# Social Channels

Broadcast / social-feed integrations. These differ from chat channels in two ways: messages are typically public, and the agent often acts as a poster rather than a bidirectional responder.

## Bluesky (AT Protocol)

```toml
[channels.bluesky]
enabled = true
handle = "you.bsky.social"
app_password = "xxxx-xxxx-xxxx-xxxx"      # create at bsky.app/settings/app-passwords
allowed_mentions = ["@trustedfriend.bsky.social"]
```

- **Auth:** Bluesky app-password (not your real password). Create one in settings.
- **Inbound:** mentions and direct messages trigger the agent. Scope with `allowed_mentions`.
- **Outbound:** 300-character posts; longer responses auto-thread.
- **Protocol:** AT Protocol via `atrium-api` crate.

## Nostr

```toml
[channels.nostr]
enabled = true
private_key_hex = "..."                   # nsec in hex
relays = [
    "wss://relay.damus.io",
    "wss://nos.lol",
    "wss://relay.primal.net",
]
allowed_pubkeys = ["npub1..."]
```

- **Auth:** raw private key. Store in the encrypted secrets backend — never in a checked-in config.
- **Inbound:** kind-1 (text), kind-4 (DM, NIP-04), and kind-1059 (gift-wrap, NIP-17).
- **Outbound:** same kinds. Zap handling is experimental.
- **Relays:** the agent connects to all listed relays; use 3–5 for reliability.

## Twitter / X

```toml
[channels.twitter]
enabled = true
api_key = "..."
api_secret = "..."
access_token = "..."
access_secret = "..."
bearer_token = "..."
```

- **Auth:** OAuth 1.0a app credentials. Requires Twitter Developer Portal access — paid tier for full API v2 access.
- **Inbound:** mentions via the Filtered Stream endpoint.
- **Outbound:** posts, replies, threads.
- **Caveat:** the free tier is rate-limited to the point of near-uselessness. Budget accordingly.

## Reddit

```toml
[channels.reddit]
enabled = true
client_id = "..."
client_secret = "..."
username = "..."
password = "..."                          # or use refresh_token
user_agent = "kylinbot-agent/0.1 by your-username"
subreddits = ["rust", "commandline"]
```

- **Auth:** OAuth 2.0 password flow or refresh token. Password flow requires a script-type app.
- **Inbound:** new posts and comments in the configured subreddits, plus replies to the agent's own posts.
- **Outbound:** posts, comments, private messages.
- **User-agent convention:** Reddit's API requires a descriptive user-agent string. Non-compliance → rate limits.

---

## Operating social channels safely

Bots on public social networks attract adversarial input. Two precautions:

1. **Restrict who the agent will respond to.** Use `allowed_mentions` / `allowed_pubkeys` / `allowed_users` to whitelist. The default empty-list behaviour varies per channel — check each.
2. **Keep autonomy level at `Supervised` or lower.** A public-facing agent in `Full` autonomy is effectively a public shell. If you want to run public-facing, disable shell tools for that channel:

```toml
[channels.bluesky]
tools_allow = ["http", "web_search"]      # whitelist — no shell, no file_write
```

## Rate limits and backoff

All social channels are subject to aggressive rate limits. KylinBot's outbound queue uses exponential backoff on 429 responses. If you hit persistent rate-limiting, lower `draft_update_interval_ms` and check whether you're accidentally editing messages (Bluesky does not support edits; others have per-operation limits).
