@jackwener/opencli 1.4.1 → 1.5.1

package/dist/clis/producthunt/utils.test.js

@@ -0,0 +1,64 @@
+import { describe, it, expect } from 'vitest';
+import { parseFeed, pickVoteCount, PRODUCTHUNT_CATEGORY_SLUGS } from './utils.js';
+const SAMPLE_ATOM = `<?xml version="1.0" encoding="UTF-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+  <title>Product Hunt</title>
+  <entry>
+    <id>tag:www.producthunt.com,2005:Post/1001</id>
+    <published>2026-03-26T10:00:00-07:00</published>
+    <title>Awesome AI Tool</title>
+    <content type="html">&lt;p&gt;The best AI tool ever made&lt;/p&gt;&lt;p&gt;&lt;a href="..."&gt;Discussion&lt;/a&gt;&lt;/p&gt;</content>
+    <author><name>Jane Doe</name></author>
+    <link rel="alternate" type="text/html" href="https://www.producthunt.com/products/awesome-ai-tool"/>
+  </entry>
+  <entry>
+    <id>tag:www.producthunt.com,2005:Post/1002</id>
+    <published>2026-03-25T08:00:00-07:00</published>
+    <title>Dev Helper</title>
+    <content type="html">&lt;p&gt;Speeds up your workflow&lt;/p&gt;</content>
+    <author><name>John Smith</name></author>
+    <link rel="alternate" type="text/html" href="https://www.producthunt.com/products/dev-helper"/>
+  </entry>
+</feed>`;
+describe('parseFeed', () => {
+    it('parses entries into ranked posts', () => {
+        const posts = parseFeed(SAMPLE_ATOM);
+        expect(posts).toHaveLength(2);
+        expect(posts[0].rank).toBe(1);
+        expect(posts[0].name).toBe('Awesome AI Tool');
+        expect(posts[0].author).toBe('Jane Doe');
+        expect(posts[0].date).toBe('2026-03-26');
+        expect(posts[0].url).toBe('https://www.producthunt.com/products/awesome-ai-tool');
+        expect(posts[0].tagline).toContain('best AI tool');
+    });
+    it('strips HTML and Discussion link from tagline', () => {
+        const posts = parseFeed(SAMPLE_ATOM);
+        expect(posts[0].tagline).not.toContain('<p>');
+        expect(posts[0].tagline).not.toContain('Discussion');
+    });
+    it('returns empty array for empty feed', () => {
+        expect(parseFeed('<feed></feed>')).toHaveLength(0);
+    });
+    it('assigns sequential ranks', () => {
+        const posts = parseFeed(SAMPLE_ATOM);
+        expect(posts.map(p => p.rank)).toEqual([1, 2]);
+    });
+    it('prefers vote-like candidates over unrelated numeric badges', () => {
+        const votes = pickVoteCount([
+            { text: '12', className: 'font-semibold', inButton: false, inReviewLink: false },
+            { text: '98', className: 'vote-button', inButton: true, inReviewLink: false },
+        ]);
+        expect(votes).toBe('98');
+    });
+    it('ignores numbers inside review links', () => {
+        const votes = pickVoteCount([
+            { text: '120', className: 'text-secondary', inButton: false, inReviewLink: true },
+            { text: '45', className: 'vote-button', inButton: true, inReviewLink: false },
+        ]);
+        expect(votes).toBe('45');
+    });
+    it('shares category slugs across commands', () => {
+        expect(PRODUCTHUNT_CATEGORY_SLUGS).toContain('developer-tools');
+        expect(PRODUCTHUNT_CATEGORY_SLUGS).toContain('ai-agents');
+    });
+});

package/dist/clis/twitter/article.js

@@ -1,5 +1,7 @@
 import { AuthRequiredError, CommandExecutionError } from '../../errors.js';
 import { cli, Strategy } from '../../registry.js';
+import { resolveTwitterQueryId } from './shared.js';
+const TWEET_RESULT_BY_REST_ID_QUERY_ID = '7xflPyRiUxGVbJd4uWmbfg';
 cli({
     site: 'twitter',
     name: 'article',
@@ -20,6 +22,7 @@ cli({
         // Navigate to the tweet page for cookie context
         await page.goto(`https://x.com/i/status/${tweetId}`);
         await page.wait(3);
+        const queryId = await resolveTwitterQueryId(page, 'TweetResultByRestId', TWEET_RESULT_BY_REST_ID_QUERY_ID);
         const result = await page.evaluate(`
       async () => {
         const tweetId = "${tweetId}";
@@ -54,34 +57,7 @@ cli({
           withArticlePlainText: true,
         });
 
-        // Dynamically resolve queryId: GitHub community source → JS bundle scan → hardcoded fallback
-        async function resolveQueryId(operationName, fallbackId) {
-          try {
-            const ghResp = await fetch('https://raw.githubusercontent.com/fa0311/twitter-openapi/refs/heads/main/src/config/placeholder.json');
-            if (ghResp.ok) {
-              const data = await ghResp.json();
-              const entry = data[operationName];
-              if (entry && entry.queryId) return entry.queryId;
-            }
-          } catch {}
-          try {
-            const scripts = performance.getEntriesByType('resource')
-              .filter(r => r.name.includes('client-web') && r.name.endsWith('.js'))
-              .map(r => r.name);
-            for (const scriptUrl of scripts.slice(0, 15)) {
-              try {
-                const text = await (await fetch(scriptUrl)).text();
-                const re = new RegExp('queryId:"([A-Za-z0-9_-]+)"[^}]{0,200}operationName:"' + operationName + '"');
-                const m = text.match(re);
-                if (m) return m[1];
-              } catch {}
-            }
-          } catch {}
-          return fallbackId;
-        }
-
-        const queryId = await resolveQueryId('TweetResultByRestId', '7xflPyRiUxGVbJd4uWmbfg');
-        const url = '/i/api/graphql/' + queryId + '/TweetResultByRestId?variables='
+        const url = '/i/api/graphql/' + ${JSON.stringify(queryId)} + '/TweetResultByRestId?variables='
           + encodeURIComponent(variables)
           + '&features=' + encodeURIComponent(features)
           + '&fieldToggles=' + encodeURIComponent(fieldToggles);

package/dist/clis/twitter/likes.d.ts

@@ -0,0 +1,24 @@
+import { sanitizeQueryId } from './shared.js';
+interface LikedTweet {
+    id: string;
+    author: string;
+    name: string;
+    text: string;
+    likes: number;
+    retweets: number;
+    created_at: string;
+    url: string;
+}
+declare function buildLikesUrl(queryId: string, userId: string, count: number, cursor?: string | null): string;
+declare function buildUserByScreenNameUrl(queryId: string, screenName: string): string;
+declare function parseLikes(data: any, seen: Set<string>): {
+    tweets: LikedTweet[];
+    nextCursor: string | null;
+};
+export declare const __test__: {
+    sanitizeQueryId: typeof sanitizeQueryId;
+    buildLikesUrl: typeof buildLikesUrl;
+    buildUserByScreenNameUrl: typeof buildUserByScreenNameUrl;
+    parseLikes: typeof parseLikes;
+};
+export {};

package/dist/clis/twitter/likes.js

@@ -0,0 +1,217 @@
+import { cli, Strategy } from '../../registry.js';
+import { AuthRequiredError, CommandExecutionError } from '../../errors.js';
+import { resolveTwitterQueryId, sanitizeQueryId } from './shared.js';
+const BEARER_TOKEN = 'AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA';
+const LIKES_QUERY_ID = 'RozQdCp4CilQzrcuU0NY5w';
+const USER_BY_SCREEN_NAME_QUERY_ID = 'qRednkZG-rn1P6b48NINmQ';
+const FEATURES = {
+    rweb_video_screen_enabled: false,
+    profile_label_improvements_pcf_label_in_post_enabled: true,
+    responsive_web_profile_redirect_enabled: false,
+    rweb_tipjar_consumption_enabled: false,
+    verified_phone_label_enabled: false,
+    creator_subscriptions_tweet_preview_api_enabled: true,
+    responsive_web_graphql_timeline_navigation_enabled: true,
+    responsive_web_graphql_skip_user_profile_image_extensions_enabled: false,
+    premium_content_api_read_enabled: false,
+    communities_web_enable_tweet_community_results_fetch: true,
+    c9s_tweet_anatomy_moderator_badge_enabled: true,
+    responsive_web_grok_analyze_button_fetch_trends_enabled: false,
+    responsive_web_grok_analyze_post_followups_enabled: true,
+    responsive_web_jetfuel_frame: true,
+    responsive_web_grok_share_attachment_enabled: true,
+    responsive_web_grok_annotations_enabled: true,
+    articles_preview_enabled: true,
+    responsive_web_edit_tweet_api_enabled: true,
+    graphql_is_translatable_rweb_tweet_is_translatable_enabled: true,
+    view_counts_everywhere_api_enabled: true,
+    longform_notetweets_consumption_enabled: true,
+    responsive_web_twitter_article_tweet_consumption_enabled: true,
+    tweet_awards_web_tipping_enabled: false,
+    content_disclosure_indicator_enabled: true,
+    content_disclosure_ai_generated_indicator_enabled: true,
+    responsive_web_grok_show_grok_translated_post: false,
+    responsive_web_grok_analysis_button_from_backend: true,
+    post_ctas_fetch_enabled: false,
+    freedom_of_speech_not_reach_fetch_enabled: true,
+    standardized_nudges_misinfo: true,
+    tweet_with_visibility_results_prefer_gql_limited_actions_policy_enabled: true,
+    longform_notetweets_rich_text_read_enabled: true,
+    longform_notetweets_inline_media_enabled: false,
+    responsive_web_grok_image_annotation_enabled: true,
+    responsive_web_grok_imagine_annotation_enabled: true,
+    responsive_web_grok_community_note_auto_translation_is_enabled: false,
+    responsive_web_enhance_cards_enabled: false
+};
+function buildLikesUrl(queryId, userId, count, cursor) {
+    const vars = {
+        userId,
+        count,
+        includePromotedContent: false,
+        withClientEventToken: false,
+        withBirdwatchNotes: false,
+        withVoice: true
+    };
+    if (cursor)
+        vars.cursor = cursor;
+    return `/i/api/graphql/${queryId}/Likes`
+        + `?variables=${encodeURIComponent(JSON.stringify(vars))}`
+        + `&features=${encodeURIComponent(JSON.stringify(FEATURES))}`;
+}
+function buildUserByScreenNameUrl(queryId, screenName) {
+    const vars = JSON.stringify({ screen_name: screenName, withSafetyModeUserFields: true });
+    const feats = JSON.stringify({
+        hidden_profile_subscriptions_enabled: true,
+        rweb_tipjar_consumption_enabled: true,
+        responsive_web_graphql_exclude_directive_enabled: true,
+        verified_phone_label_enabled: false,
+        subscriptions_verification_info_is_identity_verified_enabled: true,
+        subscriptions_verification_info_verified_since_enabled: true,
+        highlights_tweets_tab_ui_enabled: true,
+        responsive_web_twitter_article_notes_tab_enabled: true,
+        subscriptions_feature_can_gift_premium: true,
+        creator_subscriptions_tweet_preview_api_enabled: true,
+        responsive_web_graphql_skip_user_profile_image_extensions_enabled: false,
+        responsive_web_graphql_timeline_navigation_enabled: true,
+    });
+    return `/i/api/graphql/${queryId}/UserByScreenName`
+        + `?variables=${encodeURIComponent(vars)}`
+        + `&features=${encodeURIComponent(feats)}`;
+}
+function extractLikedTweet(result, seen) {
+    if (!result)
+        return null;
+    const tw = result.tweet || result;
+    const legacy = tw.legacy || {};
+    if (!tw.rest_id || seen.has(tw.rest_id))
+        return null;
+    seen.add(tw.rest_id);
+    const user = tw.core?.user_results?.result;
+    const screenName = user?.legacy?.screen_name || user?.core?.screen_name || 'unknown';
+    const displayName = user?.legacy?.name || user?.core?.name || '';
+    const noteText = tw.note_tweet?.note_tweet_results?.result?.text;
+    return {
+        id: tw.rest_id,
+        author: screenName,
+        name: displayName,
+        text: noteText || legacy.full_text || '',
+        likes: legacy.favorite_count || 0,
+        retweets: legacy.retweet_count || 0,
+        created_at: legacy.created_at || '',
+        url: `https://x.com/${screenName}/status/${tw.rest_id}`,
+    };
+}
+function parseLikes(data, seen) {
+    const tweets = [];
+    let nextCursor = null;
+    const instructions = data?.data?.user?.result?.timeline_v2?.timeline?.instructions
+        || data?.data?.user?.result?.timeline?.timeline?.instructions
+        || [];
+    for (const inst of instructions) {
+        for (const entry of inst.entries || []) {
+            const content = entry.content;
+            if (content?.entryType === 'TimelineTimelineCursor' || content?.__typename === 'TimelineTimelineCursor') {
+                if (content.cursorType === 'Bottom' || content.cursorType === 'ShowMore')
+                    nextCursor = content.value;
+                continue;
+            }
+            if (entry.entryId?.startsWith('cursor-bottom-') || entry.entryId?.startsWith('cursor-showMore-')) {
+                nextCursor = content?.value || content?.itemContent?.value || nextCursor;
+                continue;
+            }
+            const direct = extractLikedTweet(content?.itemContent?.tweet_results?.result, seen);
+            if (direct) {
+                tweets.push(direct);
+                continue;
+            }
+            for (const item of content?.items || []) {
+                const nested = extractLikedTweet(item.item?.itemContent?.tweet_results?.result, seen);
+                if (nested)
+                    tweets.push(nested);
+            }
+        }
+    }
+    return { tweets, nextCursor };
+}
+cli({
+    site: 'twitter',
+    name: 'likes',
+    description: 'Fetch liked tweets of a Twitter user',
+    domain: 'x.com',
+    strategy: Strategy.COOKIE,
+    browser: true,
+    args: [
+        { name: 'username', type: 'string', positional: true, help: 'Twitter screen name (without @). Defaults to logged-in user.' },
+        { name: 'limit', type: 'int', default: 20 },
+    ],
+    columns: ['author', 'name', 'text', 'likes', 'url'],
+    func: async (page, kwargs) => {
+        const limit = kwargs.limit || 20;
+        let username = (kwargs.username || '').replace(/^@/, '');
+        await page.goto('https://x.com');
+        await page.wait(3);
+        const ct0 = await page.evaluate(`() => {
+      return document.cookie.split(';').map(c => c.trim()).find(c => c.startsWith('ct0='))?.split('=')[1] || null;
+    }`);
+        if (!ct0)
+            throw new AuthRequiredError('x.com', 'Not logged into x.com (no ct0 cookie)');
+        // If no username provided, detect the logged-in user
+        if (!username) {
+            const href = await page.evaluate(`() => {
+        const link = document.querySelector('a[data-testid="AppTabBar_Profile_Link"]');
+        return link ? link.getAttribute('href') : null;
+      }`);
+            if (!href)
+                throw new AuthRequiredError('x.com', 'Could not detect logged-in user. Are you logged in?');
+            username = href.replace('/', '');
+        }
+        const likesQueryId = await resolveTwitterQueryId(page, 'Likes', LIKES_QUERY_ID);
+        const userByScreenNameQueryId = await resolveTwitterQueryId(page, 'UserByScreenName', USER_BY_SCREEN_NAME_QUERY_ID);
+        const headers = JSON.stringify({
+            'Authorization': `Bearer ${decodeURIComponent(BEARER_TOKEN)}`,
+            'X-Csrf-Token': ct0,
+            'X-Twitter-Auth-Type': 'OAuth2Session',
+            'X-Twitter-Active-User': 'yes',
+        });
+        // Get userId from screen_name
+        const userId = await page.evaluate(`async () => {
+      const screenName = ${JSON.stringify(username)};
+      const url = ${JSON.stringify(buildUserByScreenNameUrl(userByScreenNameQueryId, username))};
+      const resp = await fetch(url, { headers: ${headers}, credentials: 'include' });
+      if (!resp.ok) return null;
+      const d = await resp.json();
+      return d.data?.user?.result?.rest_id || null;
+    }`);
+        if (!userId) {
+            throw new CommandExecutionError(`Could not find user @${username}`);
+        }
+        const allTweets = [];
+        const seen = new Set();
+        let cursor = null;
+        for (let i = 0; i < 5 && allTweets.length < limit; i++) {
+            const fetchCount = Math.min(100, limit - allTweets.length + 10);
+            const apiUrl = buildLikesUrl(likesQueryId, userId, fetchCount, cursor);
+            const data = await page.evaluate(`async () => {
+        const r = await fetch("${apiUrl}", { headers: ${headers}, credentials: 'include' });
+        return r.ok ? await r.json() : { error: r.status };
+      }`);
+            if (data?.error) {
+                if (allTweets.length === 0)
+                    throw new CommandExecutionError(`HTTP ${data.error}: Failed to fetch likes. queryId may have expired.`);
+                break;
+            }
+            const { tweets, nextCursor } = parseLikes(data, seen);
+            allTweets.push(...tweets);
+            if (!nextCursor || nextCursor === cursor)
+                break;
+            cursor = nextCursor;
+        }
+        return allTweets.slice(0, limit);
+    },
+});
+export const __test__ = {
+    sanitizeQueryId,
+    buildLikesUrl,
+    buildUserByScreenNameUrl,
+    parseLikes,
+};

package/dist/clis/twitter/likes.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/clis/twitter/likes.test.js

@@ -0,0 +1,85 @@
+import { describe, expect, it } from 'vitest';
+import { __test__ } from './likes.js';
+describe('twitter likes helpers', () => {
+    it('falls back when queryId contains unsafe characters', () => {
+        expect(__test__.sanitizeQueryId('safe_Query-123', 'fallback')).toBe('safe_Query-123');
+        expect(__test__.sanitizeQueryId('bad"id', 'fallback')).toBe('fallback');
+        expect(__test__.sanitizeQueryId('bad/id', 'fallback')).toBe('fallback');
+        expect(__test__.sanitizeQueryId(null, 'fallback')).toBe('fallback');
+    });
+    it('builds likes url with the provided queryId', () => {
+        const url = __test__.buildLikesUrl('query123', '42', 20, 'cursor-1');
+        expect(url).toContain('/i/api/graphql/query123/Likes');
+        expect(decodeURIComponent(url)).toContain('"userId":"42"');
+        expect(decodeURIComponent(url)).toContain('"cursor":"cursor-1"');
+    });
+    it('parses likes timeline entries and bottom cursor', () => {
+        const payload = {
+            data: {
+                user: {
+                    result: {
+                        timeline_v2: {
+                            timeline: {
+                                instructions: [
+                                    {
+                                        entries: [
+                                            {
+                                                entryId: 'tweet-1',
+                                                content: {
+                                                    itemContent: {
+                                                        tweet_results: {
+                                                            result: {
+                                                                rest_id: '1',
+                                                                legacy: {
+                                                                    full_text: 'liked post',
+                                                                    favorite_count: 7,
+                                                                    retweet_count: 2,
+                                                                    created_at: 'now',
+                                                                },
+                                                                core: {
+                                                                    user_results: {
+                                                                        result: {
+                                                                            legacy: {
+                                                                                screen_name: 'alice',
+                                                                                name: 'Alice',
+                                                                            },
+                                                                        },
+                                                                    },
+                                                                },
+                                                            },
+                                                        },
+                                                    },
+                                                },
+                                            },
+                                            {
+                                                entryId: 'cursor-bottom-1',
+                                                content: {
+                                                    entryType: 'TimelineTimelineCursor',
+                                                    cursorType: 'Bottom',
+                                                    value: 'cursor-next',
+                                                },
+                                            },
+                                        ],
+                                    },
+                                ],
+                            },
+                        },
+                    },
+                },
+            },
+        };
+        const result = __test__.parseLikes(payload, new Set());
+        expect(result.nextCursor).toBe('cursor-next');
+        expect(result.tweets).toHaveLength(1);
+        expect(result.tweets[0]).toMatchObject({
+            id: '1',
+            author: 'alice',
+            name: 'Alice',
+            text: 'liked post',
+            likes: 7,
+            retweets: 2,
+            created_at: 'now',
+            url: 'https://x.com/alice/status/1',
+        });
+    });
+});

package/dist/clis/twitter/profile.js

@@ -1,5 +1,7 @@
 import { AuthRequiredError, CommandExecutionError } from '../../errors.js';
 import { cli, Strategy } from '../../registry.js';
+import { resolveTwitterQueryId } from './shared.js';
+const USER_BY_SCREEN_NAME_QUERY_ID = 'qRednkZG-rn1P6b48NINmQ';
 cli({
     site: 'twitter',
     name: 'profile',
@@ -28,6 +30,7 @@ cli({
         // Navigate directly to the user's profile page (gives us cookie context)
         await page.goto(`https://x.com/${username}`);
         await page.wait(3);
+        const queryId = await resolveTwitterQueryId(page, 'UserByScreenName', USER_BY_SCREEN_NAME_QUERY_ID);
         const result = await page.evaluate(`
       async () => {
         const screenName = "${username}";
@@ -61,34 +64,7 @@ cli({
           responsive_web_graphql_timeline_navigation_enabled: true,
         });
 
-        // Dynamically resolve queryId: GitHub community source → JS bundle scan → hardcoded fallback
-        async function resolveQueryId(operationName, fallbackId) {
-          try {
-            const ghResp = await fetch('https://raw.githubusercontent.com/fa0311/twitter-openapi/refs/heads/main/src/config/placeholder.json');
-            if (ghResp.ok) {
-              const data = await ghResp.json();
-              const entry = data[operationName];
-              if (entry && entry.queryId) return entry.queryId;
-            }
-          } catch {}
-          try {
-            const scripts = performance.getEntriesByType('resource')
-              .filter(r => r.name.includes('client-web') && r.name.endsWith('.js'))
-              .map(r => r.name);
-            for (const scriptUrl of scripts.slice(0, 15)) {
-              try {
-                const text = await (await fetch(scriptUrl)).text();
-                const re = new RegExp('queryId:"([A-Za-z0-9_-]+)"[^}]{0,200}operationName:"' + operationName + '"');
-                const m = text.match(re);
-                if (m) return m[1];
-              } catch {}
-            }
-          } catch {}
-          return fallbackId;
-        }
-
-        const queryId = await resolveQueryId('UserByScreenName', 'qRednkZG-rn1P6b48NINmQ');
-        const url = '/i/api/graphql/' + queryId + '/UserByScreenName?variables='
+        const url = '/i/api/graphql/' + ${JSON.stringify(queryId)} + '/UserByScreenName?variables='
           + encodeURIComponent(variables)
           + '&features=' + encodeURIComponent(features);
 

package/dist/clis/twitter/search.js

@@ -40,7 +40,7 @@ cli({
         { name: 'filter', type: 'string', default: 'top', choices: ['top', 'live'] },
         { name: 'limit', type: 'int', default: 15 },
     ],
-    columns: ['id', 'author', 'text', 'likes', 'views', 'url'],
+    columns: ['id', 'author', 'text', 'created_at', 'likes', 'views', 'url'],
     func: async (page, kwargs) => {
         const query = kwargs.query;
         const filter = kwargs.filter === 'live' ? 'live' : 'top';
@@ -91,6 +91,7 @@ cli({
                         id: tweet.rest_id,
                         author: tweetUser?.core?.screen_name || tweetUser?.legacy?.screen_name || 'unknown',
                         text: tweet.note_tweet?.note_tweet_results?.result?.text || tweet.legacy?.full_text || '',
+                        created_at: tweet.legacy?.created_at || '',
                         likes: tweet.legacy?.favorite_count || 0,
                         views: tweet.views?.count || '0',
                         url: `https://x.com/i/status/${tweet.rest_id}`

package/dist/clis/twitter/search.test.js

@@ -36,6 +36,7 @@ describe('twitter search command', () => {
                                                                     legacy: {
                                                                         full_text: 'hello world',
                                                                         favorite_count: 7,
+                                                                        created_at: 'Thu Mar 26 10:30:00 +0000 2026',
                                                                     },
                                                                     core: {
                                                                         user_results: {
@@ -70,6 +71,7 @@ describe('twitter search command', () => {
                 id: '1',
                 author: 'alice',
                 text: 'hello world',
+                created_at: 'Thu Mar 26 10:30:00 +0000 2026',
                 likes: 7,
                 views: '12',
                 url: 'https://x.com/i/status/1',

package/dist/clis/twitter/shared.d.ts

@@ -0,0 +1,6 @@
+import type { IPage } from '../../types.js';
+export declare function sanitizeQueryId(resolved: unknown, fallbackId: string): string;
+export declare function resolveTwitterQueryId(page: Pick<IPage, 'evaluate'>, operationName: string, fallbackId: string): Promise<string>;
+export declare const __test__: {
+    sanitizeQueryId: typeof sanitizeQueryId;
+};

package/dist/clis/twitter/shared.js

@@ -0,0 +1,35 @@
+const QUERY_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+export function sanitizeQueryId(resolved, fallbackId) {
+    return typeof resolved === 'string' && QUERY_ID_PATTERN.test(resolved) ? resolved : fallbackId;
+}
+export async function resolveTwitterQueryId(page, operationName, fallbackId) {
+    const resolved = await page.evaluate(`async () => {
+    const operationName = ${JSON.stringify(operationName)};
+    try {
+      const ghResp = await fetch('https://raw.githubusercontent.com/fa0311/twitter-openapi/refs/heads/main/src/config/placeholder.json');
+      if (ghResp.ok) {
+        const data = await ghResp.json();
+        const entry = data?.[operationName];
+        if (entry && entry.queryId) return entry.queryId;
+      }
+    } catch {}
+    try {
+      const scripts = performance.getEntriesByType('resource')
+        .filter(r => r.name.includes('client-web') && r.name.endsWith('.js'))
+        .map(r => r.name);
+      for (const scriptUrl of scripts.slice(0, 15)) {
+        try {
+          const text = await (await fetch(scriptUrl)).text();
+          const re = new RegExp('queryId:"([A-Za-z0-9_-]+)"[^}]{0,200}operationName:"' + operationName + '"');
+          const match = text.match(re);
+          if (match) return match[1];
+        } catch {}
+      }
+    } catch {}
+    return null;
+  }`);
+    return sanitizeQueryId(resolved, fallbackId);
+}
+export const __test__ = {
+    sanitizeQueryId,
+};

package/dist/clis/twitter/timeline.js

@@ -1,5 +1,6 @@
 import { AuthRequiredError, CommandExecutionError } from '../../errors.js';
 import { cli, Strategy } from '../../registry.js';
+import { resolveTwitterQueryId } from './shared.js';
 // ── Twitter GraphQL constants ──────────────────────────────────────────
 const BEARER_TOKEN = 'AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA';
 const HOME_TIMELINE_QUERY_ID = 'c-CzHF1LboFilMpsx4ZCrQ';
@@ -162,19 +163,7 @@ cli({
         if (!ct0)
             throw new AuthRequiredError('x.com', 'Not logged into x.com (no ct0 cookie)');
         // Dynamically resolve queryId for the selected endpoint
-        const resolved = await page.evaluate(`async () => {
-      try {
-        const ghResp = await fetch('https://raw.githubusercontent.com/fa0311/twitter-openapi/refs/heads/main/src/config/placeholder.json');
-        if (ghResp.ok) {
-          const data = await ghResp.json();
-          const entry = data['${endpoint}'];
-          if (entry && entry.queryId) return entry.queryId;
-        }
-      } catch {}
-      return null;
-    }`);
-        // Validate queryId format to prevent injection from untrusted upstream
-        const queryId = typeof resolved === 'string' && /^[A-Za-z0-9_-]+$/.test(resolved) ? resolved : fallbackQueryId;
+        const queryId = await resolveTwitterQueryId(page, endpoint, fallbackQueryId);
         // Build auth headers
         const headers = JSON.stringify({
             Authorization: `Bearer ${decodeURIComponent(BEARER_TOKEN)}`,