Scweet Files

Upgrade if you use 5.4.0 or 5.3

In those versions every search returned HTTP 404, from every account, and the library could not repair itself. If you saw 404 everywhere and suspected your accounts, the accounts were fine: a 404 from every account describes the request, not the credentials.

Fixed

• A search works again. Both bootstrap paths read https://x.com, which answers a short shell page with no main.js reference and no "ondemand.s" marker. So the manifest scrape found no bundle and kept a stale query ID, and the transaction-ID bootstrap built no x-client-transaction-id header. X answers 404 when that header is absent. Both paths now read https://x.com/home, and the six bundled query IDs are refreshed.
• A proxy URL with a {session} placeholder works on every path. The proxy check on lease, the transaction-ID bootstrap, and the cookie bootstrap from an auth_token each sent the literal text {session} as the proxy user name, and a provider answers HTTP 407 for that name. Only the account session builder replaced it.
• A locked account no longer looks like an empty page. X locks an account behind a human challenge and answers HTTP 200 with code 326 in the body. The engine now rests that account for locked_cooldown_s (1 hour) and logs the unlock page, https://x.com/account/access. Before, the account stayed in rotation and silently returned nothing.

Changed

• The daily caps per account rose: daily_requests_limit 30 → 300, daily_tweets_limit 600 → 6,000. The window limiter still bounds the burst rate to X's measured allowance of 50 requests per 15 minutes.
• search() sorts by "Latest" by default. "Top" is a ranked selection whose pages repeat: a measured 20,000-tweet Top order returned about 1,900 unique tweets. "Latest" is chronological and fills a volume order. Pass display_type="Top" for the old behaviour. Note: a resume checkpoint keys on the full query including display_type, so a resume started under the old default does not continue under the new one.
• api_http_impersonate defaults to "chrome", which follows the newest Chrome fingerprint that the installed curl_cffi supports, instead of the pinned chrome120 from December 2023.
• min_delay_s defaults to 1.0, a floor between two requests of one account, so a burst does not arrive at wire speed. Set 0 to remove it.
• The followers and following paths hold their own window budget, relationship_window_request_limit (45). X allows 50 requests per window at that endpoint and restricts an account there more easily than at a search.

Verified with a live run

Ten accounts, a real proxy, on 2026-09-09: a search of 2,000 with the Latest sort returned 2,020 tweets in 127 s; a Top search returned 260; a profile timeline returned 100; a filter combination returned 111; followers returned 500; and a search that matches nothing returned an empty list with no exception. The unit suite holds 346 tests.