Changelog

• 95853a1 build: ship cgo-enabled xurl chat in release binaries (#90)
• 41259e8 chore(release): v1.3.1
• 3badad6 ci: stop the duplicate GoReleaser run on release

Released by GoReleaser.

Changelog

• c440e59 chore(release): v1.3.0
• 49ea3b8 ci: publish npm from Cut Release via release.yml dispatch
• f213307 docs(changelog): tidy the xurl chat Unreleased entry before release
• 9ed649f feat: add xurl chat — an end-to-end encrypted XChat client (#89)

Released by GoReleaser.

Changelog

• 1b68527 chore(release): v1.2.3
• 9785821 ci: add Cut Release workflow for patch/minor/major cuts (#87)
• 9df8722 ci: cut release without opening a PR
• 99a7848 feat(auth): add broadcast.read and broadcast.write OAuth2 scopes (#82)
• 3a4fed5 fix(auth): stop false OAuth2 no-credentials warning without --app (#86)

Released by GoReleaser.

Changelog

• bfb0f36 docs(mcp): correct mcp --help to document first-run browser login (#81)

Released by GoReleaser.

Changelog

• a312d5d ci: harden release workflow (split npm job + workflow_dispatch, OIDC-ready) (#79)
• e719d94 feat(mcp): browser OAuth2 login on first run when no token is cached (#80)

Released by GoReleaser.

Changelog

• b8d4863 Fix media category README typo (#72)
• 080123e feat: xurl mcp + token, headless OAuth2, auth/UX hardening (v1.2.0) (#78)

Released by GoReleaser.

Changelog

• fae1840 Update SKILL.md (#70)
• 618d55c warn: oauth2 without --app saves token to credential-less app (#74)

Released by GoReleaser.

v1.1.0

Bug Fixes

• OAuth2 UsernameNotFound workaround — xurl auth oauth2 USERNAME now passes the username through to the OAuth2 flow, skipping the broken /2/users/me lookup that has been returning 403 for many developers. (#60)

• Windows OAuth2 authentication — Fixed xurl auth oauth2 on Windows where cmd /c start truncated the authorization URL at the first &, stripping required PKCE parameters. Now uses rundll32 to open the browser with the full URL intact. (#61)

• --app flag fully functional — The --app flag now correctly switches credentials for all commands. Previously it was silently ignored — token reads, saves, clears, auth auto-detection, and webhook CRC signing all used the default app regardless of --app. (#46)

• OAuth2 callback localhost resolution — The OAuth2 callback listener now binds to both 127.0.0.1 and ::1 when using localhost, fixing failures on systems where the browser resolves localhost to IPv6. The listener also starts before opening the browser, eliminating a race condition. (#64)

• OAuth2 token resilience — Token refresh no longer fails when /2/users/me is unavailable. Tokens are preserved with or without a username label, and unnamed tokens are automatically migrated once username lookup succeeds. (#64)

• Firehose endpoint typo — Fixed /2/tweets/firehose/strea/lang/en → /2/tweets/firehose/stream/lang/en in stream detection. (#49)

New Features

• Per-app redirect URI — Apps can now store a redirect_uri in ~/.xurl. Precedence: REDIRECT_URI env var → stored app config → built-in default. New CLI commands: xurl auth apps redirect-uri get/set and --redirect-uri flag on auth apps add/update. (#64)

• --username fallback for shortcut commands — Commands that need your user ID (timeline, mentions, like, etc.) now fall back to username lookup when /2/users/me is unavailable. Use -u USERNAME as a workaround. (#64)

Security

• SKILL.md hardened against secret leakage — Added explicit rules to prevent credential exposure in agent/LLM workflows. Removed examples with inline secret flags. (#34)

Changelog

• 595ed07 fix: auto-detect version from go module info for go install

Released by GoReleaser.

Changelog

• 94ef6f1 fix: use github.com/xdevplatform/xurl module path for go install

Released by GoReleaser.