Use twitter safe relay

docs/index.html

@@ -9,7 +9,7 @@
     <title>bird.fast — fast X CLI</title>
     <meta
       name="description"
-      content="bird is a fast X CLI for tweeting, replying, and reading via the X/Twitter GraphQL API (cookie auth)."
+      content="bird is a fast X CLI for tweeting, replying, and reading via the X/Twitter GraphQL API through twitter safe relay."
     />
 
     <link rel="canonical" href="https://bird.fast/" />
@@ -107,7 +107,7 @@ bird tweet "hi from bird.fast"</code></pre>
             </a>
             <a class="badge" href="https://github.com/steipete/bird#authentication-graphql">
               <span class="badge__k">auth</span>
-              <span class="badge__v">cookies</span>
+              <span class="badge__v">relay</span>
             </a>
           </div>
         </div>

docs/releasing.md

@@ -56,4 +56,4 @@ If you want a single-file binary for Homebrew/GitHub assets:
 ## Notes
 - Scoped npm name (`@steipete/bird`) requires `--access public` on first publish.
 - Homebrew formula assumes macOS universal binary; adjust URL/name if you ship per-arch.
-- Config defaults (JSON5) and Safari/Chrome/Firefox cookie selection are documented in `README.md` — keep that in sync for each release.
+- Config defaults (JSON5) and twitter safe relay setup are documented in `README.md` — keep that in sync for each release.

docs/testing.md

@@ -8,27 +8,24 @@
 Runs the CLI against real Twitter/X GraphQL endpoints to verify read-only commands still work.
 
 Requirements:
-- Auth cookies in env:
-  - `AUTH_TOKEN` (or `TWITTER_AUTH_TOKEN`)
-  - `CT0` (or `TWITTER_CT0`)
+- `TWITTER_RELAY_BASE_URL` pointing at a running twitter safe relay
 - Network access
 
 Run:
 - `pnpm test:live`
-- `pnpm bird following --all --max-pages 2 --json --cookie-source chrome --chrome-profile Default`
-- `pnpm bird list-timeline <list-id> --all --max-pages 2 --json --cookie-source chrome --chrome-profile Default`
-- `pnpm bird search "from:steipete" --all --max-pages 2 --json --cookie-source chrome --chrome-profile Default`
-- `pnpm bird home --count 5 --json --cookie-source chrome --chrome-profile Default`
-- `pnpm bird home --count 5 --following --json --cookie-source chrome --chrome-profile Default`
+- `pnpm bird following --all --max-pages 2 --json`
+- `pnpm bird list-timeline <list-id> --all --max-pages 2 --json`
+- `pnpm bird search "from:steipete" --all --max-pages 2 --json`
+- `pnpm bird home --count 5 --json`
+- `pnpm bird home --count 5 --following --json`
 
 Notes:
 - Live tests are skipped unless `BIRD_LIVE=1` (set by `pnpm test:live`).
 - Search query is configurable via `BIRD_LIVE_SEARCH_QUERY`.
 - Command timeout is configurable via `BIRD_LIVE_TIMEOUT_MS` (ms).
-- Cookie extraction timeout is configurable via `BIRD_LIVE_COOKIE_TIMEOUT_MS` (ms).
 - Spawned CLI `NODE_ENV` defaults to `production` (override with `BIRD_LIVE_NODE_ENV`).
 - If you don't tweet, set `BIRD_LIVE_TWEET_ID` to a known tweet ID to use for `read/replies/thread`.
 - Long-form article coverage: set `BIRD_LIVE_LONGFORM_TWEET_ID` to a known article tweet ID (example: `2007184284944322584` from @X; refresh by finding a tweet with `article` via `bird user-tweets X -n 20 --json`).
 - Optional: set `BIRD_LIVE_BOOKMARK_FOLDER_ID` to exercise `bookmarks --folder-id`.
 - `bird query-ids --fresh` live coverage: set `BIRD_LIVE_QUERY_IDS_FRESH=1`.
-- The live suite may hit internal X endpoints (v1.1 REST) as fallback; it still uses cookie auth (no developer API key).
+- The live suite may hit internal X endpoints (v1.1 REST) as fallback through the relay.