Writing javascript (or any programming language, but sticking with ‘script’ here) to consume an http api from an agpl service (such as lemmy or mastodon) does not force you to open source whatever client you have.
Consuming an agpl client library (maybe mastodon or lemmy provide an sdk I dunno, or some third party one) and you embed it in your app and interact with that agpl code, then yes you must open your code up.
For example, there are closed source Mastodon clients that make a lot of money. Look at the mastodon client from tapbots. The owners of mastodon have a winning case if they sued them, if your logic held up. Tapbots can safely create an entire application and consume the mastodon api without worry, why can’t you and your script?

if he’s complaining about plaintext secrets, sure. But if he’s talking about using session cookies he is wrong and should know he is wrong.