xint 2026.7.5

Highlights

Fresh installs work again. lib/spinner.ts and lib/news.ts were imported but never committed — every new install since March failed at startup (#21). CI now runs on every push/PR (it was manual-trigger-only) plus a security-guard job, so this class of bug can't ship silently again.

Security hardening (from a full audit):

• Package API server binds loopback by default; refuses unauthenticated non-loopback binds
• Billing webhook requires a configured secret — unsigned events could previously grant entitlements
• engage --execute confirms each reply, allowlists URLs against your own content pool, and guards against prompt injection from hostile tweet text
• xAI keys no longer visible in the process table (native fetch replaces curl)
• SSRF range blocking on webhooks; install.sh checksum verification required by default (this release ships checksums.txt)

2026 X API / xAI sync:

• Default model → grok-4.3 (the May 15 retirement redirects old slugs at grok-4.3 rates — cost tracking was under-counting ~6x)
• --min-likes / --quality filter server-side via min_likes: (cheaper searches)
• Owned reads at $0.001; clear 403 guidance for the removed like/follow endpoints
• references/x-api.md: 2026 pricing, operators, official X MCP server, automation policy

Plus all accumulated improvements since 2026.3.17 — full details in CHANGELOG.md.

Full diff: 2026.3.17...2026.7.5