feat(parity): close XActions feature gaps + fix retweet/longform rendering

User confirmed v0.4 works end-to-end (auth import via headless Chrome,
tweets list returns real data with HumanCount metrics + emojis +
Chinese rendering correct). Their tweets list output also surfaced
two real rendering bugs and several missing scrape commands vs
XActions. This commit closes the gap.

## Parser fixes

api/tweets.go ParseTweet:

  Longform "note tweets" support. X Premium users can post tweets up
  to 25k chars via the note_tweet feature. The full body lives at
    note_tweet.note_tweet_results.result.text
  while legacy.full_text only carries the truncated 280-char preview
  with a `…` marker. ParseTweet now reads note_tweet first and falls
  back to legacy.full_text. XActions misses this too — we're now
  ahead.

## Rendering fixes

cmd/tweets.go formatTweetRow (new):

  Replaces the inline format string with a structured renderer that
  fixes three problems from the user's live test output:

  1. Retweets showed `RT @user: <truncated>` because legacy.full_text
     for a retweet is the truncated retweet header. The actual
     retweeted content is in RetweetOf.Text. We now display
     "RT @<original_author>: <full content>" using the parsed
     retweet payload.

  2. Replies, quotes, and media were invisible. The new format
     adds:
       ↳     for replies
       →q    for tweets that quote another
       📷N   for N image attachments
       🎬N   for video
       🎞N   for animated GIFs
     so a glance at the list tells you what's a thread reply, what
     quotes another tweet, and what has media.

  3. Quotes count was missing from the metrics. We now show
     L (likes), R (retweets), Q (quotes), V (views) in compact
     HumanCount form (1.2k, 3.4M).

  Truncation is bumped from 100 to 120 runes since we have more
  signal density now.

## New scrape commands (XActions parity)

cmd/relationships.go:

  x likes <tweet-id|url>          users who liked a tweet (Favoriters)
  x retweeters <tweet-id|url>     users who retweeted
  x nonfollowers <screen-name>    XActions' #1 feature: scrape both
                                  followers and following lists, take
                                  the set difference (following \\
                                  followers), report who doesn't
                                  follow you back

  All three reuse the existing relationships.go renderer, support
  --json and -n/--limit, and route through the throttle.

## New engagement mutations

api/actions.go:

  LikeTweet / UnlikeTweet            FavoriteTweet / UnfavoriteTweet
  BookmarkTweet / UnbookmarkTweet    CreateBookmark / DeleteBookmark

  All four go through a new graphqlMutation helper that calls
  Client.GraphQL and pipes the response through classifyMutationErrors
  — same idempotent / rate-limit / not-found dispatch as the REST
  follow path. "You have already favorited" becomes a silent success
  so re-runs are safe.

cmd/engage.go (new):

  x engage like <tweet>          x engage unlike <tweet>
  x engage bookmark <tweet>      x engage unbookmark <tweet>

  Each subcommand uses Go method values ((*api.Client).LikeTweet,
  etc.) to share one runEngageOp helper without duplicating the
  client-construction boilerplate four times. No --apply gate
  because each call targets one tweet — for bulk mutations the
  user goes through `x grow` which has --max + --min-followers +
  --apply + --i-know-its-a-cloud-ip.

endpoints.yaml:

  + FavoriteTweet         lI07N6Otwv1PhnEgXILM7A
  + UnfavoriteTweet       ZYKSe-w7KEslx3JhSIk5LA
  + CreateRetweet         ojPdsZsimiJrUGLR1sjUtA
  + DeleteRetweet         iQtK4dl5hBmXewYZuEOKVw
  + CreateBookmark        aoDbu3RHznuiSkQ9aNM67Q
  + DeleteBookmark        Wlmlj2-xzyS1GN3a6cj-mQ

  All marked kind: mutation with rps 0.1 / burst 1 so the read
  bucket throttles them without sharing budget with the friendships
  daily cap. CreateRetweet / DeleteRetweet are wired in the YAML so
  a future commit can add `x engage retweet` without touching the
  schema.

## What's still XActions-only

  - postTweet / replyToTweet / quoteTweet / deleteTweet
    (writing tweets) — out of scope for v1
  - DMs — privacy-sensitive, deferred
  - blockUser / muteUser — easy to add but not urgent
  - scrapeListMembers — easy to add when someone needs it
  - schedulePost / postThread / chunked media upload
    — write-side, out of scope

Author: lroolle

api/actions.go

@@ -50,6 +50,45 @@ func (c *Client) FollowByUsername(ctx context.Context, screenName string) error
 	return c.FollowUser(ctx, uid)
 }
 
+// LikeTweet favorites a tweet via the FavoriteTweet GraphQL mutation.
+// Idempotent: returns nil if X says "you have already favorited".
+func (c *Client) LikeTweet(ctx context.Context, tweetID string) error {
+	return c.graphqlMutation(ctx, "FavoriteTweet", map[string]any{"tweet_id": tweetID})
+}
+
+// UnlikeTweet unfavorites a tweet via UnfavoriteTweet.
+func (c *Client) UnlikeTweet(ctx context.Context, tweetID string) error {
+	return c.graphqlMutation(ctx, "UnfavoriteTweet", map[string]any{"tweet_id": tweetID})
+}
+
+// BookmarkTweet adds a bookmark via CreateBookmark.
+func (c *Client) BookmarkTweet(ctx context.Context, tweetID string) error {
+	return c.graphqlMutation(ctx, "CreateBookmark", map[string]any{"tweet_id": tweetID})
+}
+
+// UnbookmarkTweet removes a bookmark via DeleteBookmark.
+func (c *Client) UnbookmarkTweet(ctx context.Context, tweetID string) error {
+	return c.graphqlMutation(ctx, "DeleteBookmark", map[string]any{"tweet_id": tweetID})
+}
+
+// graphqlMutation runs a GraphQL mutation by name, parses the response
+// envelope, and routes idempotent successes / rate-limits / not-found
+// the same way classifyMutationErrors does for REST.
+//
+// Throttle accounting: GraphQL mutations go through Client.GraphQL
+// which already runs through the read token bucket. This is a
+// deliberate compromise — the dedicated mutation budget is tied to
+// the REST friendshipsCreate path. For per-op rate limits on like /
+// retweet / bookmark X enforces its own server-side caps; we observe
+// 429s via the throttle and back off.
+func (c *Client) graphqlMutation(ctx context.Context, name string, vars map[string]any) error {
+	var raw map[string]any
+	if err := c.GraphQL(ctx, name, vars, &raw); err != nil {
+		return err
+	}
+	return classifyMutationErrors(name, raw)
+}
+
 // restMutationCheckErrors wraps Client.REST and inspects the decoded body
 // for X's `errors[]` envelope. The envelope dispatch is:
 //

api/tweets.go

@@ -276,9 +276,22 @@ func parseTweetDepth(raw any, depth int) *Tweet {
 		id = getString(legacy, "id_str")
 	}
 
+	// Tweet body. For longform "note tweets" (X Premium 25k-char
+	// posts), the full text lives at
+	//   note_tweet.note_tweet_results.result.text
+	// while legacy.full_text only carries the first 280 chars +
+	// truncation marker. Read note_tweet first, fall back to legacy.
+	text := ""
+	if note := walkPathMap(tweet, "note_tweet", "note_tweet_results", "result"); note != nil {
+		text = getString(note, "text")
+	}
+	if text == "" {
+		text = getString(legacy, "full_text")
+	}
+
 	return &Tweet{
 		ID:        id,
-		Text:      getString(legacy, "full_text"),
+		Text:      text,
 		CreatedAt: parseTwitterDate(getString(legacy, "created_at")),
 		Author:    author,
 		Metrics:   metrics,

cmd/engage.go

@@ -0,0 +1,98 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"github.com/thevibeworks/x-cli/api"
+	"github.com/thevibeworks/x-cli/internal/cmdutil"
+)
+
+// engage groups the lightweight engagement mutations: like, retweet,
+// bookmark, and their inverses. These are throttled but not gated
+// behind --apply (unlike `grow`) because they target a single tweet
+// each — no risk of bulk-following spam, no need for dry-run.
+//
+// Each subcommand calls the corresponding GraphQL mutation through
+// Client.graphqlMutation, which inspects the response envelope and
+// treats idempotent failures ("you have already favorited") as
+// success. Re-running is safe.
+//
+// For BULK engagement (follow likers / follow keyword authors), see
+// `x grow` which has --apply, --max, --min-followers, and per-mutation
+// pacing through Throttle.AwaitMutation.
+
+var engageCmd = &cobra.Command{
+	Use:   "engage",
+	Short: "Engagement actions on a tweet (like / unlike / bookmark / unbookmark)",
+}
+
+var engageLikeCmd = &cobra.Command{
+	Use:   "like <tweet-id|url>",
+	Short: "Like (favorite) a tweet",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return runEngageOp(cmd, args[0], "like", (*api.Client).LikeTweet)
+	},
+}
+
+var engageUnlikeCmd = &cobra.Command{
+	Use:   "unlike <tweet-id|url>",
+	Short: "Remove a like (unfavorite)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return runEngageOp(cmd, args[0], "unlike", (*api.Client).UnlikeTweet)
+	},
+}
+
+var engageBookmarkCmd = &cobra.Command{
+	Use:   "bookmark <tweet-id|url>",
+	Short: "Bookmark a tweet",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return runEngageOp(cmd, args[0], "bookmark", (*api.Client).BookmarkTweet)
+	},
+}
+
+var engageUnbookmarkCmd = &cobra.Command{
+	Use:   "unbookmark <tweet-id|url>",
+	Short: "Remove a bookmark",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return runEngageOp(cmd, args[0], "unbookmark", (*api.Client).UnbookmarkTweet)
+	},
+}
+
+func init() {
+	engageCmd.AddCommand(engageLikeCmd)
+	engageCmd.AddCommand(engageUnlikeCmd)
+	engageCmd.AddCommand(engageBookmarkCmd)
+	engageCmd.AddCommand(engageUnbookmarkCmd)
+	rootCmd.AddCommand(engageCmd)
+}
+
+// runEngageOp resolves the tweet id from arg, builds a client, and
+// runs the given method-value op. Method values let us write
+//
+//	(*api.Client).LikeTweet
+//
+// once per subcommand instead of duplicating the boilerplate four times.
+func runEngageOp(cmd *cobra.Command, arg, label string, op func(*api.Client, context.Context, string) error) error {
+	tweetID := extractTweetID(arg)
+	if tweetID == "" {
+		return fmt.Errorf("could not extract tweet ID from %q", arg)
+	}
+	client, err := newClient(cmd.Context())
+	if err != nil {
+		return err
+	}
+	ctx, cancel := withTimeout(cmd.Context())
+	defer cancel()
+
+	if err := op(client, ctx, tweetID); err != nil {
+		return fmt.Errorf("%s: %w", label, err)
+	}
+	cmdutil.Success("%s ok: %s", label, tweetID)
+	return nil
+}

cmd/relationships.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+
 	"github.com/thevibeworks/x-cli/api"
 	"github.com/thevibeworks/x-cli/internal/cmdutil"
 )
@@ -32,6 +33,35 @@ var followingCmd = &cobra.Command{
 	},
 }
 
+var likesCmd = &cobra.Command{
+	Use:   "likes <tweet-id|url>",
+	Short: "Scrape users who liked a tweet (Favoriters)",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runScrapeLikers,
+}
+
+var retweetersCmd = &cobra.Command{
+	Use:   "retweeters <tweet-id|url>",
+	Short: "Scrape users who retweeted a tweet",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runScrapeRetweeters,
+}
+
+var nonfollowersCmd = &cobra.Command{
+	Use:   "nonfollowers <screen-name>",
+	Short: "Find accounts the user follows that don't follow back",
+	Long: `Scrapes both the followers and following lists, then takes the
+set difference: accounts in `+"`following`"+` that aren't in `+"`followers`"+`.
+This is XActions' most-asked feature ("who doesn't follow me back").
+
+Two GraphQL roundtrips per page on each list, so a fresh run on a
+~10k account takes a minute or two. The result is sorted by
+follower count desc — drop the high-value mutuals first if you
+plan to unfollow.`,
+	Args: cobra.ExactArgs(1),
+	RunE: runScrapeNonFollowers,
+}
+
 type relationshipKind int
 
 const (
@@ -40,12 +70,118 @@ const (
 )
 
 func init() {
-	for _, c := range []*cobra.Command{followersCmd, followingCmd} {
+	for _, c := range []*cobra.Command{followersCmd, followingCmd, likesCmd, retweetersCmd, nonfollowersCmd} {
 		c.Flags().IntVarP(&relLimit, "limit", "n", 200, "max users to fetch")
 		rootCmd.AddCommand(c)
 	}
 }
 
+func runScrapeLikers(cmd *cobra.Command, args []string) error {
+	tweetID := extractTweetID(args[0])
+	if tweetID == "" {
+		return fmt.Errorf("could not extract tweet ID from %q", args[0])
+	}
+	client, err := newClient(cmd.Context())
+	if err != nil {
+		return err
+	}
+	ctx, cancel := withTimeout(cmd.Context())
+	defer cancel()
+	users, err := client.Likers(ctx, tweetID, api.PageOptions{
+		Limit: relLimit,
+		OnPage: func(fetched, limit int) {
+			if !jsonOut && verbose {
+				cmdutil.Info("fetched %d/%d", fetched, limit)
+			}
+		},
+	})
+	if err != nil {
+		return err
+	}
+	if jsonOut {
+		return cmdutil.PrintJSON(users)
+	}
+	return renderUserList(users)
+}
+
+func runScrapeRetweeters(cmd *cobra.Command, args []string) error {
+	tweetID := extractTweetID(args[0])
+	if tweetID == "" {
+		return fmt.Errorf("could not extract tweet ID from %q", args[0])
+	}
+	client, err := newClient(cmd.Context())
+	if err != nil {
+		return err
+	}
+	ctx, cancel := withTimeout(cmd.Context())
+	defer cancel()
+	users, err := client.Retweeters(ctx, tweetID, api.PageOptions{
+		Limit: relLimit,
+		OnPage: func(fetched, limit int) {
+			if !jsonOut && verbose {
+				cmdutil.Info("fetched %d/%d", fetched, limit)
+			}
+		},
+	})
+	if err != nil {
+		return err
+	}
+	if jsonOut {
+		return cmdutil.PrintJSON(users)
+	}
+	return renderUserList(users)
+}
+
+// runScrapeNonFollowers scrapes both the user's followers and following
+// lists, then returns following \ followers (set difference).
+//
+// Implementation note: we read the FULL following list (capped by
+// --limit) and the FULL followers list (also capped), then compute
+// the set difference in memory keyed by user ID. For users with
+// hundreds of thousands of followers, --limit is essentially
+// mandatory or both pulls take forever.
+func runScrapeNonFollowers(cmd *cobra.Command, args []string) error {
+	screen := strings.TrimPrefix(args[0], "@")
+	client, err := newClient(cmd.Context())
+	if err != nil {
+		return err
+	}
+	ctx, cancel := withTimeout(cmd.Context())
+	defer cancel()
+
+	cmdutil.Info("scraping %s's following list (cap: %d)...", screen, relLimit)
+	following, err := client.Following(ctx, screen, api.PageOptions{Limit: relLimit})
+	if err != nil {
+		return fmt.Errorf("following: %w", err)
+	}
+
+	cmdutil.Info("scraping %s's followers list (cap: %d)...", screen, relLimit)
+	followers, err := client.Followers(ctx, screen, api.PageOptions{Limit: relLimit})
+	if err != nil {
+		return fmt.Errorf("followers: %w", err)
+	}
+
+	followerSet := make(map[string]struct{}, len(followers))
+	for _, u := range followers {
+		followerSet[u.ID] = struct{}{}
+	}
+
+	nonback := make([]*api.UserSummary, 0, len(following))
+	for _, u := range following {
+		if _, ok := followerSet[u.ID]; !ok {
+			nonback = append(nonback, u)
+		}
+	}
+
+	cmdutil.Success("%d / %d accounts you follow do not follow back",
+		len(nonback), len(following))
+
+	if jsonOut {
+		return cmdutil.PrintJSON(nonback)
+	}
+	return renderUserList(nonback)
+}
+
 func runRelationshipScrape(cmd *cobra.Command, args []string, kind relationshipKind) error {
 	screen := strings.TrimPrefix(args[0], "@")
 	client, err := newClient(cmd.Context())