From 5690b915e1ab7d547aae54a3bbc1fafb6a919a27 Mon Sep 17 00:00:00 2001 From: Bo Zeng Date: Mon, 3 Aug 2026 01:56:54 +0000 Subject: [PATCH] fix: fetch authed /home for ClientTransaction init Logged-out x.com now serves the new x-web frontend (assets under abs.twimg.com/x-web/x-web/), which no longer references ondemand.s..js. x-client-transaction needs that file plus the homepage verification meta and loading-x-anim SVGs to generate the X-Client-Transaction-Id header; without it CreateTweet fails with 'HTTP 0: Failed to create tweet' while read endpoints keep working. The authenticated /home page still serves the legacy responsive-web frontend with all signing inputs, so fetch it with the session's auth cookies. Auth is always available here since _ensure_client_transaction runs from TwitterClient.__init__. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Aa1vBaCBrYHvoBgp8SZLoV --- twitter_cli/client.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/twitter_cli/client.py b/twitter_cli/client.py index 0436c8e..fd9d073 100644 --- a/twitter_cli/client.py +++ b/twitter_cli/client.py @@ -1103,8 +1103,15 @@ def _ensure_client_transaction(self): # a different TLS fingerprint on the same IP — a detection vector. cffi_session = _get_cffi_session() ct_headers = _gen_ct_headers() + # Logged-out x.com serves the new "x-web" frontend, which no longer + # references ondemand.s; the authenticated /home page still serves + # the legacy responsive-web frontend the CT algorithm needs. + authed_headers = dict(ct_headers) + authed_headers["Cookie"] = self._cookie_string or ( + "auth_token=%s; ct0=%s" % (self._auth_token, self._ct0) + ) home_page = cffi_session.get( - "https://x.com", headers=ct_headers, timeout=10, + "https://x.com/home", headers=authed_headers, timeout=10, ) home_page_response = bs4.BeautifulSoup(home_page.content, "html.parser") ondemand_url = get_ondemand_file_url(response=home_page_response)