Build a social growth bot as a self-learning loop on top of the Graph API and you hit a wall. Follow, tapping a search result, coordinate actions — the official API won't open them. So I drove a real device instead.
It's a device, not an app
I didn't build an installable app. I drive a USB-tethered Android phone (an A15) over adb: tap screen coordinates, input text, open deeplinks. No app review, no API scope.
adb shell input tap 540 1200
adb shell am start -a android.intent.action.VIEW \
-d "https://www.threads.net/search?q=%EC%9A%B4%EC%84%B8"A few traps
- No Korean input.
adb shell input textonly takes ASCII. Korean queries go through URL-encoded deeplinks instead — you don't type the query, you open the whole search URL. - Follow via the popup. There's no follow button on a search result, so the path is: tap avatar → profile popup → follow.
- Safezone + foreground guard. Before every action, confirm the right app is in the foreground, and only burst briefly in fixed time windows so it behaves like a human.
- Hourly burst via launchd. Instead of a resident process, wake briefly each hour and handle just a few.
The start, not the end, of automation
There's a wall adb can't cross: the CAPTCHA checkpoint. Once an account trips it, a human has to clear it on that device — not remotely, not from another device. The checkpoint is device-bound, so automation can't revive the account.
So there's a circuit breaker: if one platform hits a checkpoint, a single .paused file stops that platform only while the rest keep running. The point is to stop the bot from pushing harder and burning the account further.
Why go this far
Anything the official API covers goes through the API (it's safe). adb direct-drive is only for the small actions the API never opens — at human speed, behind layers of safeguards. If automation burns an account, that's not automation, it's a loss.
Comment and repost automation are deliberately left out — the spam risk outweighs the gain. The goal isn't "more," it's "steady without burning anything."