v0.2.0 — Sign-in-with-X (oauth)

What's new

agentx oauth — Sign-in-with-X via session cookies, no browser

Reverse-engineered X web consent flow: the /i/oauth2/authorize page is only
HTML — the approve decision goes through api.x.com/2/oauth2/authorize with
the account's session cookies. agentx rewrites the web path to the API path
automatically.

agentx oauth inspect  <authorize_url>   # app name + scope audit, no approval
agentx oauth approve  <authorize_url>   # auto-approve → callback URL
agentx oauth callback <callback_url>    # GET the app callback (finishes sign-in)

One-shot mode without a stored account: --auth-token + --ct0 (or env
TWITTER_AUTH_TOKEN / TWITTER_CT0).

Scope audit + permission rule

Every inspect/approve response now carries a scope audit:

• safeScopes — read-only (*.read), safe to approve
• writeScopes — tweet.write, users.write, follows.write, dm.*,
  like.write, bookmark.write: the app can act as the account. Agents
  must get explicit human confirmation before approving these — malicious
  apps bundle account-control permissions to post/follow/read DMs on the
  user's behalf.
• persistentScopes — offline.access (refresh tokens), flagged separately
• permissionWarning — rendered warning on every response

Install (linux amd64)

curl -sL https://github.com/DezXBT/AgentX/releases/download/v02-release/agentx-linux-amd64 -o agentx
chmod +x agentx && sudo mv agentx /usr/local/bin/

sha256: d94fef998779772be49cfa81ea08ae6813212aff5ffda0c5b10c4fc22ffdae04

Verified live against two real OAuth2 PKCE consumers (fanszn / IPXExchange,
Sovren Operator Card).