chore(release): 0.3.0

bird is GraphQL-only; bump to 0.3.0

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.3.1 — Unreleased
+
+## 0.3.0 — 2025-12-26
+
+### Added
+- Safari cookie extraction (`Cookies.binarycookies`) + `allowSafari` config toggle.
+
+### Changed
+- Removed the Sweetistics engine + fallback. `bird` is GraphQL-only.
+- Browser cookie fallback order: Safari → Chrome → Firefox.
+
+### Tests
+- Enforce coverage thresholds (>= 70% statements/branches/functions/lines) + expand unit coverage for version/output/Twitter client branches.
+
 ## 0.2.0 — 2025-12-26
 
 ### Added

README.md

@@ -1,6 +1,6 @@
 # bird 🐦 — fast X CLI for tweeting, replying, and reading
 
-`bird` is a fast X CLI for tweeting, replying, and reading. It uses either GraphQL cookies or the Sweetistics API.
+`bird` is a fast X CLI for tweeting, replying, and reading via X/Twitter GraphQL (cookie auth).
 
 ## Install
 
@@ -10,6 +10,12 @@ npm install -g @steipete/bird
 pnpm add -g @steipete/bird
 ```
 
+Homebrew (macOS, prebuilt Bun binary):
+
+```bash
+brew install steipete/tap/bird
+```
+
 ## Quickstart
 
 ```bash
@@ -51,14 +57,6 @@ bird query-ids --fresh
 - `bird whoami` — print which Twitter account your cookies belong to.
 - `bird check` — show which credentials are available and where they were sourced from.
 
-## Engines
-
-- `--engine auto` (default) — use GraphQL first; if a Sweetistics API key is available, fall back on errors.
-- `--engine graphql` — use Twitter/X GraphQL with cookies (Chrome/Firefox/env/flags).
-- `--engine sweetistics` — use Sweetistics API key (no browser cookies needed).
-
-Note: fallback to Sweetistics only happens in `--engine auto`. `--engine graphql` is strict (no fallback).
-
 Global options:
 - `--timeout <ms>`: abort requests after the given timeout (milliseconds).
 - `--plain`: stable output (no emoji, no color).
@@ -67,15 +65,19 @@ Global options:
 
 ## Authentication (GraphQL)
 
+GraphQL mode uses your existing X/Twitter web session (no password prompt). It sends requests to internal
+X endpoints and authenticates via cookies (`auth_token`, `ct0`).
+
 `bird` resolves credentials in this order:
 
 1. CLI flags: `--auth-token`, `--ct0`
 2. Environment variables: `AUTH_TOKEN`, `CT0` (fallback: `TWITTER_AUTH_TOKEN`, `TWITTER_CT0`)
-3. Browser cookies (macOS): Firefox or Chrome profiles
+3. Browser cookies (macOS): Safari, Chrome, Firefox
 
 Browser cookie sources:
-- Firefox (default): `~/Library/Application Support/Firefox/Profiles/<profile>/cookies.sqlite`
+- Safari: `~/Library/Cookies/Cookies.binarycookies` (fallback: `~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies`)
 - Chrome: `~/Library/Application Support/Google/Chrome/<Profile>/Cookies`
+- Firefox: `~/Library/Application Support/Firefox/Profiles/<profile>/cookies.sqlite`
 
 ## Config (JSON5)
 
@@ -88,9 +90,8 @@ Example `~/.config/bird/config.json5`:
 
 ```json5
 {
-  engine: "auto",
   firefoxProfile: "default-release",
-  sweetisticsApiKey: "sweet-...",
+  allowSafari: true,
   allowFirefox: true,
   allowChrome: false,
   timeoutMs: 20000
@@ -98,8 +99,7 @@ Example `~/.config/bird/config.json5`:
 ```
 
 Environment shortcuts:
-- `SWEETISTICS_API_KEY`, `SWEETISTICS_BASE_URL`
+- `BIRD_TIMEOUT_MS`
-- `BIRD_ENGINE`, `BIRD_TIMEOUT_MS`
 
 ## Output
 
@@ -109,7 +109,23 @@ Environment shortcuts:
 
 ## Query IDs (GraphQL)
 
-X rotates GraphQL query IDs frequently. `bird` caches refreshed IDs on disk and retries automatically on 404s.
+X rotates GraphQL “query IDs” frequently. Each GraphQL operation is addressed as:
+
+- `operationName` (e.g. `TweetDetail`, `CreateTweet`)
+- `queryId` (rotating ID baked into X’s web client bundles)
+
+`bird` ships with a baseline mapping in `src/lib/query-ids.json` (copied into `dist/` on build). At runtime,
+it can refresh that mapping by scraping X’s public web client bundles and caching the result on disk.
+
+Runtime cache:
+- Default path: `~/.config/bird/query-ids-cache.json`
+- Override path: `BIRD_QUERY_IDS_CACHE=/path/to/file.json`
+- TTL: 24h (stale cache is still used, but marked “not fresh”)
+
+Auto-recovery:
+- On GraphQL `404` (query ID invalid), `bird` forces a refresh once and retries.
+- For `TweetDetail`/`SearchTimeline`, `bird` also rotates through a small set of known fallback IDs to reduce
+  breakage while refreshing.
 
 Refresh on demand:
 
@@ -124,19 +140,18 @@ Exit codes:
 
 ## Version
 
-`bird --version` prints `package.json` version plus current git sha when available, e.g. `0.2.0 (3df7969b)`.
+`bird --version` prints `package.json` version plus current git sha when available, e.g. `0.3.0 (3df7969b)`.
 
 ## Media uploads
 
 - Attach media with `--media` (repeatable) and optional `--alt` per item.
 - Up to 4 images/GIFs, or 1 video (no mixing). Supported: jpg, jpeg, png, webp, gif, mp4, mov.
-- `--engine graphql`: images/GIFs + 1 video supported (uploads via Twitter legacy upload endpoint + cookies; video may take longer to process).
+- Images/GIFs + 1 video supported (uploads via Twitter legacy upload endpoint + cookies; video may take longer to process).
-- `--engine sweetistics`: images + video supported (requires `SWEETISTICS_API_KEY`).
 
 Example:
 
 ```bash
-bird --engine sweetistics tweet "hi" --media img.png --alt "desc"
+bird tweet "hi" --media img.png --alt "desc"
 ```
 
 ## Development

docs/releasing.md

@@ -53,4 +53,4 @@ If you want a single-file binary for Homebrew/GitHub assets:
 ## Notes
 - Scoped npm name (`@steipete/bird`) requires `--access public` on first publish.
 - Homebrew formula assumes macOS universal binary; adjust URL/name if you ship per-arch.
-- Config defaults (JSON5) and Firefox/Chrome cookie selection are documented in `README.md` — keep that in sync for each release.
+- Config defaults (JSON5) and Safari/Chrome/Firefox cookie selection are documented in `README.md` — keep that in sync for each release.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steipete/bird",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "CLI tool for tweeting and replying via Twitter/X GraphQL API",
   "type": "module",
   "main": "dist/index.js",
@@ -29,7 +29,6 @@
   },
   "dependencies": {
     "commander": "^14.0.2",
-    "devalue": "^5.6.1",
     "json5": "^2.2.3",
     "kleur": "^4.1.5"
   },

pnpm-lock.yaml

@@ -11,9 +11,6 @@ importers:
       commander:
         specifier: ^14.0.2
         version: 14.0.2
-      devalue:
-        specifier: ^5.6.1
-        version: 5.6.1
       json5:
         specifier: ^2.2.3
         version: 2.2.3
@@ -469,9 +466,6 @@ packages:
       supports-color:
         optional: true
 
-  [email protected]:
-    resolution: {integrity: sha512-jDwizj+IlEZBunHcOuuFVBnIMPAEHvTsJj0BcIp94xYguLRVBcXO853px/MyIJvbVzWdsGvrRweIUWJw8hBP7A==}
-
   [email protected]:
     resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
 
@@ -1003,8 +997,6 @@ snapshots:
     dependencies:
       ms: 2.1.3
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]:

scripts/update-query-ids.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env tsx
 /**
  * Fetches current Twitter/X GraphQL query IDs from public client bundles and
- * updates src/lib/query-ids.json. Inspired by Sweetistics' extractor.
+ * updates src/lib/query-ids.json.
  */
 
 import fs from 'node:fs/promises';

src/index.ts

@@ -17,12 +17,6 @@ import JSON5 from 'json5';
 import kleur from 'kleur';
 import { resolveCliInvocation } from './lib/cli-args.js';
 import { resolveCredentials } from './lib/cookies.js';
-import {
-  type EngineMode,
-  resolveEngineMode,
-  shouldAllowSweetisticsFallback,
-  shouldUseSweetistics,
-} from './lib/engine.js';
 import { extractTweetId } from './lib/extract-tweet-id.js';
 import { mentionsQueryFromUserOption, normalizeHandle } from './lib/normalize-handle.js';
 import {
@@ -34,7 +28,6 @@ import {
   statusPrefix,
 } from './lib/output.js';
 import { runtimeQueryIds } from './lib/runtime-query-ids.js';
-import { SweetisticsClient } from './lib/sweetistics-client.js';
 import { type TweetData, TwitterClient } from './lib/twitter-client.js';
 import { getCliVersion } from './lib/version.js';
 
@@ -55,14 +48,6 @@ const collect = (value: string, previous: string[] = []) => {
 const p = (kind: Parameters<typeof statusPrefix>[0]) => statusPrefix(kind, output);
 const l = (kind: Parameters<typeof labelPrefix>[0]) => labelPrefix(kind, output);
 
-function requireSweetisticsApiKey(apiKey: string | null): string {
-  if (!apiKey) {
-    console.error(`${p('err')}Sweetistics API key missing. Set SWEETISTICS_API_KEY or pass --sweetistics-api-key.`);
-    process.exit(1);
-  }
-  return apiKey;
-}
-
 function applyOutputFromCommand(command: Command) {
   const opts = command.optsWithGlobals() as { plain?: boolean; emoji?: boolean; color?: boolean };
   output = resolveOutputConfigFromCommander(opts, process.env, isTty);
@@ -83,11 +68,9 @@ const colors = {
 };
 
 type BirdConfig = {
-  engine?: EngineMode;
   chromeProfile?: string;
   firefoxProfile?: string;
-  sweetisticsApiKey?: string;
+  allowSafari?: boolean;
-  sweetisticsBaseUrl?: string;
   allowChrome?: boolean;
   allowFirefox?: boolean;
   timeoutMs?: number;
@@ -164,17 +147,6 @@ program
   .option('--firefox-profile <name>', 'Firefox profile name for cookie extraction', config.firefoxProfile)
   .option('--media <path>', 'Attach media file (repeatable, up to 4 images or 1 video)', collect, [])
   .option('--alt <text>', 'Alt text for the corresponding --media (repeatable)', collect, [])
-  .option('--sweetistics-api-key <key>', 'Sweetistics API key (or set SWEETISTICS_API_KEY)')
-  .option(
-    '--sweetistics-base-url <url>',
-    'Sweetistics base URL',
-    config.sweetisticsBaseUrl || process.env.SWEETISTICS_BASE_URL || 'https://sweetistics.com',
-  )
-  .option(
-    '--engine <engine>',
-    'Engine: graphql | sweetistics | auto',
-    process.env.BIRD_ENGINE || config.engine || 'auto',
-  )
   .option('--timeout <ms>', 'Request timeout in milliseconds')
   .option('--plain', 'Plain output (stable, no emoji, no color)')
   .option('--no-emoji', 'Disable emoji output')
@@ -186,15 +158,6 @@ program.hook('preAction', (_thisCommand, actionCommand) => {
 
 type MediaSpec = { path: string; alt?: string; mime: string; buffer: Buffer };
 
-function resolveSweetisticsConfig(options: { sweetisticsApiKey?: string; sweetisticsBaseUrl?: string }) {
-  const apiKey =
-    options.sweetisticsApiKey || process.env.SWEETISTICS_API_KEY || process.env.SWEETISTICS_LOCALHOST_API_KEY || null;
-
-  const baseUrl = options.sweetisticsBaseUrl || process.env.SWEETISTICS_BASE_URL || 'https://sweetistics.com';
-
-  return { apiKey, baseUrl };
-}
-
 function resolveTimeoutMs(...values: Array<string | number | undefined | null>): number | undefined {
   for (const value of values) {
     if (value === undefined || value === null || value === '') continue;
@@ -354,64 +317,13 @@ program
       console.error(`${p('err')}${error instanceof Error ? error.message : String(error)}`);
       process.exit(1);
     }
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
-
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      try {
-        const client = new SweetisticsClient({
-          baseUrl: sweetistics.baseUrl,
-          apiKey: sweetistics.apiKey,
-          timeoutMs,
-        });
-        let mediaIds: string[] | undefined;
-        if (media.length > 0) {
-          const uploaded: string[] = [];
-          for (const item of media) {
-            const res = await client.uploadMedia({
-              data: item.buffer.toString('base64'),
-              mimeType: item.mime,
-              alt: item.alt,
-            });
-            if (!res.success || !res.mediaId) {
-              throw new Error(res.error ?? 'Media upload failed');
-            }
-            uploaded.push(res.mediaId);
-          }
-          mediaIds = uploaded;
-        }
-        const result = await client.tweet(text, undefined, mediaIds);
-        if (result.success) {
-          console.log(`${p('ok')}Tweet posted via Sweetistics!`);
-          if (result.tweetId) {
-            console.log(`${l('url')}https://x.com/i/status/${result.tweetId}`);
-          }
-          return;
-        }
-        console.error(`${p('err')}Sweetistics post failed: ${result.error ?? 'Unknown error'}`);
-        process.exit(1);
-      } catch (error) {
-        console.error(`${p('err')}Sweetistics error: ${error instanceof Error ? error.message : String(error)}`);
-        if (error instanceof Error && /(^|\\b)INTERNAL_ERROR(\\b|$)|An unexpected error occurred/.test(error.message)) {
-          console.error(`${p('hint')}Sweetistics media upload likely needs Twitter OAuth with \`media.write\` scope.`);
-        }
-        process.exit(1);
-      }
-    }
 
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
       allowChrome: config.allowChrome ?? true,
       allowFirefox: config.allowFirefox ?? true,
     });
@@ -449,22 +361,6 @@ program
     if (result.success) {
       console.log(`${p('ok')}Tweet posted successfully!`);
       console.log(`${l('url')}https://x.com/i/status/${result.tweetId}`);
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL tweet failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).tweet(text);
-      if (fallback.success) {
-        console.log(`${p('ok')}Tweet posted via Sweetistics (fallback)!`);
-        if (fallback.tweetId) {
-          console.log(`${l('url')}https://x.com/i/status/${fallback.tweetId}`);
-        }
-      } else {
-        console.error(`${p('err')}Failed to post tweet: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Failed to post tweet: ${result.error}`);
       process.exit(1);
@@ -487,65 +383,14 @@ program
       console.error(`${p('err')}${error instanceof Error ? error.message : String(error)}`);
       process.exit(1);
     }
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
     const tweetId = extractTweetId(tweetIdOrUrl);
 
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      try {
-        const client = new SweetisticsClient({
-          baseUrl: sweetistics.baseUrl,
-          apiKey: sweetistics.apiKey,
-          timeoutMs,
-        });
-        let mediaIds: string[] | undefined;
-        if (media.length > 0) {
-          const uploaded: string[] = [];
-          for (const item of media) {
-            const res = await client.uploadMedia({
-              data: item.buffer.toString('base64'),
-              mimeType: item.mime,
-              alt: item.alt,
-            });
-            if (!res.success || !res.mediaId) {
-              throw new Error(res.error ?? 'Media upload failed');
-            }
-            uploaded.push(res.mediaId);
-          }
-          mediaIds = uploaded;
-        }
-        const result = await client.tweet(text, tweetId, mediaIds);
-        if (result.success) {
-          console.log(`${p('ok')}Reply posted via Sweetistics!`);
-          if (result.tweetId) {
-            console.log(`${l('url')}https://x.com/i/status/${result.tweetId}`);
-          }
-          return;
-        }
-        console.error(`${p('err')}Sweetistics reply failed: ${result.error ?? 'Unknown error'}`);
-        process.exit(1);
-      } catch (error) {
-        console.error(`${p('err')}Sweetistics error: ${error instanceof Error ? error.message : String(error)}`);
-        if (error instanceof Error && /(^|\\b)INTERNAL_ERROR(\\b|$)|An unexpected error occurred/.test(error.message)) {
-          console.error(`${p('hint')}Sweetistics media upload likely needs Twitter OAuth with \`media.write\` scope.`);
-        }
-        process.exit(1);
-      }
-    }
-
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
       allowChrome: config.allowChrome ?? true,
       allowFirefox: config.allowFirefox ?? true,
     });
@@ -585,22 +430,6 @@ program
     if (result.success) {
       console.log(`${p('ok')}Reply posted successfully!`);
       console.log(`${l('url')}https://x.com/i/status/${result.tweetId}`);
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL reply failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).tweet(text, tweetId);
-      if (fallback.success) {
-        console.log(`${p('ok')}Reply posted via Sweetistics (fallback)!`);
-        if (fallback.tweetId) {
-          console.log(`${l('url')}https://x.com/i/status/${fallback.tweetId}`);
-        }
-      } else {
-        console.error(`${p('err')}Failed to post reply: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Failed to post reply: ${result.error}`);
       process.exit(1);
@@ -616,47 +445,15 @@ program
   .action(async (tweetIdOrUrl: string, cmdOpts: { json?: boolean }) => {
     const opts = program.opts();
     const timeoutMs = resolveTimeoutFromOptions(opts);
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
 
     const tweetId = extractTweetId(tweetIdOrUrl);
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      const client = new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: sweetistics.apiKey,
-        timeoutMs,
-      });
-      const result = await client.read(tweetId);
-      if (result.success && result.tweet) {
-        if (cmdOpts.json) {
-          console.log(JSON.stringify(result.tweet, null, 2));
-        } else {
-          console.log(`@${result.tweet.author.username} (${result.tweet.author.name}):`);
-          console.log(result.tweet.text);
-          if (result.tweet.createdAt) {
-            console.log(`\n${l('date')}${result.tweet.createdAt}`);
-          }
-          console.log(formatStatsLine(result.tweet, output));
-        }
-        return;
-      }
-      console.error(`${p('err')}Failed to read tweet via Sweetistics: ${result.error ?? 'Unknown error'}`);
-      process.exit(1);
-    }
 
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
       allowChrome: config.allowChrome ?? true,
       allowFirefox: config.allowFirefox ?? true,
     });
@@ -684,28 +481,6 @@ program
         }
         console.log(formatStatsLine(result.tweet, output));
       }
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL read failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).read(tweetId);
-      if (fallback.success && fallback.tweet) {
-        if (cmdOpts.json) {
-          console.log(JSON.stringify(fallback.tweet, null, 2));
-        } else {
-          console.log(`@${fallback.tweet.author.username} (${fallback.tweet.author.name}):`);
-          console.log(fallback.tweet.text);
-          if (fallback.tweet.createdAt) {
-            console.log(`\n${l('date')}${fallback.tweet.createdAt}`);
-          }
-          console.log(formatStatsLine(fallback.tweet, output));
-        }
-      } else {
-        console.error(`${p('err')}Failed to read tweet: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Failed to read tweet: ${result.error}`);
       process.exit(1);
@@ -721,37 +496,16 @@ program
   .action(async (tweetIdOrUrl: string, cmdOpts: { json?: boolean }) => {
     const opts = program.opts();
     const timeoutMs = resolveTimeoutFromOptions(opts);
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
     const tweetId = extractTweetId(tweetIdOrUrl);
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      const client = new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: sweetistics.apiKey,
-        timeoutMs,
-      });
-      const result = await client.replies(tweetId);
-      if (result.success && result.tweets) {
-        printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No replies found.' });
-        return;
-      }
-      console.error(`${p('err')}Failed to fetch replies via Sweetistics: ${result.error}`);
-      process.exit(1);
-    }
 
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
+      allowChrome: config.allowChrome ?? true,
+      allowFirefox: config.allowFirefox ?? true,
     });
 
     for (const warning of warnings) {
@@ -768,19 +522,6 @@ program
 
     if (result.success && result.tweets) {
       printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No replies found.' });
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL replies failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).replies(tweetId);
-      if (fallback.success && fallback.tweets) {
-        printTweets(fallback.tweets, { json: cmdOpts.json, emptyMessage: 'No replies found.' });
-      } else {
-        console.error(`${p('err')}Failed to fetch replies: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Failed to fetch replies: ${result.error}`);
       process.exit(1);
@@ -796,37 +537,16 @@ program
   .action(async (tweetIdOrUrl: string, cmdOpts: { json?: boolean }) => {
     const opts = program.opts();
     const timeoutMs = resolveTimeoutFromOptions(opts);
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
     const tweetId = extractTweetId(tweetIdOrUrl);
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      const client = new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: sweetistics.apiKey,
-        timeoutMs,
-      });
-      const result = await client.thread(tweetId);
-      if (result.success && result.tweets) {
-        printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No thread tweets found.' });
-        return;
-      }
-      console.error(`${p('err')}Failed to fetch thread via Sweetistics: ${result.error}`);
-      process.exit(1);
-    }
 
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
+      allowChrome: config.allowChrome ?? true,
+      allowFirefox: config.allowFirefox ?? true,
     });
 
     for (const warning of warnings) {
@@ -843,19 +563,6 @@ program
 
     if (result.success && result.tweets) {
       printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No thread tweets found.' });
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL thread failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).thread(tweetId);
-      if (fallback.success && fallback.tweets) {
-        printTweets(fallback.tweets, { json: cmdOpts.json, emptyMessage: 'No thread tweets found.' });
-      } else {
-        console.error(`${p('err')}Failed to fetch thread: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Failed to fetch thread: ${result.error}`);
       process.exit(1);
@@ -873,37 +580,15 @@ program
     const opts = program.opts();
     const timeoutMs = resolveTimeoutFromOptions(opts);
     const count = Number.parseInt(cmdOpts.count || '10', 10);
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
-
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      const client = new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: sweetistics.apiKey,
-        timeoutMs,
-      });
-      const result = await client.search(query, count);
-      if (result.success && result.tweets) {
-        printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No tweets found.' });
-        return;
-      }
-      console.error(`${p('err')}Search failed via Sweetistics: ${result.error}`);
-      process.exit(1);
-    }
 
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
+      allowChrome: config.allowChrome ?? true,
+      allowFirefox: config.allowFirefox ?? true,
     });
 
     for (const warning of warnings) {
@@ -920,19 +605,6 @@ program
 
     if (result.success && result.tweets) {
       printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No tweets found.' });
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL search failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).search(query, count);
-      if (fallback.success && fallback.tweets) {
-        printTweets(fallback.tweets, { json: cmdOpts.json, emptyMessage: 'No tweets found.' });
-      } else {
-        console.error(`${p('err')}Search failed: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Search failed: ${result.error}`);
       process.exit(1);
@@ -950,9 +622,6 @@ program
     const opts = program.opts();
     const timeoutMs = resolveTimeoutFromOptions(opts);
     const count = Number.parseInt(cmdOpts.count || '10', 10);
-    const sweetistics = resolveSweetisticsConfig(opts);
-    const engine = resolveEngineMode(opts.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
 
     const fromUserOpt = mentionsQueryFromUserOption(cmdOpts.user);
     if (fromUserOpt.error) {
@@ -962,42 +631,14 @@ program
 
     let query: string | null = fromUserOpt.query;
 
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-      const client = new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: sweetistics.apiKey,
-        timeoutMs,
-      });
-
-      if (!query) {
-        const who = await client.getCurrentUser();
-        const handle = normalizeHandle(who.user?.username);
-        if (!handle) {
-          console.error(
-            `${p('err')}Could not determine current user (${who.error ?? 'Unknown error'}). Use --user <handle>.`,
-          );
-          process.exit(1);
-        }
-        query = `@${handle}`;
-      }
-
-      const result = await client.search(query, count);
-      if (result.success && result.tweets) {
-        printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No mentions found.' });
-        return;
-      }
-      console.error(`${p('err')}Failed to fetch mentions via Sweetistics: ${result.error}`);
-      process.exit(1);
-    }
-
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile,
+      chromeProfile: opts.chromeProfile || config.chromeProfile,
+      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
+      allowChrome: config.allowChrome ?? true,
+      allowFirefox: config.allowFirefox ?? true,
     });
 
     for (const warning of warnings) {
@@ -1015,27 +656,10 @@ program
       const who = await client.getCurrentUser();
       const handle = normalizeHandle(who.user?.username);
       if (!handle) {
-        if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
+        console.error(
-          console.error(
+          `${p('err')}Could not determine current user (${who.error ?? 'Unknown error'}). Use --user <handle>.`,
-            `${p('warn')}Could not determine current user (${who.error ?? 'Unknown error'}); trying Sweetistics fallback...`,
+        );
-          );
+        process.exit(1);
-          const fallbackWho = await new SweetisticsClient({
-            baseUrl: sweetistics.baseUrl,
-            apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-            timeoutMs,
-          }).getCurrentUser();
-          const fallbackHandle = normalizeHandle(fallbackWho.user?.username);
-          if (!fallbackHandle) {
-            console.error(`${p('err')}Could not determine current user. Use --user <handle>.`);
-            process.exit(1);
-          }
-          query = `@${fallbackHandle}`;
-        } else {
-          console.error(
-            `${p('err')}Could not determine current user (${who.error ?? 'Unknown error'}). Use --user <handle>.`,
-          );
-          process.exit(1);
-        }
       } else {
         query = `@${handle}`;
       }
@@ -1045,19 +669,6 @@ program
 
     if (result.success && result.tweets) {
       printTweets(result.tweets, { json: cmdOpts.json, emptyMessage: 'No mentions found.' });
-    } else if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-      console.error(`${p('warn')}GraphQL mentions failed (${result.error}); trying Sweetistics fallback...`);
-      const fallback = await new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-        timeoutMs,
-      }).search(query, count);
-      if (fallback.success && fallback.tweets) {
-        printTweets(fallback.tweets, { json: cmdOpts.json, emptyMessage: 'No mentions found.' });
-      } else {
-        console.error(`${p('err')}Failed to fetch mentions: ${result.error} | Sweetistics fallback: ${fallback.error}`);
-        process.exit(1);
-      }
     } else {
       console.error(`${p('err')}Failed to fetch mentions: ${result.error}`);
       process.exit(1);
@@ -1071,48 +682,13 @@ program
   .action(async () => {
     const opts = program.opts();
     const timeoutMs = resolveTimeoutFromOptions(opts);
-    const sweetistics = resolveSweetisticsConfig({
-      sweetisticsApiKey: opts.sweetisticsApiKey || config.sweetisticsApiKey,
-      sweetisticsBaseUrl: opts.sweetisticsBaseUrl || config.sweetisticsBaseUrl,
-    });
-    const engine = resolveEngineMode(opts.engine || config.engine);
-    const useSweetistics = shouldUseSweetistics(engine, Boolean(sweetistics.apiKey));
-    const resolvedEngine = useSweetistics ? 'sweetistics' : 'graphql';
-    if (useSweetistics) {
-      if (!sweetistics.apiKey) {
-        console.error(`${p('err')}Sweetistics engine selected but no API key provided.`);
-        process.exit(1);
-      }
-
-      const client = new SweetisticsClient({
-        baseUrl: sweetistics.baseUrl,
-        apiKey: sweetistics.apiKey,
-        timeoutMs,
-      });
-      const result = await client.getCurrentUser();
-
-      if (result.success && result.user) {
-        const handle = result.user.username ? `@${result.user.username}` : '(no handle)';
-        const name = result.user.name || handle;
-        console.log(`${l('user')}${handle} (${name})`);
-        console.log(`${l('userId')}${result.user.id}`);
-        if (result.user.email) {
-          console.log(`${l('email')}${result.user.email}`);
-        }
-        console.log(`${l('engine')}${resolvedEngine}`);
-        console.log(`${l('credentials')}Sweetistics API key`);
-        return;
-      }
-
-      console.error(`${p('err')}Failed to determine Sweetistics user: ${result.error ?? 'Unknown error'}`);
-      process.exit(1);
-    }
 
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
       chromeProfile: opts.chromeProfile || config.chromeProfile,
       firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
       allowChrome: config.allowChrome ?? true,
       allowFirefox: config.allowFirefox ?? true,
     });
@@ -1138,29 +714,9 @@ program
     if (result.success && result.user) {
       console.log(`${l('user')}@${result.user.username} (${result.user.name})`);
       console.log(`${l('userId')}${result.user.id}`);
-      console.log(`${l('engine')}${resolvedEngine}`);
+      console.log(`${l('engine')}graphql`);
       console.log(`${l('credentials')}${credentialSource}`);
     } else {
-      // Fallback: try Sweetistics if available
-      if (shouldAllowSweetisticsFallback(engine, Boolean(sweetistics.apiKey))) {
-        const fallback = await new SweetisticsClient({
-          baseUrl: sweetistics.baseUrl,
-          apiKey: requireSweetisticsApiKey(sweetistics.apiKey),
-          timeoutMs,
-        }).getCurrentUser();
-        if (fallback.success && fallback.user) {
-          const handle = fallback.user.username ? `@${fallback.user.username}` : '(no handle)';
-          const name = fallback.user.name || handle;
-          console.log(`${l('user')}${handle} (${name})`);
-          console.log(`${l('userId')}${fallback.user.id}`);
-          if (fallback.user.email) {
-            console.log(`${l('email')}${fallback.user.email}`);
-          }
-          console.log(`${l('engine')}sweetistics (fallback)`);
-          console.log(`${l('credentials')}Sweetistics API key`);
-          return;
-        }
-      }
       console.error(`${p('err')}Failed to determine current user: ${result.error ?? 'Unknown error'}`);
       process.exit(1);
     }
@@ -1175,7 +731,11 @@ program
     const { cookies, warnings } = await resolveCredentials({
       authToken: opts.authToken,
       ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile,
+      chromeProfile: opts.chromeProfile || config.chromeProfile,
+      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+      allowSafari: config.allowSafari ?? true,
+      allowChrome: config.allowChrome ?? true,
+      allowFirefox: config.allowFirefox ?? true,
     });
 
     console.log(`${p('info')}Credential check`);
@@ -1208,7 +768,7 @@ program
       console.log(`\n${p('ok')}Ready to tweet!`);
     } else {
       console.log(`\n${p('err')}Missing credentials. Options:`);
-      console.log('   1. Login to x.com in Chrome');
+      console.log('   1. Login to x.com in Safari/Chrome/Firefox');
       console.log('   2. Set AUTH_TOKEN and CT0 environment variables');
       console.log('   3. Use --auth-token and --ct0 flags');
       process.exit(1);

src/lib/cookies.ts

@@ -1,11 +1,11 @@
 /**
- * Chrome cookie extraction for Twitter authentication
+ * Browser cookie extraction for Twitter authentication
- * Uses macOS sqlite3 CLI and keychain for decryption - no native dependencies!
+ * Uses sqlite3 CLI where possible and binarycookies parsing for Safari.
  */
 
 import { execSync } from 'node:child_process';
 import { createDecipheriv, pbkdf2Sync } from 'node:crypto';
-import { copyFileSync, existsSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -71,6 +71,158 @@ function getFirefoxCookiesPath(profile?: string): string | null {
   return pickFirefoxProfile(profilesRoot, profile);
 }
 
+function getSafariCookiesPath(): string | null {
+  if (process.platform !== 'darwin') return null;
+  const home = process.env.HOME || '';
+  const candidates = [
+    join(home, 'Library', 'Cookies', 'Cookies.binarycookies'),
+    join(home, 'Library', 'Containers', 'com.apple.Safari', 'Data', 'Library', 'Cookies', 'Cookies.binarycookies'),
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+const SAFARI_COOKIE_NAMES = new Set(['auth_token', 'ct0']);
+const SAFARI_COOKIE_DOMAINS = ['x.com', 'twitter.com'];
+const SAFARI_PAGE_SIGNATURE = Buffer.from([0x00, 0x00, 0x01, 0x00]);
+
+function matchesSafariDomain(domain: string | null): boolean {
+  if (!domain) return false;
+  const normalized = (domain.startsWith('.') ? domain.slice(1) : domain).toLowerCase();
+  return SAFARI_COOKIE_DOMAINS.some((target) => normalized === target || normalized.endsWith(`.${target}`));
+}
+
+function readSafariCString(buffer: Buffer, start: number, end: number): string | null {
+  if (start < 0 || start >= end) return null;
+  let cursor = start;
+  while (cursor < end && buffer[cursor] !== 0) cursor += 1;
+  if (cursor >= end) return null;
+  return buffer.toString('utf8', start, cursor);
+}
+
+function parseSafariCookieRecord(page: Buffer, offset: number, cookies: TwitterCookies): void {
+  if (offset < 0 || offset + 4 > page.length) return;
+  const recordSize = page.readUInt32LE(offset);
+  const recordEnd = offset + recordSize;
+  if (recordSize <= 0 || recordEnd > page.length) return;
+
+  const headerStart = offset + 4;
+  const headerSize = 4 + 4 + 4 + 4 + 4 + 4 + 4; // unknown1 + flags + unknown2 + domain + name + path + value
+  if (headerStart + headerSize > recordEnd) return;
+
+  const domainOffset = page.readUInt32LE(headerStart + 12);
+  const nameOffset = page.readUInt32LE(headerStart + 16);
+  const valueOffset = page.readUInt32LE(headerStart + 24);
+
+  const domain = readSafariCString(page, offset + domainOffset, recordEnd);
+  const name = readSafariCString(page, offset + nameOffset, recordEnd);
+  const value = readSafariCString(page, offset + valueOffset, recordEnd);
+
+  if (!name || !value || !matchesSafariDomain(domain)) return;
+  if (!SAFARI_COOKIE_NAMES.has(name)) return;
+
+  const normalizedValue = normalizeValue(value);
+  if (!normalizedValue) return;
+
+  if (name === 'auth_token' && !cookies.authToken) {
+    cookies.authToken = normalizedValue;
+  } else if (name === 'ct0' && !cookies.ct0) {
+    cookies.ct0 = normalizedValue;
+  }
+}
+
+function parseSafariCookiePage(page: Buffer, cookies: TwitterCookies): void {
+  if (page.length < 12) return;
+  if (!page.subarray(0, 4).equals(SAFARI_PAGE_SIGNATURE)) return;
+  const cookieCount = page.readUInt32LE(4);
+  if (!cookieCount) return;
+
+  const offsets: number[] = [];
+  let cursor = 8;
+  for (let i = 0; i < cookieCount; i += 1) {
+    if (cursor + 4 > page.length) return;
+    offsets.push(page.readUInt32LE(cursor));
+    cursor += 4;
+  }
+
+  for (const offset of offsets) {
+    parseSafariCookieRecord(page, offset, cookies);
+    if (cookies.authToken && cookies.ct0) return;
+  }
+}
+
+function parseSafariCookies(data: Buffer, cookies: TwitterCookies): void {
+  if (data.length < 8) return;
+  if (data.subarray(0, 4).toString('utf8') !== 'cook') return;
+  const pageCount = data.readUInt32BE(4);
+  let cursor = 8;
+  const pageSizes: number[] = [];
+  for (let i = 0; i < pageCount; i += 1) {
+    if (cursor + 4 > data.length) return;
+    pageSizes.push(data.readUInt32BE(cursor));
+    cursor += 4;
+  }
+
+  for (const pageSize of pageSizes) {
+    if (cursor + pageSize > data.length) return;
+    const page = data.subarray(cursor, cursor + pageSize);
+    parseSafariCookiePage(page, cookies);
+    if (cookies.authToken && cookies.ct0) return;
+    cursor += pageSize;
+  }
+}
+
+/**
+ * Extract Twitter cookies from Safari browser using Cookies.binarycookies
+ */
+export async function extractCookiesFromSafari(): Promise<CookieExtractionResult> {
+  const warnings: string[] = [];
+  const cookies: TwitterCookies = {
+    authToken: null,
+    ct0: null,
+    source: null,
+  };
+
+  const cookiesPath = getSafariCookiesPath();
+  if (!cookiesPath) {
+    warnings.push('Safari cookies database not found.');
+    return { cookies, warnings };
+  }
+
+  let tempDir: string | null = null;
+
+  try {
+    tempDir = mkdtempSync(join(tmpdir(), 'twitter-cli-'));
+    const tempCookiesPath = join(tempDir, 'Cookies.binarycookies');
+    copyFileSync(cookiesPath, tempCookiesPath);
+    const data = readFileSync(tempCookiesPath);
+    parseSafariCookies(data, cookies);
+
+    if (cookies.authToken || cookies.ct0) {
+      cookies.source = 'Safari';
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    warnings.push(`Failed to read Safari cookies: ${message}`);
+  } finally {
+    if (tempDir) {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+        // ignore cleanup errors
+      }
+    }
+  }
+
+  if (!cookies.authToken && !cookies.ct0) {
+    warnings.push('No Twitter cookies found in Safari. Make sure you are logged into x.com in Safari.');
+  }
+
+  return { cookies, warnings };
+}
+
 /**
  * Decrypt Chrome cookie value using macOS keychain
  * Chrome encrypts cookies with a key stored in the keychain
@@ -287,11 +439,12 @@ export async function extractCookiesFromFirefox(profile?: string): Promise<Cooki
 
 /**
  * Resolve Twitter credentials from multiple sources
- * Priority: CLI args > environment variables > Chrome cookies
+ * Priority: CLI args > environment variables > Safari > Chrome > Firefox
  */
 export async function resolveCredentials(options: {
   authToken?: string;
   ct0?: string;
+  allowSafari?: boolean;
   chromeProfile?: string;
   firefoxProfile?: string;
   allowChrome?: boolean;
@@ -340,21 +493,22 @@ export async function resolveCredentials(options: {
     }
   }
 
-  const allowFirefox = options.allowFirefox ?? true;
+  const allowSafari = options.allowSafari ?? true;
   const allowChrome = options.allowChrome ?? true;
+  const allowFirefox = options.allowFirefox ?? true;
 
-  // 3. Firefox cookies (preferred browser fallback)
+  // 3. Safari cookies (preferred browser fallback)
-  if (allowFirefox && (!cookies.authToken || !cookies.ct0)) {
+  if (allowSafari && (!cookies.authToken || !cookies.ct0)) {
-    const firefoxResult = await extractCookiesFromFirefox(options.firefoxProfile);
+    const safariResult = await extractCookiesFromSafari();
-    warnings.push(...firefoxResult.warnings);
+    warnings.push(...safariResult.warnings);
 
-    if (!cookies.authToken && firefoxResult.cookies.authToken) {
+    if (!cookies.authToken && safariResult.cookies.authToken) {
-      cookies.authToken = firefoxResult.cookies.authToken;
+      cookies.authToken = safariResult.cookies.authToken;
-      cookies.source = firefoxResult.cookies.source;
+      cookies.source = safariResult.cookies.source;
     }
-    if (!cookies.ct0 && firefoxResult.cookies.ct0) {
+    if (!cookies.ct0 && safariResult.cookies.ct0) {
-      cookies.ct0 = firefoxResult.cookies.ct0;
+      cookies.ct0 = safariResult.cookies.ct0;
-      if (!cookies.source) cookies.source = firefoxResult.cookies.source;
+      if (!cookies.source) cookies.source = safariResult.cookies.source;
     }
   }
 
@@ -373,14 +527,29 @@ export async function resolveCredentials(options: {
     }
   }
 
+  // 5. Firefox cookies (tertiary browser fallback)
+  if (allowFirefox && (!cookies.authToken || !cookies.ct0)) {
+    const firefoxResult = await extractCookiesFromFirefox(options.firefoxProfile);
+    warnings.push(...firefoxResult.warnings);
+
+    if (!cookies.authToken && firefoxResult.cookies.authToken) {
+      cookies.authToken = firefoxResult.cookies.authToken;
+      cookies.source = firefoxResult.cookies.source;
+    }
+    if (!cookies.ct0 && firefoxResult.cookies.ct0) {
+      cookies.ct0 = firefoxResult.cookies.ct0;
+      if (!cookies.source) cookies.source = firefoxResult.cookies.source;
+    }
+  }
+
   // Validation
   if (!cookies.authToken) {
     warnings.push(
-      'Missing auth_token - provide via --auth-token, AUTH_TOKEN env var, or login to x.com in Chrome/Firefox',
+      'Missing auth_token - provide via --auth-token, AUTH_TOKEN env var, or login to x.com in Safari/Chrome/Firefox',
     );
   }
   if (!cookies.ct0) {
-    warnings.push('Missing ct0 - provide via --ct0, CT0 env var, or login to x.com in Chrome/Firefox');
+    warnings.push('Missing ct0 - provide via --ct0, CT0 env var, or login to x.com in Safari/Chrome/Firefox');
   }
 
   return { cookies, warnings };

src/lib/engine.ts

@@ -1,19 +0,0 @@
-export type EngineMode = 'graphql' | 'sweetistics' | 'auto';
-
-export function resolveEngineMode(value?: string): EngineMode {
-  const normalized = (value || 'auto').toLowerCase();
-  if (normalized === 'graphql' || normalized === 'sweetistics' || normalized === 'auto') {
-    return normalized;
-  }
-  return 'auto';
-}
-
-export function shouldUseSweetistics(engine: EngineMode, _hasApiKey: boolean): boolean {
-  if (engine === 'sweetistics') return true;
-  if (engine === 'graphql') return false;
-  return false; // auto: GraphQL primary, Sweetistics only as fallback
-}
-
-export function shouldAllowSweetisticsFallback(engine: EngineMode, hasApiKey: boolean): boolean {
-  return engine === 'auto' && hasApiKey;
-}

src/lib/sweetistics-client.ts

@@ -1,537 +0,0 @@
-import { parse as devalueParse } from 'devalue';
-
-export interface SweetisticsClientOptions {
-  baseUrl: string;
-  apiKey: string;
-  userAgent?: string;
-  timeoutMs?: number;
-}
-
-export interface SweetisticsTweetResult {
-  success: boolean;
-  tweetId?: string;
-  error?: string;
-}
-
-export interface SweetisticsTweet {
-  id: string;
-  text: string;
-  author: {
-    username: string;
-    name: string;
-  };
-  createdAt?: string;
-  replyCount?: number;
-  retweetCount?: number;
-  likeCount?: number;
-  conversationId?: string;
-  inReplyToStatusId?: string;
-}
-
-export interface SweetisticsTimelineResult {
-  success: boolean;
-  tweets?: SweetisticsTweet[];
-  error?: string;
-}
-
-export interface SweetisticsReadResult {
-  success: boolean;
-  tweet?: SweetisticsTweet;
-  error?: string;
-}
-
-export interface SweetisticsUserResult {
-  success: boolean;
-  user?: {
-    id: string;
-    username?: string | null;
-    name?: string | null;
-    email?: string | null;
-    profileImageUrl?: string | null;
-  };
-  error?: string;
-}
-
-type TrpcResponseEnvelope = { result?: { data?: unknown; error?: unknown } };
-
-function normalizeBaseUrl(value: string): string {
-  const trimmed = value.trim();
-  if (!trimmed) return 'https://sweetistics.com';
-  return trimmed.endsWith('/') ? trimmed.slice(0, -1) : trimmed;
-}
-
-export class SweetisticsClient {
-  private readonly baseUrl: string;
-  private readonly apiKey: string;
-  private readonly userAgent?: string;
-  private readonly timeoutMs: number;
-  // Prevent hanging requests; keep Sweetistics calls snappy for CLI users.
-  private static readonly DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
-
-  constructor(options: SweetisticsClientOptions) {
-    this.baseUrl = normalizeBaseUrl(options.baseUrl);
-    this.apiKey = options.apiKey.trim();
-    this.userAgent = options.userAgent;
-    this.timeoutMs = options.timeoutMs ?? SweetisticsClient.DEFAULT_REQUEST_TIMEOUT_MS;
-    if (!this.apiKey) {
-      throw new Error('Sweetistics API key is required');
-    }
-  }
-
-  async tweet(text: string, replyToTweetId?: string, mediaIds?: string[]): Promise<SweetisticsTweetResult> {
-    const payload: Record<string, unknown> = { text };
-    if (replyToTweetId) {
-      payload.replyToTweetId = replyToTweetId;
-    }
-    if (mediaIds && mediaIds.length > 0) {
-      payload.mediaIds = mediaIds;
-    }
-
-    let response: Response;
-    try {
-      response = await this.fetchWithTimeout(`${this.baseUrl}/api/actions/tweet`, {
-        method: 'POST',
-        headers: {
-          authorization: `Bearer ${this.apiKey}`,
-          'content-type': 'application/json',
-          ...(this.userAgent ? { 'user-agent': this.userAgent } : {}),
-        },
-        body: JSON.stringify(payload),
-      });
-    } catch (error) {
-      return { success: false, error: this.normalizeError(error) };
-    }
-
-    let data: unknown;
-    try {
-      data = await response.json();
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response parse failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    const success =
-      typeof (data as { success?: unknown })?.success === 'boolean' ? (data as { success: boolean }).success : false;
-    const tweetId =
-      typeof (data as { tweetId?: unknown })?.tweetId === 'string' ? (data as { tweetId?: string }).tweetId : undefined;
-    const errorMessage =
-      typeof (data as { error?: unknown })?.error === 'string' ? (data as { error?: string }).error : undefined;
-
-    if (!response.ok || !success) {
-      const reason = errorMessage || `HTTP ${response.status}`;
-      return { success: false, error: reason };
-    }
-
-    return { success: true, tweetId };
-  }
-
-  async read(tweetId: string): Promise<SweetisticsReadResult> {
-    // Public REST route that returns a single tweet record
-    const url = `${this.baseUrl}/api/tweets/${encodeURIComponent(tweetId)}`;
-    let response: Response;
-    try {
-      response = await this.fetchWithTimeout(url, {
-        headers: {
-          authorization: `Bearer ${this.apiKey}`,
-          ...(this.userAgent ? { 'user-agent': this.userAgent } : {}),
-        },
-      });
-    } catch (error) {
-      return { success: false, error: this.normalizeError(error) };
-    }
-
-    if (!response.ok) {
-      return { success: false, error: `HTTP ${response.status}` };
-    }
-
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    let data: any;
-    try {
-      data = await response.json();
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response parse failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    if (!data?.id || !data?.author) {
-      return { success: false, error: 'Malformed tweet payload from Sweetistics' };
-    }
-
-    const tweet: SweetisticsTweet = {
-      id: String(data.id),
-      text: String(data.text ?? ''),
-      author: {
-        username: String(data.author.username ?? ''),
-        name: String(data.author.name ?? ''),
-      },
-      createdAt: data.createdAt,
-      replyCount: data.metrics?.replyCount,
-      retweetCount: data.metrics?.retweetCount,
-      likeCount: data.metrics?.likeCount,
-      conversationId: data.conversationId,
-      // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-      inReplyToStatusId: data.referencedTweets?.find?.((r: any) => r?.type === 'replied_to')?.id,
-    };
-
-    return { success: true, tweet };
-  }
-
-  async replies(tweetId: string): Promise<SweetisticsTimelineResult> {
-    return this.fetchConversation(tweetId, { excludeRoot: true });
-  }
-
-  async thread(tweetId: string): Promise<SweetisticsTimelineResult> {
-    return this.fetchConversation(tweetId, { excludeRoot: false });
-  }
-
-  async search(query: string, count: number): Promise<SweetisticsTimelineResult> {
-    const payload = {
-      query,
-      capabilities: [
-        {
-          resource: 'tweets',
-          source: 'postgres',
-          limit: Math.max(1, Math.min(count, 50)),
-          offset: 0,
-          detail: 'summary',
-          includeRetweets: true,
-        },
-      ],
-    };
-
-    let response: Response;
-    try {
-      response = await this.fetchWithTimeout(`${this.baseUrl}/api/trpc/search.execute?batch=1`, {
-        method: 'POST',
-        headers: {
-          authorization: `Bearer ${this.apiKey}`,
-          'content-type': 'application/json',
-          ...(this.userAgent ? { 'user-agent': this.userAgent } : {}),
-        },
-        body: JSON.stringify({ 0: { json: payload } }),
-      });
-    } catch (error) {
-      return { success: false, error: this.normalizeError(error) };
-    }
-
-    if (!response.ok) {
-      return { success: false, error: `HTTP ${response.status}` };
-    }
-
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    let body: any;
-    try {
-      body = await response.json();
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response parse failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    const envelope = Array.isArray(body) ? body[0] : body;
-    if (envelope?.error) {
-      const message = envelope.error?.message ?? 'Unknown search error';
-      return { success: false, error: message };
-    }
-    const dataField = envelope?.result?.data;
-    if (!dataField) {
-      return { success: false, error: 'Missing data in Sweetistics search response' };
-    }
-
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    let parsed: any;
-    try {
-      parsed = typeof dataField === 'string' ? devalueParse(dataField) : dataField;
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics search decode failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    const tweetsSection = parsed?.tweets;
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    const items: any[] = tweetsSection?.items ?? [];
-    if (items.length === 0) {
-      return { success: true, tweets: [] };
-    }
-
-    const tweets: SweetisticsTweet[] = items.map((item) => {
-      const authorUsername = item.authorUsername || item.username || item.full?.author?.username || '';
-      const authorName = item.authorName || item.full?.author?.name || authorUsername;
-      const createdAt =
-        typeof item.createdAt === 'string'
-          ? item.createdAt
-          : (item.createdAt?.toString?.() ??
-            (Array.isArray(item.createdAt) && item.createdAt[0] === 'Date' ? item.createdAt[1] : undefined));
-      const metrics = item.full?.metrics ?? item.full ?? item;
-
-      return {
-        id: String(item.id),
-        text: String(item.text ?? item.full?.text ?? ''),
-        author: { username: String(authorUsername), name: String(authorName) },
-        createdAt,
-        replyCount: metrics?.replyCount ?? metrics?.replies ?? 0,
-        retweetCount: metrics?.retweetCount ?? metrics?.retweets ?? 0,
-        likeCount: metrics?.likeCount ?? metrics?.likes ?? 0,
-        conversationId: item.conversationId ?? item.full?.conversationId,
-        inReplyToStatusId: item.full?.inReplyToStatusId ?? undefined,
-      };
-    });
-
-    return { success: true, tweets };
-  }
-
-  async getCurrentUser(): Promise<SweetisticsUserResult> {
-    const headers = {
-      authorization: `Bearer ${this.apiKey}`,
-      'content-type': 'application/json',
-      ...(this.userAgent ? { 'user-agent': this.userAgent } : {}),
-    } satisfies Record<string, string>;
-
-    let response: Response;
-    try {
-      response = await this.fetchWithTimeout(`${this.baseUrl}/api/trpc/user.getCurrent?batch=1`, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify({ 0: { json: null } }),
-      });
-    } catch (error) {
-      return { success: false, error: this.normalizeError(error) };
-    }
-
-    // Some deployments only allow GET for queries; fall back if POST is not allowed
-    if (response.status === 405) {
-      try {
-        response = await this.fetchWithTimeout(
-          `${this.baseUrl}/api/trpc/user.getCurrent?input=${encodeURIComponent('null')}`,
-          {
-            method: 'GET',
-            headers,
-          },
-        );
-      } catch (error) {
-        return { success: false, error: this.normalizeError(error) };
-      }
-    }
-
-    if (!response.ok) {
-      return { success: false, error: `HTTP ${response.status}` };
-    }
-
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    let body: any;
-    try {
-      body = await response.json();
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response parse failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    const envelope = Array.isArray(body) ? body[0] : body;
-    const maybeError = envelope?.error?.message || envelope?.result?.error?.message;
-    if (maybeError) {
-      return { success: false, error: String(maybeError) };
-    }
-
-    let data = envelope?.result?.data?.json ?? envelope?.result?.data ?? envelope?.json ?? envelope;
-
-    try {
-      if (typeof data === 'string') {
-        data = devalueParse(data);
-      } else if (data && typeof data === 'object' && 'json' in (data as Record<string, unknown>)) {
-        const inner = (data as Record<string, unknown>).json;
-        data = typeof inner === 'string' ? devalueParse(inner) : inner;
-      }
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response decode failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    const user = data && typeof data === 'object' ? data : null;
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    if (!user || typeof (user as any).id !== 'string') {
-      return { success: false, error: 'Malformed user payload from Sweetistics' };
-    }
-
-    return {
-      success: true,
-      user: {
-        // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-        id: String((user as any).id),
-        username:
-          // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-          (user as any).username ?? (user as any).twitterUsername ?? null,
-        // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-        name: (user as any).name ?? null,
-        // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-        email: (user as any).email ?? null,
-        // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-        profileImageUrl: (user as any).profileImageUrl ?? null,
-      },
-    };
-  }
-
-  private async fetchConversation(
-    tweetId: string,
-    options: { excludeRoot: boolean; force?: boolean } = { excludeRoot: false, force: true },
-  ): Promise<SweetisticsTimelineResult> {
-    const url = new URL(`${this.baseUrl}/api/trpc/tweets.getConversation`);
-    const input: Record<string, unknown> = { tweetId };
-    // Always request a fresh conversation to avoid cached Sweetistics data unless explicitly disabled
-    if (options.force ?? true) {
-      input.force = 'true';
-    }
-    url.searchParams.set('input', JSON.stringify(input));
-
-    let response: Response;
-    try {
-      response = await this.fetchWithTimeout(url.toString(), {
-        headers: {
-          authorization: `Bearer ${this.apiKey}`,
-          ...(this.userAgent ? { 'user-agent': this.userAgent } : {}),
-        },
-      });
-    } catch (error) {
-      return { success: false, error: this.normalizeError(error) };
-    }
-
-    if (!response.ok) {
-      return { success: false, error: `HTTP ${response.status}` };
-    }
-
-    let envelope: TrpcResponseEnvelope;
-    try {
-      envelope = (await response.json()) as TrpcResponseEnvelope;
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response parse failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    if (!envelope?.result?.data) {
-      return { success: false, error: 'Missing data in Sweetistics response' };
-    }
-
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    let parsed: any;
-    try {
-      const raw =
-        typeof envelope.result.data === 'string' ? devalueParse(envelope.result.data as string) : envelope.result.data;
-      parsed = raw;
-    } catch (error) {
-      return {
-        success: false,
-        error: `Sweetistics response decode failed: ${error instanceof Error ? error.message : String(error)}`,
-      };
-    }
-
-    const tweetIds: string[] = Array.isArray(parsed?.tweetIds) ? parsed.tweetIds.map(String) : [];
-    // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-    const tweetsMap: Record<string, any> = parsed?.tweets ?? {};
-
-    if (tweetIds.length === 0 || Object.keys(tweetsMap).length === 0) {
-      return { success: false, error: 'Conversation empty or unavailable' };
-    }
-
-    const rootId = tweetId;
-    const filteredIds = options.excludeRoot ? tweetIds.filter((id) => id !== rootId) : tweetIds;
-
-    const tweets: SweetisticsTweet[] = filteredIds
-      .map((id) => tweetsMap[id])
-      .filter(Boolean)
-      // biome-ignore lint/suspicious/noExplicitAny: Sweetistics responses are loosely typed
-      .map((item: any) => ({
-        id: String(item.id),
-        text: String(item.text ?? ''),
-        author: {
-          username: String(item.author?.username ?? ''),
-          name: String(item.author?.name ?? ''),
-        },
-        createdAt: item.createdAt ?? item.timestamp ?? undefined,
-        replyCount: item.replyCount ?? item.metrics?.replyCount,
-        retweetCount: item.retweetCount ?? item.metrics?.retweetCount,
-        likeCount: item.likeCount ?? item.metrics?.likeCount,
-        conversationId: item.conversationId ?? undefined,
-        inReplyToStatusId: item.inReplyToStatusId ?? undefined,
-      }));
-
-    return { success: true, tweets };
-  }
-
-  async uploadMedia(input: {
-    data: string;
-    mimeType: string;
-    alt?: string;
-  }): Promise<{ success: boolean; mediaId?: string; error?: string }> {
-    try {
-      const response = await this.fetchWithTimeout(`${this.baseUrl}/api/actions/media/upload`, {
-        method: 'POST',
-        headers: {
-          authorization: `Bearer ${this.apiKey}`,
-          'content-type': 'application/json',
-          ...(this.userAgent ? { 'user-agent': this.userAgent } : {}),
-        },
-        body: JSON.stringify(input),
-      });
-
-      let body: unknown;
-      try {
-        body = await response.json();
-      } catch (error) {
-        return { success: false, error: this.normalizeError(error) };
-      }
-
-      const mediaId =
-        typeof (body as { mediaId?: unknown })?.mediaId === 'string'
-          ? (body as { mediaId: string }).mediaId
-          : undefined;
-      const errorMessage =
-        typeof (body as { error?: unknown })?.error === 'string' ? (body as { error: string }).error : undefined;
-      const errorCode =
-        typeof (body as { code?: unknown })?.code === 'string' ? (body as { code: string }).code : undefined;
-
-      if (!response.ok || !mediaId) {
-        const details = [errorCode, errorMessage].filter(Boolean).join(': ');
-        return { success: false, error: details.length > 0 ? details : `HTTP ${response.status}` };
-      }
-      return { success: true, mediaId };
-    } catch (error) {
-      return { success: false, error: this.normalizeError(error) };
-    }
-  }
-
-  private async fetchWithTimeout(url: string, init?: RequestInit): Promise<Response> {
-    const controller = new AbortController();
-    const timeoutId = setTimeout(
-      () => controller.abort(new Error(`Request timed out after ${this.timeoutMs}ms`)),
-      this.timeoutMs,
-    );
-
-    try {
-      return await fetch(url, { ...init, signal: controller.signal });
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  }
-
-  private normalizeError(error: unknown): string {
-    if (error instanceof Error) {
-      if ((error as { name?: string }).name === 'AbortError') {
-        return 'Request timed out';
-      }
-      return error.message;
-    }
-    return String(error);
-  }
-}

tests/cli-args.test.ts

@@ -45,15 +45,8 @@ describe('cli-args', () => {
   });
 
   it('preserves leading options before inferred read command', () => {
-    const result = resolveCliInvocation(['--engine', 'sweetistics', 'https://x.com/user/status/1234567890'], known);
+    const result = resolveCliInvocation(['--plain', 'https://x.com/user/status/1234567890'], known);
-    expect(result.argv).toEqual([
+    expect(result.argv).toEqual(['node', 'bird', '--plain', 'read', 'https://x.com/user/status/1234567890']);
-      'node',
-      'bird',
-      '--engine',
-      'sweetistics',
-      'read',
-      'https://x.com/user/status/1234567890',
-    ]);
   });
 
   it('does not rewrite when a known command is provided', () => {

tests/cookies.test.ts

@@ -14,10 +14,78 @@ vi.mock('node:fs', () => {
     copyFileSync: vi.fn(),
     mkdtempSync: vi.fn(() => '/tmp/test-dir'),
     readdirSync: vi.fn(() => []),
+    readFileSync: vi.fn(() => Buffer.alloc(0)),
     rmSync: vi.fn(),
   };
 });
 
+const itIfDarwin = process.platform === 'darwin' ? it : it.skip;
+
+function buildSafariCookieRecord(input: { domain: string; name: string; value: string; path?: string }): Buffer {
+  const domain = Buffer.from(input.domain, 'utf8');
+  const name = Buffer.from(input.name, 'utf8');
+  const path = Buffer.from(input.path ?? '/', 'utf8');
+  const value = Buffer.from(input.value, 'utf8');
+
+  const headerSize = 56;
+  const domainOffset = headerSize;
+  const nameOffset = domainOffset + domain.length + 1;
+  const pathOffset = nameOffset + name.length + 1;
+  const valueOffset = pathOffset + path.length + 1;
+  const recordSize = valueOffset + value.length + 1;
+
+  const record = Buffer.alloc(recordSize);
+  record.writeUInt32LE(recordSize, 0);
+  record.writeUInt32LE(0, 4);
+  record.writeUInt32LE(0, 8);
+  record.writeUInt32LE(0, 12);
+  record.writeUInt32LE(domainOffset, 16);
+  record.writeUInt32LE(nameOffset, 20);
+  record.writeUInt32LE(pathOffset, 24);
+  record.writeUInt32LE(valueOffset, 28);
+
+  domain.copy(record, domainOffset);
+  record[domainOffset + domain.length] = 0;
+  name.copy(record, nameOffset);
+  record[nameOffset + name.length] = 0;
+  path.copy(record, pathOffset);
+  record[pathOffset + path.length] = 0;
+  value.copy(record, valueOffset);
+  record[valueOffset + value.length] = 0;
+
+  return record;
+}
+
+function buildSafariCookiesFile(records: Buffer[]): Buffer {
+  const cookieCount = records.length;
+  const headerSize = 4 + 4 + 4 * cookieCount + 4;
+  const offsets: number[] = [];
+  let cursor = headerSize;
+  for (const record of records) {
+    offsets.push(cursor);
+    cursor += record.length;
+  }
+
+  const pageSize = cursor;
+  const page = Buffer.alloc(pageSize);
+  page.writeUInt32BE(0x00000100, 0);
+  page.writeUInt32LE(cookieCount, 4);
+  offsets.forEach((offset, index) => {
+    page.writeUInt32LE(offset, 8 + index * 4);
+  });
+  page.writeUInt32LE(0, 8 + cookieCount * 4);
+  offsets.forEach((offset, index) => {
+    records[index].copy(page, offset);
+  });
+
+  const header = Buffer.alloc(12);
+  header.write('cook', 0, 'ascii');
+  header.writeUInt32BE(1, 4);
+  header.writeUInt32BE(pageSize, 8);
+
+  return Buffer.concat([header, page]);
+}
+
 describe('cookies', () => {
   const originalEnv = process.env;
 
@@ -135,10 +203,10 @@ describe('cookies', () => {
       const result = await resolveCredentials({ allowFirefox: false, allowChrome: false });
 
       expect(result.warnings).toContain(
-        'Missing auth_token - provide via --auth-token, AUTH_TOKEN env var, or login to x.com in Chrome/Firefox',
+        'Missing auth_token - provide via --auth-token, AUTH_TOKEN env var, or login to x.com in Safari/Chrome/Firefox',
       );
       expect(result.warnings).toContain(
-        'Missing ct0 - provide via --ct0, CT0 env var, or login to x.com in Chrome/Firefox',
+        'Missing ct0 - provide via --ct0, CT0 env var, or login to x.com in Safari/Chrome/Firefox',
       );
     });
 
@@ -155,7 +223,12 @@ describe('cookies', () => {
       });
 
       const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({ allowFirefox: false, allowChrome: true, chromeProfile: 'Default' });
+      const result = await resolveCredentials({
+        allowSafari: false,
+        allowFirefox: false,
+        allowChrome: true,
+        chromeProfile: 'Default',
+      });
 
       expect(result.cookies.authToken).toBe('test_auth');
       expect(result.cookies.ct0).toBe('test_ct0');
@@ -163,6 +236,55 @@ describe('cookies', () => {
     });
   });
 
+  describe('extractCookiesFromSafari', () => {
+    itIfDarwin('returns cookies from Safari binarycookies', async () => {
+      const fs = await import('node:fs');
+      (fs.existsSync as unknown as vi.Mock).mockImplementation((path: string) =>
+        path.toLowerCase().endsWith('cookies.binarycookies'),
+      );
+      (fs.copyFileSync as unknown as vi.Mock).mockImplementation(() => {});
+      (fs.mkdtempSync as unknown as vi.Mock).mockReturnValue('/tmp/test-dir');
+      (fs.readFileSync as unknown as vi.Mock).mockReturnValue(
+        buildSafariCookiesFile([
+          buildSafariCookieRecord({ domain: '.x.com', name: 'auth_token', value: 'safari_auth' }),
+          buildSafariCookieRecord({ domain: '.x.com', name: 'ct0', value: 'safari_ct0' }),
+        ]),
+      );
+
+      const { extractCookiesFromSafari } = await import('../src/lib/cookies.js');
+      const result = await extractCookiesFromSafari();
+
+      expect(result.cookies.authToken).toBe('safari_auth');
+      expect(result.cookies.ct0).toBe('safari_ct0');
+      expect(result.cookies.source).toBe('Safari');
+    });
+
+    itIfDarwin('prefers Safari over Chrome when both are available', async () => {
+      const fs = await import('node:fs');
+
+      (fs.existsSync as unknown as vi.Mock).mockImplementation((path: string) => {
+        const lower = path.toLowerCase();
+        if (lower.endsWith('cookies.binarycookies')) return true;
+        if (lower.includes('chrome') && lower.endsWith('cookies')) return true;
+        return false;
+      });
+      (fs.copyFileSync as unknown as vi.Mock).mockImplementation(() => {});
+      (fs.mkdtempSync as unknown as vi.Mock).mockReturnValue('/tmp/test-dir');
+      (fs.readFileSync as unknown as vi.Mock).mockReturnValue(
+        buildSafariCookiesFile([
+          buildSafariCookieRecord({ domain: '.x.com', name: 'auth_token', value: 'safari_auth' }),
+          buildSafariCookieRecord({ domain: '.x.com', name: 'ct0', value: 'safari_ct0' }),
+        ]),
+      );
+
+      const { resolveCredentials } = await import('../src/lib/cookies.js');
+      const result = await resolveCredentials({ allowSafari: true, allowChrome: true, allowFirefox: false });
+
+      expect(result.cookies.authToken).toBe('safari_auth');
+      expect(result.cookies.ct0).toBe('safari_ct0');
+    });
+  });
+
   describe('extractCookiesFromChrome', () => {
     it('returns cookies when sqlite yields hex values', async () => {
       const fs = await import('node:fs');

tests/engine.test.ts

@@ -1,29 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { resolveEngineMode, shouldAllowSweetisticsFallback, shouldUseSweetistics } from '../src/lib/engine.js';
-
-describe('engine', () => {
-  it('normalizes engine values and defaults to auto', () => {
-    expect(resolveEngineMode()).toBe('auto');
-    expect(resolveEngineMode('graphql')).toBe('graphql');
-    expect(resolveEngineMode('sweetistics')).toBe('sweetistics');
-    expect(resolveEngineMode('AUTO')).toBe('auto');
-    expect(resolveEngineMode('nope')).toBe('auto');
-  });
-
-  it('uses GraphQL as primary in auto mode', () => {
-    expect(shouldUseSweetistics('auto', false)).toBe(false);
-    expect(shouldUseSweetistics('auto', true)).toBe(false);
-  });
-
-  it('forces engine selection when explicitly set', () => {
-    expect(shouldUseSweetistics('sweetistics', false)).toBe(true);
-    expect(shouldUseSweetistics('graphql', true)).toBe(false);
-  });
-
-  it('only allows Sweetistics fallback in auto mode', () => {
-    expect(shouldAllowSweetisticsFallback('auto', true)).toBe(true);
-    expect(shouldAllowSweetisticsFallback('auto', false)).toBe(false);
-    expect(shouldAllowSweetisticsFallback('graphql', true)).toBe(false);
-    expect(shouldAllowSweetisticsFallback('sweetistics', true)).toBe(false);
-  });
-});

tests/output.test.ts

@@ -1,7 +1,18 @@
 import { describe, expect, it } from 'vitest';
-import { labelPrefix, resolveOutputConfigFromArgv, statusPrefix } from '../src/lib/output.js';
+import {
+  formatStatsLine,
+  labelPrefix,
+  resolveOutputConfigFromArgv,
+  resolveOutputConfigFromCommander,
+  statusPrefix,
+} from '../src/lib/output.js';
 
 describe('output', () => {
+  it('defaults to emoji + color on TTY', () => {
+    const cfg = resolveOutputConfigFromArgv([], {}, true);
+    expect(cfg).toEqual({ plain: false, emoji: true, color: true });
+  });
+
   it('plain disables emoji + color', () => {
     const cfg = resolveOutputConfigFromArgv(['--plain'], {}, true);
     expect(cfg).toEqual({ plain: true, emoji: false, color: false });
@@ -14,9 +25,41 @@ describe('output', () => {
     expect(cfg.color).toBe(false);
   });
 
+  it('TERM=dumb disables colors by default', () => {
+    const cfg = resolveOutputConfigFromArgv([], { TERM: 'dumb' }, true);
+    expect(cfg.color).toBe(false);
+  });
+
+  it('--no-color disables colors', () => {
+    const cfg = resolveOutputConfigFromArgv(['--no-color'], {}, true);
+    expect(cfg).toEqual({ plain: false, emoji: true, color: false });
+  });
+
   it('--no-emoji switches to text prefixes', () => {
     const cfg = resolveOutputConfigFromArgv(['--no-emoji'], {}, true);
     expect(cfg.emoji).toBe(false);
     expect(statusPrefix('warn', cfg)).toBe('Warning: ');
   });
+
+  it('commander opts override defaults', () => {
+    const cfg = resolveOutputConfigFromCommander({ emoji: false, color: false }, {}, true);
+    expect(cfg).toEqual({ plain: false, emoji: false, color: false });
+    expect(statusPrefix('info', cfg)).toBe('Info: ');
+    expect(labelPrefix('date', cfg)).toBe('Date: ');
+  });
+
+  it('commander plain wins over emoji/color', () => {
+    const cfg = resolveOutputConfigFromCommander({ plain: true, emoji: true, color: true }, {}, true);
+    expect(cfg).toEqual({ plain: true, emoji: false, color: false });
+  });
+
+  it('formats stats line for all modes', () => {
+    const stats = { likeCount: null, retweetCount: undefined, replyCount: 2 };
+
+    expect(formatStatsLine(stats, { plain: true, emoji: false, color: false })).toBe(
+      'likes: 0  retweets: 0  replies: 2',
+    );
+    expect(formatStatsLine(stats, { plain: false, emoji: false, color: false })).toBe('Likes 0  Retweets 0  Replies 2');
+    expect(formatStatsLine(stats, { plain: false, emoji: true, color: false })).toBe('❤️ 0  🔁 0  💬 2');
+  });
 });

tests/sweetistics-client.test.ts

@@ -1,277 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { SweetisticsClient } from '../src/lib/sweetistics-client.js';
-
-describe('SweetisticsClient', () => {
-  const originalFetch = globalThis.fetch;
-
-  beforeEach(() => {
-    vi.resetAllMocks();
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-  });
-
-  it('posts tweet with bearer token and reply id', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({ success: true, tweetId: '123' }),
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.tweet('hello world', '456');
-
-    expect(result.success).toBe(true);
-    expect(result.tweetId).toBe('123');
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe('https://api.example.com/api/actions/tweet');
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer sweet-test' });
-    expect(JSON.parse((init as RequestInit).body as string)).toEqual({ text: 'hello world', replyToTweetId: '456' });
-  });
-
-  it('returns error when API responds with failure', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: false,
-      status: 401,
-      json: async () => ({ success: false, error: 'Unauthorized' }),
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.tweet('test');
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain('Unauthorized');
-  });
-
-  it('uploads media and passes mediaIds into tweet', async () => {
-    const fetchMock = vi
-      .fn()
-      // upload
-      .mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        json: async () => ({ mediaId: 'mid-1' }),
-      })
-      // tweet
-      .mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        json: async () => ({ success: true, tweetId: '789' }),
-      });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const uploadRes = await client.uploadMedia({ data: 'Zm9v', mimeType: 'image/png', alt: 'foo' });
-    expect(uploadRes.success).toBe(true);
-    expect(uploadRes.mediaId).toBe('mid-1');
-
-    const tweetRes = await client.tweet('hi', undefined, ['mid-1']);
-    expect(tweetRes.success).toBe(true);
-
-    // First call: upload; second call: tweet with mediaIds
-    const [, tweetInit] = fetchMock.mock.calls[1];
-    expect(JSON.parse((tweetInit as RequestInit).body as string)).toMatchObject({ mediaIds: ['mid-1'] });
-  });
-
-  it('reads a tweet', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({
-        id: '1',
-        text: 'hi',
-        author: { username: 'u', name: 'User' },
-        metrics: { likeCount: 5 },
-      }),
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.read('1');
-
-    expect(result.success).toBe(true);
-    expect(result.tweet?.id).toBe('1');
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe('https://api.example.com/api/tweets/1');
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer sweet-test' });
-  });
-
-  it('fetches replies', async () => {
-    const conversationPayload = {
-      tweetIds: ['1', '2'],
-      tweets: {
-        1: {
-          id: '1',
-          text: 'root',
-          author: { username: 'root', name: 'Root' },
-          conversationId: 'c1',
-        },
-        2: {
-          id: '2',
-          text: 'reply',
-          author: { username: 'reply', name: 'Reply' },
-          conversationId: 'c1',
-          inReplyToStatusId: '1',
-        },
-      },
-    };
-
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({
-        result: { data: conversationPayload },
-      }),
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.replies('1');
-
-    expect(result.success).toBe(true);
-    expect(result.tweets?.[0].id).toBe('2');
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toContain('/api/trpc/tweets.getConversation');
-    const params = new URL(url as string).searchParams.get('input');
-    expect(params).toBe(JSON.stringify({ tweetId: '1', force: 'true' }));
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer sweet-test' });
-  });
-
-  it('fetches thread', async () => {
-    const conversationPayload = {
-      tweetIds: ['1', '2'],
-      tweets: {
-        1: { id: '1', text: 'root', author: { username: 'root', name: 'Root' }, conversationId: 'c1' },
-        2: { id: '2', text: 'reply', author: { username: 'reply', name: 'Reply' }, conversationId: 'c1' },
-      },
-    };
-
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => ({
-        result: { data: conversationPayload },
-      }),
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.thread('1');
-
-    expect(result.success).toBe(true);
-    expect(result.tweets?.length).toBe(2);
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toContain('/api/trpc/tweets.getConversation');
-    const params = new URL(url as string).searchParams.get('input');
-    expect(params).toBe(JSON.stringify({ tweetId: '1', force: 'true' }));
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer sweet-test' });
-  });
-
-  it('searches tweets', async () => {
-    const searchPayload = {
-      tweets: {
-        items: [
-          {
-            id: '3',
-            text: 'needle',
-            authorUsername: 'n',
-            authorName: 'Needle',
-            createdAt: '2024-01-01',
-            metrics: { replyCount: 1, retweetCount: 2, likeCount: 3 },
-          },
-        ],
-      },
-    };
-
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => [{ result: { data: searchPayload } }],
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.search('needle', 5);
-
-    expect(result.success).toBe(true);
-    expect(result.tweets?.[0].id).toBe('3');
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toContain('/api/trpc/search.execute');
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer sweet-test' });
-  });
-
-  it('fetches current user', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => [{ result: { data: { json: { id: 'u1', username: 'tester', name: 'Test User' } } } }],
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.getCurrentUser();
-
-    expect(result.success).toBe(true);
-    expect(result.user?.id).toBe('u1');
-    expect(result.user?.username).toBe('tester');
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe('https://api.example.com/api/trpc/user.getCurrent?batch=1');
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer sweet-test' });
-  });
-
-  it('falls back to GET when POST is not allowed', async () => {
-    const fetchMock = vi
-      .fn()
-      .mockResolvedValueOnce({ ok: false, status: 405, json: async () => ({}) })
-      .mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        json: async () => ({ result: { data: { json: { id: 'u2', username: 'fallback' } } } }),
-      });
-
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.getCurrentUser();
-
-    expect(result.success).toBe(true);
-    expect(result.user?.id).toBe('u2');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(fetchMock.mock.calls[1][0]).toContain('input=null');
-  });
-
-  it('propagates Sweetistics user errors', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 200,
-      json: async () => [{ result: { error: { message: 'bad key' } } }],
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.getCurrentUser();
-
-    expect(result.success).toBe(false);
-    expect(result.error).toBe('bad key');
-  });
-
-  it('propagates Sweetistics error message', async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      status: 500,
-      json: async () => [{ error: { message: 'boom' } }],
-    });
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-    const client = new SweetisticsClient({ baseUrl: 'https://api.example.com', apiKey: 'sweet-test' });
-    const result = await client.search('needle', 1);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toBe('boom');
-  });
-});

tests/twitter-client.test.ts

@@ -753,6 +753,54 @@ describe('TwitterClient', () => {
       expect(result.user?.id).toBe('999');
       expect(mockFetch).toHaveBeenCalledTimes(5);
     });
+
+    it('skips an endpoint when JSON parsing fails', async () => {
+      mockFetch
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          json: async () => {
+            throw new Error('bad json');
+          },
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          json: async () => ({
+            user_id: '12345',
+            screen_name: 'tester',
+            name: 'Test User',
+          }),
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.getCurrentUser();
+
+      expect(result.success).toBe(true);
+      expect(result.user).toEqual({ id: '12345', username: 'tester', name: 'Test User' });
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+    });
+
+    it('continues on fetch errors and still succeeds via HTML fallback', async () => {
+      mockFetch
+        .mockRejectedValueOnce(new Error('boom'))
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => 'not found' })
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => 'not found' })
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => 'not found' })
+        .mockRejectedValueOnce(new Error('settings boom'))
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          text: async () => '<html>"screen_name":"fallback","user_id":"999"</html>',
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.getCurrentUser();
+
+      expect(result.success).toBe(true);
+      expect(result.user?.username).toBe('fallback');
+      expect(result.user?.id).toBe('999');
+    });
   });
 
   describe('search', () => {
@@ -832,6 +880,47 @@ describe('TwitterClient', () => {
       const parsed = JSON.parse(urlVars as string) as { rawQuery?: string };
       expect(parsed.rawQuery).toBe('needle');
     });
+
+    it('refreshes query IDs when all search endpoints 404', async () => {
+      mockFetch
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => '' })
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => '' })
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => '' })
+        .mockResolvedValueOnce({ ok: false, status: 404, text: async () => '' })
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          json: async () => ({
+            data: {
+              search_by_raw_query: {
+                search_timeline: {
+                  timeline: {
+                    instructions: [],
+                  },
+                },
+              },
+            },
+          }),
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.search('hello', 5);
+
+      expect(result.success).toBe(true);
+      expect(mockFetch).toHaveBeenCalledTimes(5);
+    });
+
+    it('returns an unknown error when no query IDs are available', async () => {
+      const client = new TwitterClient({ cookies: validCookies });
+      (client as unknown as { getSearchTimelineQueryIds: () => Promise<string[]> }).getSearchTimelineQueryIds =
+        async () => [];
+
+      const result = await client.search('hello', 5);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Unknown error fetching search results');
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
   });
 
   describe('conversation helpers', () => {

tests/version.test.ts

@@ -1,7 +1,18 @@
-import { readFileSync } from 'node:fs';
+import fs from 'node:fs';
-import { fileURLToPath } from 'node:url';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { afterEach, describe, expect, it } from 'vitest';
-import { formatVersionLine, resolveGitSha, resolvePackageVersion } from '../src/lib/version.js';
+import { FALLBACK_VERSION, formatVersionLine, resolveGitSha, resolvePackageVersion } from '../src/lib/version.js';
+
+function withTempDir<T>(fn: (dir: string) => T): T {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bird-version-test-'));
+  try {
+    return fn(dir);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
 
 describe('getCliVersion', () => {
   afterEach(() => {
@@ -10,7 +21,7 @@ describe('getCliVersion', () => {
   });
 
   it('reads package.json version when available', () => {
-    const raw = readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8');
+    const raw = fs.readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8');
     const pkg = JSON.parse(raw) as { version?: unknown };
     expect(resolvePackageVersion()).toBe(pkg.version);
   });
@@ -21,10 +32,98 @@ describe('getCliVersion', () => {
     expect(formatVersionLine('not a url')).toBe('9.9.9 (abcdef12)');
   });
 
-  it('adds git sha when available', () => {
+  it('resolves package.json version from importMetaUrl root', () => {
-    const version = resolvePackageVersion();
+    withTempDir((dir) => {
-    const sha = resolveGitSha();
+      fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ version: '1.2.3' }));
-    expect(sha).toMatch(/^[0-9a-f]{8}$/);
+      const entry = path.join(dir, 'src', 'entry.ts');
-    expect(formatVersionLine()).toBe(`${version} (${sha})`);
+      fs.mkdirSync(path.dirname(entry), { recursive: true });
+      fs.writeFileSync(entry, '// noop');
+
+      expect(resolvePackageVersion(pathToFileURL(entry).href)).toBe('1.2.3');
+    });
+  });
+
+  it('falls back to VERSION file when package.json missing', () => {
+    withTempDir((dir) => {
+      fs.writeFileSync(path.join(dir, 'VERSION'), '2.0.0\n');
+      const entry = path.join(dir, 'entry.ts');
+      fs.writeFileSync(entry, '// noop');
+
+      expect(resolvePackageVersion(pathToFileURL(entry).href)).toBe('2.0.0');
+    });
+  });
+
+  it('falls back to unknown when no version files exist', () => {
+    withTempDir((dir) => {
+      const entry = path.join(dir, 'a', 'b', 'c', 'entry.ts');
+      fs.mkdirSync(path.dirname(entry), { recursive: true });
+      fs.writeFileSync(entry, '// noop');
+
+      expect(resolvePackageVersion(pathToFileURL(entry).href)).toBe(FALLBACK_VERSION);
+    });
+  });
+
+  it('resolves git sha from .git directory HEAD', () => {
+    withTempDir((dir) => {
+      const gitDir = path.join(dir, '.git');
+      fs.mkdirSync(gitDir, { recursive: true });
+      fs.writeFileSync(path.join(gitDir, 'HEAD'), '0123456789abcdef0123456789abcdef01234567\n');
+
+      const entry = path.join(dir, 'entry.ts');
+      fs.writeFileSync(entry, '// noop');
+
+      expect(resolveGitSha(pathToFileURL(entry).href)).toBe('01234567');
+    });
+  });
+
+  it('resolves git sha from ref file and packed-refs', () => {
+    withTempDir((dir) => {
+      const gitDir = path.join(dir, '.git');
+      fs.mkdirSync(path.join(gitDir, 'refs', 'heads'), { recursive: true });
+      fs.writeFileSync(path.join(gitDir, 'HEAD'), 'ref: refs/heads/main\n');
+      fs.writeFileSync(path.join(gitDir, 'refs', 'heads', 'main'), 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n');
+
+      const entry = path.join(dir, 'entry.ts');
+      fs.writeFileSync(entry, '// noop');
+
+      expect(resolveGitSha(pathToFileURL(entry).href)).toBe('aaaaaaaa');
+
+      fs.rmSync(path.join(gitDir, 'refs', 'heads', 'main'), { force: true });
+      fs.writeFileSync(
+        path.join(gitDir, 'packed-refs'),
+        ['# pack-refs with: peeled fully-peeled', 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb refs/heads/main', ''].join(
+          '\n',
+        ),
+      );
+      expect(resolveGitSha(pathToFileURL(entry).href)).toBe('bbbbbbbb');
+    });
+  });
+
+  it('resolves git sha from .git file gitdir pointer', () => {
+    withTempDir((dir) => {
+      const realGitDir = path.join(dir, '.realgit');
+      fs.mkdirSync(realGitDir, { recursive: true });
+      fs.writeFileSync(path.join(realGitDir, 'HEAD'), 'cccccccccccccccccccccccccccccccccccccccc\n');
+      fs.writeFileSync(path.join(dir, '.git'), 'gitdir: .realgit\n');
+
+      const entry = path.join(dir, 'entry.ts');
+      fs.writeFileSync(entry, '// noop');
+
+      expect(resolveGitSha(pathToFileURL(entry).href)).toBe('cccccccc');
+    });
+  });
+
+  it('formats version line with version + sha when both available', () => {
+    withTempDir((dir) => {
+      fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ version: '3.3.3' }));
+      const gitDir = path.join(dir, '.git');
+      fs.mkdirSync(gitDir, { recursive: true });
+      fs.writeFileSync(path.join(gitDir, 'HEAD'), 'dddddddddddddddddddddddddddddddddddddddd\n');
+
+      const entry = path.join(dir, 'entry.ts');
+      fs.writeFileSync(entry, '// noop');
+
+      expect(formatVersionLine(pathToFileURL(entry).href)).toBe('3.3.3 (dddddddd)');
+    });
   });
 });

vitest.config.ts

@@ -10,6 +10,12 @@ export default defineConfig({
       reporter: ['text', 'html'],
       include: ['src/**/*.ts'],
       exclude: ['src/index.ts'],
+      thresholds: {
+        statements: 70,
+        branches: 70,
+        functions: 70,
+        lines: 70,
+      },
     },
   },
 });