xurl

fix: scope all token operations to the active app (#46)

fix(windows): preserve oauth2 auth flow on browser launch (#61)

fix(auth): pass username argument to OAuth2Flow in auth oauth2 command (#60)

Fix typo in firehose stream endpoint path (#49)

fix(skill) harden xurl SKILL.md against secret leakage (#34)