PASS.
• Do not send cookie vault contents through MCP chat logs.
• Browser MCP on laptop ≠ pinned VPS IP — account-link risk if mixed for live multi-account.

8.1 · What WebBridge is

Local daemon (~ 127.0.0.1:10086) + browser extension controlling the user’s real browser (real logins, real fingerprint).

جسر يتحكم بمتصفحك الحقيقي — مثالي للإنقاذ اليدوي والبحث، لا لـ multi-account من نفس IP المنزل.

8.2 · Hard rules

1. Health check first: kimi-webbridge status → running + extension_connected.
2. First navigate with newTab: true.
3. Prefer snapshot @e refs over brittle CSS.
4. Use fill for inputs and contenteditable.
5. Screenshots: read returned file path (not raw base64 in model).
6. evaluate: compact JSON; IIFE to avoid const redeclare.
7. Sites checking event.isTrusted may reject synthetic click/fill — Rescue Window human path.
8. Close session/tabs at task end; one session name per site/task.

8.3 · WebBridge vs Playwright Mode C

9.1 · Stack components scored

9.2 · Goal-oriented path scores

11.1 · Cross-platform ranking levers

11.2 · Platform-flavored notes

• Instagram: warm-up scroll before post; Reels completion; localStorage critical; avoid link spam storms.
• TikTok: hook in 1s; native ratios; soft-ban risk from spam comments.
• X/Twitter: conversation density; profile URL not /home; avoid auto-reply storms.
• Facebook: correct profile.php?id=… or username; identity mismatch kills reach.

12.1 · Pre-flight

• ☐ media.addict.best / Hybrid memory loaded
• ☐ boot() / self_check PASS (not INCONCLUSIVE)
• ☐ secrets scanner ≠ FAIL
• ☐ account in registry with profile URL
• ☐ cookie .enc or vault file exists; SameSite sanitized
• ☐ account_routing → correct VPS
• ☐ no stale .browser.lock
• ☐ IP risk check; proxy null unless needed

12.2 · Enter

• ☐ cookies injected before goto
• ☐ land on profile URL
• ☐ session health markers OK
• ☐ screenshot proof saved
• ☐ cookies re-saved if mutated

12.3 · Scrape / target

• ☐ rate governor on
• ☐ NSRE filters applied
• ☐ non-empty structured output
• ☐ sanitize before LLM

12.4 · Publish

• ☐ warm_up done
• ☐ PrePublish / Virality ≥ 60
• ☐ media header valid
• ☐ post URL captured
• ☐ first_60_minutes executed
• ☐ log_post + proof
• ☐ final_gate all_pass True

12.5 · Quick commands

# Mode C enter (on Contabo VPS)
python3 /opt/claude-master1-private/enter_account.py twitter_dr_promedic1 --gui --screenshot

# Mode B portal — profile cards
# https://contabo149.addict.best

# Spec reference
# https://media.addict.best

# This notes page
# https://notes.addict.best/hybrid-automation-credentials.html

13.1 · Advantage filter (why a tip is allowed here)

13.2 · High-advantage operator notes (net-new vs §1–12)

13.3 · Platform playbooks (advantage table)

سقوف اللعب = أسقف لا أهداف. الحسابات < 21 يوماً تخضع لـ PhasedGrowth أولاً.

Playbook numbers are ceilings, not targets. Accounts < 21d use PhasedGrowth first.

13.4 · Cookie hygiene (advantage over “just export cookies”)

13.5 · Keep-alive loop (advantage: fewer L2 re-logins)

1) Scan vault/*.js or sessions/*.enc
2) Stealth persistent context on pinned VPS (Mode C accounts)
3) Poisson human scroll (extends TTL without spam actions)
4) Rewrite cookies to source
5) Quarantine login redirects → quarantine/
6) engage sessions: CookieChain.refresh_silently() every 45 minutes
7) IG/TT: persist local_storage inside encrypted blob
8) Sync from Mac hub to VPS only when export is fresh (avoid overwriting good VPS session with stale Mac copy)

13.6 · Expanded references (for explanation depth — not more fluff tips)

13.7 · Research / scrape validity (CLEAR + OmniMemory)

13.8 · Score deltas (only where expansion improves §9)

13.9 · Explicit non-additions (rejected fluff)

• ❌ Another “be human” paragraph without a mechanism (Bezier/Poisson/Fitts already cover it).
• ❌ Motivational growth quotes.
• ❌ Re-copying the entire media.addict.best master into notes (token waste; link + memory instead).
• ❌ Gray-hat captcha farms / residential proxy spam as “tips” (ethics + usually worse IP reputation).
• ❌ Platform official API “shortcuts” for grow/publish (banned in Hybrid path).