fix: bootstrap ClientTransaction from responsive home

[LuciusChen]

Summary

• fetch https://x.com/home when bootstrapping ClientTransaction
• keep auth cookies out of the HTML bootstrap request
• add a regression test covering the responsive home URL, ondemand bundle lookup, feature refresh, and cache write

The root path now serves a lightweight logged-out shell without the ondemand.s bundle. The responsive home path still exposes the assets required to generate x-client-transaction-id, which SearchTimeline requires.

This supersedes the closed #71 with the narrower path-only fix discussed there.

Fixes #69.
Fixes #73.

Validation

• 243 passed, 6 deselected
• ruff check .
• mypy twitter_cli

[bakemocho]

Independent reproduction and one datum that may help decide between this PR and #79.

As of 2026-08-03, https://x.com (root) returns a minimal shell page (~34KB, no script tags, no ondemand.s reference) to non-browser clients, which makes get_ondemand_file_url() fail with 'NoneType' object has no attribute 'group'. Writes then go out without x-client-transaction-id and X rejects them with a misleading error 344: You have reached your daily limit for sending Tweets and messages (no real limit was hit; reads keep working).

Measured with the same curl_cffi Chrome-fingerprint session the CLI uses:

Fetch	Size	contains ondemand.s
https://x.com (no cookies)	~34KB	no
https://x.com/home (no cookies)	~274KB	yes
https://x.com/home (auth cookies)	~276KB	yes

Anonymous /home still serves the full manifest, so this PR's URL-only change is sufficient and sending auth cookies (#79) is not strictly required for CT init.

Applied this patch locally: CT init succeeds, transaction IDs generate, and a live post went through on the first try with the 344 error gone. Also fixes the symptoms in #69, #73, and #78.

[nmmanas]

Third independent reproduction, plus one data point that isolates the variable between this PR and #79.

I hit the same failure (Failed to init ClientTransaction: 'NoneType' object has no attribute 'group', then SearchTimeline 404) and, before finding this queue, fixed it the other way: keep the bootstrap on root https://x.com but attach the session cookies. That also works — logged in, root serves the responsive-web shell with the ondemand.s map; twitter search "vibe coding" --from levelsio returns results and the log line flips to ClientTransaction initialized for x-client-transaction-id. Verified live, full suite 242 passed + a regression test confirmed failing without the change.

So the two dimensions cross cleanly, using the same curl_cffi Chrome-fingerprint session the CLI uses:

Fetch	ondemand.s present
x.com, no cookies	no
x.com, with cookies	yes (my result)
x.com/home, no cookies	yes (#74, corroborated on #80 and by @bakemocho)
x.com/home, with cookies	yes (#79)

Either axis alone is sufficient, which means the cookies in #79 are genuinely redundant given the path change here. That makes this PR the right one: it is the only variant that changes exactly one thing, and it keeps auth cookies off an HTML bootstrap fetch that does not need them.

I have closed my duplicate (#85) in favour of this. +1 to merging #74.