@jackwener/opencli 1.7.14 → 1.7.16

package/clis/twitter/bookmark.test.js

@@ -0,0 +1,74 @@
+import { describe, expect, it } from 'vitest';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
+import { getRegistry } from '@jackwener/opencli/registry';
+import './bookmark.js';
+import { createPageMock } from '../test-utils.js';
+
+describe('twitter bookmark command', () => {
+    it('navigates to the tweet URL and reports success when the bookmark script confirms', async () => {
+        const cmd = getRegistry().get('twitter/bookmark');
+        expect(cmd?.func).toBeTypeOf('function');
+        const page = createPageMock([
+            { ok: true, message: 'Tweet successfully bookmarked.' },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        });
+        expect(page.goto).toHaveBeenCalledWith('https://x.com/alice/status/2040254679301718161');
+        expect(page.wait).toHaveBeenNthCalledWith(1, { selector: '[data-testid="primaryColumn"]' });
+        expect(page.wait).toHaveBeenNthCalledWith(2, 2);
+        const script = page.evaluate.mock.calls[0][0];
+        // Idempotency probe: when already bookmarked ([data-testid="removeBookmark"] present),
+        // the script returns ok:true with an "already bookmarked" message.
+        expect(script).toContain("targetArticle?.querySelector('[data-testid=\"removeBookmark\"]')");
+        expect(script).toContain("targetArticle?.querySelector('[data-testid=\"bookmark\"]')");
+        expect(script).toContain('bookmarkBtn.click()');
+        // Article scoping comes from the shared helper (buildTwitterArticleScopeSource):
+        // critical here because conversation pages render multiple
+        // bookmark/removeBookmark buttons and a bare querySelector would
+        // silently bookmark a different tweet.
+        expect(script).toContain('__twHasLinkToTarget');
+        expect(script).toContain('__twGetStatusIdFromHref');
+        expect(script).toContain("document.querySelectorAll('article')");
+        expect(result).toEqual([
+            { status: 'success', message: 'Tweet successfully bookmarked.' },
+        ]);
+    });
+
+    it('returns a failed row without re-waiting when the bookmark script reports a UI mismatch', async () => {
+        const cmd = getRegistry().get('twitter/bookmark');
+        const page = createPageMock([
+            {
+                ok: false,
+                message: 'Could not find Bookmark button on the requested tweet. Are you logged in?',
+            },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        });
+        expect(result).toEqual([
+            {
+                status: 'failed',
+                message: 'Could not find Bookmark button on the requested tweet. Are you logged in?',
+            },
+        ]);
+        expect(page.wait).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws CommandExecutionError when no page is provided', async () => {
+        const cmd = getRegistry().get('twitter/bookmark');
+        await expect(cmd.func(undefined, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(CommandExecutionError);
+    });
+
+    it('rejects invalid tweet URLs before navigation', async () => {
+        const cmd = getRegistry().get('twitter/bookmark');
+        const page = createPageMock([]);
+        await expect(cmd.func(page, {
+            url: 'https://evil.com/?next=https://x.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(ArgumentError);
+        expect(page.goto).not.toHaveBeenCalled();
+        expect(page.evaluate).not.toHaveBeenCalled();
+    });
+});

package/clis/twitter/bookmarks.js

@@ -1,6 +1,6 @@
 import { cli, Strategy } from '@jackwener/opencli/registry';
 import { AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
-const BEARER_TOKEN = 'AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA';
+import { TWITTER_BEARER_TOKEN, applyTopByEngagement } from './utils.js';
 const BOOKMARKS_QUERY_ID = 'Fy0QMy4q_aZCpkO0PnyLYw';
 const FEATURES = {
     rweb_video_screen_enabled: false,
@@ -101,21 +101,20 @@ cli({
     site: 'twitter',
     name: 'bookmarks',
     access: 'read',
-    description: 'Fetch Twitter/X bookmarks',
+    description: 'Fetch your Twitter/X bookmarks (the logged-in user\'s saved tweets, newest first)',
     domain: 'x.com',
     strategy: Strategy.COOKIE,
     browser: true,
+    browserSession: { reuse: 'site' },
     args: [
-        { name: 'limit', type: 'int', default: 20 },
+        { name: 'limit', type: 'int', default: 20, help: 'Maximum number of bookmarks to return (default 20).' },
+        { name: 'top-by-engagement', type: 'int', default: 0, help: 'When set to N>0, re-rank the bookmarks by weighted engagement (likes×1 + retweets×3 + replies×2 + bookmarks×5 + log10(views+1)×0.5) and return the top N. Default 0 keeps the API\'s native (saved-time) ordering.' },
     ],
     columns: ['id', 'author', 'text', 'likes', 'retweets', 'bookmarks', 'created_at', 'url'],
     func: async (page, kwargs) => {
         const limit = kwargs.limit || 20;
-        await page.goto('https://x.com');
-        await page.wait(3);
-        const ct0 = await page.evaluate(`() => {
-      return document.cookie.split(';').map(c => c.trim()).find(c => c.startsWith('ct0='))?.split('=')[1] || null;
-    }`);
+        const cookies = await page.getCookies({ url: 'https://x.com' });
+        const ct0 = cookies.find((c) => c.name === 'ct0')?.value || null;
         if (!ct0)
             throw new AuthRequiredError('x.com', 'Not logged into x.com (no ct0 cookie)');
         const queryId = await page.evaluate(`async () => {
@@ -143,7 +142,7 @@ cli({
       return null;
     }`) || BOOKMARKS_QUERY_ID;
         const headers = JSON.stringify({
-            'Authorization': `Bearer ${decodeURIComponent(BEARER_TOKEN)}`,
+            'Authorization': `Bearer ${decodeURIComponent(TWITTER_BEARER_TOKEN)}`,
             'X-Csrf-Token': ct0,
             'X-Twitter-Auth-Type': 'OAuth2Session',
             'X-Twitter-Active-User': 'yes',
@@ -169,6 +168,7 @@ cli({
                 break;
             cursor = nextCursor;
         }
-        return allTweets.slice(0, limit);
+        const trimmed = allTweets.slice(0, limit);
+        return applyTopByEngagement(trimmed, kwargs['top-by-engagement']);
     },
 });

package/clis/twitter/delete.js

@@ -1,33 +1,13 @@
 import { cli, Strategy } from '@jackwener/opencli/registry';
 import { CommandExecutionError } from '@jackwener/opencli/errors';
-function extractTweetId(url) {
-    let pathname = '';
-    try {
-        pathname = new URL(url).pathname;
-    }
-    catch {
-        throw new Error(`Invalid tweet URL: ${url}`);
-    }
-    const match = pathname.match(/\/status\/(\d+)/);
-    if (!match?.[1]) {
-        throw new Error(`Could not extract tweet ID from URL: ${url}`);
-    }
-    return match[1];
-}
+import { parseTweetUrl, buildTwitterArticleScopeSource } from './shared.js';
+
 function buildDeleteScript(tweetId) {
     return `(async () => {
       try {
           const visible = (el) => !!el && (el.offsetParent !== null || el.getClientRects().length > 0);
-          const tweetId = ${JSON.stringify(tweetId)};
-          const targetArticle = Array.from(document.querySelectorAll('article')).find((article) =>
-              Array.from(article.querySelectorAll('a[href*="/status/"]')).some((link) => {
-                  try {
-                      return new URL(link.href, window.location.origin).pathname.includes('/status/' + tweetId);
-                  } catch {
-                      return false;
-                  }
-              })
-          );
+          ${buildTwitterArticleScopeSource(tweetId)}
+          const targetArticle = findTargetArticle();
 
           if (!targetArticle) {
               return { ok: false, message: 'Could not find the tweet card matching the requested URL.' };
@@ -82,17 +62,14 @@ cli({
     func: async (page, kwargs) => {
         if (!page)
             throw new CommandExecutionError('Browser session required for twitter delete');
-        let tweetId = '';
-        try {
-            tweetId = extractTweetId(kwargs.url);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            throw new CommandExecutionError(message);
-        }
-        await page.goto(kwargs.url);
+        // parseTweetUrl throws ArgumentError on malformed/off-domain inputs —
+        // this replaces the ad-hoc local extractTweetId which only checked
+        // the path shape and accepted any host (silent: would try to act on
+        // attacker-controlled redirect URLs).
+        const target = parseTweetUrl(kwargs.url);
+        await page.goto(target.url);
         await page.wait({ selector: '[data-testid="primaryColumn"]' }); // Wait for tweet to load completely
-        const result = await page.evaluate(buildDeleteScript(tweetId));
+        const result = await page.evaluate(buildDeleteScript(target.id));
         if (result.ok) {
             // Wait for the deletion request to be processed
             await page.wait(2);
@@ -105,5 +82,4 @@ cli({
 });
 export const __test__ = {
     buildDeleteScript,
-    extractTweetId,
 };

package/clis/twitter/delete.test.js

@@ -1,13 +1,8 @@
 import { describe, expect, it, vi } from 'vitest';
-import { CommandExecutionError } from '@jackwener/opencli/errors';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
 import { getRegistry } from '@jackwener/opencli/registry';
-import { __test__ } from './delete.js';
 import './delete.js';
 describe('twitter delete command', () => {
-    it('extracts tweet ids from both user and i/status URLs', () => {
-        expect(__test__.extractTweetId('https://x.com/alice/status/2040254679301718161?s=20')).toBe('2040254679301718161');
-        expect(__test__.extractTweetId('https://x.com/i/status/2040318731105313143')).toBe('2040318731105313143');
-    });
     it('targets the matched tweet article instead of the first More button on the page', async () => {
         const cmd = getRegistry().get('twitter/delete');
         expect(cmd?.func).toBeTypeOf('function');
@@ -23,9 +18,17 @@ describe('twitter delete command', () => {
         expect(page.wait).toHaveBeenNthCalledWith(1, { selector: '[data-testid="primaryColumn"]' });
         expect(page.wait).toHaveBeenNthCalledWith(2, 2);
         const script = page.evaluate.mock.calls[0][0];
+        // Article-scoping must come from the shared helper (not an inline
+        // `pathname.includes('/status/' + tweetId)` substring match — see
+        // codex-mini0 #1400 catch where `/status/123` would match
+        // `/status/1234567`). The helper emits `__twHasLinkToTarget` and
+        // `__twGetStatusIdFromHref` plus the canonical anchored regex.
+        expect(script).toContain('__twHasLinkToTarget');
+        expect(script).toContain('__twGetStatusIdFromHref');
         expect(script).toContain("document.querySelectorAll('article')");
-        expect(script).toContain("'/status/' + tweetId");
         expect(script).toContain("targetArticle.querySelectorAll('button,[role=\"button\"]')");
+        // Substring match must NOT appear — exact-id match only.
+        expect(script).not.toContain("'/status/' + tweetId");
         expect(result).toEqual([
             {
                 status: 'success',
@@ -55,7 +58,7 @@ describe('twitter delete command', () => {
         ]);
         expect(page.wait).toHaveBeenCalledTimes(1);
     });
-    it('normalizes invalid tweet URLs into CommandExecutionError', async () => {
+    it('rejects malformed or off-domain URLs with ArgumentError before navigation', async () => {
         const cmd = getRegistry().get('twitter/delete');
         expect(cmd?.func).toBeTypeOf('function');
         const page = {
@@ -63,11 +66,20 @@ describe('twitter delete command', () => {
             wait: vi.fn(),
             evaluate: vi.fn(),
         };
+        // parseTweetUrl bubbles ArgumentError directly (no CommandExecutionError
+        // wrapping); replaces the previous local extractTweetId path that hid
+        // typed-input failures behind a generic CliError.
         await expect(cmd.func(page, {
             url: 'https://x.com/alice/home',
-        })).rejects.toThrow(CommandExecutionError);
+        })).rejects.toThrow(ArgumentError);
         expect(page.goto).not.toHaveBeenCalled();
         expect(page.wait).not.toHaveBeenCalled();
         expect(page.evaluate).not.toHaveBeenCalled();
     });
+    it('throws CommandExecutionError when no page is provided', async () => {
+        const cmd = getRegistry().get('twitter/delete');
+        await expect(cmd.func(undefined, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(CommandExecutionError);
+    });
 });

package/clis/twitter/download.js

@@ -12,14 +12,15 @@ cli({
     site: 'twitter',
     name: 'download',
     access: 'read',
-    description: '下载 Twitter/X 媒体（图片和视频）',
+    description: 'Download Twitter/X media (images and videos). Provide either <username> to scan a profile\'s media tab, or --tweet-url to download a single tweet.',
     domain: 'x.com',
     strategy: Strategy.COOKIE,
+    browserSession: { reuse: 'site' },
     args: [
-        { name: 'username', positional: true, help: 'Twitter username (downloads from media tab)' },
-        { name: 'tweet-url', help: 'Single tweet URL to download' },
-        { name: 'limit', type: 'int', default: 10, help: 'Number of tweets to scan' },
-        { name: 'output', default: './twitter-downloads', help: 'Output directory' },
+        { name: 'username', positional: true, help: 'Twitter username (with or without @) to scan their /media tab. Either <username> or --tweet-url is required.' },
+        { name: 'tweet-url', help: 'Single tweet URL to download. Use this OR <username>, not both required at once.' },
+        { name: 'limit', type: 'int', default: 10, help: 'Maximum number of media items to download when scanning a profile (default 10). Ignored when --tweet-url is used.' },
+        { name: 'output', default: './twitter-downloads', help: 'Output directory (default ./twitter-downloads). A per-source subdir is created inside.' },
     ],
     columns: ['index', 'type', 'status', 'size'],
     func: async (page, kwargs) => {

package/clis/twitter/followers.js

@@ -79,13 +79,20 @@ cli({
     site: 'twitter',
     name: 'followers',
     access: 'read',
-    description: 'Get accounts following a Twitter/X user',
+    description: 'Get accounts following a Twitter/X user (defaults to the logged-in user when no user is given)',
     domain: 'x.com',
     strategy: Strategy.UI,
     browser: true,
+    browserSession: { reuse: 'site' },
     args: [
-        { name: 'user', positional: true, type: 'string', required: false },
-        { name: 'limit', type: 'int', default: 50 },
+        {
+            name: 'user',
+            positional: true,
+            type: 'string',
+            required: false,
+            help: 'Twitter/X handle (with or without @). Omit to fetch followers of the currently logged-in account.',
+        },
+        { name: 'limit', type: 'int', default: 50, help: 'Maximum number of follower rows to return (default 50). Must be a positive integer.' },
     ],
     // `followers` (count) is NOT exposed: the SPA followers-list view does not
     // render it. Use `twitter profile <user>` for per-user follower counts.

package/clis/twitter/following.js

@@ -1,8 +1,8 @@
 import { cli, Strategy } from '@jackwener/opencli/registry';
 import { ArgumentError, AuthRequiredError, CommandExecutionError, EmptyResultError } from '@jackwener/opencli/errors';
 import { resolveTwitterQueryId, sanitizeQueryId } from './shared.js';
+import { TWITTER_BEARER_TOKEN } from './utils.js';
 
-const BEARER_TOKEN = 'AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA';
 const FOLLOWING_QUERY_ID = 'zx6e-TLzRkeDO_a7p4b3JQ';  // Following fallback
 const USER_BY_SCREEN_NAME_QUERY_ID = 'qRednkZG-rn1P6b48NINmQ';
 
@@ -135,13 +135,20 @@ cli({
     site: 'twitter',
     name: 'following',
     access: 'read',
-    description: 'Get accounts a Twitter/X user is following',
+    description: 'Get accounts a Twitter/X user is following (defaults to the logged-in user when no user is given)',
     domain: 'x.com',
     strategy: Strategy.COOKIE,
     browser: true,
+    browserSession: { reuse: 'site' },
     args: [
-        { name: 'user', positional: true, type: 'string', required: false },
-        { name: 'limit', type: 'int', default: 50 },
+        {
+            name: 'user',
+            positional: true,
+            type: 'string',
+            required: false,
+            help: 'Twitter/X handle (with or without @). Omit to fetch the accounts the currently logged-in user follows.',
+        },
+        { name: 'limit', type: 'int', default: 50, help: 'Maximum number of following rows to return (default 50). Must be a positive integer.' },
     ],
     columns: ['screen_name', 'name', 'bio', 'followers'],
     func: async (page, kwargs) => {
@@ -151,12 +158,8 @@ cli({
         }
         let targetUser = normalizeScreenName(kwargs.user);
 
-        await page.goto('https://x.com');
-        await page.wait(3);
-
-        const ct0 = await page.evaluate(`() => {
-            return document.cookie.split(';').map(c => c.trim()).find(c => c.startsWith('ct0='))?.split('=')[1] || null;
-        }`);
+        const cookies = await page.getCookies({ url: 'https://x.com' });
+        const ct0 = cookies.find((c) => c.name === 'ct0')?.value || null;
         if (!ct0)
             throw new AuthRequiredError('x.com', 'Not logged into x.com (no ct0 cookie)');
 
@@ -176,7 +179,7 @@ cli({
         const followingQueryId = await resolveTwitterQueryId(page, 'Following', FOLLOWING_QUERY_ID);
         const userByScreenNameQueryId = await resolveTwitterQueryId(page, 'UserByScreenName', USER_BY_SCREEN_NAME_QUERY_ID);
         const headers = JSON.stringify({
-            'Authorization': `Bearer ${decodeURIComponent(BEARER_TOKEN)}`,
+            'Authorization': `Bearer ${decodeURIComponent(TWITTER_BEARER_TOKEN)}`,
             'X-Csrf-Token': ct0,
             'X-Twitter-Auth-Type': 'OAuth2Session',
             'X-Twitter-Active-User': 'yes',

package/clis/twitter/following.test.js

@@ -205,8 +205,8 @@ function createFollowingPage(followingResponses, { ct0 = 'token', userLookup = {
     const page = {
         goto: vi.fn().mockResolvedValue(undefined),
         wait: vi.fn().mockResolvedValue(undefined),
+        getCookies: vi.fn(async () => (ct0 ? [{ name: 'ct0', value: ct0 }] : [])),
         evaluate: vi.fn(async (script) => {
-            if (script.includes('document.cookie')) return ct0;
             if (script.includes('operationName')) return null;
             if (script.includes('/UserByScreenName')) return userLookup;
             if (script.includes('/Following')) return followingResponses.shift() || followingPayload([], null);
@@ -228,6 +228,7 @@ describe('twitter following command', () => {
         const rows = await command.func(page, { user: '@elonmusk', limit: 3 });
 
         expect(rows.map((row) => row.screen_name)).toEqual(['alice', 'bob', 'carol']);
+        expect(page.getCookies).toHaveBeenCalledWith({ url: 'https://x.com' });
         const userLookupScript = page.evaluate.mock.calls.find(([script]) => script.includes('/UserByScreenName'))?.[0] || '';
         expect(decodeURIComponent(userLookupScript)).toContain('"screen_name":"elonmusk"');
         expect(decodeURIComponent(userLookupScript)).not.toContain('"screen_name":"@elonmusk"');

package/clis/twitter/hide-reply.js

@@ -1,5 +1,7 @@
 import { CommandExecutionError } from '@jackwener/opencli/errors';
 import { cli, Strategy } from '@jackwener/opencli/registry';
+import { parseTweetUrl, buildTwitterArticleScopeSource } from './shared.js';
+
 cli({
     site: 'twitter',
     name: 'hide-reply',
@@ -15,28 +17,45 @@ cli({
     func: async (page, kwargs) => {
         if (!page)
             throw new CommandExecutionError('Browser session required for twitter hide-reply');
-        await page.goto(kwargs.url);
+        const target = parseTweetUrl(kwargs.url);
+        await page.goto(target.url);
         await page.wait({ selector: '[data-testid="primaryColumn"]' });
         const result = await page.evaluate(`(async () => {
         try {
+            ${buildTwitterArticleScopeSource(target.id)}
+            const visible = (el) => !!el && (el.offsetParent !== null || el.getClientRects().length > 0);
+            // Locate the article matching the requested status id, then find
+            // its More menu. Without article scoping we'd grab whatever the
+            // first "More" button on the page is — usually the parent tweet
+            // (silent: hide the wrong reply, or fail silently if the parent
+            // is not a reply you authored).
             let attempts = 0;
+            let targetArticle = null;
             let moreMenu = null;
 
             while (attempts < 20) {
-                moreMenu = document.querySelector('[aria-label="More"]');
-                if (moreMenu) break;
+                targetArticle = findTargetArticle();
+                if (targetArticle) {
+                    const buttons = Array.from(targetArticle.querySelectorAll('button,[role="button"]'));
+                    moreMenu = buttons.find((el) => visible(el) && (el.getAttribute('aria-label') || '').trim() === 'More');
+                    if (moreMenu) break;
+                }
                 await new Promise(r => setTimeout(r, 500));
                 attempts++;
             }
 
+            if (!targetArticle) {
+                return { ok: false, message: 'Could not find the requested reply article on this page.' };
+            }
             if (!moreMenu) {
-                return { ok: false, message: 'Could not find the "More" menu on this tweet. Are you logged in?' };
+                return { ok: false, message: 'Could not find the "More" menu on the requested reply. Are you logged in?' };
             }
 
             moreMenu.click();
             await new Promise(r => setTimeout(r, 1000));
 
-            // Look for the "Hide reply" menu item
+            // Look for the "Hide reply" menu item. Menu items render at the
+            // document root, not inside the article — scope is the open menu.
             const items = document.querySelectorAll('[role="menuitem"]');
             let hideItem = null;
             for (const item of items) {

package/clis/twitter/hide-reply.test.js

@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
+import { getRegistry } from '@jackwener/opencli/registry';
+import './hide-reply.js';
+import { createPageMock } from '../test-utils.js';
+
+describe('twitter hide-reply command', () => {
+    it('navigates to the reply URL and reports success when the hide-reply script confirms', async () => {
+        const cmd = getRegistry().get('twitter/hide-reply');
+        expect(cmd?.func).toBeTypeOf('function');
+        const page = createPageMock([
+            { ok: true, message: 'Reply successfully hidden.' },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        });
+        expect(page.goto).toHaveBeenCalledWith('https://x.com/alice/status/2040254679301718161');
+        expect(page.wait).toHaveBeenNthCalledWith(1, { selector: '[data-testid="primaryColumn"]' });
+        expect(page.wait).toHaveBeenNthCalledWith(2, 2);
+        const script = page.evaluate.mock.calls[0][0];
+        // Article-scoped More menu lookup — without scoping, the bare
+        // [aria-label="More"] selector grabs the parent tweet's More menu and
+        // silently hides the wrong reply (or fails because the parent is not a
+        // reply you authored).
+        expect(script).toContain('moreMenu.click()');
+        expect(script).toContain('[role="menuitem"]');
+        expect(script).toContain("'Hide reply'");
+        expect(script).toContain('hideItem.click()');
+        // Article scoping comes from the shared helper (buildTwitterArticleScopeSource):
+        // emits __twHasLinkToTarget + __twGetStatusIdFromHref + the anchored
+        // tweet-path regex. JSDOM-level coverage lives in shared.test.js.
+        expect(script).toContain('__twHasLinkToTarget');
+        expect(script).toContain('__twGetStatusIdFromHref');
+        expect(script).toContain("document.querySelectorAll('article')");
+        expect(result).toEqual([
+            { status: 'success', message: 'Reply successfully hidden.' },
+        ]);
+    });
+
+    it('returns a failed row without re-waiting when the hide-reply script reports a UI mismatch', async () => {
+        const cmd = getRegistry().get('twitter/hide-reply');
+        const page = createPageMock([
+            {
+                ok: false,
+                message: 'Could not find "Hide reply" option. This may not be a reply on your tweet.',
+            },
+        ]);
+        const result = await cmd.func(page, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        });
+        expect(result).toEqual([
+            {
+                status: 'failed',
+                message: 'Could not find "Hide reply" option. This may not be a reply on your tweet.',
+            },
+        ]);
+        expect(page.wait).toHaveBeenCalledTimes(1);
+    });
+
+    it('throws CommandExecutionError when no page is provided', async () => {
+        const cmd = getRegistry().get('twitter/hide-reply');
+        await expect(cmd.func(undefined, {
+            url: 'https://x.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(CommandExecutionError);
+    });
+
+    it('rejects invalid tweet URLs before navigation', async () => {
+        const cmd = getRegistry().get('twitter/hide-reply');
+        const page = createPageMock([]);
+        await expect(cmd.func(page, {
+            url: 'https://x.com.evil.com/alice/status/2040254679301718161',
+        })).rejects.toThrow(ArgumentError);
+        expect(page.goto).not.toHaveBeenCalled();
+        expect(page.evaluate).not.toHaveBeenCalled();
+    });
+});

package/clis/twitter/like.js

@@ -1,5 +1,7 @@
 import { CommandExecutionError } from '@jackwener/opencli/errors';
 import { cli, Strategy } from '@jackwener/opencli/registry';
+import { parseTweetUrl, buildTwitterArticleScopeSource } from './shared.js';
+
 cli({
     site: 'twitter',
     name: 'like',
@@ -15,21 +17,28 @@ cli({
     func: async (page, kwargs) => {
         if (!page)
             throw new CommandExecutionError('Browser session required for twitter like');
-        await page.goto(kwargs.url);
+        const target = parseTweetUrl(kwargs.url);
+        await page.goto(target.url);
         await page.wait({ selector: '[data-testid="primaryColumn"]' }); // Wait for tweet to load completely
         const result = await page.evaluate(`(async () => {
         try {
-            // Poll for the tweet to render
+            ${buildTwitterArticleScopeSource(target.id)}
+            // Poll for the tweet to render. We scope state probes to the
+            // article matching the requested status id — on conversation
+            // pages multiple articles render and a bare querySelector would
+            // grab the first one (silent: like the wrong tweet).
             let attempts = 0;
             let likeBtn = null;
             let unlikeBtn = null;
-            
+            let targetArticle = null;
+
             while (attempts < 20) {
-                unlikeBtn = document.querySelector('[data-testid="unlike"]');
-                likeBtn = document.querySelector('[data-testid="like"]');
-                
-                if (unlikeBtn || likeBtn) break;
-                
+                targetArticle = findTargetArticle();
+                likeBtn = targetArticle?.querySelector('[data-testid="like"]') || null;
+                unlikeBtn = targetArticle?.querySelector('[data-testid="unlike"]') || null;
+
+                if (likeBtn || unlikeBtn) break;
+
                 await new Promise(r => setTimeout(r, 500));
                 attempts++;
             }
@@ -46,9 +55,10 @@ cli({
             // Click Like
             likeBtn.click();
             await new Promise(r => setTimeout(r, 1000));
-            
-            // Verify success by checking if the 'unlike' button appeared
-            const verifyBtn = document.querySelector('[data-testid="unlike"]');
+
+            // Verify success by checking if the 'unlike' button reappeared
+            const verifyArticle = findTargetArticle() || targetArticle;
+            const verifyBtn = verifyArticle?.querySelector('[data-testid="unlike"]');
             if (verifyBtn) {
                 return { ok: true, message: 'Tweet successfully liked.' };
             } else {