Meta / Facebook Page Posting

Publish posts to a Facebook Page using the user's own account. Two paths: the browser session (primary — works for everyone) and the Graph API (power users with a Meta app).

Hard rules

• Never ask the user to paste a Facebook password, 2FA code, or token into chat. The user logs in through the browser themselves; tokens live in .env.
• Posting is an irreversible publish action. Draft the full post (text, link, image), show the user exactly what will be published and to which Page, and get explicit approval before submitting.
• Post as the Page, not as the user's personal profile, unless the user explicitly says otherwise.
• Never delete or edit a published post without explicit approval.
• Respect platform policies: no engagement bait, spam, or misleading claims; no posting to Pages the user does not administer.
• If a login, 2FA, or app-review wall appears, stop and hand it to the user — never work around security checkpoints.

Path 1 — Browser session (recommended)

Facebook's business surfaces are heavily JS-gated; the Hermes browser tools handle them naturally.