Routes the two credential-writing call sites (xfetch session sync, no-Docker XHS cookie fallback) through the same atomic os.open(..., 0o600) pattern Config.save() already uses, closing a TOCTOU window where credential files were briefly world-readable (CWE-732). Also hardens _sync_bird_env() with shlex.quote against a shell-injection breakout in the sourceable env file — verified exploitable on the pre-fix code. Maintainer follow-up: scoped the injection-probe test markers to tmp_path so they can't poison reruns. 107 tests pass.
browser_cookie3 has been unmaintained for 15+ months and breaks with
newer browser versions. rookiepy (Rust-based, 345 stars, updated 2026-01)
is now the preferred cookie extraction backend.
- xueqiu.py: try rookiepy first, fallback to browser_cookie3
- cookie_extract.py: same priority order, compatible API wrapper
- Remove bird CLI credential sync (bird repo deleted)
- 104 tests passing
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Xueqiu stock API requires a login session token (xq_a_token) that
is generated by Xueqiu's frontend JavaScript and cannot be obtained by
simply visiting the homepage. This caused persistent HTTP 400 (error
code 400016) for all users.
Changes:
- _ensure_cookies(): add three-level priority — config file (saved by
--from-browser) → live Chrome cookies via browser_cookie3 → homepage
fallback. The homepage-only approach only ever got acw_tc (anti-DDoS
token), never xq_a_token.
- _get_json(): switch User-Agent from "agent-reach/1.0" to a real Chrome
UA, and add Referer: https://xueqiu.com/ to all API requests.
- get_hot_posts(): replace the defunct /statuses/hot/listV3.json endpoint
(returns empty body) with the v4 public timeline endpoint; correctly
parse item.data as a JSON string to extract author, text, and likes.
- cookie_extract.py: add Xueqiu to PLATFORM_SPECS and configure_from_browser
so that `agent-reach configure --from-browser chrome` now also saves
Xueqiu cookies (only when xq_a_token is present).
- check(): improve error message to direct users to --from-browser instead
of suggesting a proxy.
- Fix urllib.parse.quote usage (was using urllib.request.quote).
- Update tier and backends description to reflect cookie requirement.
- Add 2 new tests: cookie loading from config, Referer/UA header verification.
- Update docs: README, install guide, troubleshooting, SKILL.md, CHANGELOG.
- Replace xreach CLI with bird (@steipete/bird) as Twitter/X backend
- bird uses AUTH_TOKEN/CT0 env vars (simpler than xreach's session.json)
- Accept both 'bird' and 'birdx' binary names
- Remove version detection logic (bird v0.8.0 is the baseline)
- Write credentials.env to ~/.config/bird/ for easy sourcing
- Keep xfetch session.json sync for backward compatibility
- Update SKILL.md commands: bird search/read/user-tweets/thread
- Update install/uninstall to use npm @steipete/bird
- All 52 tests pass
Previously, Extracting cookies from chrome...
✅ Twitter/X: auth_token + ct0
✅ Cookies configured! Run `agent-reach doctor` to see updated status. stored Twitter
cookies in ~/.agent-reach/config.yaml but did NOT write them to
~/.config/xfetch/session.json. This caused xreach CLI to report
'Not authenticated' even after a successful configure.
The xfetch bridge existed only in the manual
code path (cli.py:829). This commit extracts it into a shared helper
_sync_xfetch_session() in cookie_extract.py and calls it from
configure_from_browser() too, so both paths behave consistently.
Fix is non-fatal: if the xfetch dir/file cannot be written, the error
is swallowed silently (agent-reach config.yaml remains the source of truth).
Co-authored-by: Panniantong <panniantong@users.noreply.github.com>
@aaronjmars