fix: install + whoami bugs (#68, #56, #41)

- install.sh: detect root with `id -u` instead of the bash-only `$EUID`, so
  `curl ... | sh` under a POSIX shell (dash) installs to /usr/local/bin as root
  instead of silently falling back to ~/.local/bin (#68).
- npm/install.js: extract the Windows .zip with PowerShell's Expand-Archive
  instead of the Unix `unzip` command, fixing `npm install -g` on Windows (#56).
- whoami/user: request `verified_type` and `subscription_type` so Premium/blue
  accounts report correctly instead of `verified: false` (#41).

Author: santiagomed

CHANGELOG.md

@@ -6,6 +6,9 @@ All user-visible bugs and enhancements should be recorded here.
 
 ### Fixed
 
+- [2026-06-29] `install.sh` now uses `id -u` instead of the bash-only `$EUID` to detect root, so `curl ... | sh` (POSIX/dash) installs to `/usr/local/bin` as root instead of silently falling back to `~/.local/bin`. (#68)
+- [2026-06-29] npm install on Windows works again: `install.js` extracts the `.zip` with PowerShell's `Expand-Archive` instead of the Unix `unzip` command. (#56)
+- [2026-06-29] `whoami` (and `user`) now request `verified_type` and `subscription_type`, so Premium/blue accounts are reported correctly instead of `verified: false`. (#41)
 - [2026-06-29] OAuth2 token exchange and refresh now send client credentials with the correct auth style — HTTP Basic header for confidential clients (those with a secret), `client_id` in the body for public clients — instead of relying on autodetection, which could fail against X with `unauthorized_client: Missing valid authorization header`.
 - [2026-06-29] `mcp` bridge no longer launches a browser at startup: it still refreshes an existing token silently, but when none is available it fails fast with instructions (`xurl auth oauth2 [--app NAME] [--headless]`) instead of opening a browser mid-startup (which could hang an MCP client's handshake) and printing to the JSON-RPC stdout channel. OAuth2 diagnostics now go to stderr.
 - [2026-06-29] `mcp` bridge no longer lets a strict client hang: a request that cannot be answered — transport failure, a failed token refresh/retry after a 401, or a response with an empty/non-JSON body — now gets a synthesized JSON-RPC error keyed to its id. Notifications (e.g. `notifications/cancelled`) are no longer head-of-line blocked behind an in-flight streaming response, large but valid JSON error bodies are forwarded whole instead of being truncated, the standalone server->client stream stops probing a non-event-stream `200` and only resets its reconnect backoff after a healthy stream, and stdin memory stays bounded when an oversized line is dropped.

api/shortcuts.go

@@ -187,7 +187,7 @@ func SearchPosts(client Client, query string, maxResults int, opts RequestOption
 // GetMe fetches the authenticated user's profile.
 func GetMe(client Client, opts RequestOptions) (json.RawMessage, error) {
 	opts.Method = "GET"
-	opts.Endpoint = "/2/users/me?user.fields=created_at,description,public_metrics,verified,profile_image_url"
+	opts.Endpoint = "/2/users/me?user.fields=created_at,description,public_metrics,verified,verified_type,subscription_type,profile_image_url"
 	opts.Data = ""
 
 	return client.SendRequest(opts)
@@ -198,7 +198,7 @@ func LookupUser(client Client, username string, opts RequestOptions) (json.RawMe
 	username = ResolveUsername(username)
 
 	opts.Method = "GET"
-	opts.Endpoint = fmt.Sprintf("/2/users/by/username/%s?user.fields=created_at,description,public_metrics,verified,profile_image_url", username)
+	opts.Endpoint = fmt.Sprintf("/2/users/by/username/%s?user.fields=created_at,description,public_metrics,verified,verified_type,subscription_type,profile_image_url", username)
 	opts.Data = ""
 
 	return client.SendRequest(opts)

cli/shortcuts_test.go

@@ -39,7 +39,7 @@ func (f fakeClient) SendMultipartRequest(options api.MultipartOptions) (json.Raw
 func TestResolveMyUserIDUsesUsernameFallback(t *testing.T) {
 	client := fakeClient{
 		sendRequest: func(options api.RequestOptions) (json.RawMessage, error) {
-			require.Equal(t, "/2/users/by/username/alice?user.fields=created_at,description,public_metrics,verified,profile_image_url", options.Endpoint)
+			require.Equal(t, "/2/users/by/username/alice?user.fields=created_at,description,public_metrics,verified,verified_type,subscription_type,profile_image_url", options.Endpoint)
 			return json.RawMessage(`{"data":{"id":"42"}}`), nil
 		},
 	}
@@ -52,7 +52,7 @@ func TestResolveMyUserIDUsesUsernameFallback(t *testing.T) {
 func TestResolveMyUserIDReturnsHelpfulErrorWhenGetMeFails(t *testing.T) {
 	client := fakeClient{
 		sendRequest: func(options api.RequestOptions) (json.RawMessage, error) {
-			require.Equal(t, "/2/users/me?user.fields=created_at,description,public_metrics,verified,profile_image_url", options.Endpoint)
+			require.Equal(t, "/2/users/me?user.fields=created_at,description,public_metrics,verified,verified_type,subscription_type,profile_image_url", options.Endpoint)
 			return nil, fmt.Errorf("boom")
 		},
 	}

install.sh

@@ -7,7 +7,10 @@ PROGRAM_NAME="xurl"
 
 # Install to ~/.local/bin by default (no sudo needed).
 # Falls back to /usr/local/bin if run as root.
-if [ "$EUID" -eq 0 ]; then
+# Use `id -u` rather than `$EUID`: $EUID is bash-only and expands to empty under
+# POSIX shells (e.g. dash, the default /bin/sh on Debian/Ubuntu), which silently
+# picks the user path even when run as root via `curl ... | sh`.
+if [ "$(id -u)" -eq 0 ]; then
     INSTALL_DIR="/usr/local/bin"
 else
     INSTALL_DIR="${HOME}/.local/bin"

npm/install.js

@@ -69,7 +69,12 @@ async function install() {
   if (ext === "tar.gz") {
     execSync(`tar xzf "${archivePath}" -C "${tmpDir}"`);
   } else {
-    execSync(`unzip -o "${archivePath}" -d "${tmpDir}"`);
+    // Windows releases are .zip. Extract with PowerShell's Expand-Archive,
+    // which is built into Windows, instead of the Unix `unzip` command (which
+    // isn't present on Windows and broke `npm install -g` there).
+    execSync(
+      `powershell -NoProfile -NonInteractive -Command "Expand-Archive -LiteralPath '${archivePath}' -DestinationPath '${tmpDir}' -Force"`
+    );
   }
 
   const binaryName = plat === "Windows" ? "xurl.exe" : "xurl";