RMS Threads Assistant — local-first AI replies and scheduling for Threads

he core engineering problem: how do you let a local desktop app publish to a social platform on the user's behalf, without ever holding that user's access token in a place a compromised machine could leak it — while still keeping the app itself local-first for everything that isn't publishing.

The problem with client-held tokens

Most desktop integrations with a platform API store the OAuth access token directly on the client. That's simple, but it means:

• a compromised or stolen device exposes the live token;
• token refresh and revocation have to be re-implemented per client;
• there's no single point to enforce licensing or rate-limit policy across installs.

RMS Threads Assistant solves this by splitting responsibilities across two services rather than treating the desktop app as the sole owner of the integration.

Architecture of the approach

The system is split into three layers:

• Desktop app (Rust / Tauri 2) — UI, local SQLite storage, LLM calls, scheduling logic. Holds only an opaque account reference, never a Meta token.
• Edge service (`ta-media`) — owns Meta OAuth exchange, encrypted token storage and refresh, and every Graph API call (publish, search, delete, insights). The desktop app never talks to Meta directly.
• License service — gates Meta operations on trial/license status via signed install-proof, independent of the edge and desktop layers.

Each client authenticates with its own Meta Developer app credentials rather than a shared one, so no user's traffic shares another user's rate limit.

AI pipeline

Two independent pipelines run against the same underlying infrastructure:

• Replies: keyword search (via the edge) → relevance pre-filter → reply generation → safety/toxicity gate → auto-publish or manual queue.
• Original posts: composed via the Planner → optional AI generation → safety gate → enqueued into a unified `thread_chains` publish table.

Both converge on the same publish queue, so there's one code path for "publish now" and "publish later" — no separate instant-vs-scheduled branches to maintain.

Media & carousels

Images are staged locally until publish time, then uploaded through the edge with a signed install-proof header, which converts them into Meta media containers before the actual `threads_publish` call. Carousels support 2–20 images per Meta's own limits.

Rate limiting

Daily post/reply counters are tracked per account, with a mutex lock preventing race conditions between concurrent operations. Publishing automatically pauses at 80% of Meta's daily caps rather than waiting for a hard block.

Summary

RMS Threads Assistant isn't a scraper with an AI layer bolted on. It's an architecture that keeps a genuinely local-first app for everything that doesn't need to touch Meta's infrastructure, and isolates the one part that does — OAuth and publishing — into a minimal, independently auditable edge service. That split is what makes it possible to say the desktop app never holds a live Meta token, without giving up the "installs anywhere, keeps working" feel of a local-first tool.