@acedatacloud/skills 2026.704.0 → 2026.704.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.704.0",
+  "version": "2026.704.2",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/bluesky/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: bluesky
-description: Publish, delete and read your own posts on Bluesky via the AT Protocol (XRPC). Use when the user wants to post to their Bluesky account, cross-post an article as a short dev-focused post, delete a post, or list their own recent posts with engagement stats (reposts, likes, replies). Auth uses the user's handle plus an App Password.
+description: Publish (with optional images), delete and read your own posts on Bluesky via the AT Protocol (XRPC). Use when the user wants to post to their Bluesky account (text or 带图 / with a picture), cross-post an article as a short dev-focused post, attach an image, delete a post, or list their own recent posts with engagement stats (reposts, likes, replies). Auth uses the user's handle plus an App Password.
 when_to_use: |
   Trigger when the user wants to publish a post to their Bluesky account,
   delete one, or review their own recent posts and engagement. Bluesky runs on
@@ -12,152 +12,103 @@ allowed_tools: [Bash]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "1.0"
+  version: "1.1"
 ---
 
-Call the **Bluesky AT Protocol** XRPC endpoints with `curl + jq`. Three
-connector credentials are injected: `$BLUESKY_HANDLE` (e.g. `name.bsky.social`),
-`$BLUESKY_APP_PASSWORD` (an App Password created in Bluesky **Settings →
-Privacy and Security → App Passwords**, NOT the account login password) and
-`$BLUESKY_SERVICE` (the PDS base URL, default `https://bsky.social`).
-
-Errors come back as JSON `{"error":"<name>","message":"<detail>"}` — show it
-verbatim. A `401 {"error":"AuthenticationRequired","message":"Invalid identifier
-or password"}` on session creation means the identifier or App Password is
-wrong/revoked. The **#1 cause is a bare handle**: the identifier must be the
-FULL handle (`alice.bsky.social`), a DID, or the account email — a bare
-`alice` will NOT resolve. Step 1 auto-appends `.bsky.social` to a bare handle
-on the default PDS; if it still fails, the user must re-connect the Bluesky
-connector with the full handle (or generate a fresh App Password).
-
-## Step 1 — always create a session first
-
-Everything needs a short-lived `accessJwt` and your account `did`. Do this once
-per task and reuse the values. The identifier must be a full handle, DID or
-email — normalize a bare username (no `.` / `@`) to `<name>.bsky.social` when
-using the default PDS, otherwise `createSession` returns `AuthenticationRequired`:
-
-```bash
-SVC="${BLUESKY_SERVICE:-https://bsky.social}"
-ID="$BLUESKY_HANDLE"
-# Bare username → full handle on the default bsky.social PDS. A dotted handle
-# (custom domain), a DID (`did:...`) or an email are already valid — leave them.
-case "$ID" in
-  *.* | *@* | did:*) : ;;
-  *) [ "$SVC" = "https://bsky.social" ] && ID="$ID.bsky.social" ;;
-esac
-SESSION=$(curl -sS -X POST "$SVC/xrpc/com.atproto.server.createSession" \
-  -H "Content-Type: application/json" \
-  -d "$(jq -n --arg id "$ID" --arg pw "$BLUESKY_APP_PASSWORD" \
-        '{identifier:$id, password:$pw}')")
-echo "$SESSION" | jq '{did, handle, active}'
-JWT=$(echo "$SESSION" | jq -r .accessJwt)
-DID=$(echo "$SESSION" | jq -r .did)
+Everything runs through the shipped CLI [`scripts/bluesky.py`](scripts/bluesky.py)
+— self-contained (`requests` + `Pillow`, both preinstalled in the sandbox). One
+call creates the session, auto-computes clickable **facets** (links, #hashtags,
+@mentions with correct UTF-8 byte offsets), and for image posts downloads the
+file, **resizes/recompresses it to Bluesky's ~1 MB blob limit**, `uploadBlob`s it
+and builds the `app.bsky.embed.images` embed — so there's no fragile
+`curl + jq + heredoc` to hand-assemble (the old inline recipe kept breaking on
+shell quoting, especially once an image + facets were involved).
+
+Three connector credentials are injected: `$BLUESKY_HANDLE`
+(e.g. `name.bsky.social`), `$BLUESKY_APP_PASSWORD` (an App Password from Bluesky
+**Settings → Privacy and Security → App Passwords**, NOT the login password) and
+`$BLUESKY_SERVICE` (PDS base URL, default `https://bsky.social`). The CLI reads
+them from the env — never echo them.
+
+```sh
+BSKY="$SKILL_DIR/scripts/bluesky.py"
+python3 "$BSKY" whoami          # verify the session → {did, handle, service}
 ```
 
-If `JWT` / `DID` are empty or `null`, print the raw `$SESSION` (it contains the
-error) and stop — do not continue to post. On `AuthenticationRequired`, tell the
-user to reconnect the connector using their **full** handle (e.g.
-`name.bsky.social`, not `name`) and a valid App Password.
-
-## Post to Bluesky
-
-**Confirm the text with the user before posting.** Text is limited to **300
-graphemes**; longer text → `400 {"error":"InvalidRequest"}`. `createdAt` must be
-an ISO-8601 UTC timestamp.
-
-```bash
-TEXT="Hello Bluesky 👋 shipping with the AT Protocol"
-NOW=$(date -u +%Y-%m-%dT%H:%M:%S.000Z)
-curl -sS -X POST "$SVC/xrpc/com.atproto.repo.createRecord" \
-  -H "Authorization: Bearer $JWT" \
-  -H "Content-Type: application/json" \
-  -d "$(jq -n --arg did "$DID" --arg text "$TEXT" --arg now "$NOW" \
-        '{repo:$did, collection:"app.bsky.feed.post",
-          record:{ "$type":"app.bsky.feed.post", text:$text, createdAt:$now, langs:["en"] }}')" \
-  | jq '{uri, cid}'
+If `whoami` fails with `session_failed` / `AuthenticationRequired`, the
+identifier or App Password is wrong. The **#1 cause is a bare handle** — the CLI
+auto-appends `.bsky.social` to a bare username on the default PDS, but if it
+still fails the user must reconnect the connector with their **full** handle
+(`name.bsky.social`, a custom domain, a DID, or the account email) and a valid
+App Password.
+
+## Post — text, images and links in one call
+
+**Confirm the text with the user before posting** (it publishes as their real
+account). Text ≤ **300 graphemes**. Clickable links / #hashtags / @mentions are
+turned into facets automatically — just write them in the text, no byte-offset
+math needed.
+
+```sh
+# plain text post
+python3 "$BSKY" post --text "Hello Bluesky 👋 shipping with the AT Protocol"
+
+# 带图发送 / post WITH an image (URL or local path) — the image is downloaded,
+# resized to fit the blob limit, uploaded and embedded automatically:
+python3 "$BSKY" post \
+  --text "Stop wiring 3 image APIs. One endpoint → posters, cards, mockups. https://platform.acedata.cloud/documents/openai-images-generations-integration #AI #API" \
+  --image "https://cdn.acedata.cloud/xxxx.png" --alt "AI image API hero"
+
+# up to 4 images, each with its own --alt (paired by order)
+python3 "$BSKY" post --text "gallery" --image a.png --alt "one" --image b.png --alt "two"
 ```
 
-The returned `uri` looks like `at://did:plc:xxxx/app.bsky.feed.post/<rkey>`. The
-public web URL is `https://bsky.app/profile/$ID/post/<rkey>` where `$ID` is the
-normalized handle from Step 1 (or use the `did`) and `<rkey>` is the last path
-segment of the `uri`.
-
-### Clickable links, mentions and hashtags (facets)
-
-Plain URLs/hashtags in `text` are shown but **not clickable** — Bluesky needs
-`facets` with UTF-8 **byte** offsets. Add a hashtag link like this (byteStart/
-byteEnd are byte indices into the UTF-8 text, not character indices):
-
-```bash
-# text = "New post about #ai" — "#ai" starts at byte 15, ends at byte 18
-curl -sS -X POST "$SVC/xrpc/com.atproto.repo.createRecord" \
-  -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" \
-  -d "$(jq -n --arg did "$DID" --arg now "$NOW" '
-    {repo:$did, collection:"app.bsky.feed.post",
-     record:{ "$type":"app.bsky.feed.post", text:"New post about #ai", createdAt:$now,
-       facets:[ { index:{byteStart:15, byteEnd:18},
-                  features:[{ "$type":"app.bsky.richtext.facet#tag", tag:"ai" }] } ] }}')" \
-  | jq '{uri, cid}'
+Multi-line text or lots of emoji? Skip shell-quoting headaches by writing the
+text to a file and using `--text-file` (or pipe via `--text -`):
+
+```sh
+cat > /tmp/post.txt <<'EOF'
+Line one 🎨
+
+Line two with a link https://platform.acedata.cloud #AI
+EOF
+python3 "$BSKY" post --text-file /tmp/post.txt --image "https://cdn.acedata.cloud/xxxx.png"
 ```
 
-For a link, use feature `app.bsky.richtext.facet#link` with a `uri` field; for a
-mention, `app.bsky.richtext.facet#mention` with a `did`. Compute byte offsets
-with e.g. `printf '%s' "$prefix" | wc -c`.
+Success prints
+`{"posted":true,"uri":"at://…","url":"https://bsky.app/profile/<handle>/post/<rkey>", ...}`.
+The `url` is the public, shareable link — hand it to the user verbatim.
 
 ## List my recent posts + engagement
 
-```bash
-curl -sS "$SVC/xrpc/app.bsky.feed.getAuthorFeed?actor=$DID&limit=20&filter=posts_no_replies" \
-  -H "Authorization: Bearer $JWT" \
-  | jq '.feed[] | {uri: .post.uri,
-                   text: .post.record.text,
-                   reposts: .post.repostCount,
-                   likes: .post.likeCount,
-                   replies: .post.replyCount,
-                   at: .post.indexedAt}'
+```sh
+python3 "$BSKY" list --limit 20                    # default filter: posts_no_replies
+python3 "$BSKY" list --limit 50 --filter posts_with_media
 ```
 
-`limit` max 100. `filter` options: `posts_with_replies`, `posts_no_replies`,
-`posts_with_media`, `posts_and_author_threads`.
+`--filter`: `posts_no_replies` | `posts_with_replies` | `posts_with_media` |
+`posts_and_author_threads`. `--limit` max 100.
 
 ## Delete a post
 
-`deleteRecord` needs the `rkey` (the last path segment of the post `uri`):
-
-```bash
-POST_URI="at://$DID/app.bsky.feed.post/3kabc123xyz"
-RKEY="${POST_URI##*/}"
-curl -sS -X POST "$SVC/xrpc/com.atproto.repo.deleteRecord" \
-  -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" \
-  -d "$(jq -n --arg did "$DID" --arg rkey "$RKEY" \
-        '{repo:$did, collection:"app.bsky.feed.post", rkey:$rkey}')" \
-  | jq '{deleted: true, rkey: "'"$RKEY"'"}'
+```sh
+python3 "$BSKY" delete --uri "at://did:plc:xxxx/app.bsky.feed.post/3kabc123xyz"
 ```
 
-An empty `{}` response is success. `400 {"error":"InvalidRequest"}` usually
-means the record is already gone or the `rkey` is wrong.
-
-## Attaching images (optional)
-
-Upload each image via `POST $SVC/xrpc/com.atproto.repo.uploadBlob`
-(`Content-Type: image/jpeg`, raw bytes body, Bearer `$JWT`) → returns a `blob`
-object. Then set `record.embed` to
-`{ "$type":"app.bsky.embed.images", images:[{ alt:"<desc>", image:<blob> }] }`.
-Max 4 images per post; each blob ≲ 1 MB (resize/compress first).
+Pass the full `at://…` post `uri` (from `list` or a prior `post`); the CLI
+extracts the `rkey`. An empty result / `deleted:true` is success.
 
 ## Gotchas
 
 - **App Password, not account password:** creating a session with the real
   login password may be rejected or trip 2FA. Always the App Password from
   Settings → App Passwords.
-- **Byte offsets, not char offsets:** facet `byteStart`/`byteEnd` are UTF-8
-  byte indices — emoji and CJK take multiple bytes. Get them wrong and the
-  link highlights the wrong span.
+- **Facets & image resizing are automatic** — the CLI computes link/#tag/@mention
+  byte offsets and shrinks oversized images to the ~1 MB blob limit for you.
 - **300 graphemes**, counted as user-perceived characters (emoji = 1).
 - **Rate limits:** the PDS rate-limits writes per account; space out bulk posts
   or you'll get `429 {"error":"RateLimitExceeded"}`.
 - **Self-hosted PDS:** if the user runs their own PDS, `$BLUESKY_SERVICE` points
   there; all XRPC calls target that host, not `bsky.social`.
-- The `accessJwt` is short-lived (~2h). For a single task it's fine; if it
-  expires mid-task, just re-run Step 1.
+- The CLI creates a fresh short-lived session on **every** invocation, so an
+  expiring `accessJwt` is never a concern — just run the command again.

package/skills/bluesky/scripts/bluesky.py

@@ -0,0 +1,345 @@
+#!/usr/bin/env python3
+"""Bluesky (AT Protocol / XRPC) CLI shipped with the `bluesky` skill.
+
+Deps: `requests` + `Pillow` (both preinstalled in the sandbox). One command does
+the whole publish flow that previously had to be hand-assembled from curl + jq +
+python heredocs (and kept breaking on shell quoting):
+
+- create a session (handle normalized to a full handle on the default PDS)
+- auto-compute richtext `facets` (clickable links, #hashtags, @mentions) with
+  correct UTF-8 byte offsets
+- attach images: download the URL/path, resize/recompress to Bluesky's ~1 MB
+  blob limit, `uploadBlob`, and build the `app.bsky.embed.images` embed
+- `createRecord`, then print the public post URL
+
+Secrets ($BLUESKY_APP_PASSWORD) are read from the env and never printed.
+"""
+
+import argparse
+import io
+import json
+import os
+import re
+import sys
+from datetime import datetime, timezone
+
+import requests
+from PIL import Image
+
+# bsky.social's uploadBlob rejects images over ~1 MB; stay safely under it.
+BLOB_LIMIT = 976_560
+URL_RE = re.compile(r"https?://[^\s\]\)]+")
+TAG_RE = re.compile(r"(?<!\w)#([A-Za-z0-9_]+)")
+# A mention target must be a dotted handle (name.bsky.social / custom domain);
+# each dot-separated segment is non-empty so a trailing sentence dot isn't eaten.
+MENTION_RE = re.compile(r"(?<!\w)@([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)+)")
+
+
+def out(o):
+    print(json.dumps(o, ensure_ascii=False))
+
+
+def die(o):
+    out(o)
+    sys.exit(1)
+
+
+def env_service():
+    return os.environ.get("BLUESKY_SERVICE", "https://bsky.social").rstrip("/")
+
+
+def normalize_identifier(handle, svc):
+    # A dotted handle, an email or a DID is already valid; a bare username needs
+    # `.bsky.social` on the default PDS or createSession returns AuthRequired.
+    if any(c in handle for c in ".@") or handle.startswith("did:"):
+        return handle
+    if svc == "https://bsky.social":
+        return f"{handle}.bsky.social"
+    return handle
+
+
+def create_session(svc):
+    handle = os.environ["BLUESKY_HANDLE"]
+    pw = os.environ["BLUESKY_APP_PASSWORD"]
+    ident = normalize_identifier(handle, svc)
+    try:
+        r = requests.post(
+            f"{svc}/xrpc/com.atproto.server.createSession",
+            json={"identifier": ident, "password": pw},
+            timeout=30,
+        )
+    except requests.RequestException as e:
+        die({"error": "session_request_failed", "detail": str(e)})
+    data = r.json() if r.content else {}
+    if r.status_code != 200 or not data.get("accessJwt"):
+        die({
+            "error": "session_failed",
+            "status": r.status_code,
+            "detail": data,
+            "hint": "reconnect the Bluesky connector with your FULL handle "
+                    "(e.g. name.bsky.social) and a valid App Password",
+        })
+    return data["accessJwt"], data["did"], ident
+
+
+def byte_index(text, char_index):
+    return len(text[:char_index].encode("utf-8"))
+
+
+def resolve_handle(svc, handle):
+    try:
+        r = requests.get(
+            f"{svc}/xrpc/com.atproto.identity.resolveHandle",
+            params={"handle": handle},
+            timeout=15,
+        )
+        if r.status_code == 200:
+            return r.json().get("did")
+    except requests.RequestException:
+        pass
+    return None
+
+
+def build_facets(text, svc):
+    """Compute link / hashtag / mention facets with UTF-8 byte offsets."""
+    facets = []
+    url_spans = []  # char ranges already claimed by a link facet
+    for m in URL_RE.finditer(text):
+        uri = m.group(0).rstrip(".,;:)]}'\"")  # drop trailing punctuation
+        c_start, c_end = m.start(), m.start() + len(uri)
+        url_spans.append((c_start, c_end))
+        facets.append({
+            "index": {"byteStart": byte_index(text, c_start),
+                      "byteEnd": byte_index(text, c_end)},
+            "features": [{"$type": "app.bsky.richtext.facet#link", "uri": uri}],
+        })
+
+    def inside_url(pos):
+        # Skip #frag / @x that live inside a URL (e.g. https://x.com/#a) so
+        # facets never overlap — atproto rejects overlapping richtext ranges.
+        return any(s <= pos < e for s, e in url_spans)
+
+    for m in TAG_RE.finditer(text):
+        if inside_url(m.start()):
+            continue
+        facets.append({
+            "index": {"byteStart": byte_index(text, m.start()),
+                      "byteEnd": byte_index(text, m.end())},
+            "features": [{"$type": "app.bsky.richtext.facet#tag", "tag": m.group(1)}],
+        })
+    for m in MENTION_RE.finditer(text):
+        if inside_url(m.start()):
+            continue
+        did = resolve_handle(svc, m.group(1))
+        if did:
+            facets.append({
+                "index": {"byteStart": byte_index(text, m.start()),
+                          "byteEnd": byte_index(text, m.end())},
+                "features": [{"$type": "app.bsky.richtext.facet#mention", "did": did}],
+            })
+    return facets
+
+
+def fetch_bytes(src):
+    if re.match(r"^https?://", src):
+        r = requests.get(src, timeout=120, headers={"User-Agent": "Mozilla/5.0 (bluesky-skill)"})
+        r.raise_for_status()
+        return r.content
+    with open(src, "rb") as f:
+        return f.read()
+
+
+def compress_to_limit(raw):
+    """Return (bytes, mime) within BLOB_LIMIT, recompressing/resizing if needed."""
+    known = {"JPEG": "image/jpeg", "PNG": "image/png", "WEBP": "image/webp", "GIF": "image/gif"}
+    try:
+        fmt = Image.open(io.BytesIO(raw)).format
+    except Exception:
+        die({"error": "image_decode_failed", "detail": "could not read the image bytes"})
+    # Small AND a format Bluesky handles as-is → upload untouched (keeps PNG
+    # transparency / animated GIF). Otherwise fall through and re-encode to JPEG
+    # so the blob's bytes always match its declared mimeType.
+    if len(raw) <= BLOB_LIMIT and fmt in known:
+        return raw, known[fmt]
+
+    img = Image.open(io.BytesIO(raw))
+    if img.mode not in ("RGB", "L"):
+        img = img.convert("RGB")
+    max_side = max(img.size)
+    buf = io.BytesIO()
+    for target_side in (max_side, 2048, 1600, 1280, 1024, 800, 640):
+        if target_side < max_side:
+            ratio = target_side / max_side
+            work = img.resize((max(1, int(img.width * ratio)), max(1, int(img.height * ratio))))
+        else:
+            work = img
+        for quality in (90, 85, 80, 70, 60, 50, 40):
+            buf = io.BytesIO()
+            work.save(buf, format="JPEG", quality=quality, optimize=True)
+            if buf.tell() <= BLOB_LIMIT:
+                return buf.getvalue(), "image/jpeg"
+    # Couldn't get under the limit; return the smallest attempt and let the API decide.
+    return buf.getvalue(), "image/jpeg"
+
+
+def upload_blob(svc, jwt, raw, mime):
+    r = requests.post(
+        f"{svc}/xrpc/com.atproto.repo.uploadBlob",
+        data=raw,
+        headers={"Authorization": f"Bearer {jwt}", "Content-Type": mime},
+        timeout=120,
+    )
+    data = r.json() if r.content else {}
+    if r.status_code != 200 or "blob" not in data:
+        die({"error": "uploadBlob_failed", "status": r.status_code, "detail": data})
+    return data["blob"]
+
+
+def read_text(a):
+    if a.text_file:
+        with open(a.text_file, encoding="utf-8") as f:
+            return f.read().rstrip("\n")
+    if a.text == "-":
+        return sys.stdin.read().rstrip("\n")
+    if a.text is not None:
+        return a.text
+    return ""  # no text source; caller allows this when images are attached
+
+
+def cmd_post(a):
+    svc = env_service()
+    text = read_text(a)
+    images = a.image or []
+    if len(images) > 4:
+        die({"error": "too_many_images", "detail": "Bluesky allows at most 4 images per post"})
+    if not text and not images:
+        die({"error": "empty_post", "detail": "a post needs --text/--text-file or at least one --image"})
+    jwt, did, ident = create_session(svc)
+    record = {
+        "$type": "app.bsky.feed.post",
+        "text": text,
+        "createdAt": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z"),
+        "langs": [a.lang],
+    }
+    facets = build_facets(text, svc)
+    if facets:
+        record["facets"] = facets
+
+    if images:
+        alts = a.alt or []
+        embed_images = []
+        for i, src in enumerate(images):
+            try:
+                raw = fetch_bytes(src)
+            except (requests.RequestException, OSError) as e:
+                die({"error": "image_fetch_failed", "src": src, "detail": str(e)})
+            blob_bytes, mime = compress_to_limit(raw)
+            blob = upload_blob(svc, jwt, blob_bytes, mime)
+            # Missing alt defaults to empty (never reuse another image's alt).
+            alt = alts[i] if i < len(alts) else ""
+            embed_images.append({"alt": alt, "image": blob})
+        record["embed"] = {"$type": "app.bsky.embed.images", "images": embed_images}
+
+    r = requests.post(
+        f"{svc}/xrpc/com.atproto.repo.createRecord",
+        headers={"Authorization": f"Bearer {jwt}", "Content-Type": "application/json"},
+        json={"repo": did, "collection": "app.bsky.feed.post", "record": record},
+        timeout=60,
+    )
+    data = r.json() if r.content else {}
+    if r.status_code != 200 or "uri" not in data:
+        die({"error": "createRecord_failed", "status": r.status_code, "detail": data})
+    rkey = data["uri"].rsplit("/", 1)[-1]
+    out({
+        "posted": True,
+        "uri": data["uri"],
+        "cid": data.get("cid"),
+        "url": f"https://bsky.app/profile/{ident}/post/{rkey}",
+        "images": len(images),
+        "facets": len(facets),
+    })
+
+
+def cmd_list(a):
+    svc = env_service()
+    jwt, did, _ = create_session(svc)
+    r = requests.get(
+        f"{svc}/xrpc/app.bsky.feed.getAuthorFeed",
+        params={"actor": did, "limit": a.limit, "filter": a.filter},
+        headers={"Authorization": f"Bearer {jwt}"},
+        timeout=30,
+    )
+    data = r.json() if r.content else {}
+    if r.status_code != 200:
+        die({"error": "getAuthorFeed_failed", "status": r.status_code, "detail": data})
+    out([
+        {
+            "uri": it["post"]["uri"],
+            "text": it["post"]["record"].get("text", ""),
+            "reposts": it["post"].get("repostCount", 0),
+            "likes": it["post"].get("likeCount", 0),
+            "replies": it["post"].get("replyCount", 0),
+            "at": it["post"].get("indexedAt"),
+        }
+        for it in data.get("feed", [])
+    ])
+
+
+def cmd_delete(a):
+    svc = env_service()
+    jwt, did, _ = create_session(svc)
+    rkey = a.uri.rsplit("/", 1)[-1]
+    r = requests.post(
+        f"{svc}/xrpc/com.atproto.repo.deleteRecord",
+        headers={"Authorization": f"Bearer {jwt}", "Content-Type": "application/json"},
+        json={"repo": did, "collection": "app.bsky.feed.post", "rkey": rkey},
+        timeout=30,
+    )
+    if r.status_code != 200:
+        die({"error": "deleteRecord_failed", "status": r.status_code,
+             "detail": r.json() if r.content else {}})
+    out({"deleted": True, "rkey": rkey})
+
+
+def cmd_whoami(a):
+    svc = env_service()
+    jwt, did, ident = create_session(svc)
+    out({"did": did, "handle": ident, "service": svc, "session": bool(jwt)})
+
+
+def main():
+    p = argparse.ArgumentParser(prog="bluesky", description="Bluesky AT Protocol CLI")
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    pp = sub.add_parser("post", help="publish a post (text + optional images + auto facets)")
+    pp.add_argument("--text", help='post text (use "-" to read from stdin)')
+    pp.add_argument("--text-file", help="read post text from a file (safest for multi-line/emoji)")
+    pp.add_argument("--image", action="append", help="image URL or local path (repeatable, max 4)")
+    pp.add_argument("--alt", action="append", help="alt text per image (repeatable, paired by order)")
+    pp.add_argument("--lang", default="en", help="BCP-47 language tag (default: en)")
+    pp.set_defaults(func=cmd_post)
+
+    pl = sub.add_parser("list", help="list my recent posts with engagement")
+    pl.add_argument("--limit", type=int, default=20)
+    pl.add_argument("--filter", default="posts_no_replies",
+                    help="posts_no_replies | posts_with_replies | posts_with_media | posts_and_author_threads")
+    pl.set_defaults(func=cmd_list)
+
+    pd = sub.add_parser("delete", help="delete one of my posts by its at:// uri")
+    pd.add_argument("--uri", required=True)
+    pd.set_defaults(func=cmd_delete)
+
+    pw = sub.add_parser("whoami", help="verify the session and show did/handle")
+    pw.set_defaults(func=cmd_whoami)
+
+    a = p.parse_args()
+    try:
+        a.func(a)
+    except SystemExit:
+        raise
+    except Exception as e:
+        die({"error": f"{type(e).__name__}", "detail": str(e)})
+
+
+if __name__ == "__main__":
+    main()

package/skills/x/SKILL.md

@@ -0,0 +1,109 @@
+---
+name: x
+description: Read & act on X (Twitter) with the user's own login cookies (BYOC) — post tweets (text / images / video / threads / replies / quotes), search tweets & users, read timelines and single tweets, like / retweet / follow / delete, and see trends. Use when the user mentions X / Twitter, 发推 / 发推特 / 推特, "我的 Twitter", posting to X, searching X, or reading their X timeline.
+when_to_use: |
+  Trigger for anything on the user's X (Twitter) account driven by their own
+  login cookie: post a tweet / thread / reply / quote (optionally with images or
+  a video), search tweets or users, read their home timeline or a user's tweets,
+  look up one tweet, like / retweet / follow / delete, or check trends. This acts
+  as the user's REAL account, so every write is gated behind an explicit
+  confirmation.
+connections: [x]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+# x — read & post on X (Twitter) via your own cookies
+
+Drives the user's **real** X account through X's internal web API via
+[`twikit`](https://github.com/d60/twikit), authenticated by the login cookie they
+captured with the ACE extension. No official API key, no cost.
+
+> ⚠️ **Not yet E2E-verified.** Built against twikit's documented API but not run
+> against a live account at build time. The first live run is the verification —
+> if X's internal API drifted it surfaces as a clear error, not silent breakage.
+
+The connector injects the cookie jar as an env var:
+
+- `X_COOKIES` — a JSON array of cookies (needs at least `auth_token` + `ct0`).
+  **Secret — full account access. Never echo or print it.**
+
+## Setup — install twikit once per session
+
+`twikit` may not be preinstalled; bootstrap it (same pattern as the telegram
+skill), then call the shipped CLI:
+
+```sh
+python3 -c "import twikit" 2>/dev/null || pip install --user --quiet twikit 2>/dev/null || true
+X=$SKILL_DIR/scripts/x.py
+python3 $X whoami          # who is logged in
+```
+
+## Read commands (run directly)
+
+```sh
+python3 $X whoami                                            # the logged-in account
+python3 $X search --query "ai agents" --product Latest --limit 20   # Top | Latest | Media
+python3 $X search-users --query "openai" --limit 10
+python3 $X timeline --limit 20                               # my home timeline
+python3 $X user-tweets --user elonmusk --type Tweets --limit 20     # Tweets|Replies|Media|Likes
+python3 $X tweet --id 1234567890123456789                    # single tweet detail
+python3 $X trends --category trending --limit 20             # trending|for-you|news|sports|entertainment
+```
+
+`--user` accepts either an `@screen_name` (the `@` is optional) or a numeric id.
+
+## Verify the connection first
+
+```sh
+python3 $X whoami
+# → {"id": "...", "screen_name": "...", "followers_count": ...}
+```
+
+On an auth error the cookie is expired — have the user reconnect at
+<https://auth.acedata.cloud/user/connections>. Do **not** loop-retry.
+
+## Write commands — GATED (dry-run unless trailing `--confirm`)
+
+Every state-changing command (`post`, `thread`, `like`, `unlike`, `retweet`,
+`unretweet`, `follow`, `unfollow`, `delete`) **dry-runs** without a trailing
+`--confirm`. `--confirm` is honored **only as the last argument**, so a tweet
+body that merely contains "--confirm" can never silently post. Always show the
+dry-run, get an explicit "yes" on the exact text, then re-run with `--confirm`.
+
+```sh
+python3 $X post --text "hello world"                          # dry-run
+python3 $X post --text "hello world" --confirm                # LIVE tweet
+python3 $X post --text "look at this" --media a.jpg,b.png --confirm     # up to 4 images (or 1 video)
+python3 $X post --text "great point" --reply-to 123456 --confirm        # reply
+python3 $X post --text "worth reading" --quote-url https://x.com/u/status/123 --confirm  # quote
+python3 $X thread --text "1/2 first" --text "2/2 second" --confirm       # thread (2+ segments)
+python3 $X like --id 123456 --confirm
+python3 $X retweet --id 123456 --confirm
+python3 $X follow --user elonmusk --confirm
+python3 $X delete --id 123456 --confirm                        # delete one of MY tweets
+```
+
+- **A confirmed `post` / `thread` is immediately PUBLIC** on the user's real
+  account — there is no draft step. Always confirm the exact text first.
+- `--media` takes comma-separated file paths. X allows up to **4 images** OR
+  **1 video/GIF** per tweet; for a thread the media attaches to the **first**
+  segment only.
+
+## Gotchas
+
+- **This is the user's real X account.** Confirm before any write — posts are
+  immediate and public.
+- **Not E2E-verified** (see the warning above) — expect to validate the first run.
+- **twikit is a scraper of X's non-public API.** It can break when X changes its
+  internal endpoints. A `Couldn't get KEY_BYTE indices` / transaction-id error
+  means twikit needs upgrading: `pip install --user -U twikit`. An auth error
+  means the cookie expired → reconnect.
+- **ToS / rate-limit / ban risk.** This acts through the web API, not the
+  official API — high-frequency automation can get the account rate-limited or
+  suspended. Keep volume human-like.
+- **Never print `X_COOKIES`** — it is full account access.
+- **DMs are intentionally not exposed** by this skill.

package/skills/x/scripts/x.py

@@ -0,0 +1,417 @@
+#!/usr/bin/env python3
+"""
+x — read & act on X (Twitter) with the user's own login cookies (BYOC).
+
+Drives X's internal web API through `twikit` (https://github.com/d60/twikit),
+authenticated by the ``auth_token`` + ``ct0`` cookies the user captured with the
+ACE extension. This acts as the user's REAL account, so every state-changing
+command (post / thread / reply / quote / like / retweet / follow / delete) is
+GATED by a trailing ``--confirm`` — without it, the command dry-runs.
+
+The connector injects the cookie jar as a JSON env var ``X_COOKIES`` (a JSON list
+of cookie dicts, each with at least ``name`` and ``value``). It is full account
+access — NEVER echo or print it.
+
+twikit is a scraper of X's non-public API: it can drift when X changes its
+internal endpoints, and high-frequency use risks rate-limiting or account
+suspension under X's ToS. Errors surface as clear messages rather than silent
+breakage.
+
+Examples:
+  python3 x.py whoami
+  python3 x.py search --query "python" --product Latest --limit 20
+  python3 x.py timeline --limit 20
+  python3 x.py user-tweets --user elonmusk --type Tweets --limit 20
+  python3 x.py tweet --id 1234567890
+  python3 x.py trends --category trending
+  python3 x.py post --text "hello world" --confirm
+  python3 x.py post --text "look" --media a.jpg,b.jpg --confirm
+  python3 x.py thread --text "1/2 first" --text "2/2 second" --confirm
+  python3 x.py like --id 1234567890 --confirm
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import os
+import sys
+
+UA = (
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+    "(KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
+)
+
+_RAW = sys.argv[1:]
+# --confirm is honored ONLY as the last token, and only one is stripped, so a
+# tweet body that merely contains "--confirm" can never silently confirm a write.
+CONFIRM = bool(_RAW) and _RAW[-1] == "--confirm"
+ARGV = _RAW[:-1] if CONFIRM else list(_RAW)
+
+# State-changing commands — dry-run unless the invocation ends with --confirm.
+GATED = {
+    "post", "thread", "like", "unlike", "retweet", "unretweet",
+    "follow", "unfollow", "delete",
+}
+
+
+def out(obj) -> None:
+    print(json.dumps(obj, ensure_ascii=False, indent=2, default=str))
+
+
+def die(msg: str, code: int = 1) -> None:
+    out({"error": msg})
+    sys.exit(code)
+
+
+def load_cookie_dict() -> dict:
+    raw = os.environ.get("X_COOKIES")
+    if not raw:
+        die("X_COOKIES is not set — connect X (Twitter) at "
+            "https://auth.acedata.cloud/user/connections, then retry.")
+    try:
+        jar = json.loads(raw)
+    except json.JSONDecodeError as e:
+        die(f"X_COOKIES is not valid JSON: {e}")
+    if not isinstance(jar, list):
+        die(f"X_COOKIES must be a JSON list of cookies, got {type(jar).__name__}")
+    cookies = {}
+    for c in jar:
+        name, value = c.get("name"), c.get("value")
+        if name and value is not None:
+            cookies[name] = value
+    if "auth_token" not in cookies or "ct0" not in cookies:
+        die("X_COOKIES is missing auth_token / ct0 — re-capture the cookie on "
+            "x.com with the ACE extension, then reconnect at "
+            "https://auth.acedata.cloud/user/connections.")
+    return cookies
+
+
+def make_client():
+    from twikit import Client
+    proxy = (
+        os.environ.get("X_PROXY")
+        or os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy")
+        or os.environ.get("ALL_PROXY") or os.environ.get("all_proxy")
+        or None
+    )
+    client = Client("en-US", proxy=proxy, user_agent=UA)
+    client.set_cookies(load_cookie_dict())
+    return client
+
+
+# ── formatting ──────────────────────────────────────────────────────
+
+def fmt_user(u) -> dict:
+    return {
+        "id": str(getattr(u, "id", "")),
+        "name": getattr(u, "name", None),
+        "screen_name": getattr(u, "screen_name", None),
+        "url": f"https://x.com/{getattr(u, 'screen_name', '')}",
+        "followers_count": getattr(u, "followers_count", None),
+        "following_count": getattr(u, "following_count", None),
+        "statuses_count": getattr(u, "statuses_count", None),
+        "verified": getattr(u, "verified", None) or getattr(u, "is_blue_verified", None),
+        "description": (getattr(u, "description", None) or "")[:200],
+    }
+
+
+def fmt_tweet(t) -> dict:
+    author = getattr(t, "user", None)
+    sn = getattr(author, "screen_name", None) if author else None
+    tid = str(getattr(t, "id", ""))
+    return {
+        "id": tid,
+        "text": (getattr(t, "full_text", None) or getattr(t, "text", None) or "")[:280],
+        "author": sn,
+        "url": f"https://x.com/{sn}/status/{tid}" if sn and tid else None,
+        "created_at": getattr(t, "created_at", None),
+        "favorite_count": getattr(t, "favorite_count", None),
+        "retweet_count": getattr(t, "retweet_count", None),
+        "reply_count": getattr(t, "reply_count", None),
+        "quote_count": getattr(t, "quote_count", None),
+        "view_count": getattr(t, "view_count", None),
+        "lang": getattr(t, "lang", None),
+    }
+
+
+async def resolve_user(client, target: str):
+    t = target.lstrip("@").strip()
+    if t.isdigit():
+        return await client.get_user_by_id(t)
+    return await client.get_user_by_screen_name(t)
+
+
+# ── read commands ───────────────────────────────────────────────────
+
+async def cmd_whoami(client, _args):
+    u = await client.user()
+    out(fmt_user(u))
+
+
+async def cmd_search(client, args):
+    tweets = await client.search_tweet(args.query, args.product, count=args.limit)
+    items = list(tweets)[: args.limit]
+    out({"query": args.query, "product": args.product,
+         "count": len(items), "tweets": [fmt_tweet(t) for t in items]})
+
+
+async def cmd_search_users(client, args):
+    users = await client.search_user(args.query, count=args.limit)
+    items = list(users)[: args.limit]
+    out({"query": args.query, "count": len(items),
+         "users": [fmt_user(u) for u in items]})
+
+
+async def cmd_timeline(client, args):
+    tweets = await client.get_latest_timeline(count=args.limit)
+    items = list(tweets)[: args.limit]
+    out({"count": len(items), "tweets": [fmt_tweet(t) for t in items]})
+
+
+async def cmd_user_tweets(client, args):
+    u = await resolve_user(client, args.user)
+    tweets = await client.get_user_tweets(u.id, args.type, count=args.limit)
+    items = list(tweets)[: args.limit]
+    out({"user": fmt_user(u), "type": args.type,
+         "count": len(items), "tweets": [fmt_tweet(t) for t in items]})
+
+
+async def cmd_tweet(client, args):
+    t = await client.get_tweet_by_id(args.id)
+    out(fmt_tweet(t))
+
+
+async def cmd_trends(client, args):
+    trends = await client.get_trends(args.category, count=args.limit)
+    out({"category": args.category,
+         "trends": [{"name": getattr(x, "name", None),
+                     "tweets_count": getattr(x, "tweets_count", None)}
+                    for x in list(trends)[: args.limit]]})
+
+
+# ── write commands (GATED) ──────────────────────────────────────────
+
+async def _upload_media(client, media_arg: str) -> list:
+    media_ids = []
+    for path in [p.strip() for p in media_arg.split(",") if p.strip()]:
+        if not os.path.isfile(path):
+            die(f"media file not found: {path}")
+        media_ids.append(await client.upload_media(path, wait_for_completion=True))
+    return media_ids
+
+
+def _quote_note(args) -> dict:
+    return {
+        "reply_to": getattr(args, "reply_to", None),
+        "quote_url": getattr(args, "quote_url", None),
+        "media": getattr(args, "media", None),
+    }
+
+
+async def cmd_post(client, args):
+    text = (args.text or "").strip()
+    if not text and not args.media:
+        die("provide --text and/or --media")
+    media_ids = await _upload_media(client, args.media) if args.media else None
+    tweet = await client.create_tweet(
+        text=text, media_ids=media_ids,
+        reply_to=args.reply_to, attachment_url=args.quote_url)
+    out({"ok": True, "posted": True, **fmt_tweet(tweet)})
+
+
+async def cmd_thread(client, args):
+    texts = [t for t in (args.text or []) if t and t.strip()]
+    if len(texts) < 2:
+        die("a thread needs at least two --text segments")
+    media_ids = await _upload_media(client, args.media) if args.media else None
+    posted, reply_to = [], None
+    for i, text in enumerate(texts):
+        tweet = await client.create_tweet(
+            text=text.strip(),
+            media_ids=media_ids if i == 0 else None,
+            reply_to=reply_to)
+        reply_to = tweet.id
+        posted.append(fmt_tweet(tweet))
+    out({"ok": True, "posted": True, "count": len(posted), "tweets": posted})
+
+
+async def cmd_like(client, args):
+    await client.favorite_tweet(args.id)
+    out({"ok": True, "liked": True, "tweet_id": args.id})
+
+
+async def cmd_unlike(client, args):
+    await client.unfavorite_tweet(args.id)
+    out({"ok": True, "unliked": True, "tweet_id": args.id})
+
+
+async def cmd_retweet(client, args):
+    await client.retweet(args.id)
+    out({"ok": True, "retweeted": True, "tweet_id": args.id})
+
+
+async def cmd_unretweet(client, args):
+    await client.delete_retweet(args.id)
+    out({"ok": True, "unretweeted": True, "tweet_id": args.id})
+
+
+async def cmd_follow(client, args):
+    u = await resolve_user(client, args.user)
+    await client.follow_user(u.id)
+    out({"ok": True, "followed": True, "user": u.screen_name, "user_id": str(u.id)})
+
+
+async def cmd_unfollow(client, args):
+    u = await resolve_user(client, args.user)
+    await client.unfollow_user(u.id)
+    out({"ok": True, "unfollowed": True, "user": u.screen_name, "user_id": str(u.id)})
+
+
+async def cmd_delete(client, args):
+    await client.delete_tweet(args.id)
+    out({"ok": True, "deleted": True, "tweet_id": args.id})
+
+
+def gated_dry_run(args) -> None:
+    """Print what a state-changing command WOULD do, without any network call."""
+    cmd = args.command
+    fields: dict = {}
+    if cmd == "post":
+        fields = {"text_preview": (args.text or "")[:280], **_quote_note(args)}
+    elif cmd == "thread":
+        texts = [t for t in (args.text or []) if t and t.strip()]
+        fields = {"segments": len(texts), "preview": [t[:120] for t in texts],
+                  "media_on_first": args.media}
+    elif cmd in ("follow", "unfollow"):
+        fields = {"user": args.user}
+    else:  # like / unlike / retweet / unretweet / delete
+        fields = {"tweet_id": args.id}
+    out({"dry_run": True, "command": cmd, **fields,
+         "note": "Re-run with --confirm as the LAST argument to actually run "
+                 "this. It acts on the user's REAL X account."})
+
+
+COMMANDS = {
+    "whoami": cmd_whoami,
+    "search": cmd_search,
+    "search-users": cmd_search_users,
+    "timeline": cmd_timeline,
+    "user-tweets": cmd_user_tweets,
+    "tweet": cmd_tweet,
+    "trends": cmd_trends,
+    "post": cmd_post,
+    "thread": cmd_thread,
+    "like": cmd_like,
+    "unlike": cmd_unlike,
+    "retweet": cmd_retweet,
+    "unretweet": cmd_unretweet,
+    "follow": cmd_follow,
+    "unfollow": cmd_unfollow,
+    "delete": cmd_delete,
+}
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="x.py", description="X (Twitter) cookie CLI")
+    sub = p.add_subparsers(dest="command", required=True)
+
+    sub.add_parser("whoami", help="show the logged-in account")
+
+    sp = sub.add_parser("search", help="search tweets by keyword")
+    sp.add_argument("--query", required=True)
+    sp.add_argument("--product", choices=["Top", "Latest", "Media"], default="Latest")
+    sp.add_argument("--limit", type=int, default=20)
+
+    sp = sub.add_parser("search-users", help="search users by keyword")
+    sp.add_argument("--query", required=True)
+    sp.add_argument("--limit", type=int, default=20)
+
+    sp = sub.add_parser("timeline", help="my home timeline (latest)")
+    sp.add_argument("--limit", type=int, default=20)
+
+    sp = sub.add_parser("user-tweets", help="a user's tweets")
+    sp.add_argument("--user", required=True, help="@screen_name or numeric id")
+    sp.add_argument("--type", choices=["Tweets", "Replies", "Media", "Likes"],
+                    default="Tweets")
+    sp.add_argument("--limit", type=int, default=20)
+
+    sp = sub.add_parser("tweet", help="single tweet detail")
+    sp.add_argument("--id", required=True)
+
+    sp = sub.add_parser("trends", help="trending topics")
+    sp.add_argument("--category",
+                    choices=["trending", "for-you", "news", "sports", "entertainment"],
+                    default="trending")
+    sp.add_argument("--limit", type=int, default=20)
+
+    sp = sub.add_parser("post", help="publish a tweet (GATED by trailing --confirm)")
+    sp.add_argument("--text", default="")
+    sp.add_argument("--media", help="comma-separated image/video file paths")
+    sp.add_argument("--reply-to", dest="reply_to", help="tweet id to reply to")
+    sp.add_argument("--quote-url", dest="quote_url", help="tweet URL to quote")
+
+    sp = sub.add_parser("thread", help="publish a thread (GATED by trailing --confirm)")
+    sp.add_argument("--text", action="append", help="one per tweet; repeat 2+ times")
+    sp.add_argument("--media", help="comma-separated paths, attached to the FIRST tweet")
+
+    for name in ("like", "unlike", "retweet", "unretweet", "delete"):
+        sp = sub.add_parser(name, help=f"{name} a tweet (GATED by trailing --confirm)")
+        sp.add_argument("--id", required=True)
+
+    for name in ("follow", "unfollow"):
+        sp = sub.add_parser(name, help=f"{name} a user (GATED by trailing --confirm)")
+        sp.add_argument("--user", required=True, help="@screen_name or numeric id")
+
+    return p
+
+
+async def run(args) -> None:
+    client = make_client()
+    await COMMANDS[args.command](client, args)
+
+
+def main() -> None:
+    args = build_parser().parse_args(ARGV)
+    # Gated commands dry-run offline (no cookies, no network) unless --confirm.
+    if args.command in GATED and not CONFIRM:
+        gated_dry_run(args)
+        return
+    try:
+        from twikit.errors import (
+            Unauthorized, Forbidden, TooManyRequests, NotFound,
+            TweetNotAvailable, UserNotFound, UserUnavailable,
+            AccountLocked, AccountSuspended, TwitterException,
+        )
+    except Exception as e:  # twikit not importable
+        die(f"twikit is not available: {e}. Install with "
+            f"`pip install --user twikit`.")
+    try:
+        asyncio.run(run(args))
+    except (Unauthorized,) as e:
+        die(f"auth failed — cookie likely expired. Reconnect X at "
+            f"https://auth.acedata.cloud/user/connections. ({e})")
+    except (AccountLocked, AccountSuspended) as e:
+        die(f"account locked/suspended by X: {e}")
+    except TooManyRequests as e:
+        die(f"rate limited by X — wait and retry, or slow down. ({e})")
+    except (NotFound, TweetNotAvailable, UserNotFound, UserUnavailable) as e:
+        die(f"not found / unavailable: {e}")
+    except Forbidden as e:
+        die(f"forbidden by X (content rule, protected account, or ToS): {e}")
+    except TwitterException as e:
+        die(f"X API error: {e}")
+    except Exception as e:
+        # twikit scrapes X's non-public API; a bare error here usually means an
+        # expired cookie OR that X changed its internal endpoints and twikit
+        # needs upgrading (e.g. "Couldn't get KEY_BYTE indices" = transaction-id
+        # bootstrap drift → `pip install --user -U twikit`).
+        die(f"X request failed ({type(e).__name__}: {e}). Likely an expired "
+            f"cookie — reconnect at https://auth.acedata.cloud/user/connections "
+            f"— or twikit drift vs X's internal API (try `pip install --user -U "
+            f"twikit`).")
+
+
+if __name__ == "__main__":
+    main()