@acedatacloud/skills 2026.713.4 → 2026.713.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.713.4",
+  "version": "2026.713.5",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/xiaohongshu/README.md

@@ -0,0 +1,36 @@
+# Xiaohongshu Connector Skill
+
+AceDataCloud adaptation for operating Xiaohongshu through an encrypted BYOC cookie connector. It runs Chromium directly over CDP inside the existing Skill sandbox; no hosted or long-running MCP server is required.
+
+## Provenance
+
+This Skill is rewritten from [`xpzouying/xiaohongshu-mcp`](https://github.com/xpzouying/xiaohongshu-mcp), used by AceDataCloud with permission from its author. The connector-cookie adapter, direct-CDP process isolation, confirmation gates, and Agent Skill integration are AceDataCloud changes.
+
+The browser business modules, workflow structure, split preview/confirmation approach, validation ideas, and operational guidance are adapted from MIT-licensed [`autoclaw-cc/xiaohongshu-skills`](https://github.com/autoclaw-cc/xiaohongshu-skills):
+
+- Business modules: commit `b043748282a57e347c52f517dfb59819121134ab`.
+- Hardened direct-CDP runtime: commit `406e0590523f`.
+- The upstream MIT license is retained at `scripts/vendor/LICENSE.autoclaw-xiaohongshu-skills`.
+
+No AutoClaw browser extension, local WebSocket bridge, persistent Chrome profile, or hosted MCP server is used.
+
+## Capabilities
+
+- Login status and connected account identity.
+- Home recommendations, filtered search, note details and comments, and user profiles.
+- Image, video, and formatted text-only long-article publishing.
+- Tags, scheduled publishing, visibility, original declaration, templates, and product binding.
+- Comments, comment replies, likes/unlikes, and favorites/unfavorites.
+- Private messages remain in the Android-only `xhs-dm` Skill.
+
+## Security model
+
+- AuthBackend stores the browser-extension cookie jar encrypted.
+- aichat2 injects it as `XIAOHONGSHU_COOKIES` only while this Skill is active.
+- The CLI validates domains and converts Chrome-extension cookie fields to CDP `CookieParam` records.
+- Cookies are injected through `Storage.setCookies` into an incognito Chromium context instead of being passed through files or command arguments.
+- Each command creates a private temporary profile, starts Chromium on a random loopback CDP port, then terminates Chromium and removes the entire profile.
+- Chromium receives a minimal child environment that excludes `XIAOHONGSHU_COOKIES`; Cookie values are never placed in process arguments or model-visible output.
+- Real account writes dry-run unless the invocation ends with `--confirm`; the Skill instructions require a structured user confirmation before that second invocation.
+
+Xiaohongshu's web "draft box" is stored in the browser profile rather than the connected account. This Skill deliberately destroys its temporary profile after each command, so it uses code-enforced dry-run previews instead of claiming durable Xiaohongshu drafts. Confirmation is an orchestration policy, not a cryptographic authorization boundary.

package/skills/xiaohongshu/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: xiaohongshu
+description: Read, search, preview, publish, and interact on 小红书 / Xiaohongshu / RED using the user's connected account. Supports recommendations, details/comments, profiles, image/video/long-article publishing, schedules, product binding, comments/replies, likes, and favorites. Real writes always dry-run first and require explicit confirmation.
+when_to_use: |
+  Trigger when the user asks to use their connected 小红书 / Xiaohongshu / RED account:
+  check account status, browse recommendations, search notes, inspect comments or profiles,
+  preview or publish image/video/long-article notes, schedule a note, bind products,
+  comment/reply, like/unlike, or favorite/unfavorite.
+  Private messages are handled by the separate Android-only xhs-dm skill.
+connections: [xiaohongshu]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+# Xiaohongshu connector
+
+Operate the user's real Xiaohongshu account using the login cookies they captured with the ACE extension. The runtime injects `XIAOHONGSHU_COOKIES`; never print, inspect, or pass that value on the command line.
+
+This Skill is rewritten for AceDataCloud from the authorized [`xpzouying/xiaohongshu-mcp`](https://github.com/xpzouying/xiaohongshu-mcp) automation engine. Browser modules, workflow, and safety patterns are adapted from MIT-licensed [`autoclaw-cc/xiaohongshu-skills`](https://github.com/autoclaw-cc/xiaohongshu-skills). See [`README.md`](README.md) for pinned commits and provenance.
+
+## Locate the CLI
+
+Every Bash call is a fresh shell. Resolve the script at the start of each call:
+
+```sh
+XHS="$SKILL_DIR/scripts/xiaohongshu.py"
+[ -f "$XHS" ] || XHS=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/xiaohongshu.py' 2>/dev/null | head -1)
+[ -f "$XHS" ] || { echo "xiaohongshu skill runtime not found" >&2; exit 1; }
+```
+
+## Read operations
+
+Run these directly:
+
+```sh
+python3 "$XHS" status
+python3 "$XHS" whoami
+python3 "$XHS" feeds
+
+python3 "$XHS" search --keyword "AI Agent"
+python3 "$XHS" search --keyword "旅行" --sort-by 最新 --note-type 图文 --publish-time 一周内
+
+python3 "$XHS" detail --feed-id FEED_ID --xsec-token XSEC_TOKEN --xsec-source XSEC_SOURCE
+python3 "$XHS" detail --feed-id FEED_ID --xsec-token XSEC_TOKEN --xsec-source XSEC_SOURCE --load-all-comments --limit 50
+python3 "$XHS" profile --user-id USER_ID --xsec-token XSEC_TOKEN
+```
+
+Search/feed results contain the `feed_id`, `xsec_token`, `xsecSource`, and author `user_id` needed by detail, profile, and interaction commands. Preserve `xsecSource`: recommendation/search rows use `pc_feed`, while rows returned from a user profile use `pc_note`. Do not invent those identifiers.
+
+## Image publishing
+
+`publish` accepts 1-18 images. Each `--images` value is either a public HTTPS URL or an existing absolute sandbox path. Text can be inline or read from an absolute UTF-8 file.
+
+```sh
+# Dry-run: validates and shows the exact public write, but changes nothing.
+python3 "$SKILL_DIR/scripts/xiaohongshu.py" publish \
+  --title "标题" \
+  --content-file /absolute/path/content.txt \
+  --images https://cdn.example.com/1.jpg \
+  --images /absolute/path/2.png \
+  --tags AI --tags 效率 \
+  --visibility 仅自己可见
+
+# After the dry-run, show the complete preview and use `ask_user_question`.
+# Only after the user selects `确认执行`, repeat the exact command with
+# `--confirm` as its final argument:
+python3 "$XHS" publish \
+  --title "标题" \
+  --content-file /absolute/path/content.txt \
+  --images https://cdn.example.com/1.jpg \
+  --tags AI --visibility 仅自己可见 \
+  --preview-digest DIGEST \
+  --confirm
+```
+
+The CLI defaults every write command to dry-run. Xiaohongshu web drafts live only in the browser profile, while this Skill intentionally destroys its temporary profile after every command to prevent account crossover.
+
+After showing the complete dry-run, pause with this exact card shape (replace `PREFIX` with the first 12 characters of `preview_digest`):
+
+```json
+{
+  "questions": [{
+    "header": "小红书确认",
+    "question": "确认执行已展示的小红书写操作？预览摘要 PREFIX",
+    "options": [
+      {"label": "确认执行", "description": "执行刚刚展示的完整预览"},
+      {"label": "取消", "description": "不执行任何账号写操作"}
+    ]
+  }]
+}
+```
+
+Optional publishing flags:
+
+- `--schedule-at <ISO8601>`: 1 hour to 14 days ahead.
+- `--visibility`: `公开可见`, `仅自己可见`, or `仅互关好友可见`.
+- `--original`: declare original content.
+- Repeat `--products` to bind products; the account must have product permissions.
+
+## Video publishing
+
+Video must be an existing absolute local path. Remote video URLs are rejected; download the user's supplied file into the sandbox first.
+
+```sh
+python3 "$XHS" publish-video --title "标题" --content "描述" --video /absolute/video.mp4 --tags 视频
+# After explicit confirmation, repeat the exact command with --confirm last:
+python3 "$XHS" publish-video --title "标题" --content "描述" --video /absolute/video.mp4 --tags 视频 --preview-digest DIGEST --confirm
+```
+
+Use Bash's maximum `timeout: 120` for confirmed video operations. Report a timeout without retrying the write, because the publish may already have reached Xiaohongshu.
+
+## Long articles
+
+Long articles support a named layout template, an independent post description, scheduling, visibility, original declaration, and products. Inline images are currently rejected because Xiaohongshu's web editor has no upload flow this Skill can verify; image notes remain fully supported. If `--template` is omitted, the first available template is selected.
+
+```sh
+python3 "$SKILL_DIR/scripts/xiaohongshu.py" publish-long \
+  --title "长文标题" \
+  --content-file /absolute/path/article.txt \
+  --description "发布页摘要" \
+  --visibility 仅自己可见
+
+# After explicit confirmation, repeat the exact command with --confirm last:
+python3 "$XHS" publish-long \
+  --title "长文标题" \
+  --content-file /absolute/path/article.txt \
+  --description "发布页摘要" \
+  --visibility 仅自己可见 \
+  --preview-digest DIGEST \
+  --confirm
+```
+
+## Interactions
+
+Every interaction is a real account write and follows the same dry-run then confirm flow. Repeat the exact previewed command with `--confirm` as the final argument only after explicit confirmation.
+
+```sh
+python3 "$XHS" comment --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --content "评论"
+python3 "$XHS" comment --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --content "评论" --preview-digest DIGEST --confirm
+
+python3 "$XHS" reply --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --comment-id COMMENT_ID --content "回复"
+python3 "$XHS" reply --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --comment-id COMMENT_ID --content "回复" --preview-digest DIGEST --confirm
+
+python3 "$XHS" like --feed-id ID --xsec-token TOKEN --xsec-source SOURCE
+python3 "$XHS" like --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --preview-digest DIGEST --confirm
+python3 "$XHS" unlike --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --preview-digest DIGEST --confirm
+
+python3 "$XHS" favorite --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --preview-digest DIGEST --confirm
+python3 "$XHS" unfavorite --feed-id ID --xsec-token TOKEN --xsec-source SOURCE --preview-digest DIGEST --confirm
+```
+
+For reversible tests or temporary actions, inspect the current `liked` / `collected` state first and restore that exact state afterward.
+
+## Mandatory write policy
+
+- Never add `--confirm` until the user has seen the exact dry-run and selected `确认执行` in the required structured confirmation card. Plain prose from the model is not approval.
+- The confirmation card must use header `小红书确认`, exactly `确认执行` / `取消` options, and include the dry-run digest's first 12 hex characters in its question.
+- Repeat the exact previewed arguments and pass its `preview_digest`; if anything changes, the CLI rejects the write and requires a new dry-run.
+- A confirmed write must be one direct `python3 "$SKILL_DIR/scripts/xiaohongshu.py" ... --confirm` command. Never add shell chaining, redirection, command substitution, or wrappers.
+- `--confirm` is honored only as the final argument.
+- Do not batch-comment, mass-like, mass-favorite, or perform unsolicited engagement.
+- Stop immediately on CAPTCHA, verification, risk-control, rate-limit, or account-restriction errors. Do not retry around them.
+- Do not publish external links, contact details, or promotional spam unless the user explicitly supplied and approved them.
+- Scheduled/unattended runs may read or produce dry-run previews only. Xiaohongshu writes always require an interactive confirmation.
+
+## Authentication and errors
+
+Authentication belongs to the Connector, not this skill. It does not expose QR login or cookie deletion. If status reports logged out, ask the user to reconnect at <https://auth.acedata.cloud/user/connections> using the ACE extension.
+
+The browser automation follows Xiaohongshu's web UI and can drift. Report the exact safe error summary; never dump runtime logs, environment variables, cookies, or `xsec_token` values in errors or write previews.

package/skills/xiaohongshu/requirements.txt

@@ -0,0 +1 @@
+urllib3==2.2.3

package/skills/xiaohongshu/scripts/vendor/LICENSE.autoclaw-xiaohongshu-skills

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Auto-Claw-CC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/xiaohongshu/scripts/vendor/title_utils.py

@@ -0,0 +1,57 @@
+"""UTF-16 标题长度计算，对应 Go pkg/xhsutil/title.go。"""
+
+from __future__ import annotations
+
+MAX_TITLE_LENGTH = 20
+
+
+def truncate_title(s: str, max_length: int = MAX_TITLE_LENGTH) -> str:
+    """将标题裁剪到 max_length 以内（逐字符从末尾去除）。
+
+    Args:
+        s: 原始标题。
+        max_length: 最大允许长度（默认 20）。
+
+    Returns:
+        满足长度要求的标题字符串。
+    """
+    if calc_title_length(s) <= max_length:
+        return s
+    while s and calc_title_length(s) > max_length:
+        s = s[:-1]
+    return s
+
+
+def calc_title_length(s: str) -> int:
+    """计算小红书标题长度。
+
+    规则（同 Go CalcTitleLength）：
+    - 非 ASCII 字符（中文、全角符号、emoji 代码单元等）算 2
+    - ASCII 字符算 1
+    - 最终结果向上取整除以 2，上限 MAX_TITLE_LENGTH = 20
+
+    Emoji 按 UTF-16 码元计数：
+    - 基础 emoji（如 ✨ U+2728, BMP）= 1 码元 → 权重 2 → 贡献 1
+    - SMP emoji（如 💇 U+1F487，surrogate pair）= 2 码元 → 权重 4 → 贡献 2
+    - ZWJ 序列（如 💇‍♀️）= 5 码元 → 权重 10 → 贡献 5
+    - 旗帜（如 🇨🇳，2 个 regional indicator）= 4 码元 → 权重 8 → 贡献 4
+
+    Examples:
+        >>> calc_title_length("你好世界")
+        4
+        >>> calc_title_length("hello")
+        3
+        >>> calc_title_length("OOTD穿搭分享")
+        6
+        >>> calc_title_length("💇\u200d♀️")
+        5
+    """
+    byte_len = 0
+    encoded = s.encode("utf-16-le")
+    for i in range(0, len(encoded), 2):
+        code_unit = int.from_bytes(encoded[i : i + 2], "little")
+        if code_unit > 127:
+            byte_len += 2
+        else:
+            byte_len += 1
+    return (byte_len + 1) // 2

package/skills/xiaohongshu/scripts/vendor/xhs/__init__.py

@@ -0,0 +1 @@
+"""小红书 CDP 自动化核心包。"""