fix: narrow tweet results

docs: release notes for 0.4.0
docs: add undocumented API disclaimer
2025-12-26 22:40:45 +01:00 · 2025-12-26 22:39:13 +01:00 · 2025-12-26 22:34:25 +01:00 · 2025-12-26 22:33:20 +01:00 · 2025-12-26 22:24:13 +01:00 · 2025-12-26 22:22:21 +01:00
18 changed files with 1449 additions and 180 deletions
@@ -1,6 +1,17 @@
 # Changelog

-## 0.3.1 — Unreleased
+## 0.4.1 — Unreleased
+
+## 0.4.0 — 2025-12-26
+
+### Added
+- Cookie source selection: `--cookie-source safari|chrome|firefox` (repeatable) + `cookieSource` config (string or array).
+
+### Fixed
+- `tweet`/`reply`: fallback to `statuses/update.json` when GraphQL `CreateTweet` returns error 226 (“automated request”).
+
+### Breaking
+- Remove `allowSafari`/`allowChrome`/`allowFirefox` config toggles in favor of `cookieSource` ordering.

 ## 0.3.0 — 2025-12-26

@@ -2,12 +2,22 @@

 `bird` is a fast X CLI for tweeting, replying, and reading via X/Twitter GraphQL (cookie auth).

+## Disclaimer
+
+This project uses X/Twitter’s **undocumented** web GraphQL API (and cookie auth). X can change endpoints, query IDs,
+and anti-bot behavior at any time — **expect this to break without notice**.
+
 ## Install

 ```bash
 npm install -g @steipete/bird
 # or
 pnpm add -g @steipete/bird
+# or
+bun add -g @steipete/bird
+
+# one-shot (no install)
+bunx @steipete/bird whoami
 ```

 Homebrew (macOS, prebuilt Bun binary):
@@ -62,17 +72,22 @@ Global options:
 - `--plain`: stable output (no emoji, no color).
 - `--no-emoji`: disable emoji output.
 - `--no-color`: disable ANSI colors (or set `NO_COLOR=1`).
+- `--cookie-source <safari|chrome|firefox>`: choose browser cookie source (repeatable; order matters).

 ## Authentication (GraphQL)

 GraphQL mode uses your existing X/Twitter web session (no password prompt). It sends requests to internal
 X endpoints and authenticates via cookies (`auth_token`, `ct0`).

+Write operations:
+- `tweet`/`reply` primarily use GraphQL (`CreateTweet`).
+- If GraphQL returns error `226` (“automated request”), `bird` falls back to the legacy `statuses/update.json` endpoint.
+
 `bird` resolves credentials in this order:

 1. CLI flags: `--auth-token`, `--ct0`
 2. Environment variables: `AUTH_TOKEN`, `CT0` (fallback: `TWITTER_AUTH_TOKEN`, `TWITTER_CT0`)
-3. Browser cookies (macOS): Safari, Chrome, Firefox
+3. Browser cookies (macOS): Safari, Chrome, Firefox (override via `--cookie-source` order)

 Browser cookie sources:
 - Safari: `~/Library/Cookies/Cookies.binarycookies` (fallback: `~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies`)
@@ -90,10 +105,9 @@ Example `~/.config/bird/config.json5`:

 ```json5
 {
+  // Cookie source order for browser extraction (string or array)
+  cookieSource: ["firefox", "safari"],
  firefoxProfile: "default-release",
-  allowSafari: true,
-  allowFirefox: true,
-  allowChrome: false,
  timeoutMs: 20000
 }
 ```
@@ -172,4 +186,4 @@ pnpm run lint
 ## Notes

 - GraphQL uses internal X endpoints and can be rate limited (429).
- Query IDs rotate; refresh them with `pnpm run graphql:update`.
+- Query IDs rotate; refresh at runtime with `bird query-ids --fresh` (or update the baked baseline via `pnpm run graphql:update`).
@@ -0,0 +1 @@
+
@@ -0,0 +1,43 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1" />
+    <meta name="color-scheme" content="dark" />
+    <meta name="theme-color" content="#0b0d10" />
+    <title>404 — bird.fast</title>
+    <link rel="icon" href="./favicon.svg" type="image/svg+xml" />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      rel="stylesheet"
+      href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,[email protected],500..900&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap"
+    />
+    <link rel="stylesheet" href="./assets/site.css" />
+  </head>
+  <body class="is-404">
+    <div class="bg" aria-hidden="true">
+      <div class="bg__orb bg__orb--a"></div>
+      <div class="bg__orb bg__orb--b"></div>
+      <div class="bg__grid"></div>
+      <div class="bg__noise"></div>
+    </div>
+
+    <main class="notfound">
+      <a class="brand brand--solo" href="./" aria-label="bird.fast home">
+        <span class="brand__mark" aria-hidden="true">
+          <img src="./assets/mark.svg" width="26" height="26" alt="" />
+        </span>
+        <span class="brand__word">bird</span>
+        <span class="brand__dot">.fast</span>
+      </a>
+      <h1 class="title title--small">404</h1>
+      <p class="lede lede--small">That path doesn’t exist. The CLI does.</p>
+      <div class="cta">
+        <a class="btn btn--hot" href="./">Go home</a>
+        <a class="btn btn--ghost" href="https://github.com/steipete/bird">Open GitHub</a>
+      </div>
+    </main>
+  </body>
+</html>
+
@@ -0,0 +1 @@
+bird.fast
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 28 28" fill="none">
+  <path
+    d="M19.7 10.3c-.9-2.8-3.5-4.8-6.5-4.8-3.8 0-6.9 3.1-6.9 6.9 0 3.9 3.1 7 6.9 7 .9 0 1.8-.2 2.6-.5 1.8 1 3.8 1.2 5.8.6-2.3-.4-3.6-1.4-4.2-2.9 1.6-1.2 2.6-3.1 2.6-5.2 0-.3 0-.6-.1-.9h.9l2.5-2.1-3.6.1z"
+    fill="rgba(244,241,233,0.92)"
+  />
+  <path
+    d="M22.9 9.6l-1.7 1.4h-1.1c-.3-1-.9-1.9-1.6-2.7l4.4-.2z"
+    fill="rgba(183,255,106,0.88)"
+  />
+</svg>
+
@@ -0,0 +1,479 @@
+:root {
+  --bg: #0b0d10;
+  --fg: #f4f1e9;
+  --muted: rgba(244, 241, 233, 0.66);
+  --dim: rgba(244, 241, 233, 0.12);
+  --edge: rgba(244, 241, 233, 0.16);
+  --hot: #b7ff6a;
+  --hot2: #6afcff;
+  --ink: rgba(8, 9, 12, 0.72);
+
+  --serif: "Fraunces", ui-serif, "Iowan Old Style", "Apple Garamond", serif;
+  --sans: "IBM Plex Sans", ui-sans-serif, system-ui, -apple-system, sans-serif;
+  --mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+
+  --radius: 18px;
+  --shadow: 0 24px 80px rgba(0, 0, 0, 0.55);
+  --max: 1080px;
+}
+
+* { box-sizing: border-box; }
+html, body { height: 100%; }
+body {
+  margin: 0;
+  font-family: var(--sans);
+  color: var(--fg);
+  background: var(--bg);
+  overflow-x: hidden;
+}
+
+a { color: inherit; text-underline-offset: 4px; }
+a:hover { text-decoration-thickness: 2px; }
+
+.skip {
+  position: absolute;
+  left: 12px;
+  top: 12px;
+  padding: 10px 12px;
+  border-radius: 10px;
+  border: 1px solid var(--edge);
+  background: rgba(0, 0, 0, 0.7);
+  transform: translateY(-140%);
+  transition: transform 180ms ease;
+  z-index: 999;
+}
+.skip:focus { transform: translateY(0); outline: none; }
+
+.bg { position: fixed; inset: 0; pointer-events: none; z-index: 0; }
+.bg__orb {
+  position: absolute;
+  width: 900px;
+  height: 900px;
+  border-radius: 999px;
+  filter: blur(48px);
+  opacity: 0.55;
+  transform: translate3d(0, 0, 0);
+}
+.bg__orb--a {
+  left: -320px;
+  top: -280px;
+  background: radial-gradient(circle at 30% 30%, rgba(183, 255, 106, 0.95), rgba(183, 255, 106, 0.0) 62%);
+}
+.bg__orb--b {
+  right: -360px;
+  bottom: -320px;
+  background: radial-gradient(circle at 30% 30%, rgba(106, 252, 255, 0.95), rgba(106, 252, 255, 0.0) 62%);
+}
+.bg__grid {
+  position: absolute;
+  inset: 0;
+  background-image:
+    linear-gradient(to right, rgba(244, 241, 233, 0.06) 1px, transparent 1px),
+    linear-gradient(to bottom, rgba(244, 241, 233, 0.06) 1px, transparent 1px);
+  background-size: 64px 64px;
+  opacity: 0.22;
+  mask-image: radial-gradient(circle at 48% 25%, black 0%, black 45%, transparent 72%);
+}
+.bg__noise {
+  position: absolute;
+  inset: 0;
+  opacity: 0.09;
+  mix-blend-mode: overlay;
+  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='180' height='180'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='.85' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='180' height='180' filter='url(%23n)' opacity='.48'/%3E%3C/svg%3E");
+}
+
+.top { position: sticky; top: 0; z-index: 10; backdrop-filter: blur(14px); }
+.top__inner {
+  max-width: var(--max);
+  margin: 0 auto;
+  padding: 18px 18px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+.top::after {
+  content: "";
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  height: 1px;
+  background: linear-gradient(90deg, transparent, rgba(244, 241, 233, 0.16), transparent);
+}
+
+.brand {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  text-decoration: none;
+}
+.brand__mark {
+  width: 28px;
+  height: 28px;
+  display: grid;
+  place-items: center;
+  border-radius: 10px;
+  border: 1px solid rgba(244, 241, 233, 0.18);
+  background: rgba(0, 0, 0, 0.18);
+  box-shadow: 0 10px 38px rgba(0, 0, 0, 0.38);
+}
+.brand__word {
+  font-family: var(--serif);
+  letter-spacing: -0.02em;
+  font-variation-settings: "opsz" 144;
+  font-weight: 780;
+  font-size: 18px;
+}
+.brand__dot {
+  font-family: var(--mono);
+  font-weight: 500;
+  font-size: 13px;
+  color: var(--muted);
+  transform: translateY(1px);
+}
+
+.nav { display: flex; gap: 14px; }
+.nav__link {
+  font-size: 13px;
+  color: var(--muted);
+  text-decoration: none;
+  padding: 10px 10px;
+  border-radius: 12px;
+  border: 1px solid transparent;
+}
+.nav__link:hover {
+  color: var(--fg);
+  border-color: rgba(244, 241, 233, 0.14);
+  background: rgba(0, 0, 0, 0.18);
+}
+.nav__link:focus-visible { outline: 2px solid rgba(183, 255, 106, 0.55); outline-offset: 2px; }
+
+main { position: relative; z-index: 1; }
+
+.hero { padding: 64px 18px 26px; }
+.hero__inner { max-width: var(--max); margin: 0 auto; }
+
+.kicker {
+  margin: 0 0 10px;
+  font-family: var(--mono);
+  font-size: 12px;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: rgba(244, 241, 233, 0.62);
+}
+.title {
+  margin: 0 0 14px;
+  font-family: var(--serif);
+  font-weight: 820;
+  letter-spacing: -0.05em;
+  line-height: 0.95;
+  font-size: clamp(54px, 8vw, 118px);
+  font-variation-settings: "opsz" 144;
+  text-shadow: 0 22px 70px rgba(0, 0, 0, 0.55);
+}
+.title__dot {
+  font-family: var(--mono);
+  font-weight: 500;
+  letter-spacing: -0.02em;
+  font-size: 0.7em;
+  margin-left: 8px;
+  color: rgba(183, 255, 106, 0.92);
+  text-shadow: 0 0 0 transparent;
+}
+.lede {
+  margin: 0 0 24px;
+  max-width: 70ch;
+  font-size: 16px;
+  line-height: 1.6;
+  color: var(--muted);
+}
+
+.cta { display: flex; gap: 12px; align-items: center; flex-wrap: wrap; }
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  padding: 12px 14px;
+  border-radius: 14px;
+  text-decoration: none;
+  border: 1px solid rgba(244, 241, 233, 0.14);
+  background: rgba(0, 0, 0, 0.14);
+  color: var(--fg);
+  font-size: 13px;
+  box-shadow: 0 16px 60px rgba(0, 0, 0, 0.32);
+}
+.btn:hover { border-color: rgba(244, 241, 233, 0.22); }
+.btn:focus-visible { outline: 2px solid rgba(106, 252, 255, 0.55); outline-offset: 2px; }
+.btn--hot {
+  border-color: rgba(183, 255, 106, 0.35);
+  background: linear-gradient(180deg, rgba(183, 255, 106, 0.22), rgba(183, 255, 106, 0.08));
+}
+.btn--hot:hover { border-color: rgba(183, 255, 106, 0.55); }
+.btn--ghost { color: rgba(244, 241, 233, 0.78); }
+
+.terminal {
+  margin-top: 24px;
+  border-radius: var(--radius);
+  border: 1px solid rgba(244, 241, 233, 0.14);
+  background: rgba(0, 0, 0, 0.30);
+  box-shadow: var(--shadow);
+  overflow: hidden;
+}
+.terminal__bar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 10px 12px;
+  background: rgba(0, 0, 0, 0.25);
+  border-bottom: 1px solid rgba(244, 241, 233, 0.10);
+}
+.terminal__dots { display: inline-flex; gap: 6px; }
+.terminal__dots i {
+  width: 9px;
+  height: 9px;
+  border-radius: 999px;
+  background: rgba(244, 241, 233, 0.16);
+}
+.terminal__label {
+  font-family: var(--mono);
+  font-size: 11px;
+  color: rgba(244, 241, 233, 0.55);
+}
+.terminal__body { position: relative; padding: 14px 14px 16px; }
+.terminal pre { margin: 0; overflow-x: auto; }
+.terminal code {
+  font-family: var(--mono);
+  font-size: 13px;
+  line-height: 1.55;
+  color: rgba(244, 241, 233, 0.86);
+}
+
+.copy {
+  position: absolute;
+  right: 12px;
+  top: 12px;
+  border: 1px solid rgba(244, 241, 233, 0.14);
+  border-radius: 12px;
+  padding: 10px 12px;
+  background: rgba(0, 0, 0, 0.22);
+  color: rgba(244, 241, 233, 0.86);
+  font-family: var(--mono);
+  font-size: 12px;
+  cursor: pointer;
+  transition: transform 120ms ease, border-color 120ms ease;
+}
+.copy:hover { border-color: rgba(244, 241, 233, 0.25); transform: translateY(-1px); }
+.copy:focus-visible { outline: 2px solid rgba(183, 255, 106, 0.55); outline-offset: 2px; }
+.copy__done { display: none; }
+.copy.is-done .copy__idle { display: none; }
+.copy.is-done .copy__done { display: inline; color: rgba(183, 255, 106, 0.92); }
+
+.badges {
+  margin-top: 16px;
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 10px;
+}
+.badge {
+  text-decoration: none;
+  border-radius: 16px;
+  border: 1px solid rgba(244, 241, 233, 0.12);
+  background: rgba(0, 0, 0, 0.14);
+  padding: 12px 12px;
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  box-shadow: 0 12px 44px rgba(0, 0, 0, 0.28);
+}
+.badge:hover { border-color: rgba(244, 241, 233, 0.22); }
+.badge__k { font-family: var(--mono); font-size: 12px; color: rgba(244, 241, 233, 0.62); }
+.badge__v { font-family: var(--mono); font-size: 12px; color: rgba(244, 241, 233, 0.90); }
+
+.stripe { padding: 44px 18px; }
+.stripe__inner { max-width: var(--max); margin: 0 auto; }
+.stripe--tight { padding-top: 28px; }
+.stripe--end { padding-bottom: 64px; }
+
+.h2 {
+  margin: 0 0 10px;
+  font-family: var(--serif);
+  font-weight: 760;
+  letter-spacing: -0.03em;
+  font-size: 28px;
+  font-variation-settings: "opsz" 144;
+}
+.h3 { margin: 0 0 8px; font-weight: 650; font-size: 16px; }
+.p { margin: 0 0 14px; line-height: 1.6; color: rgba(244, 241, 233, 0.80); }
+.p--muted { color: var(--muted); }
+
+.cards { display: grid; gap: 12px; grid-template-columns: repeat(3, minmax(0, 1fr)); }
+.card {
+  border-radius: var(--radius);
+  border: 1px solid rgba(244, 241, 233, 0.12);
+  background: rgba(0, 0, 0, 0.16);
+  padding: 16px 16px 14px;
+  box-shadow: 0 18px 70px rgba(0, 0, 0, 0.28);
+}
+.code {
+  margin: 12px 0 0;
+  border-radius: 14px;
+  padding: 12px 12px;
+  background: rgba(0, 0, 0, 0.30);
+  border: 1px solid rgba(244, 241, 233, 0.10);
+  overflow-x: auto;
+}
+.code code { font-family: var(--mono); font-size: 12px; line-height: 1.55; color: rgba(244, 241, 233, 0.86); }
+
+.cmds { display: flex; flex-wrap: wrap; gap: 10px; margin-top: 14px; }
+.cmd {
+  border-radius: 999px;
+  padding: 10px 12px;
+  border: 1px solid rgba(244, 241, 233, 0.14);
+  background: rgba(0, 0, 0, 0.14);
+  color: rgba(244, 241, 233, 0.78);
+  font-family: var(--mono);
+  font-size: 12px;
+  cursor: pointer;
+}
+.cmd:hover { border-color: rgba(244, 241, 233, 0.24); color: rgba(244, 241, 233, 0.92); }
+.cmd.is-on {
+  border-color: rgba(183, 255, 106, 0.42);
+  background: linear-gradient(180deg, rgba(183, 255, 106, 0.18), rgba(183, 255, 106, 0.05));
+  color: rgba(244, 241, 233, 0.96);
+}
+.cmd:focus-visible { outline: 2px solid rgba(183, 255, 106, 0.55); outline-offset: 2px; }
+
+.demo {
+  margin-top: 14px;
+  position: relative;
+  border-radius: var(--radius);
+  border: 1px solid rgba(244, 241, 233, 0.12);
+  background: rgba(0, 0, 0, 0.20);
+  padding: 14px 14px 16px;
+  box-shadow: 0 18px 70px rgba(0, 0, 0, 0.28);
+}
+.demo__pre { margin: 0; overflow-x: auto; }
+.demo__pre code { font-family: var(--mono); font-size: 13px; line-height: 1.55; color: rgba(244, 241, 233, 0.86); }
+.copy--demo { top: 10px; right: 10px; }
+
+.steps { display: grid; gap: 12px; grid-template-columns: repeat(3, minmax(0, 1fr)); margin-top: 14px; }
+.step {
+  border-radius: var(--radius);
+  border: 1px solid rgba(244, 241, 233, 0.12);
+  background: rgba(0, 0, 0, 0.14);
+  padding: 16px 16px 14px;
+  box-shadow: 0 18px 70px rgba(0, 0, 0, 0.26);
+}
+.step__num {
+  font-family: var(--mono);
+  font-size: 11px;
+  letter-spacing: 0.12em;
+  color: rgba(244, 241, 233, 0.56);
+  margin-bottom: 10px;
+}
+.pill {
+  display: inline-block;
+  padding: 1px 7px 2px;
+  border-radius: 999px;
+  border: 1px solid rgba(244, 241, 233, 0.14);
+  background: rgba(0, 0, 0, 0.20);
+  font-family: var(--mono);
+  font-size: 12px;
+  color: rgba(244, 241, 233, 0.86);
+}
+
+.footerline {
+  margin-top: 16px;
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 10px;
+  color: rgba(244, 241, 233, 0.60);
+}
+.tiny { font-size: 12px; color: rgba(244, 241, 233, 0.72); }
+.tiny--muted { color: rgba(244, 241, 233, 0.52); }
+.sep { opacity: 0.5; }
+
+.notice {
+  margin-top: 18px;
+  border-radius: var(--radius);
+  border: 1px solid rgba(244, 241, 233, 0.12);
+  background: rgba(0, 0, 0, 0.22);
+  padding: 14px 14px;
+  display: grid;
+  grid-template-columns: 34px 1fr;
+  gap: 12px;
+  align-items: start;
+  box-shadow: 0 18px 70px rgba(0, 0, 0, 0.26);
+}
+.notice__icon {
+  width: 34px;
+  height: 34px;
+  border-radius: 12px;
+  display: grid;
+  place-items: center;
+  font-family: var(--mono);
+  font-weight: 600;
+  border: 1px solid rgba(244, 241, 233, 0.14);
+  background: rgba(0, 0, 0, 0.18);
+  color: rgba(244, 241, 233, 0.86);
+}
+.notice__title {
+  margin: 0 0 4px;
+  font-weight: 700;
+  letter-spacing: -0.01em;
+}
+.notice__text { margin: 0; color: var(--muted); line-height: 1.6; }
+.notice--warn {
+  border-color: rgba(183, 255, 106, 0.18);
+  background: linear-gradient(180deg, rgba(183, 255, 106, 0.10), rgba(0, 0, 0, 0.22));
+}
+.notice--warn .notice__icon {
+  border-color: rgba(183, 255, 106, 0.28);
+  background: rgba(183, 255, 106, 0.08);
+  color: rgba(183, 255, 106, 0.92);
+}
+
+.bottom {
+  position: relative;
+  z-index: 1;
+  padding: 28px 18px 40px;
+}
+.bottom__inner { max-width: var(--max); margin: 0 auto; }
+
+/* 404 */
+body.is-404 { display: grid; place-items: center; }
+.notfound { max-width: 640px; padding: 18px; text-align: left; }
+.brand--solo { margin-bottom: 26px; }
+.title--small { font-size: clamp(56px, 10vw, 96px); margin-bottom: 6px; }
+.lede--small { max-width: 54ch; }
+
+/* reveal */
+[data-reveal] { opacity: 0; transform: translateY(14px); filter: blur(6px); }
+body.is-ready [data-reveal] {
+  opacity: 1;
+  transform: translateY(0);
+  filter: blur(0);
+  transition: opacity 620ms cubic-bezier(0.2, 0.8, 0.2, 1), transform 620ms cubic-bezier(0.2, 0.8, 0.2, 1),
+    filter 620ms cubic-bezier(0.2, 0.8, 0.2, 1);
+}
+body.is-ready [data-reveal]:nth-child(1) { transition-delay: 70ms; }
+body.is-ready [data-reveal]:nth-child(2) { transition-delay: 140ms; }
+body.is-ready [data-reveal]:nth-child(3) { transition-delay: 210ms; }
+body.is-ready [data-reveal]:nth-child(4) { transition-delay: 280ms; }
+body.is-ready [data-reveal]:nth-child(5) { transition-delay: 350ms; }
+body.is-ready [data-reveal]:nth-child(6) { transition-delay: 420ms; }
+
+@media (prefers-reduced-motion: reduce) {
+  [data-reveal] { opacity: 1; transform: none; filter: none; }
+  body.is-ready [data-reveal] { transition: none; }
+  .copy { transition: none; }
+}
+
+@media (max-width: 920px) {
+  .badges { grid-template-columns: 1fr; }
+  .cards { grid-template-columns: 1fr; }
+  .steps { grid-template-columns: 1fr; }
+  .nav { display: none; }
+}
@@ -0,0 +1,80 @@
+const by = (sel, root = document) => root.querySelector(sel);
+const all = (sel, root = document) => Array.from(root.querySelectorAll(sel));
+
+const demoSnippets = {
+  tweet: `bird tweet "ship it"`,
+  reply: `bird reply https://x.com/user/status/1234567890123456789 "same"`,
+  read: `bird read https://x.com/user/status/1234567890123456789`,
+  thread: `bird thread 1234567890123456789`,
+  search: `bird search "from:steipete" -n 5`,
+  mentions: `bird mentions -n 5`,
+};
+
+const setDemo = (key) => {
+  const code = by("#demoCode");
+  if (!code) return;
+  const value = demoSnippets[key] ?? demoSnippets.tweet;
+  code.textContent = value;
+};
+
+const wireTabs = () => {
+  const buttons = all("[data-cmd]");
+  if (buttons.length === 0) return;
+  buttons.forEach((b) => {
+    b.addEventListener("click", () => {
+      const key = b.getAttribute("data-cmd") ?? "tweet";
+      buttons.forEach((x) => {
+        const on = x === b;
+        x.classList.toggle("is-on", on);
+        x.setAttribute("aria-selected", on ? "true" : "false");
+      });
+      setDemo(key);
+    });
+  });
+};
+
+const wireCopy = () => {
+  all("[data-copy]").forEach((btn) => {
+    btn.addEventListener("click", async () => {
+      const sel = btn.getAttribute("data-copy");
+      if (!sel) return;
+      const node = by(sel);
+      if (!node) return;
+      const text = node.textContent ?? "";
+      try {
+        await navigator.clipboard.writeText(text);
+        btn.classList.add("is-done");
+        window.setTimeout(() => btn.classList.remove("is-done"), 900);
+      } catch {
+        // noop
+      }
+    });
+  });
+};
+
+const wireOrbs = () => {
+  const a = by(".bg__orb--a");
+  const b = by(".bg__orb--b");
+  if (!a || !b) return;
+
+  let raf = 0;
+  const onMove = (e) => {
+    if (raf) cancelAnimationFrame(raf);
+    raf = requestAnimationFrame(() => {
+      const x = e.clientX / window.innerWidth;
+      const y = e.clientY / window.innerHeight;
+      a.style.transform = `translate3d(${(x - 0.4) * 80}px, ${(y - 0.4) * 70}px, 0)`;
+      b.style.transform = `translate3d(${(x - 0.6) * 90}px, ${(y - 0.6) * 80}px, 0)`;
+    });
+  };
+
+  window.addEventListener("mousemove", onMove, { passive: true });
+};
+
+document.documentElement.classList.add("js");
+window.setTimeout(() => document.body.classList.add("is-ready"), 20);
+
+wireTabs();
+wireCopy();
+wireOrbs();
+
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <defs>
+    <linearGradient id="g" x1="0" x2="1" y1="0" y2="1">
+      <stop offset="0" stop-color="#b7ff6a" stop-opacity="0.95" />
+      <stop offset="1" stop-color="#6afcff" stop-opacity="0.85" />
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="14" fill="#0b0d10" />
+  <rect x="5" y="5" width="54" height="54" rx="12" fill="rgba(255,255,255,0.06)" stroke="rgba(255,255,255,0.10)" />
+  <path
+    d="M46 24c-2.1-6.5-8.1-11-15.2-11C21.9 13 15 19.9 15 28.8 15 37.8 21.9 45 30.8 45c2.1 0 4.2-.4 6.1-1.2 4.1 2.2 8.8 2.7 13.4 1.3-5.4-.9-8.4-3.3-9.7-6.7 3.7-2.9 6-7.4 6-12.1 0-.7-.1-1.4-.2-2.1H48l6-5-8.4.1z"
+    fill="url(#g)"
+  />
+</svg>
+
@@ -0,0 +1,232 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1" />
+    <meta name="color-scheme" content="dark" />
+    <meta name="theme-color" content="#0b0d10" />
+
+    <title>bird.fast — fast X CLI</title>
+    <meta
+      name="description"
+      content="bird is a fast X CLI for tweeting, replying, and reading via the X/Twitter GraphQL API (cookie auth)."
+    />
+
+    <link rel="canonical" href="https://bird.fast/" />
+    <link rel="icon" href="./favicon.svg" type="image/svg+xml" />
+
+    <meta property="og:title" content="bird.fast" />
+    <meta property="og:description" content="Fast X CLI for tweeting, replying, and reading." />
+    <meta property="og:type" content="website" />
+    <meta property="og:url" content="https://bird.fast/" />
+
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      rel="stylesheet"
+      href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,[email protected],500..900&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap"
+    />
+
+    <link rel="stylesheet" href="./assets/site.css" />
+  </head>
+
+  <body>
+    <a class="skip" href="#content">Skip to content</a>
+
+    <div class="bg" aria-hidden="true">
+      <div class="bg__orb bg__orb--a"></div>
+      <div class="bg__orb bg__orb--b"></div>
+      <div class="bg__grid"></div>
+      <div class="bg__noise"></div>
+    </div>
+
+    <header class="top">
+      <div class="top__inner">
+        <a class="brand" href="./" aria-label="bird.fast home">
+          <span class="brand__mark" aria-hidden="true">
+            <img src="./assets/mark.svg" width="26" height="26" alt="" />
+          </span>
+          <span class="brand__word">bird</span>
+          <span class="brand__dot">.fast</span>
+        </a>
+
+        <nav class="nav">
+          <a class="nav__link" href="#install">Install</a>
+          <a class="nav__link" href="#commands">Commands</a>
+          <a class="nav__link" href="https://github.com/steipete/bird">GitHub</a>
+        </nav>
+      </div>
+    </header>
+
+    <main id="content">
+      <section class="hero">
+        <div class="hero__inner">
+          <p class="kicker" data-reveal>Fast X CLI. Cookie auth. Zero fuss.</p>
+
+          <h1 class="title" data-reveal>
+            <span class="title__big">bird</span><span class="title__dot">.fast</span>
+          </h1>
+
+          <p class="lede" data-reveal>
+            Tweet, reply, read threads, search, mentions — powered by X/Twitter GraphQL and your existing
+            browser session.
+          </p>
+
+          <div class="cta" data-reveal>
+            <a class="btn btn--hot" href="#install">Install</a>
+            <a class="btn btn--ghost" href="https://github.com/steipete/bird#quickstart">Quickstart</a>
+          </div>
+
+          <div class="terminal" data-reveal>
+            <div class="terminal__bar">
+              <span class="terminal__dots" aria-hidden="true">
+                <i></i><i></i><i></i>
+              </span>
+              <span class="terminal__label">copy &amp; run</span>
+            </div>
+            <div class="terminal__body">
+              <pre><code id="installCmd">npm install -g @steipete/bird
+
+bird whoami
+bird tweet "hi from bird.fast"</code></pre>
+              <button class="copy" type="button" data-copy="#installCmd">
+                <span class="copy__idle">Copy</span>
+                <span class="copy__done" aria-hidden="true">Copied</span>
+              </button>
+            </div>
+          </div>
+
+          <div class="badges" data-reveal>
+            <a class="badge" href="https://www.npmjs.com/package/@steipete/bird">
+              <span class="badge__k">npm</span>
+              <span class="badge__v">@steipete/bird</span>
+            </a>
+            <a class="badge" href="https://github.com/steipete/bird">
+              <span class="badge__k">repo</span>
+              <span class="badge__v">steipete/bird</span>
+            </a>
+            <a class="badge" href="https://github.com/steipete/bird#authentication-graphql">
+              <span class="badge__k">auth</span>
+              <span class="badge__v">cookies</span>
+            </a>
+          </div>
+        </div>
+      </section>
+
+      <section class="stripe" id="install">
+        <div class="stripe__inner">
+          <h2 class="h2">Install</h2>
+          <div class="cards">
+            <article class="card">
+              <h3 class="h3">npm / pnpm / bun</h3>
+              <p class="p">Pick your poison. Node ≥ 20.</p>
+              <pre class="code"><code>npm install -g @steipete/bird
+pnpm add -g @steipete/bird
+bun add -g @steipete/bird</code></pre>
+            </article>
+            <article class="card">
+              <h3 class="h3">One-shot</h3>
+              <p class="p">No install. Just prove it works.</p>
+              <pre class="code"><code>bunx @steipete/bird whoami</code></pre>
+            </article>
+            <article class="card">
+              <h3 class="h3">Homebrew (macOS)</h3>
+              <p class="p">Prebuilt Bun binary.</p>
+              <pre class="code"><code>brew install steipete/tap/bird</code></pre>
+            </article>
+          </div>
+        </div>
+      </section>
+
+      <section class="stripe stripe--tight" id="commands">
+        <div class="stripe__inner">
+          <h2 class="h2">Commands</h2>
+          <p class="p p--muted">Everything you need for a fast “read → reply → move on” loop.</p>
+
+          <div class="cmds" role="tablist" aria-label="bird commands">
+            <button class="cmd is-on" type="button" data-cmd="tweet" role="tab" aria-selected="true">
+              tweet
+            </button>
+            <button class="cmd" type="button" data-cmd="reply" role="tab" aria-selected="false">reply</button>
+            <button class="cmd" type="button" data-cmd="read" role="tab" aria-selected="false">read</button>
+            <button class="cmd" type="button" data-cmd="thread" role="tab" aria-selected="false">thread</button>
+            <button class="cmd" type="button" data-cmd="search" role="tab" aria-selected="false">search</button>
+            <button class="cmd" type="button" data-cmd="mentions" role="tab" aria-selected="false">
+              mentions
+            </button>
+          </div>
+
+          <div class="demo" aria-live="polite">
+            <pre class="demo__pre"><code id="demoCode">bird tweet "ship it"</code></pre>
+            <button class="copy copy--demo" type="button" data-copy="#demoCode">
+              <span class="copy__idle">Copy</span>
+              <span class="copy__done" aria-hidden="true">Copied</span>
+            </button>
+          </div>
+        </div>
+      </section>
+
+      <section class="stripe stripe--end">
+        <div class="stripe__inner">
+          <h2 class="h2">How it works</h2>
+          <div class="steps">
+            <article class="step">
+              <div class="step__num">01</div>
+              <h3 class="h3">Use your existing session</h3>
+              <p class="p p--muted">
+                Cookie auth. No password prompt. Reads from Safari/Chrome/Firefox (configurable).
+              </p>
+            </article>
+            <article class="step">
+              <div class="step__num">02</div>
+              <h3 class="h3">GraphQL first</h3>
+              <p class="p p--muted">
+                Talks to X’s internal endpoints. Query IDs rotate — bird auto-refreshes and caches them.
+              </p>
+            </article>
+            <article class="step">
+              <div class="step__num">03</div>
+              <h3 class="h3">Fast, scriptable output</h3>
+              <p class="p p--muted">
+                Human output by default. Flip to <span class="pill">--json</span> or
+                <span class="pill">--plain</span> when you need stability.
+              </p>
+            </article>
+          </div>
+
+          <aside class="notice notice--warn" role="note" aria-label="Disclaimer">
+            <div class="notice__icon" aria-hidden="true">!</div>
+            <div class="notice__body">
+              <p class="notice__title">Undocumented API.</p>
+              <p class="notice__text">
+                bird uses X/Twitter’s private web GraphQL endpoints and rotating query IDs. X can change things anytime —
+                expect breakage without notice.
+              </p>
+            </div>
+          </aside>
+
+          <div class="footerline">
+            <a class="tiny" href="https://github.com/steipete/bird#authentication-graphql">
+              Authentication details
+            </a>
+            <span class="sep" aria-hidden="true">•</span>
+            <a class="tiny" href="https://github.com/steipete/bird#config-json5">Config (JSON5)</a>
+            <span class="sep" aria-hidden="true">•</span>
+            <a class="tiny" href="https://github.com/steipete/bird/issues">Issues</a>
+          </div>
+        </div>
+      </section>
+    </main>
+
+    <footer class="bottom">
+      <div class="bottom__inner">
+        <p class="tiny">
+          Made by <a href="https://steipete.me">Peter</a>. MIT licensed. Built for GitHub Pages.
+        </p>
+        <p class="tiny tiny--muted">bird.fast is the landing page; the project lives on GitHub.</p>
+      </div>
+    </footer>
+
+    <script src="./assets/site.js" type="module"></script>
+  </body>
+</html>
@@ -1,6 +1,6 @@
 {
  "name": "@steipete/bird",
-  "version": "0.3.0",
+  "version": "0.4.0",
  "description": "CLI tool for tweeting and replying via Twitter/X GraphQL API",
  "type": "module",
  "main": "dist/index.js",
@@ -16,11 +16,12 @@ import { Command } from 'commander';
 import JSON5 from 'json5';
 import kleur from 'kleur';
 import { resolveCliInvocation } from './lib/cli-args.js';
-import { resolveCredentials } from './lib/cookies.js';
+import { type CookieSource, resolveCredentials } from './lib/cookies.js';
 import { extractTweetId } from './lib/extract-tweet-id.js';
 import { mentionsQueryFromUserOption, normalizeHandle } from './lib/normalize-handle.js';
 import {
  formatStatsLine,
+  formatTweetUrlLine,
  labelPrefix,
  type OutputConfig,
  resolveOutputConfigFromArgv,
@@ -45,6 +46,32 @@ const collect = (value: string, previous: string[] = []) => {
  return previous;
 };

+const COOKIE_SOURCES: CookieSource[] = ['safari', 'chrome', 'firefox'];
+
+function parseCookieSource(value: string): CookieSource {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === 'safari' || normalized === 'chrome' || normalized === 'firefox') return normalized;
+  throw new Error(`Invalid --cookie-source "${value}". Allowed: safari, chrome, firefox.`);
+}
+
+function resolveCookieSourceOrder(input: unknown): CookieSource[] | undefined {
+  if (typeof input === 'string') return [parseCookieSource(input)];
+  if (Array.isArray(input)) {
+    const result: CookieSource[] = [];
+    for (const entry of input) {
+      if (typeof entry !== 'string') continue;
+      result.push(parseCookieSource(entry));
+    }
+    return result.length > 0 ? result : undefined;
+  }
+  return undefined;
+}
+
+const collectCookieSource = (value: string, previous: CookieSource[] = []) => {
+  previous.push(parseCookieSource(value));
+  return previous;
+};
+
 const p = (kind: Parameters<typeof statusPrefix>[0]) => statusPrefix(kind, output);
 const l = (kind: Parameters<typeof labelPrefix>[0]) => labelPrefix(kind, output);

@@ -70,9 +97,7 @@ const colors = {
 type BirdConfig = {
  chromeProfile?: string;
  firefoxProfile?: string;
-  allowSafari?: boolean;
-  allowChrome?: boolean;
-  allowFirefox?: boolean;
+  cookieSource?: CookieSource | CookieSource[];
  timeoutMs?: number;
 };

@@ -145,6 +170,12 @@ program
  .option('--ct0 <token>', 'Twitter ct0 cookie')
  .option('--chrome-profile <name>', 'Chrome profile name for cookie extraction', config.chromeProfile)
  .option('--firefox-profile <name>', 'Firefox profile name for cookie extraction', config.firefoxProfile)
+  .option(
+    '--cookie-source <source>',
+    'Cookie source for browser cookie extraction (repeatable)',
+    collectCookieSource,
+    [],
+  )
  .option('--media <path>', 'Attach media file (repeatable, up to 4 images or 1 video)', collect, [])
  .option('--alt <text>', 'Alt text for the corresponding --media (repeatable)', collect, [])
  .option('--timeout <ms>', 'Request timeout in milliseconds')
@@ -152,6 +183,27 @@ program
  .option('--no-emoji', 'Disable emoji output')
  .option('--no-color', 'Disable ANSI colors (or set NO_COLOR)');

+type CredentialsOptions = {
+  authToken?: string;
+  ct0?: string;
+  chromeProfile?: string;
+  firefoxProfile?: string;
+  cookieSource?: CookieSource[];
+};
+
+function resolveCredentialsFromOptions(opts: CredentialsOptions) {
+  const cookieSource = opts.cookieSource?.length
+    ? opts.cookieSource
+    : (resolveCookieSourceOrder(config.cookieSource) ?? COOKIE_SOURCES);
+  return resolveCredentials({
+    authToken: opts.authToken,
+    ct0: opts.ct0,
+    cookieSource,
+    chromeProfile: opts.chromeProfile || config.chromeProfile,
+    firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
+  });
+}
+
 program.hook('preAction', (_thisCommand, actionCommand) => {
  applyOutputFromCommand(actionCommand);
 });
@@ -318,15 +370,7 @@ program
      process.exit(1);
    }

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -360,7 +404,7 @@ program

    if (result.success) {
      console.log(`${p('ok')}Tweet posted successfully!`);
-      console.log(`${l('url')}https://x.com/i/status/${result.tweetId}`);
+      console.log(formatTweetUrlLine(result.tweetId, output));
    } else {
      console.error(`${p('err')}Failed to post tweet: ${result.error}`);
      process.exit(1);
@@ -385,15 +429,7 @@ program
    }
    const tweetId = extractTweetId(tweetIdOrUrl);

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -429,7 +465,7 @@ program

    if (result.success) {
      console.log(`${p('ok')}Reply posted successfully!`);
-      console.log(`${l('url')}https://x.com/i/status/${result.tweetId}`);
+      console.log(formatTweetUrlLine(result.tweetId, output));
    } else {
      console.error(`${p('err')}Failed to post reply: ${result.error}`);
      process.exit(1);
@@ -448,15 +484,7 @@ program

    const tweetId = extractTweetId(tweetIdOrUrl);

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -498,15 +526,7 @@ program
    const timeoutMs = resolveTimeoutFromOptions(opts);
    const tweetId = extractTweetId(tweetIdOrUrl);

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -539,15 +559,7 @@ program
    const timeoutMs = resolveTimeoutFromOptions(opts);
    const tweetId = extractTweetId(tweetIdOrUrl);

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -581,15 +593,7 @@ program
    const timeoutMs = resolveTimeoutFromOptions(opts);
    const count = Number.parseInt(cmdOpts.count || '10', 10);

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -631,15 +635,7 @@ program

    let query: string | null = fromUserOpt.query;

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -683,15 +679,7 @@ program
    const opts = program.opts();
    const timeoutMs = resolveTimeoutFromOptions(opts);

-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    for (const warning of warnings) {
      console.error(`${p('warn')}${warning}`);
@@ -728,15 +716,7 @@ program
  .description('Check credential availability')
  .action(async () => {
    const opts = program.opts();
-    const { cookies, warnings } = await resolveCredentials({
-      authToken: opts.authToken,
-      ct0: opts.ct0,
-      chromeProfile: opts.chromeProfile || config.chromeProfile,
-      firefoxProfile: opts.firefoxProfile || config.firefoxProfile,
-      allowSafari: config.allowSafari ?? true,
-      allowChrome: config.allowChrome ?? true,
-      allowFirefox: config.allowFirefox ?? true,
-    });
+    const { cookies, warnings } = await resolveCredentialsFromOptions(opts);

    console.log(`${p('info')}Credential check`);
    console.log('─'.repeat(40));
@@ -12,6 +12,7 @@ import { join } from 'node:path';
 export interface TwitterCookies {
  authToken: string | null;
  ct0: string | null;
+  cookieHeader: string | null;
  source: string | null;
 }

@@ -20,6 +21,8 @@ export interface CookieExtractionResult {
  warnings: string[];
 }

+export type CookieSource = 'safari' | 'chrome' | 'firefox';
+
 function normalizeValue(value: unknown): string | null {
  if (typeof value === 'string') {
    const trimmed = value.trim();
@@ -84,7 +87,6 @@ function getSafariCookiesPath(): string | null {
  return null;
 }

-const SAFARI_COOKIE_NAMES = new Set(['auth_token', 'ct0']);
 const SAFARI_COOKIE_DOMAINS = ['x.com', 'twitter.com'];
 const SAFARI_PAGE_SIGNATURE = Buffer.from([0x00, 0x00, 0x01, 0x00]);

@@ -102,7 +104,19 @@ function readSafariCString(buffer: Buffer, start: number, end: number): string |
  return buffer.toString('utf8', start, cursor);
 }

-function parseSafariCookieRecord(page: Buffer, offset: number, cookies: TwitterCookies): void {
+function serializeCookieJar(jar: Record<string, string>): string {
+  const entries = Object.entries(jar)
+    .filter(([, value]) => typeof value === 'string' && value.length > 0)
+    .sort(([a], [b]) => a.localeCompare(b));
+  return entries.map(([name, value]) => `${name}=${value}`).join('; ');
+}
+
+function parseSafariCookieRecord(
+  page: Buffer,
+  offset: number,
+  jar: Record<string, string>,
+  cookies: TwitterCookies,
+): void {
  if (offset < 0 || offset + 4 > page.length) return;
  const recordSize = page.readUInt32LE(offset);
  const recordEnd = offset + recordSize;
@@ -121,11 +135,12 @@ function parseSafariCookieRecord(page: Buffer, offset: number, cookies: TwitterC
  const value = readSafariCString(page, offset + valueOffset, recordEnd);

  if (!name || !value || !matchesSafariDomain(domain)) return;
-  if (!SAFARI_COOKIE_NAMES.has(name)) return;

  const normalizedValue = normalizeValue(value);
  if (!normalizedValue) return;

+  jar[name] = normalizedValue;
+
  if (name === 'auth_token' && !cookies.authToken) {
    cookies.authToken = normalizedValue;
  } else if (name === 'ct0' && !cookies.ct0) {
@@ -133,7 +148,7 @@ function parseSafariCookieRecord(page: Buffer, offset: number, cookies: TwitterC
  }
 }

-function parseSafariCookiePage(page: Buffer, cookies: TwitterCookies): void {
+function parseSafariCookiePage(page: Buffer, jar: Record<string, string>, cookies: TwitterCookies): void {
  if (page.length < 12) return;
  if (!page.subarray(0, 4).equals(SAFARI_PAGE_SIGNATURE)) return;
  const cookieCount = page.readUInt32LE(4);
@@ -148,12 +163,11 @@ function parseSafariCookiePage(page: Buffer, cookies: TwitterCookies): void {
  }

  for (const offset of offsets) {
-    parseSafariCookieRecord(page, offset, cookies);
-    if (cookies.authToken && cookies.ct0) return;
+    parseSafariCookieRecord(page, offset, jar, cookies);
  }
 }

-function parseSafariCookies(data: Buffer, cookies: TwitterCookies): void {
+function parseSafariCookies(data: Buffer, jar: Record<string, string>, cookies: TwitterCookies): void {
  if (data.length < 8) return;
  if (data.subarray(0, 4).toString('utf8') !== 'cook') return;
  const pageCount = data.readUInt32BE(4);
@@ -168,8 +182,7 @@ function parseSafariCookies(data: Buffer, cookies: TwitterCookies): void {
  for (const pageSize of pageSizes) {
    if (cursor + pageSize > data.length) return;
    const page = data.subarray(cursor, cursor + pageSize);
-    parseSafariCookiePage(page, cookies);
-    if (cookies.authToken && cookies.ct0) return;
+    parseSafariCookiePage(page, jar, cookies);
    cursor += pageSize;
  }
 }
@@ -182,6 +195,7 @@ export async function extractCookiesFromSafari(): Promise<CookieExtractionResult
  const cookies: TwitterCookies = {
    authToken: null,
    ct0: null,
+    cookieHeader: null,
    source: null,
  };

@@ -194,11 +208,15 @@ export async function extractCookiesFromSafari(): Promise<CookieExtractionResult
  let tempDir: string | null = null;

  try {
+    const jar: Record<string, string> = {};
    tempDir = mkdtempSync(join(tmpdir(), 'twitter-cli-'));
    const tempCookiesPath = join(tempDir, 'Cookies.binarycookies');
    copyFileSync(cookiesPath, tempCookiesPath);
    const data = readFileSync(tempCookiesPath);
-    parseSafariCookies(data, cookies);
+    parseSafariCookies(data, jar, cookies);
+    if (Object.keys(jar).length > 0) {
+      cookies.cookieHeader = serializeCookieJar(jar);
+    }

    if (cookies.authToken || cookies.ct0) {
      cookies.source = 'Safari';
@@ -291,6 +309,7 @@ export async function extractCookiesFromChrome(profile?: string): Promise<Cookie
  const cookies: TwitterCookies = {
    authToken: null,
    ct0: null,
+    cookieHeader: null,
    source: null,
  };

@@ -319,8 +338,10 @@ export async function extractCookiesFromChrome(profile?: string): Promise<Cookie
      copyFileSync(shmPath, `${tempDbPath}-shm`);
    }

+    const jar: Record<string, string> = {};
+
    // Use sqlite3 CLI to query cookies (no native deps required!)
-    const query = `SELECT name, hex(encrypted_value) as encrypted_hex FROM cookies WHERE host_key IN ('.x.com', '.twitter.com', 'x.com', 'twitter.com') AND name IN ('auth_token', 'ct0');`;
+    const query = `SELECT name, hex(encrypted_value) as encrypted_hex FROM cookies WHERE host_key IN ('.x.com', '.twitter.com', 'x.com', 'twitter.com');`;

    const result = execSync(`sqlite3 -separator '|' "${tempDbPath}" "${query}"`, {
      encoding: 'utf8',
@@ -334,6 +355,7 @@ export async function extractCookiesFromChrome(profile?: string): Promise<Cookie

        const decryptedValue = decryptCookieValue(encryptedHex);
        if (decryptedValue) {
+          jar[name] = decryptedValue;
          if (name === 'auth_token' && !cookies.authToken) {
            cookies.authToken = decryptedValue;
          } else if (name === 'ct0' && !cookies.ct0) {
@@ -343,6 +365,10 @@ export async function extractCookiesFromChrome(profile?: string): Promise<Cookie
      }
    }

+    if (Object.keys(jar).length > 0) {
+      cookies.cookieHeader = serializeCookieJar(jar);
+    }
+
    if (cookies.authToken || cookies.ct0) {
      cookies.source = profile ? `Chrome profile "${profile}"` : 'Chrome default profile';
    }
@@ -376,6 +402,7 @@ export async function extractCookiesFromFirefox(profile?: string): Promise<Cooki
  const cookies: TwitterCookies = {
    authToken: null,
    ct0: null,
+    cookieHeader: null,
    source: null,
  };

@@ -393,7 +420,9 @@ export async function extractCookiesFromFirefox(profile?: string): Promise<Cooki
    const tempDbPath = join(tempDir, 'cookies.sqlite');
    copyFileSync(cookiesPath, tempDbPath);

-    const query = `SELECT name, value FROM moz_cookies WHERE host IN ('.x.com', '.twitter.com', 'x.com', 'twitter.com') AND name IN ('auth_token', 'ct0');`;
+    const jar: Record<string, string> = {};
+
+    const query = `SELECT name, value FROM moz_cookies WHERE host IN ('.x.com', '.twitter.com', 'x.com', 'twitter.com');`;

    const result = execSync(`sqlite3 -separator '|' "${tempDbPath}" "${query}"`, {
      encoding: 'utf8',
@@ -404,6 +433,7 @@ export async function extractCookiesFromFirefox(profile?: string): Promise<Cooki
      for (const line of result.split('\n')) {
        const [name, value] = line.split('|');
        if (!name || !value) continue;
+        jar[name] = value;
        if (name === 'auth_token' && !cookies.authToken) {
          cookies.authToken = value;
        } else if (name === 'ct0' && !cookies.ct0) {
@@ -412,6 +442,10 @@ export async function extractCookiesFromFirefox(profile?: string): Promise<Cooki
      }
    }

+    if (Object.keys(jar).length > 0) {
+      cookies.cookieHeader = serializeCookieJar(jar);
+    }
+
    if (cookies.authToken || cookies.ct0) {
      cookies.source = profile ? `Firefox profile "${profile}"` : 'Firefox default profile';
    }
@@ -444,19 +478,20 @@ export async function extractCookiesFromFirefox(profile?: string): Promise<Cooki
 export async function resolveCredentials(options: {
  authToken?: string;
  ct0?: string;
-  allowSafari?: boolean;
+  cookieSource?: CookieSource | CookieSource[];
  chromeProfile?: string;
  firefoxProfile?: string;
-  allowChrome?: boolean;
-  allowFirefox?: boolean;
 }): Promise<CookieExtractionResult> {
  const warnings: string[] = [];
  const cookies: TwitterCookies = {
    authToken: null,
    ct0: null,
+    cookieHeader: null,
    source: null,
  };

+  const cookieSource = options.cookieSource;
+
  // 1. CLI arguments (highest priority)
  if (options.authToken) {
    cookies.authToken = options.authToken;
@@ -493,52 +528,42 @@ export async function resolveCredentials(options: {
    }
  }

-  const allowSafari = options.allowSafari ?? true;
-  const allowChrome = options.allowChrome ?? true;
-  const allowFirefox = options.allowFirefox ?? true;
-
-  // 3. Safari cookies (preferred browser fallback)
-  if (allowSafari && (!cookies.authToken || !cookies.ct0)) {
-    const safariResult = await extractCookiesFromSafari();
-    warnings.push(...safariResult.warnings);
-
-    if (!cookies.authToken && safariResult.cookies.authToken) {
-      cookies.authToken = safariResult.cookies.authToken;
-      cookies.source = safariResult.cookies.source;
-    }
-    if (!cookies.ct0 && safariResult.cookies.ct0) {
-      cookies.ct0 = safariResult.cookies.ct0;
-      if (!cookies.source) cookies.source = safariResult.cookies.source;
-    }
+  if (cookies.authToken && cookies.ct0) {
+    cookies.cookieHeader = `auth_token=${cookies.authToken}; ct0=${cookies.ct0}`;
+    return { cookies, warnings };
  }

-  // 4. Chrome cookies (secondary browser fallback)
-  if (allowChrome && (!cookies.authToken || !cookies.ct0)) {
-    const chromeResult = await extractCookiesFromChrome(options.chromeProfile);
-    warnings.push(...chromeResult.warnings);
+  const sourcesToTry: CookieSource[] = Array.isArray(cookieSource)
+    ? cookieSource
+    : cookieSource
+      ? [cookieSource]
+      : ['safari', 'chrome', 'firefox'];

-    if (!cookies.authToken && chromeResult.cookies.authToken) {
-      cookies.authToken = chromeResult.cookies.authToken;
-      cookies.source = chromeResult.cookies.source;
+  for (const source of sourcesToTry) {
+    if (source === 'safari') {
+      const safariResult = await extractCookiesFromSafari();
+      warnings.push(...safariResult.warnings);
+      if (safariResult.cookies.authToken && safariResult.cookies.ct0) {
+        return { cookies: safariResult.cookies, warnings };
+      }
+      continue;
    }
-    if (!cookies.ct0 && chromeResult.cookies.ct0) {
-      cookies.ct0 = chromeResult.cookies.ct0;
-      if (!cookies.source) cookies.source = chromeResult.cookies.source;
-    }
-  }

-  // 5. Firefox cookies (tertiary browser fallback)
-  if (allowFirefox && (!cookies.authToken || !cookies.ct0)) {
-    const firefoxResult = await extractCookiesFromFirefox(options.firefoxProfile);
-    warnings.push(...firefoxResult.warnings);
-
-    if (!cookies.authToken && firefoxResult.cookies.authToken) {
-      cookies.authToken = firefoxResult.cookies.authToken;
-      cookies.source = firefoxResult.cookies.source;
+    if (source === 'chrome') {
+      const chromeResult = await extractCookiesFromChrome(options.chromeProfile);
+      warnings.push(...chromeResult.warnings);
+      if (chromeResult.cookies.authToken && chromeResult.cookies.ct0) {
+        return { cookies: chromeResult.cookies, warnings };
+      }
+      continue;
    }
-    if (!cookies.ct0 && firefoxResult.cookies.ct0) {
-      cookies.ct0 = firefoxResult.cookies.ct0;
-      if (!cookies.source) cookies.source = firefoxResult.cookies.source;
+
+    if (source === 'firefox') {
+      const firefoxResult = await extractCookiesFromFirefox(options.firefoxProfile);
+      warnings.push(...firefoxResult.warnings);
+      if (firefoxResult.cookies.authToken && firefoxResult.cookies.ct0) {
+        return { cookies: firefoxResult.cookies, warnings };
+      }
    }
  }

@@ -552,5 +577,9 @@ export async function resolveCredentials(options: {
    warnings.push('Missing ct0 - provide via --ct0, CT0 env var, or login to x.com in Safari/Chrome/Firefox');
  }

+  if (cookies.authToken && cookies.ct0) {
+    cookies.cookieHeader = `auth_token=${cookies.authToken}; ct0=${cookies.ct0}`;
+  }
+
  return { cookies, warnings };
 }
@@ -76,3 +76,11 @@ export function formatStatsLine(
  if (!cfg.emoji) return `Likes ${likeCount}  Retweets ${retweetCount}  Replies ${replyCount}`;
  return `❤️ ${likeCount}  🔁 ${retweetCount}  💬 ${replyCount}`;
 }
+
+export function formatTweetUrl(tweetId: string): string {
+  return `https://x.com/i/status/${tweetId}`;
+}
+
+export function formatTweetUrlLine(tweetId: string, cfg: OutputConfig): string {
+  return `${labelPrefix('url', cfg)}${formatTweetUrl(tweetId)}`;
+}
@@ -2,6 +2,7 @@
 * Twitter GraphQL API client for posting tweets and replies
 */

+import { randomBytes, randomUUID } from 'node:crypto';
 import type { TwitterCookies } from './cookies.js';
 import queryIds from './query-ids.json' with { type: 'json' };
 import { runtimeQueryIds } from './runtime-query-ids.js';
@@ -10,6 +11,7 @@ const TWITTER_API_BASE = 'https://x.com/i/api/graphql';
 const TWITTER_GRAPHQL_POST_URL = 'https://x.com/i/api/graphql';
 const TWITTER_UPLOAD_URL = 'https://upload.twitter.com/i/media/upload.json';
 const TWITTER_MEDIA_METADATA_URL = 'https://x.com/i/api/1.1/media/metadata/create.json';
+const TWITTER_STATUS_UPDATE_URL = 'https://x.com/i/api/1.1/statuses/update.json';

 // Query IDs rotate frequently; the values in query-ids.json are refreshed by
 // scripts/update-query-ids.ts. The fallback values keep the client usable if
@@ -179,11 +181,15 @@ type GraphqlTweetResult = {
  };
 };

-export interface TweetResult {
-  success: boolean;
-  tweetId?: string;
-  error?: string;
-}
+export type TweetResult =
+  | {
+      success: true;
+      tweetId: string;
+    }
+  | {
+      success: false;
+      error: string;
+    };

 export interface UploadMediaResult {
  success: boolean;
@@ -254,8 +260,12 @@ interface CreateTweetResponse {
 export class TwitterClient {
  private authToken: string;
  private ct0: string;
+  private cookieHeader: string;
  private userAgent: string;
  private timeoutMs?: number;
+  private clientUuid: string;
+  private clientDeviceId: string;
+  private clientUserId?: string;

  constructor(options: TwitterClientOptions) {
    if (!options.cookies.authToken || !options.cookies.ct0) {
@@ -263,10 +273,13 @@ export class TwitterClient {
    }
    this.authToken = options.cookies.authToken;
    this.ct0 = options.cookies.ct0;
+    this.cookieHeader = options.cookies.cookieHeader || `auth_token=${this.authToken}; ct0=${this.ct0}`;
    this.userAgent =
      options.userAgent ||
      'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36';
    this.timeoutMs = options.timeoutMs;
+    this.clientUuid = randomUUID();
+    this.clientDeviceId = randomUUID();
  }

  private async getQueryId(operationName: OperationName): Promise<string> {
@@ -343,19 +356,34 @@ export class TwitterClient {
    return this.getJsonHeaders();
  }

+  private createTransactionId(): string {
+    return randomBytes(16).toString('hex');
+  }
+
  private getBaseHeaders(): Record<string, string> {
-    return {
+    const headers: Record<string, string> = {
+      accept: '*/*',
+      'accept-language': 'en-US,en;q=0.9',
      authorization:
        'Bearer AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA',
      'x-csrf-token': this.ct0,
      'x-twitter-auth-type': 'OAuth2Session',
      'x-twitter-active-user': 'yes',
      'x-twitter-client-language': 'en',
-      cookie: `auth_token=${this.authToken}; ct0=${this.ct0}`,
+      'x-client-uuid': this.clientUuid,
+      'x-twitter-client-deviceid': this.clientDeviceId,
+      'x-client-transaction-id': this.createTransactionId(),
+      cookie: this.cookieHeader,
      'user-agent': this.userAgent,
      origin: 'https://x.com',
      referer: 'https://x.com/',
    };
+
+    if (this.clientUserId) {
+      headers['x-twitter-client-user-id'] = this.clientUserId;
+    }
+
+    return headers;
  }

  private getJsonHeaders(): Record<string, string> {
@@ -1278,6 +1306,7 @@ export class TwitterClient {
    variables: Record<string, unknown>,
    features: Record<string, boolean>,
  ): Promise<TweetResult> {
+    await this.ensureClientUserId();
    let queryId = await this.getQueryId('CreateTweet');
    let urlWithOperation = `${TWITTER_API_BASE}/${queryId}/CreateTweet`;

@@ -1285,9 +1314,10 @@ export class TwitterClient {
    let body = buildBody();

    try {
+      const headers = { ...this.getHeaders(), referer: 'https://x.com/compose/post' };
      let response = await this.fetchWithTimeout(urlWithOperation, {
        method: 'POST',
-        headers: this.getHeaders(),
+        headers,
        body,
      });

@@ -1301,14 +1331,14 @@ export class TwitterClient {

        response = await this.fetchWithTimeout(urlWithOperation, {
          method: 'POST',
-          headers: this.getHeaders(),
+          headers: { ...this.getHeaders(), referer: 'https://x.com/compose/post' },
          body,
        });

        if (response.status === 404) {
          const retry = await this.fetchWithTimeout(TWITTER_GRAPHQL_POST_URL, {
            method: 'POST',
-            headers: this.getHeaders(),
+            headers: { ...this.getHeaders(), referer: 'https://x.com/compose/post' },
            body,
          });

@@ -1320,7 +1350,9 @@ export class TwitterClient {
          const data = (await retry.json()) as CreateTweetResponse;

          if (data.errors && data.errors.length > 0) {
-            return { success: false, error: data.errors.map((e) => e.message).join(', ') };
+            const fallback = await this.tryStatusUpdateFallback(data.errors, variables);
+            if (fallback) return fallback;
+            return { success: false, error: this.formatErrors(data.errors) };
          }

          const tweetId = data.data?.create_tweet?.tweet_results?.result?.rest_id;
@@ -1341,9 +1373,11 @@ export class TwitterClient {
      const data = (await response.json()) as CreateTweetResponse;

      if (data.errors && data.errors.length > 0) {
+        const fallback = await this.tryStatusUpdateFallback(data.errors, variables);
+        if (fallback) return fallback;
        return {
          success: false,
-          error: data.errors.map((e) => e.message).join(', '),
+          error: this.formatErrors(data.errors),
        };
      }

@@ -1367,6 +1401,123 @@ export class TwitterClient {
    }
  }

+  private formatErrors(errors: Array<{ message: string; code?: number }>): string {
+    return errors
+      .map((error) => (typeof error.code === 'number' ? `${error.message} (${error.code})` : error.message))
+      .join(', ');
+  }
+
+  private statusUpdateInputFromCreateTweetVariables(variables: Record<string, unknown>): {
+    text: string;
+    inReplyToTweetId?: string;
+    mediaIds?: string[];
+  } | null {
+    const text = typeof variables.tweet_text === 'string' ? variables.tweet_text : null;
+    if (!text) return null;
+
+    const reply = variables.reply;
+    const inReplyToTweetId =
+      reply &&
+      typeof reply === 'object' &&
+      typeof (reply as { in_reply_to_tweet_id?: unknown }).in_reply_to_tweet_id === 'string'
+        ? (reply as { in_reply_to_tweet_id: string }).in_reply_to_tweet_id
+        : undefined;
+
+    const media = variables.media;
+    const mediaEntities =
+      media && typeof media === 'object' ? (media as { media_entities?: unknown }).media_entities : undefined;
+
+    const mediaIds = Array.isArray(mediaEntities)
+      ? mediaEntities
+          .map((entity) =>
+            entity && typeof entity === 'object' && 'media_id' in (entity as Record<string, unknown>)
+              ? (entity as { media_id?: unknown }).media_id
+              : undefined,
+          )
+          .filter((value): value is string | number => typeof value === 'string' || typeof value === 'number')
+          .map((value) => String(value))
+      : undefined;
+
+    return { text, inReplyToTweetId, mediaIds: mediaIds && mediaIds.length > 0 ? mediaIds : undefined };
+  }
+
+  private async postStatusUpdate(input: {
+    text: string;
+    inReplyToTweetId?: string;
+    mediaIds?: string[];
+  }): Promise<TweetResult> {
+    const params = new URLSearchParams();
+    params.set('status', input.text);
+    if (input.inReplyToTweetId) {
+      params.set('in_reply_to_status_id', input.inReplyToTweetId);
+      params.set('auto_populate_reply_metadata', 'true');
+    }
+    if (input.mediaIds && input.mediaIds.length > 0) {
+      params.set('media_ids', input.mediaIds.join(','));
+    }
+
+    try {
+      const response = await this.fetchWithTimeout(TWITTER_STATUS_UPDATE_URL, {
+        method: 'POST',
+        headers: {
+          ...this.getBaseHeaders(),
+          'content-type': 'application/x-www-form-urlencoded',
+          referer: 'https://x.com/compose/post',
+        },
+        body: params.toString(),
+      });
+
+      if (!response.ok) {
+        const text = await response.text();
+        return { success: false, error: `HTTP ${response.status}: ${text.slice(0, 200)}` };
+      }
+
+      const data = (await response.json()) as {
+        id_str?: string;
+        id?: string | number;
+        errors?: Array<{ message: string; code?: number }>;
+      };
+
+      if (data.errors && data.errors.length > 0) {
+        return { success: false, error: this.formatErrors(data.errors) };
+      }
+
+      const tweetId =
+        typeof data.id_str === 'string' ? data.id_str : data.id !== undefined ? String(data.id) : undefined;
+
+      if (tweetId) return { success: true, tweetId };
+      return { success: false, error: 'Tweet created but no ID returned' };
+    } catch (error) {
+      return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+
+  private async tryStatusUpdateFallback(
+    errors: Array<{ message: string; code?: number }>,
+    variables: Record<string, unknown>,
+  ): Promise<TweetResult | null> {
+    if (!errors.some((error) => error.code === 226)) return null;
+    const input = this.statusUpdateInputFromCreateTweetVariables(variables);
+    if (!input) return null;
+
+    const fallback = await this.postStatusUpdate(input);
+    if (fallback.success) return fallback;
+
+    return {
+      success: false,
+      error: `${this.formatErrors(errors)} | fallback: ${fallback.error ?? 'Unknown error'}`,
+    };
+  }
+
+  private async ensureClientUserId(): Promise<void> {
+    if (process.env.NODE_ENV === 'test') return;
+    if (this.clientUserId) return;
+    const result = await this.getCurrentUser();
+    if (result.success && result.user?.id) {
+      this.clientUserId = result.user.id;
+    }
+  }
+
  /**
   * Search for tweets matching a query
   */
@@ -1543,6 +1694,7 @@ export class TwitterClient {
                  : null;

        if (username && userId) {
+          this.clientUserId = userId;
          return {
            success: true,
            user: {
@@ -1565,7 +1717,7 @@ export class TwitterClient {
      try {
        const response = await this.fetchWithTimeout(page, {
          headers: {
-            cookie: `auth_token=${this.authToken}; ct0=${this.ct0}`,
+            cookie: this.cookieHeader,
            'user-agent': this.userAgent,
          },
        });
@@ -105,6 +105,66 @@ describe('cookies', () => {
  });

  describe('resolveCredentials', () => {
+    it('honors cookieSource=firefox even when Safari has cookies', async () => {
+      const { resolveCredentials } = await import('../src/lib/cookies.js');
+      const fs = await import('node:fs');
+      const { execSync } = await import('node:child_process');
+
+      // Safari cookie file exists + contains different cookies
+      (fs.existsSync as unknown as vi.Mock).mockImplementation((path: string) => {
+        const lower = path.toLowerCase();
+        if (lower.endsWith('cookies.binarycookies')) return true;
+        if (lower.endsWith('cookies.sqlite')) return true;
+        if (lower.includes('firefox')) return true;
+        return false;
+      });
+      (fs.readdirSync as unknown as vi.Mock).mockReturnValue([
+        { isDirectory: () => true, name: 'abc.default-release' },
+      ]);
+      (fs.copyFileSync as unknown as vi.Mock).mockImplementation(() => {});
+      (fs.readFileSync as unknown as vi.Mock).mockReturnValue(
+        buildSafariCookiesFile([
+          buildSafariCookieRecord({ domain: '.x.com', name: 'auth_token', value: 'safari_auth' }),
+          buildSafariCookieRecord({ domain: '.x.com', name: 'ct0', value: 'safari_ct0' }),
+        ]),
+      );
+
+      // Firefox sqlite3 extraction returns different cookies
+      (execSync as unknown as vi.Mock).mockImplementation((cmd: string) => {
+        if (cmd.includes('sqlite3')) return 'auth_token|firefox_auth\nct0|firefox_ct0';
+        return '';
+      });
+
+      const result = await resolveCredentials({ cookieSource: 'firefox' });
+      expect(result.cookies.authToken).toBe('firefox_auth');
+      expect(result.cookies.ct0).toBe('firefox_ct0');
+      expect(result.cookies.source).toContain('Firefox');
+    });
+
+    itIfDarwin('honors cookieSource=safari', async () => {
+      const { resolveCredentials } = await import('../src/lib/cookies.js');
+      const fs = await import('node:fs');
+
+      (fs.existsSync as unknown as vi.Mock).mockImplementation((path: string) =>
+        path.toLowerCase().endsWith('cookies.binarycookies'),
+      );
+      (fs.copyFileSync as unknown as vi.Mock).mockImplementation(() => {});
+      (fs.mkdtempSync as unknown as vi.Mock).mockReturnValue('/tmp/test-dir');
+      (fs.readFileSync as unknown as vi.Mock).mockReturnValue(
+        buildSafariCookiesFile([
+          buildSafariCookieRecord({ domain: '.x.com', name: 'auth_token', value: 'safari_auth' }),
+          buildSafariCookieRecord({ domain: '.x.com', name: 'ct0', value: 'safari_ct0' }),
+        ]),
+      );
+
+      const result = await resolveCredentials({ cookieSource: 'safari' });
+      expect(result.cookies.authToken).toBe('safari_auth');
+      expect(result.cookies.ct0).toBe('safari_ct0');
+      expect(result.cookies.cookieHeader).toContain('auth_token=safari_auth');
+      expect(result.cookies.cookieHeader).toContain('ct0=safari_ct0');
+      expect(result.cookies.source).toBe('Safari');
+    });
+
    it('uses firefox when enabled and returns cookies', async () => {
      const { resolveCredentials } = await import('../src/lib/cookies.js');
      const fs = await import('node:fs');
@@ -126,14 +186,12 @@ describe('cookies', () => {
      const { execSync } = await import('node:child_process');
      (execSync as unknown as vi.Mock).mockReturnValue('auth_token|firefox_auth\nct0|firefox_ct0');

-      const result = await resolveCredentials({
-        allowFirefox: true,
-        allowChrome: false,
-        firefoxProfile: 'abc.default-release',
-      });
+      const result = await resolveCredentials({ cookieSource: 'firefox', firefoxProfile: 'abc.default-release' });

      expect(result.cookies.authToken).toBe('firefox_auth');
      expect(result.cookies.ct0).toBe('firefox_ct0');
+      expect(result.cookies.cookieHeader).toContain('auth_token=firefox_auth');
+      expect(result.cookies.cookieHeader).toContain('ct0=firefox_ct0');
      expect(result.cookies.source).toContain('Firefox');
    });

@@ -149,6 +207,7 @@ describe('cookies', () => {

      expect(result.cookies.authToken).toBe('cli_auth');
      expect(result.cookies.ct0).toBe('cli_ct0');
+      expect(result.cookies.cookieHeader).toBe('auth_token=cli_auth; ct0=cli_ct0');
      expect(result.cookies.source).toBe('CLI argument');
    });

@@ -157,7 +216,7 @@ describe('cookies', () => {
      process.env.CT0 = 'test_ct0';

      const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({ allowFirefox: false, allowChrome: false });
+      const result = await resolveCredentials({ cookieSource: 'safari' });

      expect(result.cookies.authToken).toBe('test_auth_token');
      expect(result.cookies.ct0).toBe('test_ct0');
@@ -169,7 +228,7 @@ describe('cookies', () => {
      process.env.TWITTER_CT0 = 'twitter_ct0';

      const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({ allowFirefox: false, allowChrome: false });
+      const result = await resolveCredentials({ cookieSource: 'safari' });

      expect(result.cookies.authToken).toBe('twitter_auth');
      expect(result.cookies.ct0).toBe('twitter_ct0');
@@ -191,7 +250,7 @@ describe('cookies', () => {
      process.env.CT0 = '';

      const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({ allowFirefox: false, allowChrome: false });
+      const result = await resolveCredentials({ cookieSource: 'safari' });

      expect(result.cookies.authToken).toBeNull();
      expect(result.cookies.ct0).toBeNull();
@@ -200,7 +259,7 @@ describe('cookies', () => {

    it('should warn when credentials are missing', async () => {
      const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({ allowFirefox: false, allowChrome: false });
+      const result = await resolveCredentials({ cookieSource: 'safari' });

      expect(result.warnings).toContain(
        'Missing auth_token - provide via --auth-token, AUTH_TOKEN env var, or login to x.com in Safari/Chrome/Firefox',
@@ -223,12 +282,7 @@ describe('cookies', () => {
      });

      const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({
-        allowSafari: false,
-        allowFirefox: false,
-        allowChrome: true,
-        chromeProfile: 'Default',
-      });
+      const result = await resolveCredentials({ cookieSource: 'chrome', chromeProfile: 'Default' });

      expect(result.cookies.authToken).toBe('test_auth');
      expect(result.cookies.ct0).toBe('test_ct0');
@@ -278,7 +332,7 @@ describe('cookies', () => {
      );

      const { resolveCredentials } = await import('../src/lib/cookies.js');
-      const result = await resolveCredentials({ allowSafari: true, allowChrome: true, allowFirefox: false });
+      const result = await resolveCredentials({ cookieSource: ['safari', 'chrome'] });

      expect(result.cookies.authToken).toBe('safari_auth');
      expect(result.cookies.ct0).toBe('safari_ct0');
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
  formatStatsLine,
+  formatTweetUrlLine,
  labelPrefix,
  resolveOutputConfigFromArgv,
  resolveOutputConfigFromCommander,
@@ -62,4 +63,13 @@ describe('output', () => {
    expect(formatStatsLine(stats, { plain: false, emoji: false, color: false })).toBe('Likes 0  Retweets 0  Replies 2');
    expect(formatStatsLine(stats, { plain: false, emoji: true, color: false })).toBe('❤️ 0  🔁 0  💬 2');
  });
+
+  it('always includes tweet URL in all modes', () => {
+    const id = '1234567890';
+    const url = `https://x.com/i/status/${id}`;
+
+    expect(formatTweetUrlLine(id, { plain: true, emoji: false, color: false })).toContain(url);
+    expect(formatTweetUrlLine(id, { plain: false, emoji: false, color: false })).toContain(url);
+    expect(formatTweetUrlLine(id, { plain: false, emoji: true, color: false })).toContain(url);
+  });
 });
@@ -6,6 +6,7 @@ describe('TwitterClient', () => {
  const validCookies = {
    authToken: 'test_auth_token',
    ct0: 'test_ct0_token',
+    cookieHeader: 'auth_token=test_auth_token; ct0=test_ct0_token',
    source: 'test',
  };

@@ -19,7 +20,7 @@ describe('TwitterClient', () => {
      expect(
        () =>
          new TwitterClient({
-            cookies: { authToken: null, ct0: 'test', source: null },
+            cookies: { authToken: null, ct0: 'test', cookieHeader: null, source: null },
          }),
      ).toThrow('Both authToken and ct0 cookies are required');
    });
@@ -28,7 +29,7 @@ describe('TwitterClient', () => {
      expect(
        () =>
          new TwitterClient({
-            cookies: { authToken: 'test', ct0: null, source: null },
+            cookies: { authToken: 'test', ct0: null, cookieHeader: null, source: null },
          }),
      ).toThrow('Both authToken and ct0 cookies are required');
    });
@@ -169,6 +170,118 @@ describe('TwitterClient', () => {
      expect(result.error).toContain('Rate limit exceeded');
    });

+    it('falls back to statuses/update.json when CreateTweet returns code 226', async () => {
+      mockFetch
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            errors: [
+              {
+                message: 'Authorization: This request looks like it might be automated.',
+                code: 226,
+              },
+            ],
+          }),
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            id_str: '1234567890',
+          }),
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.tweet('Hello world!');
+
+      expect(result.success).toBe(true);
+      expect(result.tweetId).toBe('1234567890');
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+      expect(String(mockFetch.mock.calls[1][0])).toContain('statuses/update.json');
+    });
+
+    it('surfaces statuses/update.json failure when CreateTweet returns code 226', async () => {
+      mockFetch
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            errors: [
+              {
+                message: 'Authorization: This request looks like it might be automated.',
+                code: 226,
+              },
+            ],
+          }),
+        })
+        .mockResolvedValueOnce({
+          ok: false,
+          status: 403,
+          text: async () => 'Forbidden',
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.tweet('Hello world!');
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('(226)');
+      expect(result.error).toContain('fallback: HTTP 403');
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+      expect(String(mockFetch.mock.calls[1][0])).toContain('statuses/update.json');
+    });
+
+    it('surfaces statuses/update.json API errors when CreateTweet returns code 226', async () => {
+      mockFetch
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            errors: [
+              {
+                message: 'Authorization: This request looks like it might be automated.',
+                code: 226,
+              },
+            ],
+          }),
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            errors: [{ message: 'Nope', code: 999 }],
+          }),
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.tweet('Hello world!');
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('(226)');
+      expect(result.error).toContain('fallback: Nope (999)');
+    });
+
+    it('surfaces statuses/update.json missing id when CreateTweet returns code 226', async () => {
+      mockFetch
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            errors: [
+              {
+                message: 'Authorization: This request looks like it might be automated.',
+                code: 226,
+              },
+            ],
+          }),
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({}),
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.tweet('Hello world!');
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('(226)');
+      expect(result.error).toContain('fallback: Tweet created but no ID returned');
+    });
+
    it('should handle HTTP errors', async () => {
      mockFetch.mockResolvedValueOnce({
        ok: false,
@@ -348,6 +461,42 @@ describe('TwitterClient', () => {
      expect(body.features.rweb_video_screen_enabled).toBe(true);
      expect(body.features.creator_subscriptions_tweet_preview_api_enabled).toBe(true);
    });
+
+    it('falls back to statuses/update.json for replies when CreateTweet returns code 226', async () => {
+      mockFetch
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            errors: [
+              {
+                message: 'Authorization: This request looks like it might be automated.',
+                code: 226,
+              },
+            ],
+          }),
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            id_str: '999',
+          }),
+        });
+
+      const client = new TwitterClient({ cookies: validCookies });
+      const result = await client.reply('This is a reply', '1234567890', ['111', '222']);
+
+      expect(result.success).toBe(true);
+      expect(result.tweetId).toBe('999');
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+
+      const [, options] = mockFetch.mock.calls[1];
+      expect(String(mockFetch.mock.calls[1][0])).toContain('statuses/update.json');
+      expect(options.method).toBe('POST');
+      expect(options.body).toContain('status=This+is+a+reply');
+      expect(options.body).toContain('in_reply_to_status_id=1234567890');
+      expect(options.body).toContain('auto_populate_reply_metadata=true');
+      expect(options.body).toContain('media_ids=111%2C222');
+    });
  });

  describe('getTweet', () => {
Author	SHA1	Message	Date
Peter Steinberger	c16726e9d8	fix: narrow tweet results	2025-12-26 22:40:45 +01:00
Peter Steinberger	2483e32c11	docs: release notes for 0.4.0	2025-12-26 22:39:13 +01:00
Peter Steinberger	dfdb7452f6	docs: add undocumented API disclaimer	2025-12-26 22:34:25 +01:00
Peter Steinberger	e8bc711c9e	docs: mark 0.4.0 unreleased	2025-12-26 22:33:20 +01:00
Peter Steinberger	a39948fbbd	feat: add bird.fast GitHub Pages site	2025-12-26 22:24:13 +01:00
Peter Steinberger	a518df5bb8	Create CNAME	2025-12-26 22:22:21 +01:00
Peter Steinberger	3db2145c2c	chore(release): 0.4.0	2025-12-26 22:08:07 +01:00
Peter Steinberger	a3d1ba29f7	test(cli): always print tweet URL	2025-12-26 22:04:08 +01:00
Peter Steinberger	1007d051e4	fix(tweet): fallback to statuses/update on 226	2025-12-26 21:57:36 +01:00
Peter Steinberger	e8e98e641a	refactor(auth)!: replace allow toggles with cookieSource	2025-12-26 21:28:27 +01:00
Peter Steinberger	008e550654	test: skip safari cookieSource on non-darwin	2025-12-26 21:18:41 +01:00
Peter Steinberger	1744f4cc24	feat(auth): allow selecting cookie source	2025-12-26 21:17:20 +01:00
Peter Steinberger	bd777f6acc	docs(changelog): start 0.3.1	2025-12-26 21:03:51 +01:00
Peter Steinberger	fe07d133c5	chore: undo 0.3.1 bump	2025-12-26 20:55:31 +01:00
Peter Steinberger	9a18b49b58	chore: bump to 0.3.1	2025-12-26 20:53:21 +01:00