@jackwener/opencli 1.7.13 → 1.7.14

package/cli-manifest.json

@@ -22760,6 +22760,40 @@
     "sourceFile": "twitter/profile.js",
     "navigateBefore": "https://x.com"
   },
+  {
+    "site": "twitter",
+    "name": "quote",
+    "description": "Quote-tweet a specific tweet with your own text",
+    "access": "write",
+    "domain": "x.com",
+    "strategy": "ui",
+    "browser": true,
+    "args": [
+      {
+        "name": "url",
+        "type": "string",
+        "required": true,
+        "positional": true,
+        "help": "The URL of the tweet to quote"
+      },
+      {
+        "name": "text",
+        "type": "string",
+        "required": true,
+        "positional": true,
+        "help": "The text content of your quote"
+      }
+    ],
+    "columns": [
+      "status",
+      "message",
+      "text"
+    ],
+    "type": "js",
+    "modulePath": "twitter/quote.js",
+    "sourceFile": "twitter/quote.js",
+    "navigateBefore": true
+  },
   {
     "site": "twitter",
     "name": "reply",
@@ -22855,6 +22889,32 @@
     "sourceFile": "twitter/reply-dm.js",
     "navigateBefore": true
   },
+  {
+    "site": "twitter",
+    "name": "retweet",
+    "description": "Retweet a specific tweet",
+    "access": "write",
+    "domain": "x.com",
+    "strategy": "ui",
+    "browser": true,
+    "args": [
+      {
+        "name": "url",
+        "type": "string",
+        "required": true,
+        "positional": true,
+        "help": "The URL of the tweet to retweet"
+      }
+    ],
+    "columns": [
+      "status",
+      "message"
+    ],
+    "type": "js",
+    "modulePath": "twitter/retweet.js",
+    "sourceFile": "twitter/retweet.js",
+    "navigateBefore": true
+  },
   {
     "site": "twitter",
     "name": "search",
@@ -23139,6 +23199,58 @@
     "sourceFile": "twitter/unfollow.js",
     "navigateBefore": true
   },
+  {
+    "site": "twitter",
+    "name": "unlike",
+    "description": "Remove a like from a specific tweet",
+    "access": "write",
+    "domain": "x.com",
+    "strategy": "ui",
+    "browser": true,
+    "args": [
+      {
+        "name": "url",
+        "type": "string",
+        "required": true,
+        "positional": true,
+        "help": "The URL of the tweet to unlike"
+      }
+    ],
+    "columns": [
+      "status",
+      "message"
+    ],
+    "type": "js",
+    "modulePath": "twitter/unlike.js",
+    "sourceFile": "twitter/unlike.js",
+    "navigateBefore": true
+  },
+  {
+    "site": "twitter",
+    "name": "unretweet",
+    "description": "Undo a retweet on a specific tweet",
+    "access": "write",
+    "domain": "x.com",
+    "strategy": "ui",
+    "browser": true,
+    "args": [
+      {
+        "name": "url",
+        "type": "string",
+        "required": true,
+        "positional": true,
+        "help": "The URL of the tweet to unretweet"
+      }
+    ],
+    "columns": [
+      "status",
+      "message"
+    ],
+    "type": "js",
+    "modulePath": "twitter/unretweet.js",
+    "sourceFile": "twitter/unretweet.js",
+    "navigateBefore": true
+  },
   {
     "site": "uisdc",
     "name": "news",

package/clis/twitter/quote.js

@@ -0,0 +1,139 @@
+import { CommandExecutionError } from '@jackwener/opencli/errors';
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { parseTweetUrl } from './shared.js';
+
+function extractTweetId(url) {
+    return parseTweetUrl(url).id;
+}
+
+function buildQuoteComposerUrl(url) {
+    // Twitter/X quote-tweet compose URL: the `url` param attaches the source
+    // tweet as a quoted card. Validating tweet-id shape early surfaces obvious
+    // typos before any browser interaction.
+    const parsed = parseTweetUrl(url);
+    return `https://x.com/compose/post?url=${encodeURIComponent(parsed.url)}`;
+}
+
+async function submitQuote(page, text, tweetId) {
+    return page.evaluate(`(async () => {
+        try {
+            const visible = (el) => !!el && (el.offsetParent !== null || el.getClientRects().length > 0);
+            const getStatusId = (href) => {
+                try {
+                    const match = new URL(href, window.location.origin).pathname.match(/^\\/(?:[^/]+|i)\\/status\\/(\\d+)\\/?$/);
+                    return match?.[1] || null;
+                } catch {
+                    return null;
+                }
+            };
+            const boxes = Array.from(document.querySelectorAll('[data-testid="tweetTextarea_0"]'));
+            const box = boxes.find(visible) || boxes[0];
+            if (!box) {
+                return { ok: false, message: 'Could not find the quote composer text area. Are you logged in?' };
+            }
+
+            box.focus();
+            const textToInsert = ${JSON.stringify(text)};
+            const tweetId = ${JSON.stringify(tweetId)};
+            // execCommand('insertText') is more reliable with Twitter's Draft.js editor.
+            if (!document.execCommand('insertText', false, textToInsert)) {
+                // Fallback to paste event if execCommand fails.
+                const dataTransfer = new DataTransfer();
+                dataTransfer.setData('text/plain', textToInsert);
+                box.dispatchEvent(new ClipboardEvent('paste', {
+                    clipboardData: dataTransfer,
+                    bubbles: true,
+                    cancelable: true,
+                }));
+            }
+
+            await new Promise(r => setTimeout(r, 1000));
+
+            // Confirm the quoted card is rendered before submitting; otherwise we may
+            // accidentally post a plain tweet without the quote attachment.
+            let cardAttempts = 0;
+            let hasQuoteCard = false;
+            while (cardAttempts < 20) {
+                hasQuoteCard = Array.from(document.querySelectorAll('a[href*="/status/"]'))
+                    .some((link) => getStatusId(link.href) === tweetId);
+                if (hasQuoteCard) break;
+                await new Promise(r => setTimeout(r, 250));
+                cardAttempts++;
+            }
+            if (!hasQuoteCard) {
+                return { ok: false, message: 'Quote target did not render in the composer. The source tweet may be deleted or restricted.' };
+            }
+
+            const buttons = Array.from(
+                document.querySelectorAll('[data-testid="tweetButton"], [data-testid="tweetButtonInline"]')
+            );
+            const btn = buttons.find((el) => visible(el) && !el.disabled && el.getAttribute('aria-disabled') !== 'true');
+            if (!btn) {
+                return { ok: false, message: 'Tweet button is disabled or not found.' };
+            }
+
+            btn.click();
+
+            const normalize = s => String(s || '').replace(/\\u00a0/g, ' ').replace(/\\s+/g, ' ').trim();
+            const expectedText = normalize(textToInsert);
+            for (let i = 0; i < 30; i++) {
+                await new Promise(r => setTimeout(r, 500));
+                const toasts = Array.from(document.querySelectorAll('[role="alert"], [data-testid="toast"]'))
+                    .filter((el) => visible(el));
+                const successToast = toasts.find((el) => /sent|posted|your post was sent|your tweet was sent/i.test(el.textContent || ''));
+                if (successToast) return { ok: true, message: 'Quote tweet posted successfully.' };
+                const alert = toasts.find((el) => /failed|error|try again|not sent|could not/i.test(el.textContent || ''));
+                if (alert) return { ok: false, message: (alert.textContent || 'Quote tweet failed to post.').trim() };
+
+                const visibleBoxes = Array.from(document.querySelectorAll('[data-testid="tweetTextarea_0"]')).filter(visible);
+                const composerStillHasText = visibleBoxes.some((box) =>
+                    normalize(box.innerText || box.textContent || '').includes(expectedText)
+                );
+                if (!composerStillHasText) return { ok: true, message: 'Quote tweet posted successfully.' };
+            }
+            return { ok: false, message: 'Quote tweet submission did not complete before timeout.' };
+        } catch (e) {
+            return { ok: false, message: e.toString() };
+        }
+    })()`);
+}
+
+cli({
+    site: 'twitter',
+    name: 'quote',
+    access: 'write',
+    description: 'Quote-tweet a specific tweet with your own text',
+    domain: 'x.com',
+    strategy: Strategy.UI,
+    browser: true,
+    args: [
+        { name: 'url', type: 'string', required: true, positional: true, help: 'The URL of the tweet to quote' },
+        { name: 'text', type: 'string', required: true, positional: true, help: 'The text content of your quote' },
+    ],
+    columns: ['status', 'message', 'text'],
+    func: async (page, kwargs) => {
+        if (!page)
+            throw new CommandExecutionError('Browser session required for twitter quote');
+
+        // Dedicated composer is more reliable than the inline quote-tweet button.
+        const target = parseTweetUrl(kwargs.url);
+        await page.goto(`https://x.com/compose/post?url=${encodeURIComponent(target.url)}`, { waitUntil: 'load', settleMs: 2500 });
+        await page.wait({ selector: '[data-testid="tweetTextarea_0"]', timeout: 15 });
+
+        const result = await submitQuote(page, kwargs.text, target.id);
+        if (result.ok) {
+            // Wait for network submission to complete
+            await page.wait(3);
+        }
+        return [{
+                status: result.ok ? 'success' : 'failed',
+                message: result.message,
+                text: kwargs.text,
+            }];
+    }
+});
+
+export const __test__ = {
+    buildQuoteComposerUrl,
+    extractTweetId,
+};

package/clis/twitter/quote.test.js

@@ -0,0 +1,106 @@
+import { describe, expect, it } from 'vitest';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
+import { getRegistry } from '@jackwener/opencli/registry';
+import { __test__ } from './quote.js';
+import './quote.js';
+import { createPageMock } from '../test-utils.js';
+
+describe('twitter quote helpers', () => {
+    it('extracts tweet ids from both user and i/status URLs', () => {
+        expect(__test__.extractTweetId('https://x.com/alice/status/2040254679301718161?s=20')).toBe('2040254679301718161');
+        expect(__test__.extractTweetId('https://x.com/i/status/2040318731105313143')).toBe('2040318731105313143');
+    });
+
+    it('builds the quote composer URL with the source tweet attached as ?url=...', () => {
+        const composeUrl = __test__.buildQuoteComposerUrl('https://x.com/alice/status/2040254679301718161?s=20');
+        // The full source URL is round-tripped via encodeURIComponent — decoding it
+        // back must yield the original URL. This guards against accidental drops of
+        // query parameters or fragment characters in future refactors.
+        const parsed = new URL(composeUrl);
+        expect(parsed.origin + parsed.pathname).toBe('https://x.com/compose/post');
+        expect(parsed.searchParams.get('url')).toBe('https://x.com/alice/status/2040254679301718161?s=20');
+    });
+
+    it('rejects malformed URLs before any browser interaction', () => {
+        expect(() => __test__.buildQuoteComposerUrl('https://x.com/alice/home')).toThrow(/Could not extract tweet ID/);
+        expect(() => __test__.buildQuoteComposerUrl('not a url')).toThrow(/Invalid tweet URL/);
+        expect(() => __test__.buildQuoteComposerUrl('https://evil.com/?next=https://x.com/alice/status/2040254679301718161')).toThrow(ArgumentError);
+    });
+});
+
+describe('twitter quote command', () => {
+    it('navigates to the quote composer and reports success when the script confirms', async () => {
+        const cmd = getRegistry().get('twitter/quote');
+        expect(cmd?.func).toBeTypeOf('function');
+        const page = createPageMock([
+            { ok: true, message: 'Quote tweet posted successfully.' },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+            text: 'great take',
+        });
+        expect(page.goto).toHaveBeenCalledWith(
+            'https://x.com/compose/post?url=https%3A%2F%2Fx.com%2Falice%2Fstatus%2F2040254679301718161',
+            { waitUntil: 'load', settleMs: 2500 },
+        );
+        expect(page.wait).toHaveBeenNthCalledWith(1, { selector: '[data-testid="tweetTextarea_0"]', timeout: 15 });
+        expect(page.wait).toHaveBeenNthCalledWith(2, 3);
+        const script = page.evaluate.mock.calls[0][0];
+        // Quote-attachment guard: the script must verify the quoted card rendered
+        // before submitting; otherwise we'd silently post a plain tweet without
+        // the quote attachment.
+        expect(script).toContain('Quote target did not render');
+        expect(script).toContain('document.execCommand');
+        expect(script).toContain('tweetButton');
+        expect(script).toContain('getStatusId(link.href) === tweetId');
+        expect(script).toContain('Quote tweet submission did not complete before timeout');
+        expect(script).toContain('[role="alert"], [data-testid="toast"]');
+        expect(result).toEqual([
+            {
+                status: 'success',
+                message: 'Quote tweet posted successfully.',
+                text: 'great take',
+            },
+        ]);
+    });
+
+    it('returns a failed row when the quote target fails to render', async () => {
+        const cmd = getRegistry().get('twitter/quote');
+        expect(cmd?.func).toBeTypeOf('function');
+        const page = createPageMock([
+            { ok: false, message: 'Quote target did not render in the composer. The source tweet may be deleted or restricted.' },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+            text: 'orphaned quote',
+        });
+        expect(result).toEqual([
+            {
+                status: 'failed',
+                message: 'Quote target did not render in the composer. The source tweet may be deleted or restricted.',
+                text: 'orphaned quote',
+            },
+        ]);
+        // Only the textarea wait should run when ok is false (no extra 3s post-submit wait).
+        expect(page.wait).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws CommandExecutionError when no page is provided', async () => {
+        const cmd = getRegistry().get('twitter/quote');
+        await expect(cmd.func(undefined, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+            text: 'hi',
+        })).rejects.toThrow(CommandExecutionError);
+    });
+
+    it('rejects invalid tweet URLs before navigation', async () => {
+        const cmd = getRegistry().get('twitter/quote');
+        const page = createPageMock([]);
+        await expect(cmd.func(page, {
+            url: 'https://x.com.evil.com/alice/status/2040254679301718161',
+            text: 'hi',
+        })).rejects.toThrow(ArgumentError);
+        expect(page.goto).not.toHaveBeenCalled();
+        expect(page.evaluate).not.toHaveBeenCalled();
+    });
+});

package/clis/twitter/retweet.js

@@ -0,0 +1,99 @@
+import { CommandExecutionError } from '@jackwener/opencli/errors';
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { parseTweetUrl } from './shared.js';
+
+cli({
+    site: 'twitter',
+    name: 'retweet',
+    access: 'write',
+    description: 'Retweet a specific tweet',
+    domain: 'x.com',
+    strategy: Strategy.UI,
+    browser: true,
+    args: [
+        { name: 'url', type: 'string', required: true, positional: true, help: 'The URL of the tweet to retweet' },
+    ],
+    columns: ['status', 'message'],
+    func: async (page, kwargs) => {
+        if (!page)
+            throw new CommandExecutionError('Browser session required for twitter retweet');
+        const target = parseTweetUrl(kwargs.url);
+        await page.goto(target.url);
+        await page.wait({ selector: '[data-testid="primaryColumn"]' });
+        const result = await page.evaluate(`(async () => {
+        try {
+            const tweetId = ${JSON.stringify(target.id)};
+            const findTargetArticle = () => Array.from(document.querySelectorAll('article')).find((article) =>
+                Array.from(article.querySelectorAll('a[href*="/status/"]')).some((link) => {
+                    try {
+                        const match = new URL(link.href, window.location.origin).pathname.match(/^\/(?:[^/]+|i)\/status\/(\d+)\/?$/);
+                        return match?.[1] === tweetId;
+                    } catch {
+                        return false;
+                    }
+                })
+            );
+            // Poll for the tweet to render
+            let attempts = 0;
+            let retweetBtn = null;
+            let unretweetBtn = null;
+            let targetArticle = null;
+
+            while (attempts < 20) {
+                targetArticle = findTargetArticle();
+                unretweetBtn = targetArticle?.querySelector('[data-testid="unretweet"]') || null;
+                retweetBtn = targetArticle?.querySelector('[data-testid="retweet"]') || null;
+
+                if (unretweetBtn || retweetBtn) break;
+
+                await new Promise(r => setTimeout(r, 500));
+                attempts++;
+            }
+
+            // Already retweeted: idempotent success
+            if (unretweetBtn) {
+                return { ok: true, message: 'Tweet is already retweeted.' };
+            }
+
+            if (!retweetBtn) {
+                return { ok: false, message: 'Could not find the Retweet button on this tweet after waiting 10 seconds. Are you logged in?' };
+            }
+
+            // Step 1: click Retweet button → opens menu
+            retweetBtn.click();
+
+            // Step 2: wait for the confirm menu item to appear, then click it
+            let confirmBtn = null;
+            for (let i = 0; i < 20; i++) {
+                await new Promise(r => setTimeout(r, 250));
+                confirmBtn = document.querySelector('[data-testid="retweetConfirm"]');
+                if (confirmBtn) break;
+            }
+            if (!confirmBtn) {
+                return { ok: false, message: 'Retweet menu opened but the confirm option did not appear.' };
+            }
+            confirmBtn.click();
+            await new Promise(r => setTimeout(r, 1000));
+
+            // Verify success by checking if the 'unretweet' button appeared
+            const verifyArticle = findTargetArticle() || targetArticle;
+            const verifyBtn = verifyArticle?.querySelector('[data-testid="unretweet"]');
+            if (verifyBtn) {
+                return { ok: true, message: 'Tweet successfully retweeted.' };
+            } else {
+                return { ok: false, message: 'Retweet action was initiated but UI did not update as expected.' };
+            }
+        } catch (e) {
+            return { ok: false, message: e.toString() };
+        }
+    })()`);
+        if (result.ok) {
+            // Wait for the retweet network request to be processed
+            await page.wait(2);
+        }
+        return [{
+                status: result.ok ? 'success' : 'failed',
+                message: result.message
+            }];
+    }
+});

package/clis/twitter/retweet.test.js

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
+import { getRegistry } from '@jackwener/opencli/registry';
+import './retweet.js';
+import { createPageMock } from '../test-utils.js';
+
+describe('twitter retweet command', () => {
+    it('clicks the retweet button then the confirm menu item and reports success', async () => {
+        const cmd = getRegistry().get('twitter/retweet');
+        expect(cmd?.func).toBeTypeOf('function');
+        const page = createPageMock([
+            { ok: true, message: 'Tweet successfully retweeted.' },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        });
+        expect(page.goto).toHaveBeenCalledWith('https://x.com/alice/status/2040254679301718161');
+        expect(page.wait).toHaveBeenNthCalledWith(1, { selector: '[data-testid="primaryColumn"]' });
+        expect(page.wait).toHaveBeenNthCalledWith(2, 2);
+        const script = page.evaluate.mock.calls[0][0];
+        // Two-step UI flow must be present:
+        //   1) click the retweet button
+        //   2) wait for and click the confirm menu item (data-testid="retweetConfirm")
+        expect(script).toContain('retweetBtn.click()');
+        expect(script).toContain("document.querySelector('[data-testid=\"retweetConfirm\"]')");
+        expect(script).toContain('confirmBtn.click()');
+        expect(script).toContain("document.querySelectorAll('article')");
+        expect(script).toContain('match?.[1] === tweetId');
+        expect(script).toContain("targetArticle?.querySelector('[data-testid=\"retweet\"]')");
+        // Idempotency probe: when already retweeted ([data-testid="unretweet"] present),
+        // the script returns ok:true with an "already retweeted" message.
+        expect(script).toContain("targetArticle?.querySelector('[data-testid=\"unretweet\"]')");
+        expect(result).toEqual([
+            { status: 'success', message: 'Tweet successfully retweeted.' },
+        ]);
+    });
+
+    it('returns a failed row when the confirm menu item never appears', async () => {
+        const cmd = getRegistry().get('twitter/retweet');
+        expect(cmd?.func).toBeTypeOf('function');
+        const page = createPageMock([
+            { ok: false, message: 'Retweet menu opened but the confirm option did not appear.' },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        });
+        expect(result).toEqual([
+            { status: 'failed', message: 'Retweet menu opened but the confirm option did not appear.' },
+        ]);
+        expect(page.wait).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws CommandExecutionError when no page is provided', async () => {
+        const cmd = getRegistry().get('twitter/retweet');
+        await expect(cmd.func(undefined, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(CommandExecutionError);
+    });
+
+    it('rejects invalid tweet URLs before navigation', async () => {
+        const cmd = getRegistry().get('twitter/retweet');
+        const page = createPageMock([]);
+        await expect(cmd.func(page, {
+            url: 'https://evil.com/?next=https://x.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(ArgumentError);
+        expect(page.goto).not.toHaveBeenCalled();
+        expect(page.evaluate).not.toHaveBeenCalled();
+    });
+});

package/clis/twitter/shared.js

@@ -1,4 +1,41 @@
+import { ArgumentError } from '@jackwener/opencli/errors';
+
 const QUERY_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+const TWEET_PATH_PATTERN = /^\/(?:[^/]+|i)\/status\/(\d+)\/?$/;
+const TWEET_HOSTS = new Set(['x.com', 'twitter.com']);
+
+function isTwitterHost(hostname) {
+    return TWEET_HOSTS.has(hostname)
+        || hostname.endsWith('.x.com')
+        || hostname.endsWith('.twitter.com');
+}
+
+export function parseTweetUrl(rawUrl) {
+    const value = String(rawUrl ?? '').trim();
+    if (!value) {
+        throw new ArgumentError('twitter tweet URL cannot be empty', 'Example: opencli twitter retweet https://x.com/jack/status/20');
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new ArgumentError(`Invalid tweet URL: ${value}`, 'Use a full https://x.com/<user>/status/<id> URL');
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (parsed.protocol !== 'https:' || !isTwitterHost(hostname)) {
+        throw new ArgumentError(`Invalid tweet URL host: ${value}`, 'Use a full https://x.com/<user>/status/<id> URL');
+    }
+    const match = parsed.pathname.match(TWEET_PATH_PATTERN);
+    if (!match?.[1]) {
+        throw new ArgumentError(`Could not extract tweet ID from URL: ${value}`, 'Use a full https://x.com/<user>/status/<id> URL');
+    }
+    return {
+        id: match[1],
+        url: parsed.toString(),
+    };
+}
+
 export function sanitizeQueryId(resolved, fallbackId) {
     return typeof resolved === 'string' && QUERY_ID_PATTERN.test(resolved) ? resolved : fallbackId;
 }
@@ -65,4 +102,5 @@ export function extractMedia(legacy) {
 export const __test__ = {
     sanitizeQueryId,
     extractMedia,
+    parseTweetUrl,
 };

package/clis/twitter/shared.test.js

@@ -1,7 +1,34 @@
 import { describe, expect, it } from 'vitest';
 import { __test__ } from './shared.js';
+import { ArgumentError } from '@jackwener/opencli/errors';
 
-const { extractMedia } = __test__;
+const { extractMedia, parseTweetUrl } = __test__;
+
+describe('twitter parseTweetUrl', () => {
+    it('accepts exact Twitter/X tweet URLs and preserves query parameters', () => {
+        expect(parseTweetUrl('https://x.com/alice/status/2040254679301718161?s=20')).toEqual({
+            id: '2040254679301718161',
+            url: 'https://x.com/alice/status/2040254679301718161?s=20',
+        });
+        expect(parseTweetUrl('https://mobile.twitter.com/i/status/2040318731105313143')).toEqual({
+            id: '2040318731105313143',
+            url: 'https://mobile.twitter.com/i/status/2040318731105313143',
+        });
+    });
+
+    it('rejects non-https, off-domain, host-suffix, embedded, and path-suffix URLs', () => {
+        const invalid = [
+            'http://x.com/alice/status/2040254679301718161',
+            'https://evil.com/alice/status/2040254679301718161',
+            'https://x.com.evil.com/alice/status/2040254679301718161',
+            'https://evil.com/?next=https://x.com/alice/status/2040254679301718161',
+            'https://x.com/alice/status/2040254679301718161/photo/1',
+        ];
+        for (const url of invalid) {
+            expect(() => parseTweetUrl(url)).toThrow(ArgumentError);
+        }
+    });
+});
 
 describe('twitter extractMedia', () => {
     it('returns false + empty list when legacy has no media', () => {