v2.3.0 — agent media, personas, composite drafts, proxy pools

Agent-native media, personas, composite draft staging, and proxy pool management — followed by a hardening wave driven by live testing against a real X account. 25 → 32 MCP tools.

Full detail in CHANGELOG.md.

Added

• get_tweet(account, tweet_url, include_images=true) — text, author, public counts, typed media and persona in one read.
• Typed media on tweets — photos with alt text and video posters, deduped, avatars excluded. Photos return to vision-capable clients as MCP ImageContent; fetches are allowlisted to *.twimg.com, capped at 8 MB / 5 s, and re-encoded to JPEG ≤1024 px. Any failure degrades to URL-only and never errors the tool.
• include_images on search_tweets and prepare_reply.
• Freeform account persona, prepended to reply and post prompts.
• Composite draft-only tools — research_and_stage and draft_post_variations, both persona-aware and both refusing paused accounts.
• Proxy pool management — list_proxies, add_proxy, remove_proxy, test_proxy, fully masked, with validated atomic settings.json writes.
• Bundled 5-skill agent pack — x-use skills install|list, offered at the end of x-use init, plus a Claude plugin marketplace kept byte-identical by a CI drift guard.
• Docs — docs/MCP_GUIDE.md (32-tool reference) and docs/SETUP_PROMPT.md (one-prompt setup).

Changed

• Default LLM max_tokens raised to 1200 — reasoning models were spending the whole budget on reasoning and returning empty replies. An empty completion with finish_reason="length" now retries once at max(2x, 1200).
• The cookie handshake drops its redundant post-cookie refresh, removing one full page load from every cold start.

Fixed

Highlights — the full grouped list is in the changelog.

• A failed add_account/update_account no longer deletes the account's live cookie file. Importing a cookie_file overwrites config/<id>_cookies.json, and orphan cleanup then unlinked that path on a failed config write — so update_account(cookie_file=…, proxy="bad-url") returned ok:false and destroyed a working login that nothing backs up. The import now stashes any pre-existing file and restores it on rollback, deleting only files it created.
• Userinfo masking now handles passwords containing /, whitespace, or a second @. The previous regex could not match those, so http://user:pa/ss@host was emitted completely unmasked — reachable via list_proxies, get_account, and proxy error text. Masking now scans the URL authority directly, and the three copies of that regex are collapsed into one shared implementation.
• Security — whole-userinfo masking everywhere, sanitized queue last_error, *.twimg.com fetch allowlist.
• Queue — cancel-during-sleep honored, zombie processing items recovered, paused accounts skipped on drain-all, dedup keys include media and community.
• Sessions — cancel-safe cold start and close, unresponsive drivers force-quit, cookie shape validation, proxy pool import fix.
• Config writes — backup failures block the write, shared proxy validation, corrupt configs surfaced rather than treated as empty.
• Engine truthfulness — no action reports success without confirmation; navigation failures are respected instead of swallowed.

Both of the first two fixes were regressions introduced within this release cycle and never reached a published version — 2.2.0 is unaffected. Each is now pinned by regression tests.

Testing

599 tests passing, up from 551, requiring no network and no browser.