@acedatacloud/skills 2026.628.0 → 2026.628.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.628.0",
+  "version": "2026.628.2",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/_shared/unattended.md

@@ -0,0 +1,16 @@
+# Unattended Scheduled-Task Confirmation
+
+Write-capable Skill helpers may support unattended scheduled-task execution with
+a common `--unattended-confirm` flag. The flag must only bypass the normal
+dry-run/confirmation flow when all platform-provided environment checks pass:
+
+- `AICHAT_UNATTENDED_MODE=true`
+- `AICHAT_ACTIVE_SKILL` matches the helper's Skill slug
+- `AICHAT_ACTIVE_SKILL` is present in `AICHAT_UNATTENDED_ALLOWED_SKILLS`
+- `AICHAT_UNATTENDED_EXPIRES_AT`, when present, is still in the future
+
+If any check fails, the helper must return a dry-run style response and must not
+perform the write/send/publish/delete action. The current Skills packaging does
+not automatically bundle `_shared` files into each Skill, so helpers that need
+runtime code should vendor a small guard module in their own `scripts/` folder
+until packaging grows shared-runtime support.

package/skills/personal-wechat/SKILL.md

@@ -27,7 +27,9 @@ Credentials are injected by the `personalwechat` BYOC connector:
 - `PERSONALWECHAT_API_TOKEN` — Wisdom `API_TOKEN`. Secret — never echo, print, or log it.
 
 The helper sends the token as `Authorization: Bearer ...`; it never puts the
-token in the URL.
+token in the URL. For queued UI operations such as search and send, the helper
+submits the task and waits for `/api/tasks/{id}` before printing the final
+result.
 
 This is the user's **real personal WeChat account**. Read operations can run
 directly. Sending messages or files must be dry-run first, then performed only

package/skills/personal-wechat/scripts/personal_wechat.py

@@ -7,11 +7,12 @@ import argparse
 import json
 import os
 import sys
-import time
 import urllib.error
 import urllib.parse
 import urllib.request
 
+from unattended import unattended_confirm_allowed
+
 
 BASE_URL = os.environ.get("PERSONALWECHAT_BASE_URL", "").rstrip("/")
 API_TOKEN = os.environ.get("PERSONALWECHAT_API_TOKEN", "")
@@ -28,34 +29,6 @@ def _json(data) -> None:
     print(json.dumps(data, ensure_ascii=False, default=str))
 
 
-def unattended_confirm_allowed() -> tuple[bool, str]:
-    if os.environ.get("AICHAT_UNATTENDED_MODE") != "true":
-        return False, "not running in AceDataCloud unattended scheduled-task mode"
-
-    active_skill = os.environ.get("AICHAT_ACTIVE_SKILL", "")
-    if active_skill not in SKILL_SLUGS:
-        return False, f"active skill {active_skill or '<empty>'!r} is not personal-wechat"
-
-    raw_allowed = os.environ.get("AICHAT_UNATTENDED_ALLOWED_SKILLS", "[]")
-    try:
-        allowed = json.loads(raw_allowed)
-    except json.JSONDecodeError:
-        return False, "AICHAT_UNATTENDED_ALLOWED_SKILLS is not valid JSON"
-    if not isinstance(allowed, list) or active_skill not in allowed:
-        return False, f"skill {active_skill!r} is not pre-authorized for unattended confirmation"
-
-    expires_raw = os.environ.get("AICHAT_UNATTENDED_EXPIRES_AT", "")
-    if expires_raw:
-      try:
-          expires_at = int(expires_raw)
-      except ValueError:
-          return False, "AICHAT_UNATTENDED_EXPIRES_AT is invalid"
-      if expires_at < int(time.time()):
-          return False, "unattended authorization has expired"
-
-    return True, "ok"
-
-
 def request(method: str, path: str, *, params: dict | None = None, body: dict | None = None):
     if not BASE_URL:
         _die("PERSONALWECHAT_BASE_URL is not set. Reconnect the Personal WeChat connector.")
@@ -93,6 +66,28 @@ def request(method: str, path: str, *, params: dict | None = None, body: dict |
         _die(f"Cannot reach Wisdom at {BASE_URL}: {reason}", code=3)
 
 
+def wait_task(task_id: str, *, timeout: float = 600.0):
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        task = request("GET", f"/api/tasks/{task_id}")
+        status = task.get("status")
+        if status == "succeeded":
+            return task.get("result")
+        if status == "failed":
+            error = task.get("error") or {}
+            _die(f"Task failed: {error.get('message') or error}", code=2)
+        time.sleep(0.35)
+    _die(f"Task {task_id} did not finish within {timeout:g}s", code=2)
+
+
+def request_task(method: str, path: str, *, params: dict | None = None, body: dict | None = None, timeout: float = 600.0):
+    task = request(method, path, params=params, body=body)
+    task_id = task.get("id")
+    if not task_id:
+        return task
+    return wait_task(task_id, timeout=timeout)
+
+
 def compact_conversation(item: dict) -> dict:
     return {
         "id": item.get("id") or item.get("strUsrName"),
@@ -195,17 +190,17 @@ def main() -> None:
         data = request("POST", "/api/messages/history/query", body={"db": args.db, "sql": args.sql})
         _json(data)
     elif args.cmd == "search":
-        _json(request("POST", "/api/search", body={"query": args.query}))
+        _json(request_task("POST", "/api/search", body={"query": args.query}, timeout=120))
     elif args.cmd == "send":
         if args.unattended_confirm:
-            allowed, reason = unattended_confirm_allowed()
+            allowed, reason = unattended_confirm_allowed(SKILL_SLUGS)
             if not allowed:
                 _json({"dry_run": True, "target": args.target, "text": args.text, "error": "unattended_confirmation_denied", "reason": reason})
                 return
         elif not args.confirm:
             _json({"dry_run": True, "target": args.target, "text": args.text, "note": "Re-run with --confirm after explicit user approval, or --unattended-confirm when this Skill is pre-authorized for an AceDataCloud scheduled task."})
             return
-        _json(request("POST", "/api/messages/send", body={"target": args.target, "type": "text", "text": args.text}))
+        _json(request_task("POST", "/api/messages/send", body={"target": args.target, "type": "text", "text": args.text}))
     elif args.cmd == "refresh-history":
         _json(request("POST", "/api/messages/history/refresh"))
 

package/skills/personal-wechat/scripts/unattended.py

@@ -0,0 +1,39 @@
+"""Unattended scheduled-task confirmation guard bundled with this Skill."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from collections.abc import Iterable
+
+
+def unattended_confirm_allowed(skill_slugs: Iterable[str]) -> tuple[bool, str]:
+    """Return whether the active Skill is pre-authorized for unattended writes."""
+
+    if os.environ.get("AICHAT_UNATTENDED_MODE") != "true":
+        return False, "not running in AceDataCloud unattended scheduled-task mode"
+
+    active_skill = os.environ.get("AICHAT_ACTIVE_SKILL", "")
+    allowed_skill_slugs = set(skill_slugs)
+    if active_skill not in allowed_skill_slugs:
+        return False, f"active skill {active_skill or '<empty>'!r} is not one of {sorted(allowed_skill_slugs)!r}"
+
+    raw_allowed = os.environ.get("AICHAT_UNATTENDED_ALLOWED_SKILLS", "[]")
+    try:
+        allowed = json.loads(raw_allowed)
+    except json.JSONDecodeError:
+        return False, "AICHAT_UNATTENDED_ALLOWED_SKILLS is not valid JSON"
+    if not isinstance(allowed, list) or active_skill not in allowed:
+        return False, f"skill {active_skill!r} is not pre-authorized for unattended confirmation"
+
+    expires_raw = os.environ.get("AICHAT_UNATTENDED_EXPIRES_AT", "")
+    if expires_raw:
+        try:
+            expires_at = int(expires_raw)
+        except ValueError:
+            return False, "AICHAT_UNATTENDED_EXPIRES_AT is invalid"
+        if expires_at < int(time.time()):
+            return False, "unattended authorization has expired"
+
+    return True, "ok"