Full 1/4 — Session · cookies · credentials · logging
Expert session steward: continuous health, cookie heal, three-state logs, quarantine, Console API.
Methodology (expert)
- boot/self-check before any browser (proxy, geo/timezone/locale match, profile, vault, DISPLAY).
- Classify session: alive | expired | checkpoint | locked | shadowban_canary.
- Heal path: credentials → auto-login → capture → encrypt sessions/{account}.enc → chmod 600 → delete plaintext.
- Inject cookies BEFORE first navigate; save AFTER confirmed success; silent refresh ~45m on long engage.
- Quarantine on checkpoint/locked/shadowban — never ban-loop; L1/L2/L3 incident map.
- One account → one IP/profile forever (Mode C multi-account).
- Every step: correlation_id + JSONL log + progress.json verified only on PASS.
Pro tips
- Never share cookie jars across brands.
- Residential proxy reputation matters more than fingerprint magic.
- Match exit IP = browser timezone = locale or security AI flags you.
- Shadowban canary = real chrono/tag tab empty → L3 48h halt.
- Never log passwords; evidence paths only.
- Prefer Manager Console action=full_heal / verify; require done_allowed=true.
Code blocks · agent-ready
RUN="runs/$(date +%Y-%m-%d_%H%M)_session_${ACCOUNT}"
mkdir -p "$RUN/evidence"
JOB=$(curl -sS -H "X-Console-Token: $MANAGER_CONSOLE_TOKEN" \
-H "Content-Type: application/json" \
-d "{\"action\":\"full_heal\",\"platform\":\"$PLATFORM\",\"label\":\"$ACCOUNT\"}" \
https://manager.addict.best/console/api/run)
echo "$JOB" | tee "$RUN/job_start.json"
# poll /console/api/jobs/{id} until status=done AND done_allowed=true
import json, time, uuid
from pathlib import Path
from verification_engine import VerificationEngine
def log_action(run_dir, *, platform, account, action, target, result, evidence=None):
assert result in ("PASS", "FAIL", "INCONCLUSIVE")
row = {
"ts": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
"correlation_id": uuid.uuid4().hex,
"platform": platform, "account": account,
"action": action, "target": target, "result": result, "evidence": evidence,
}
p = Path(run_dir) / "run.jsonl"
p.parent.mkdir(parents=True, exist_ok=True)
with p.open("a") as f:
f.write(json.dumps(row) + "\n")
return row
eng = VerificationEngine(work_dir=run_dir, progress_file=f"{run_dir}/progress.json")
eng.checkpoint("session_health", "complete", f"{run_dir}/session_health.json")
r = eng.verify_file(f"{run_dir}/session_health.json")
if not r.ok:
raise SystemExit(f"STOP verify_file: {r.detail}")
ok, report = eng.final_gate({
"session_health": f"{run_dir}/session_health.json",
"run_jsonl": f"{run_dir}/run.jsonl",
})
assert ok, report
Cookie + logging issue fixes (production playbook)
From manager_vs_social_analysis.md — manager console vs social agent cookie vaults. Use these steps when sessions look healthy in UI but login fails, or health is stale.
Fix methodology
- Map 3 layers: Keep-alive cron → LIVE vault /root/dashboard-social-media/*.js → Manager copy /opt/manager-console/cookies/ (must not shadow live).
- Immediate: fix corrupt JSON → sync/symlink manager cookies to dashboard → restart manager-console.
- Recover quarantined accounts with local_auto_login.py --platform X --label Y when no live replacement.
- Purge expired cookies (keep expires<=0 session cookies) across vault; re-export broken accounts.
- Harden: cron keep-alive 0 2,10,18 + rsync after; logrotate for keep_alive/api/agent logs; fix accounts.js typos.
- Logging ops: tail -f keep_alive.log + api.log + agent.log; systemctl is-active manager-console social-agent caddy; inspect latest jobs/*.json for done_allowed.
- Health gate: PASS only if parse OK + critical cookies alive + home feed proof after inject; INCONCLUSIVE if unmeasurable; FAIL if corrupt/missing.
Issue tips (why it breaks)
- Root cause of broken cookies: manager /opt/manager-console/cookies/ can be weeks stale while LIVE vault is /root/dashboard-social-media/ — keep-alive only writes the dashboard dir.
- MANAGER_COOKIE_DIRS scans multiple dirs but manager cookies/ has priority; stale copies shadow fresh dashboard files → remove or symlink manager copies to dashboard.
- Corrupted JSON (e.g. Dr_promedic1.js unterminated string) breaks BOTH manager console and social agent parsers — delete + re-login or truncate to last valid ].
- Partial expiry (1–3 expired of many) is common on Twitter/TikTok; critical session cookies (auth_token/ct0, sessionid) often still work but degrade without keep-alive.
- Quarantined files ≠ always dead: sometimes an old quarantine copy exists while a live dashboard copy still works — check both before re-login.
- Typo filenames (faacebook-*) and non-JSON stubs (metadata-only .js) waste keep-alive cycles and fail health checks — fix accounts.js + remove stubs.
- Duplicate cookie files (tiktok.com:@x.js vs tiktok-x.js) double keep-alive work — keep one naming scheme.
- Keep-alive once/day is too rare for TikTok (~24h sessions) — run 3×/day (02,10,18) + rsync dashboard → manager cookies after keep-alive.
- Logging: keep_alive.log, api.log, agent.log have NO rotation (Caddy/journald do) — install logrotate weekly rotate 4 compress copytruncate.
- Manager UI 401 on /accounts without token falls back to embedded stale inventory — save X-Console-Token or make /accounts public (never returns passwords).
- Job JSON under /opt/manager-console/jobs/ accumulates forever — prune old jobs after verification audit.
- Always verify: cookie JSON starts with [, parseable, cookie_count>0, critical session cookies present, inject BEFORE navigate, save AFTER success, chmod 600, never print values.
Fix code blocks
# Fix corrupted cookie JSON (example Dr_promedic1.js) — Contabo
ssh -i ~/.ssh/contabo2_new1 root@149.102.150.185
# Option A (recommended): delete + re-login
rm -f /root/dashboard-social-media/Dr_promedic1.js /opt/manager-console/cookies/Dr_promedic1.js
cd /opt/manager-console/bin
python3 local_auto_login.py --platform twitter --label Dr_promedic1
# Option B: truncate to last valid JSON array
python3 -c "
import json
path='/root/dashboard-social-media/Dr_promedic1.js'
content=open(path).read()
for i in range(len(content)-1,-1,-1):
if content[i]==']':
try:
cookies=json.loads(content[:i+1])
open(path,'w').write(json.dumps(cookies,indent=4)+'\nhttps://x.com/Dr_promedic1\n')
print('Fixed: kept', len(cookies), 'cookies'); break
except Exception: continue
"
# Sync manager cookies to LIVE dashboard vault (stop 26-day shadow) # Prefer symlinks so manager always reads live data rm -f /opt/manager-console/cookies/*.js cd /opt/manager-console/cookies for f in /root/dashboard-social-media/*.js; do [ "$(basename "$f")" = "accounts.js" ] && continue ln -sf "$f" "$(basename "$f")" done ls -la /opt/manager-console/cookies/ | head -8 systemctl restart manager-console # Permanent: after keep-alive, rsync (crontab example) # 0 2,10,18 * * * /usr/bin/python3 /root/dashboard-social-media/session_sync_keep_alive.py >> /root/dashboard-social-media/keep_alive.log 2>&1 # 5 2,10,18 * * * rsync -a --include='*.js' --exclude='*' /root/dashboard-social-media/ /opt/manager-console/cookies/ 2>/dev/null
# Recover quarantined / missing sessions via manager auto-login cd /opt/manager-console/bin python3 local_auto_login.py --platform facebook --label doctorkhaledzezo python3 local_auto_login.py --platform instagram --label master1_vip1 # Fix typo in social agent manifest sed -i 's/faacebook-promedic1.com.js/facebook-promedic1.com.js/g' \ /root/dashboard-social-media/accounts.js # Remove non-cookie stub files rm -f /root/dashboard-social-media/facebook.com:master1.edugames.js
# Purge expired cookies (keep session cookies expires<=0)
# + logrotate for keep-alive / manager api / social-agent logs
cat > /etc/logrotate.d/social-agent << 'EOF'
/root/dashboard-social-media/keep_alive.log
/opt/manager-console/logs/api.log
/var/log/social-agent/agent.log {
weekly
rotate 4
compress
delaycompress
missingok
notifempty
copytruncate
}
EOF
# Monitor
tail -f /root/dashboard-social-media/keep_alive.log \
/opt/manager-console/logs/api.log \
/var/log/social-agent/agent.log
systemctl is-active social-agent manager-console caddy
grep "Keep-alive loop completed" /root/dashboard-social-media/keep_alive.log | tail -1
ls -t /opt/manager-console/jobs/*.json | head -1 | xargs python3 -m json.tool | head -30
# FULL MERGED TEMPLATE 1/4 — SESSION · COOKIES · CREDENTIALS · LOGGING
# media.addict.best/automation · EXPERT · paste entire block into AI agent
ROLE: Session & cookie steward for media.addict.best/automation.
SCOPE tools: boot, verify_session, auto_login, encrypt_cookies, canary, quarantine, log
FORBIDDEN: publish, delete comments, like comments, captcha bypass.
ACCOUNTS: [LIST] · PLATFORMS: [IG/TT/X/FB] · LABEL: [LABEL]
## METHODOLOGY (execute in order)
1) boot/self-check: proxy, geoIP=timezone=locale, profile dir, vault, DISPLAY if headed.
2) Monitor continuously: alive | expired | checkpoint | locked | shadowban signals.
3) Structured log every action → run.jsonl (ts, platform, account, action, target, PASS|FAIL|INCONCLUSIVE, evidence, correlation_id).
4) Cookie change/expire: detect → auto-login if allowed → capture → encrypt sessions/{account}.enc → chmod 600 → delete plaintext → inject before nav → save after success.
5) Silent refresh ~45m on long engage; SameSite Titlecase hygiene.
6) Quarantine on shadowban|checkpoint|session_expired|account_locked — no ban-loop.
7) One account → one stable IP/profile forever (Mode C).
8) Write session_health.json + progress.json under runs/YYYY-MM-DD_HHMM_session_{account}/.
## HOW TO RUN
- Plan → (EXECUTE only if live login) → act → log → verify → report.
- Prefer Manager Console API: action=verify | full_heal | auto_login.
- Shadowban canary on real chrono/tag; empty → L3 48h pause.
- After Console job: require done_allowed==true (auto verification_engine).
## PRO TIPS
- Never share cookie jars across brands. Inject cookies BEFORE first navigation.
- Residential geo-matched proxies; IP = timezone = locale.
- Evidence paths only — never log passwords. Headed + Xvfb + residential beats fingerprint-only.
## TOOLS
Playwright / Patchright / CloakBrowser · persistent profiles · Xvfb · encrypted vault · Manager Console API · OMNI keep-alive / auto-login.
## CODE — Console heal
```bash
RUN="runs/$(date +%Y-%m-%d_%H%M)_session_${ACCOUNT}"; mkdir -p "$RUN/evidence"
curl -sS -H "X-Console-Token: $MANAGER_CONSOLE_TOKEN" -H "Content-Type: application/json" \
-d "{\"action\":\"full_heal\",\"platform\":\"$PLATFORM\",\"label\":\"$ACCOUNT\"}" \
https://manager.addict.best/console/api/run
# poll /console/api/jobs/{id} until status=done AND done_allowed=true
```
## CODE — verify_file gate
```python
from verification_engine import VerificationEngine
eng = VerificationEngine(work_dir=run_dir, progress_file=f"{run_dir}/progress.json")
eng.checkpoint("session", "complete", f"{run_dir}/session_health.json")
r = eng.verify_file(f"{run_dir}/session_health.json")
if not r.ok: raise SystemExit(r.detail)
ok, rep = eng.final_gate({"session_health": f"{run_dir}/session_health.json", "run": f"{run_dir}/run.jsonl"})
if not ok: raise SystemExit(rep)
```
## TASK VERIFY
- Re-open home → authenticated UI for LABEL (not login wall).
- eng.verify_file on session_health.json + run.jsonl; final_gate PASS.
- progress.json verified:true; three-state only.
- States: planned→validated→executed→verifying→verified|failed.
## FINAL REPORT
task=session | steps table | PASS/FAIL/INCONCLUSIVE | evidence | final_gate | done_allowed
## COOKIE + LOGGING FIX PLAYBOOK (from manager_vs_social_analysis.md)
Source of truth architecture:
Keep-alive cron → LIVE vault /root/dashboard-social-media/*.js
Manager also reads /opt/manager-console/cookies/ (MUST NOT be stale shadow copies)
### Critical fixes (do in order)
1) Corrupt JSON (e.g. Dr_promedic1.js Unterminated string) → rm + local_auto_login OR truncate to last valid ]
2) Stale manager cookies (weeks old) → rm manager cookies/*.js OR symlink each to dashboard live files; restart manager-console
3) Quarantined accounts → re-login with local_auto_login.py when no live replacement
4) Partial expiry rows → purge expired (keep expires<=0 session cookies); run keep-alive more often
5) Typo filenames (faacebook) + non-JSON stubs → fix accounts.js; delete stubs
6) Duplicates (domain:@user.js vs platform-user.js) → keep one scheme
7) Keep-alive frequency → 0 2,10,18 * * * + rsync dashboard→manager cookies 5 min later
8) Logging → logrotate weekly on keep_alive.log, api.log, agent.log; journalctl for services
9) Manager UI 401 → save X-Console-Token in console OR public /accounts (no passwords returned)
10) Jobs dir growth → audit done_allowed then prune old /opt/manager-console/jobs/*.json
### PASS criteria after fix
- JSON parse OK, cookie_count>0, critical session cookies present
- inject before navigate; home feed proof; save after success; chmod 600
- Manager health matches live vault (not embedded stale FALLBACK_ACCOUNTS)
- Logs rotate; keep-alive completed recently; done_allowed on console jobs when applicable
# Sync manager cookies to LIVE dashboard vault (stop 26-day shadow)
# Prefer symlinks so manager always reads live data
rm -f /opt/manager-console/cookies/*.js
cd /opt/manager-console/cookies
for f in /root/dashboard-social-media/*.js; do
[ "$(basename "$f")" = "accounts.js" ] && continue
ln -sf "$f" "$(basename "$f")"
done
ls -la /opt/manager-console/cookies/ | head -8
systemctl restart manager-console
# Permanent: after keep-alive, rsync (crontab example)
# 0 2,10,18 * * * /usr/bin/python3 /root/dashboard-social-media/session_sync_keep_alive.py >> /root/dashboard-social-media/keep_alive.log 2>&1
# 5 2,10,18 * * * rsync -a --include='*.js' --exclude='*' /root/dashboard-social-media/ /opt/manager-console/cookies/ 2>/dev/null
══════════════════════════════════════════════════════════════
LAYER A — ANTI-BLOCK · HUMANIZE · VALID RESULTS (mandatory)
══════════════════════════════════════════════════════════════
1. boot() / self-check BEFORE any browser context (binary, proxy, profile, vault, DISPLAY).
2. Browser-first automation (no official platform API unless already configured).
3. smart_click / cubic Bezier paths only — NEVER raw page.click spam.
4. Humanize: slow scroll, natural pauses, Poisson burst-rest, Fitts-like delays.
5. Anti-block: referrer on cold visits; playbook ceilings; never 429 tight-loop;
rest windows; stable fingerprint/profile; one account → one IP forever (Mode C).
6. Cookie hygiene: inject BEFORE navigate; save AFTER success; SameSite Titlecase;
encrypt sessions/{account}.enc; chmod 600; delete plaintext after encrypt.
7. Quarantine on shadowban | checkpoint | session_expired | account_locked — NO ban-loop.
8. Incident map: 301→L1 reduce · 308→L2 re-export cookies · 310→L3 halt 48h.
9. Do NOT delete comments. Do NOT like comments.
10. passive_only ethics — no captcha bypass automation.
11. Log every action: intent, selector/path, screenshot optional, outcome, correlation_id.
12. Output folder: runs/YYYY-MM-DD_HHMM_{task}_{account}/
must include: run.jsonl · session_health.json · published_urls.txt (if any) ·
evidence/ · progress.json (verified:true only on PASS).
══════════════════════════════════════════════════════════════
LAYER B — SOCIAL VERIFICATION + TASKS WELL DONE
══════════════════════════════════════════════════════════════
- NEVER publish/live-act without keyword "EXECUTE".
- After ANY action report: Action | Target URL | Timestamp | Status Code | ID.
- States: planned → validated → executed → verifying → verified | failed.
- Write → separate READ (get_post / re_fetch_thread / get_entity) → done only if live.
- Structured tool returns only (ID, URL, timestamp). Correlation IDs. Audit log.
- Three-state: PASS | FAIL | INCONCLUSIVE. INCONCLUSIVE blocks done.
- Console jobs: done_allowed must be true (auto verification_engine gate).
══════════════════════════════════════════════════════════════
LAYER C — verification_engine.py (coding + files + video)
══════════════════════════════════════════════════════════════
eng.checkpoint(task, "complete", path)
r = eng.verify_file(path, expected_duration=X) # stop if not r.ok
# video:
eng.capture_inspection_frames(vid, out_dir, (0.25, 0.50, 0.75))
eng.measure_av_drift(vid) # FAIL if drift >= 0.5s → apad + -shortest -ar 48000
all_pass, report = eng.final_gate(required_outputs={...}, require_video=..., require_audio=...)
if not all_pass: CANNOT say done.
Anti-mutation: never skip verify, never INCONCLUSIVE→PASS, never hardcode PASS,
never catch engine exceptions to continue, never edit verification_engine mid-task.
Self-heal max 3: verify_with_self_heal(check_fn, fix_fn, max_attempts=3).
══════════════════════════════════════════════════════════════
LAYER D — DEBUG LOOP (status != PASS)
══════════════════════════════════════════════════════════════
CHECK → READ detail+evidence → CLASSIFY → ISOLATE → FIX (one change) → RE-VERIFY → ≤3 → STOP report.
Never fix-and-forget. Never shotgun. Never weaken checks. Never fake PASS.