x-developer 2.6.1 → 2.6.2

package/skills/x-twitter-scraper/references/webhooks.md

@@ -25,8 +25,12 @@ Every delivery is a `POST` request to your URL with a JSON body:
 
 ```json
 {
+  "schemaVersion": 1,
+  "streamEventId": "9010",
+  "deliveryId": "334",
   "eventType": "tweet.new",
   "username": "elonmusk",
+  "occurredAt": "2026-02-24T16:45:00.000Z",
   "data": {
     "tweetId": "1893556789012345678",
     "text": "Hello world",
@@ -37,7 +41,16 @@ Every delivery is a `POST` request to your URL with a JSON body:
 
 ## Signature Verification
 
-The `X-Xquik-Signature` header contains: `sha256=` + HMAC-SHA256(secret, raw JSON body).
+Each request contains `X-Xquik-Timestamp`, `X-Xquik-Nonce`, and
+`X-Xquik-Signature`. The signature is `sha256=` plus HMAC-SHA256 over:
+
+```text
+<timestamp>.<nonce>.<raw JSON body>
+```
+
+Reject timestamps outside a 5-minute window. Reject reused nonces within that
+window. Compare signatures in constant time before parsing JSON.
+Use an atomic shared nonce store in multi-instance deployments.
 
 ### Node.js (Standard Library)
 
@@ -47,11 +60,25 @@ import { createServer } from "node:http";
 
 // This is the per-webhook secret from the POST /webhooks response, not a Xquik account credential
 const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;
+const recentNonces = new Map();
 
-function verifySignature(payload, signature, secret) {
-  if (typeof signature !== "string" || !secret) return false;
+function claimNonce(nonce) {
+  const now = Date.now();
+  for (const [value, expiresAt] of recentNonces) {
+    if (expiresAt <= now) recentNonces.delete(value);
+  }
+  if (recentNonces.has(nonce)) return false;
+  recentNonces.set(nonce, now + 5 * 60 * 1000);
+  return true;
+}
 
-  const expected = "sha256=" + createHmac("sha256", secret).update(payload).digest("hex");
+function verifySignature(payload, signature, timestamp, nonce, secret) {
+  if (![signature, timestamp, nonce, secret].every((value) => typeof value === "string")) return false;
+  if (!/^\d+$/.test(timestamp) || !/^[0-9a-f]{32}$/.test(nonce)) return false;
+  if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60 * 1000) return false;
+
+  const input = `${timestamp}.${nonce}.${payload}`;
+  const expected = "sha256=" + createHmac("sha256", secret).update(input).digest("hex");
   const expectedBuffer = Buffer.from(expected, "utf8");
   const signatureBuffer = Buffer.from(signature, "utf8");
 
@@ -73,26 +100,25 @@ const server = createServer((req, res) => {
   req.on("end", () => {
     const payload = Buffer.concat(chunks).toString("utf8");
     const signature = req.headers["x-xquik-signature"];
+    const timestamp = req.headers["x-xquik-timestamp"];
+    const nonce = req.headers["x-xquik-nonce"];
 
-    if (!verifySignature(payload, signature, WEBHOOK_SECRET)) {
+    if (
+      !verifySignature(payload, signature, timestamp, nonce, WEBHOOK_SECRET) ||
+      !claimNonce(nonce)
+    ) {
       res.writeHead(401).end("Invalid signature");
       return;
     }
 
     const event = JSON.parse(payload);
 
-    switch (event.eventType) {
-      case "tweet.new":
-        console.log(`New tweet from @${event.username}: ${event.data.text}`);
-        break;
-      case "tweet.reply":
-        console.log(`Reply from @${event.username}: ${event.data.text}`);
-        break;
-      case "tweet.retweet":
-        console.log(`@${event.username} retweeted`);
-        break;
+    if (!["tweet.new", "tweet.reply", "tweet.retweet"].includes(event.eventType)) {
+      res.writeHead(400).end("Unsupported event type");
+      return;
     }
 
+    console.log("Accepted verified Xquik webhook");
     res.writeHead(200).end("OK");
   });
 });
@@ -106,6 +132,8 @@ server.listen(3000);
 import hmac
 import hashlib
 import json
+import re
+import time
 from http.server import BaseHTTPRequestHandler, HTTPServer
 
 def load_secret(name: str) -> str:
@@ -114,20 +142,36 @@ def load_secret(name: str) -> str:
 
 # Per-webhook secret from POST /webhooks response, not a Xquik account credential
 WEBHOOK_SECRET = load_secret("XQUIK_WEBHOOK_SECRET")
-
-def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
-    expected = "sha256=" + hmac.new(
-        secret.encode(), payload, hashlib.sha256
-    ).hexdigest()
+RECENT_NONCES: dict[str, int] = {}
+
+def claim_nonce(nonce: str) -> bool:
+    now = int(time.time() * 1000)
+    for value, expires_at in list(RECENT_NONCES.items()):
+        if expires_at <= now:
+            RECENT_NONCES.pop(value, None)
+    if nonce in RECENT_NONCES:
+        return False
+    RECENT_NONCES[nonce] = now + 5 * 60 * 1000
+    return True
+
+def verify_signature(payload: bytes, signature: str, timestamp: str, nonce: str, secret: str) -> bool:
+    if not timestamp.isdigit() or not re.fullmatch(r"[0-9a-f]{32}", nonce):
+        return False
+    if abs(int(time.time() * 1000) - int(timestamp)) > 5 * 60 * 1000:
+        return False
+    signing_input = timestamp.encode() + b"." + nonce.encode() + b"." + payload
+    expected = "sha256=" + hmac.new(secret.encode(), signing_input, hashlib.sha256).hexdigest()
     return hmac.compare_digest(expected, signature)
 
 class WebhookHandler(BaseHTTPRequestHandler):
     def do_POST(self):
         signature = self.headers.get("X-Xquik-Signature", "")
+        timestamp = self.headers.get("X-Xquik-Timestamp", "")
+        nonce = self.headers.get("X-Xquik-Nonce", "")
         length = int(self.headers.get("Content-Length", "0"))
         payload = self.rfile.read(length)
 
-        if not verify_signature(payload, signature, WEBHOOK_SECRET):
+        if not verify_signature(payload, signature, timestamp, nonce, WEBHOOK_SECRET) or not claim_nonce(nonce):
             self.send_response(401)
             self.end_headers()
             self.wfile.write(b"Invalid signature")
@@ -135,9 +179,13 @@ class WebhookHandler(BaseHTTPRequestHandler):
 
         event = json.loads(payload)
 
-        if event["eventType"] == "tweet.new":
-            print(f"New tweet from @{event['username']}: {event['data']['text']}")
+        if event.get("eventType") not in {"tweet.new", "tweet.reply", "tweet.retweet"}:
+            self.send_response(400)
+            self.end_headers()
+            self.wfile.write(b"Unsupported event type")
+            return
 
+        print("Accepted verified Xquik webhook")
         self.send_response(200)
         self.end_headers()
         self.wfile.write(b"OK")
@@ -159,13 +207,39 @@ import (
     "io"
     "net/http"
     "os"
+    "regexp"
+    "strconv"
+    "sync"
+    "time"
 )
 
 // Per-webhook secret from POST /webhooks response, not a Xquik account credential
 var webhookSecret = os.Getenv("XQUIK_WEBHOOK_SECRET")
+var recentNonces sync.Map
+
+func claimNonce(nonce string) bool {
+    now := time.Now().UnixMilli()
+    recentNonces.Range(func(key, value any) bool {
+        if value.(int64) <= now {
+            recentNonces.Delete(key)
+        }
+        return true
+    })
+    _, replayed := recentNonces.LoadOrStore(nonce, now+5*60*1000)
+    return !replayed
+}
 
-func verifySignature(payload []byte, signature, secret string) bool {
+func verifySignature(payload []byte, signature, timestamp, nonce, secret string) bool {
+    signedAt, err := strconv.ParseInt(timestamp, 10, 64)
+    if err != nil || !regexp.MustCompile(`^[0-9a-f]{32}$`).MatchString(nonce) {
+        return false
+    }
+    age := time.Now().UnixMilli() - signedAt
+    if age < -5*60*1000 || age > 5*60*1000 {
+        return false
+    }
     mac := hmac.New(sha256.New, []byte(secret))
+    mac.Write([]byte(timestamp + "." + nonce + "."))
     mac.Write(payload)
     expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
     return hmac.Equal([]byte(expected), []byte(signature))
@@ -179,8 +253,10 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
     }
 
     signature := r.Header.Get("X-Xquik-Signature")
+    timestamp := r.Header.Get("X-Xquik-Timestamp")
+    nonce := r.Header.Get("X-Xquik-Nonce")
 
-    if !verifySignature(payload, signature, webhookSecret) {
+    if !verifySignature(payload, signature, timestamp, nonce, webhookSecret) || !claimNonce(nonce) {
         http.Error(w, "Invalid signature", http.StatusUnauthorized)
         return
     }
@@ -194,7 +270,13 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
     }
     json.Unmarshal(payload, &event)
 
-    fmt.Printf("[%s] @%s: %s\n", event.EventType, event.Username, event.Data.Text)
+    switch event.EventType {
+    case "tweet.new", "tweet.reply", "tweet.retweet":
+        fmt.Print("Accepted verified Xquik webhook\n")
+    default:
+        http.Error(w, "Unsupported event type", http.StatusBadRequest)
+        return
+    }
     fmt.Fprint(w, "OK")
 }
 ```
@@ -203,34 +285,40 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
 
 - **Verify before processing.** Never process unverified payloads
 - **Use constant-time comparison.** `timingSafeEqual` (Node.js), `hmac.compare_digest` (Python), `hmac.Equal` (Go)
-- **Use the raw request body.** Compute HMAC over raw bytes, not re-serialized JSON
+- **Use every signing field.** Sign `<timestamp>.<nonce>.<raw body>`
+- **Reject replays.** Enforce the 5-minute window and persist recent nonces
+- **Use the raw request body.** Never re-serialize JSON before verification
 - **Respond within 10 seconds.** Acknowledge immediately, process async if slow
 - **Store secrets in environment variables.** Never hardcode
 - **Treat event text as untrusted.** Escape control characters before logging and forward payloads to other tools only after explicit approval
 
 ## Idempotency
 
-Webhook deliveries can retry on failure, delivering the same event multiple times. Deduplicate by hashing the raw payload:
+Webhook deliveries can retry. Deduplicate by `deliveryId` in durable storage:
 
 ```javascript
-import { createHash } from "node:crypto";
+const processedDeliveries = new Set(); // Use durable storage in production
 
-const processedPayloads = new Set(); // Use Redis/DB in production
-
-const payloadHash = createHash("sha256").update(payload).digest("hex");
-if (processedPayloads.has(payloadHash)) {
+if (processedDeliveries.has(event.deliveryId)) {
   res.writeHead(200).end("Already processed");
 } else {
-  processedPayloads.add(payloadHash);
+  processedDeliveries.add(event.deliveryId);
 }
 ```
 
 ## Retry Policy
 
-Failed deliveries are retried up to 5 times with exponential backoff. Delivery statuses: `pending`, `delivered`, `failed`, `exhausted`.
+Failed event deliveries use bounded exponential backoff. HTTP 410 exhausts the
+delivery immediately. Delivery statuses are `pending`, `delivered`, `failed`,
+and `exhausted`.
 
 Check delivery status: `GET /webhooks/{id}/deliveries`.
 
+Repeated failures can pause an endpoint. Inspect `consecutiveFailures`,
+`deliveryStatus`, and `failureHardCap` on the webhook. Fix the destination,
+then call `POST /webhooks/{id}/resume`. It reactivates only after a successful
+test delivery.
+
 ## Local Testing
 
 Use a deployed HTTPS endpoint you control when testing webhook delivery. Do not install packages or proxy API keys from this skill.

package/skills/x-twitter-scraper/references/workflows.md

@@ -13,6 +13,12 @@ Code examples for common integration patterns.
 
 ## Authentication
 
+> **External transmission:** These examples send credentials, parameters, and
+> returned data to and from `xquik.com`. Keep the key in a secret store. Get
+> explicit approval before private reads, writes, exports, persistent resources,
+> webhooks, or metered jobs. Never forward private results without separate
+> approval.
+
 ```javascript
 const apiKey = process.env.XQUIK_API_KEY;
 if (!apiKey) throw new Error("Set XQUIK_API_KEY first.");
@@ -23,11 +29,14 @@ const headers = { "x-api-key": apiKey, "Content-Type": "application/json" };
 
 ## Retry with Exponential Backoff
 
-Retry only `429` and `5xx`. Never retry `4xx` (except 429). Max 3 retries:
+Retry only idempotent requests after `429` and `5xx`. Never automatically retry
+`POST`, `PATCH`, or `DELETE`. Max 3 retries:
 
 ```javascript
 async function xquikFetch(path, options = {}) {
   const baseDelay = 1000;
+  const method = (options.method || "GET").toUpperCase();
+  const retrySafe = ["GET", "HEAD", "OPTIONS"].includes(method);
 
   for (let attempt = 0; attempt <= 3; attempt++) {
     const response = await fetch(`${BASE}${path}`, {
@@ -37,7 +46,7 @@ async function xquikFetch(path, options = {}) {
 
     if (response.ok) return response.json();
 
-    const retryable = response.status === 429 || response.status >= 500;
+    const retryable = retrySafe && (response.status === 429 || response.status >= 500);
     if (!retryable || attempt === 3) {
       const error = await response.json();
       throw new Error(`Xquik API ${response.status}: ${error.error}`);
@@ -55,7 +64,9 @@ async function xquikFetch(path, options = {}) {
 
 ## Cursor Pagination
 
-Events, draws, extractions, and extraction results use cursor-based pagination. When more results exist, the response includes `hasMore: true` and a `nextCursor` string. Pass `nextCursor` as the `after` query parameter.
+Events, draws, extractions, and extraction results use cursor-based pagination.
+When more results exist, the response includes `hasMore: true` and a
+`nextCursor` string. Pass it as `cursor`. Radar alone uses `after`.
 
 ```javascript
 async function fetchAllPages(path, dataKey) {
@@ -64,7 +75,7 @@ async function fetchAllPages(path, dataKey) {
 
   while (true) {
     const params = new URLSearchParams({ limit: "100" });
-    if (cursor) params.set("after", cursor);
+    if (cursor) params.set("cursor", cursor);
 
     const data = await xquikFetch(`${path}?${params}`);
     results.push(...data[dataKey]);
@@ -82,6 +93,10 @@ Cursors are opaque strings. Never decode or construct them manually.
 ## Complete Extraction Workflow
 
 ```javascript
+function requireExplicitApproval(scope) {
+  throw new Error(`Approval required for ${scope}. Implement the approval gate first.`);
+}
+
 // Step 1: Estimate usage before running
 const estimate = await xquikFetch("/extractions/estimate", {
   method: "POST",
@@ -97,7 +112,8 @@ if (!estimate.allowed) {
   return;
 }
 
-// Step 2: Create extraction job
+// Step 2: Create extraction job after approving this exact bounded request
+requireExplicitApproval("the bounded extraction job, usage, recipients, and retention");
 let job = await xquikFetch("/extractions", {
   method: "POST",
   body: JSON.stringify({
@@ -118,7 +134,7 @@ let cursor;
 const allResults = [];
 
 while (true) {
-  const path = `/extractions/${job.id}${cursor ? `?after=${cursor}` : ""}`;
+  const path = `/extractions/${job.id}${cursor ? `?cursor=${cursor}` : ""}`;
   const page = await xquikFetch(path);
   allResults.push(...page.results);
 
@@ -126,7 +142,8 @@ while (true) {
   cursor = page.nextCursor;
 }
 
-// Step 5: Export as CSV/JSON/MD/MD-document/PDF/TXT/XLSX (100,000 row limit; PDF 10,000)
+// Step 5: Export only after reviewing a bounded preview and approving transmission
+requireExplicitApproval("the fixed export scope, audience, storage, and retention");
 const exportUrl = `${BASE}/extractions/${job.id}/export?format=csv`;
 const csvResponse = await fetch(exportUrl, { headers });
 const csvData = await csvResponse.text();
@@ -160,7 +177,8 @@ const webhook = await xquikFetch("/webhooks", {
 const events = await xquikFetch("/events?monitorId=7&limit=50");
 ```
 
-Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `webhook.test`.
+Monitor event types include `tweet.new`, `tweet.quote`, `tweet.reply`, and
+`tweet.retweet`. Test deliveries use `webhook.test`; do not subscribe to it.
 
 ## Endpoint Guide
 
@@ -182,7 +200,7 @@ Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `webhoo
 | **Get bookmark folders** | `GET /x/bookmarks/folders` | Metered |
 | **Get notifications** | `GET /x/notifications` | Metered per result |
 | **Get home timeline** | `GET /x/timeline` | Metered per result |
-| **Get DM history** | `GET /x/dm/{userId}/history` | Metered per result |
+| **Get DM history** | `GET /x/dm/{userId}/history?account={username}` | Private; approve exact account and block ambiguity |
 | **Monitor an X account** | `POST /monitors` | Active monitors are metered hourly |
 | **Poll for events** | `GET /events` | Included |
 | **Receive events via webhook** | `POST /webhooks` | Included; confirmation required for destination URL |

package/skills/x-twitter-scraper/skill-card.md

@@ -69,7 +69,7 @@ Other properties: The skill performs no shell execution, no local file access, n
 
 ## Skill Version
 
-2.6.1
+2.6.2
 
 ## Ethical Considerations
 

package/skills/xquik-social-research/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: xquik-social-research
 description: Research public X data with Xquik. Use for tweet search, tweet lookup, user discovery, profile timelines, threads, followers, trends, exports, monitoring plans, or MCP setup. Keep public reads bounded. Require explicit approval before private reads, writes, persistent resources, or bulk jobs. Not affiliated with X Corp.
+license: MIT
 ---
 
 # Xquik Social Research

package/stub-server.mjs

@@ -12,7 +12,7 @@ import { pathToFileURL } from "node:url";
 
 const SERVER_INFO = {
   name: "xquik",
-  version: "2.6.1",
+  version: "2.6.2",
 };
 
 const CAPABILITIES = {

package/task-guides/check-mutuals.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/clean-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/export-tweets-csv.md

@@ -1,11 +1,11 @@
 ---
 name: export-tweets-csv
-description: "Use when the user wants to export X (Twitter) data to CSV, JSONL, or XLSX. Covers exporting extraction results (tweets, followers, mentions, giveaway entrants) and formatting them for spreadsheets or pipelines. Download handling only."
+description: "Use when the user wants to export X (Twitter) data to CSV, JSON, Markdown, PDF, TXT, or XLSX. Covers extraction results and giveaway entrant files. Download handling only."
 license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -26,7 +26,7 @@ metadata:
     credentialProxy: false
 ---
 
-# Export X Data to CSV/JSONL/XLSX
+# Export X Data
 
 Download completed extractions or draw entrant lists in spreadsheet-friendly formats.
 
@@ -35,7 +35,7 @@ Download completed extractions or draw entrant lists in spreadsheet-friendly for
 | Endpoint | Purpose | Usage |
 |---|---|---|
 | GET /extractions/{id}/export?format=csv | CSV export | Read tier |
-| GET /extractions/{id}/export?format=jsonl | Line-delimited JSON | Read tier |
+| GET /extractions/{id}/export?format=json | JSON export | Read tier |
 | GET /extractions/{id}/export?format=xlsx | Excel workbook | Read tier |
 | GET /draws/{id}/export?format=csv | Giveaway entrants/winners | Read tier |
 
@@ -59,7 +59,16 @@ GET /extractions/{id}/export?format=csv
 
 - CSV: broad compatibility, Excel/Sheets open directly
 - XLSX: preserves types, multiple sheets per extraction
-- JSONL: best for piping into scripts or databases
+- JSON: structured data for scripts or databases
+- Markdown, PDF, or TXT: human-readable reports
+
+## Export Filters
+
+The endpoint accepts follower, following, post, engagement, profile, media,
+language, search, and date filters. Use `minFollowers`, `maxFollowers`,
+`minFollowing`, `maxFollowing`, `minPosts`, `maxPosts`, `minLikes`,
+`minReplies`, `minRetweets`, `minViews`, `hasDescription`, `hasLocation`,
+`hasMedia`, `verified`, `lang`, `search`, `sinceDate`, and `untilDate`.
 
 ## Security
 

package/task-guides/extract-followers.md

@@ -1,11 +1,11 @@
 ---
 name: extract-followers
-description: "Use when the user wants to extract the follower list of any public X (Twitter) account. Pulls follower profiles, filters by verified status, and exports to CSV or JSONL for analysis. Read-only."
+description: "Use when the user wants to extract the follower list of any public X (Twitter) account. Pulls follower profiles, filters by verified status, and exports supported files for analysis. Read-only."
 license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/find-bangers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -44,7 +44,9 @@ Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
 1. Get a handle from the user.
 2. `GET /x/users/{id}` to get the baseline follower count and numeric `id`.
-3. Either page `GET /x/users/{id}/tweets?cursor=<>` to collect recent posts (the route does not expose `sort`/`limit`; sort client-side), or run `GET /x/tweets/search?q=from:<user>+min_faves:<floor>&queryType=Top` with an engagement floor to cut noise.
+3. Page `GET /x/users/{id}/tweets?pageSize=300&cursor=<>`, then sort
+   client-side. Continue until `has_next_page` is false. Or use Tweet Search
+   with a `minFaves` filter and `queryType=Top`.
 4. Compute engagement rate per tweet = (likes + RTs + replies) / followers.
 5. Surface tweets with engagement rate more than 3-5x the median for that author. Those are bangers.
 

package/task-guides/find-influencers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -51,15 +51,18 @@ POST /extractions
 -> 202 { "id": "<extractionId>", "toolType": "people_search", "status": "running" }
 ```
 
-The server only accepts `toolType` and `searchQuery`. Follower-count filters and verified-only shortlists happen **after** extraction, on the returned rows.
+The request also accepts profile filters. Examples include `minFollowers`,
+`maxFollowers`, `minPosts`, `minAccountAgeDays`, `verifiedType`,
+`hasWebsite`, `hasLocation`, and text-match fields. Apply them before
+estimation so excluded rows are not delivered.
 
 ## Typical flow
 
-1. Ask the user for the niche keyword and any follower-range / verified preferences (applied client-side).
+1. Ask for the niche, result bound, and profile filters.
 2. Call `POST /extractions/estimate`, show the usage estimate.
 3. On approval, `POST /extractions`.
 4. Poll `GET /extractions/{id}` until `completed`.
-5. Retrieve `GET /extractions/{id}?after=<cursor>` and filter locally by `followers_count` range and `verified` flag.
+5. Retrieve `GET /extractions/{id}?cursor=<cursor>` until `hasMore` is false.
 6. Optionally enrich the shortlist with `GET /x/users/{id}` for recency signals. The `{id}` segment accepts a username or numeric user ID.
 7. Export via `GET /extractions/{id}/export?format=csv` if raw data is needed.
 

package/task-guides/find-viral-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/follow-unfollow.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -40,13 +40,15 @@ Follow and unfollow accounts as a connected user, and check follow state.
 | GET /x/followers/check?source=<a>&target=<b> | Does A follow B? | Read tier |
 
 Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
+Every follow or unfollow needs a unique `Idempotency-Key` header.
+Direct REST callers supply it. Hosted MCP injects it automatically.
 
 ## Quick reference
 
 ```
 POST /x/users/{id}/follow
 { "account": "<connected_username>" }
--> { followed: true }
+-> XWriteAction (HTTP 200 terminal or HTTP 202 accepted)
 
 DELETE /x/users/{id}/follow
 { "account": "<connected_username>" }
@@ -59,11 +61,14 @@ For follow/unfollow, `{id}` is the numeric user ID. Resolve a @handle with `GET
 1. `GET /x/accounts` to pick the acting account.
 2. `GET /x/users/{id}` to resolve each target handle to a numeric `id`.
 3. Show the user the target handle and the acting account. Wait for approval.
-4. Call `POST /x/users/{id}/follow` to follow, or `DELETE /x/users/{id}/follow` to unfollow.
+4. Send the write. Direct REST supplies the key. Hosted MCP injects it.
+5. Poll `statusUrl` after a `202` response until `terminal` is true.
 
 ## Bulk operations
 
-If the user asks to follow or unfollow many accounts at once, list every target first, require explicit confirmation for the full list, then iterate with a short delay (1-2s) between calls to avoid rate limits. Never silently batch.
+If the user asks to follow or unfollow many accounts at once, list every target
+first and require explicit confirmation for the full list. Process serially.
+Honor `Retry-After` when returned. Never silently batch.
 
 Hard no:
 - Mass-following random accounts based on a scrape

package/task-guides/for-you-feed.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/going-viral.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:

package/task-guides/grow-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.6.1"
+  version: "2.6.2"
   openclaw:
     requires:
       env:
@@ -44,7 +44,9 @@ Base URL: `https://xquik.com/api/v1`. Auth: `x-api-key: xq_...` header.
 
 1. Ask the user for their handle.
 2. `GET /x/users/{id}` to resolve to a numeric `id` and capture the baseline follower count.
-3. Page `GET /x/users/{id}/tweets?cursor=<>` (supported parameters: `cursor`, `includeReplies`, `includeParentTweet`) until you have ~100 recent tweets.
+3. Page `GET /x/users/{id}/tweets?pageSize=100&cursor=<>`. Use
+   `includeReplies`, `includeRetweets`, or other documented filters as needed.
+   Stop only when `has_next_page` is false or 100 rows are collected.
 4. Compute: average engagement rate, best-performing format, best day/time, ratio of replies-to-posts-to-threads.
 5. Call `/styles/{id}/performance` for a server-side breakdown.
 6. Present 3-5 concrete recommendations (e.g., "Your threads get 4x the engagement of single tweets. Post 1-2 threads per week.").