@acedatacloud/skills 2026.721.3 → 2026.722.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.721.3",
+  "version": "2026.722.1",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/ai-chat/SKILL.md

@@ -56,11 +56,11 @@ models include:
 
 | Family | Current examples |
 |--------|------------------|
-| OpenAI / reasoning | `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4`, `gpt-5.4-pro`, `gpt-5.2`, `gpt-5.1`, `gpt-5`, `gpt-5-mini`, `gpt-5-nano`, `gpt-4.1`, `gpt-4.1-mini`, `gpt-4.1-nano`, `gpt-4o`, `gpt-4o-mini`, `o1`, `o3`, `o4-mini` |
+| OpenAI / reasoning | `gpt-5.6-luna`, `gpt-5.6-terra`, `gpt-5.6-sol`, `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4`, `gpt-5.4-pro`, `gpt-5.2`, `gpt-5.1`, `gpt-5`, `gpt-5-mini`, `gpt-5-nano`, `gpt-4.1`, `gpt-4.1-mini`, `gpt-4.1-nano`, `gpt-4o`, `gpt-4o-mini`, `o1`, `o3`, `o4-mini` |
 | OpenAI free-tier chat-completions | `gpt-5.5:free`, `gpt-5:free`, `gpt-4.1:free`, `gpt-4o:free`, `gpt-4o-mini:free`, `gpt-oss:free` |
 | Claude | `claude-fable-5`, `claude-sonnet-5`, `claude-opus-4-8`, `claude-opus-4-7`, `claude-opus-4-6`, `claude-opus-4-5-20251101`, `claude-sonnet-4-6`, `claude-sonnet-4-5-20250929`, `claude-sonnet-4-20250514`, `claude-haiku-4-5-20251001`, `claude-3-7-sonnet-20250219` |
-| Gemini | `gemini-3.1-pro`, `gemini-3.1-pro-preview`, `gemini-3.1-flash-image-preview`, `gemini-3.1-flash-lite-preview`, `gemini-3-pro-preview`, `gemini-2.5-flash-lite`, `gemini-2.0-flash-lite` |
-| Grok | `grok-4`, `grok-4-0709`, `grok-3`, `grok-3-fast` |
+| Gemini | `gemini-3.5-flash`, `gemini-3.1-pro`, `gemini-3.1-pro-preview`, `gemini-3.1-flash-image-preview`, `gemini-3.1-flash-lite-preview`, `gemini-3-pro-preview`, `gemini-2.5-flash-lite`, `gemini-2.0-flash-lite` |
+| Grok | `grok-4.5`, `grok-4`, `grok-4-0709`, `grok-3`, `grok-3-fast` |
 | DeepSeek | `deepseek-r1`, `deepseek-r1-0528`, `deepseek-v3`, `deepseek-v3-250324`, `deepseek-v3.2-exp`, `deepseek-v4-flash` |
 | Kimi | `kimi-k3`, `kimi-k2.6`, `kimi-k2.5`, `kimi-k2-thinking-turbo`, `kimi-k2-thinking`, `kimi-k2-instruct-0905`, `kimi-k2-0905-preview`, `kimi-k2-turbo-preview`, `kimi-k2-0711-preview` |
 | GLM | `glm-5.2`, `glm-5.1`, `glm-5`, `glm-5-turbo`, `glm-4.7`, `glm-4.6`, `glm-4.5`, `glm-4.5v`, `glm-3-turbo` |

package/skills/discordbot/SKILL.md

@@ -1,18 +1,18 @@
 ---
 name: discordbot
-description: List channels, read recent messages, and send messages on Discord using the user's own bot, via the Discord REST API. Use when the user wants their Discord BOT to post a message, read a channel, or list servers/channels — anything that acts in a server the bot was invited to.
+description: List channels, read recent messages, send channel messages, and send a single user-initiated DM on Discord using the user's own bot via the Discord REST API.
 when_to_use: |
   Trigger when the user wants to send, read, or list things on Discord
   through their bot: list the servers/channels the bot can see, read recent
-  messages in a channel, or post / reply in a channel. Messages are sent as
-  the BOT, not the user's personal account, and only in servers the bot has
-  been invited to with the right permissions.
+  messages in a channel, post / reply in a channel, or DM one user who has
+  explicitly initiated the interaction. Messages are sent as the BOT, not
+  the user's personal account, and only where the bot has access.
 connections: [discordbot]
 allowed_tools: [Bash]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "1.0"
+  version: "1.1"
 ---
 
 We drive the [Discord API](https://discord.com/developers/docs/reference)
@@ -33,8 +33,21 @@ bot token is wrong/reset — ask the user to re-paste it at
 `auth.acedata.cloud/user/connections`. A `429` carries `retry_after`
 (seconds) — sleep that long, then retry; never parallelize.
 
-**Before sending a message, confirm the exact channel and content with the
-user.** Sending is irreversible and public to that channel.
+## Sending safety
+
+- Before sending, confirm the exact destination and final content with the
+  user. Sending is irreversible.
+- A DM must be initiated by a recipient action, such as asking the bot for
+  details by replying with an advertised keyword. Server membership, a public
+  profile, or appearing in a member list is not consent.
+- Send to exactly one recipient per invocation. Never enumerate members,
+  create DM channels in a loop, or send unsolicited/bulk outreach.
+- For an unattended scheduled run, send only when its task definition already
+  contains one exact `recipient_id`, `consent_channel_id`,
+  `consent_message_id`, `consent_keyword`, and approved `content`. If any is
+  missing, return a draft without sending.
+- Do not follow up unless the recipient replies. Treat `stop`, `unsubscribe`,
+  or an equivalent refusal as a permanent opt-out.
 
 ## Recipes
 
@@ -77,7 +90,7 @@ bot. Needs the *Read Message History* permission in that channel.
 CHANNEL_ID="123456789012345678"
 curl -sS -H "Authorization: Bot $DISCORDBOT_TOKEN" \
   "https://discord.com/api/v10/channels/$CHANNEL_ID/messages?limit=20" \
-  | jq 'map({author: .author.username, ts: .timestamp, content})'
+  | jq 'map({id, author_id: .author.id, author: .author.username, author_bot: .author.bot, ts: .timestamp, content})'
 ```
 
 ### Send a message to a channel
@@ -103,6 +116,34 @@ curl -sS -X POST \
         '{content: $c, message_reference: {message_id: $m}}')"
 ```
 
+### Send one opt-in DM
+
+Use only after applying every rule in **Sending safety**. The helper fetches
+the source message from Discord and verifies that its non-bot author matches
+`RECIPIENT_ID` and its complete text matches `CONSENT_KEYWORD`. Do not call the
+Create DM endpoint directly. Matching is case-insensitive and collapses
+surrounding or repeated whitespace.
+
+```sh
+RECIPIENT_ID="123456789012345678"
+CONSENT_CHANNEL_ID="223456789012345678"
+CONSENT_MESSAGE_ID="323456789012345678"
+CONSENT_KEYWORD="details"
+
+python3 "$SKILL_DIR/scripts/discordbot.py" send-opt-in-dm \
+  --recipient-id "$RECIPIENT_ID" \
+  --consent-channel-id "$CONSENT_CHANNEL_ID" \
+  --consent-message-id "$CONSENT_MESSAGE_ID" \
+  --consent-keyword "$CONSENT_KEYWORD" \
+  --content "Here are the details you requested."
+```
+
+The command is a dry-run unless the final argument is `--confirm`. In a
+pre-authorized scheduled task, use final `--unattended-confirm` instead. The
+helper validates all IDs, verifies the opt-in message, and skips an identical
+message already present in the DM history. Discord may block or rate-limit bots
+that open many DMs; do not retry by targeting another account.
+
 ## Notes
 
 - A "server" in the UI is a "guild" in the API; messages live in channels
@@ -113,5 +154,7 @@ curl -sS -X POST \
   URL → pick a server (the user needs *Manage Server* there).
 - This is a bot, not the user's account — it cannot read the user's DMs or
   the user's full server list, only what the bot itself can access.
+- A bot can open its own DM channel with one consenting user; that does not
+  grant access to the connected user's personal DMs.
 - Mentions: `<@USER_ID>` pings a user, `<#CHANNEL_ID>` links a channel. Plain
   text is fine for normal messages.

package/skills/discordbot/scripts/discordbot.py

@@ -0,0 +1,230 @@
+#!/usr/bin/env python3
+"""Permission-first Discord Bot actions."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+API_BASE = "https://discord.com/api/v10"
+SNOWFLAKE_RE = re.compile(r"[0-9]{17,20}")
+
+
+class DiscordBotError(RuntimeError):
+    pass
+
+
+def out(payload: dict[str, Any]) -> None:
+    print(json.dumps(payload, ensure_ascii=False, indent=2))
+
+
+def normalize_text(value: str) -> str:
+    return " ".join(value.split()).casefold()
+
+
+def validate_snowflake(name: str, value: str) -> str:
+    value = value.strip()
+    if not SNOWFLAKE_RE.fullmatch(value):
+        raise DiscordBotError(f"{name} must be a 17-20 digit Discord snowflake")
+    return value
+
+
+def validate_send_input(
+    recipient_id: str,
+    consent_channel_id: str,
+    consent_message_id: str,
+    consent_keyword: str,
+    content: str,
+) -> dict[str, str]:
+    values = {
+        "recipient_id": validate_snowflake("recipient_id", recipient_id),
+        "consent_channel_id": validate_snowflake("consent_channel_id", consent_channel_id),
+        "consent_message_id": validate_snowflake("consent_message_id", consent_message_id),
+        "consent_keyword": consent_keyword.strip(),
+        "content": content.strip(),
+    }
+    if not values["consent_keyword"] or len(values["consent_keyword"]) > 64:
+        raise DiscordBotError("consent_keyword must contain 1-64 characters")
+    if not values["content"] or len(values["content"]) > 2000:
+        raise DiscordBotError("content must contain 1-2000 characters")
+    return values
+
+
+def api_request(method: str, path: str, payload: dict[str, Any] | None = None) -> Any:
+    token = os.environ.get("DISCORDBOT_TOKEN", "").strip()
+    if not token:
+        raise DiscordBotError(
+            "DISCORDBOT_TOKEN is not set; connect Discord Bot at "
+            "https://auth.acedata.cloud/user/connections"
+        )
+    body = json.dumps(payload).encode() if payload is not None else None
+    request = urllib.request.Request(
+        f"{API_BASE}{path}",
+        data=body,
+        method=method,
+        headers={
+            "Authorization": f"Bot {token}",
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "User-Agent": "AceDataCloud-DiscordBot/1.1",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=15) as response:
+            raw = response.read()
+    except urllib.error.HTTPError as exc:
+        raw = exc.read()
+        try:
+            detail = json.loads(raw.decode())
+            message = str(detail.get("message") or detail.get("code") or "request rejected")
+            retry_after = detail.get("retry_after")
+        except (UnicodeDecodeError, json.JSONDecodeError, AttributeError):
+            message = "request rejected"
+            retry_after = None
+        suffix = f"; retry_after={retry_after}" if retry_after is not None else ""
+        raise DiscordBotError(f"Discord API {exc.code}: {message}{suffix}") from None
+    except urllib.error.URLError as exc:
+        raise DiscordBotError(f"Discord API unavailable: {exc.reason}") from None
+
+    if not raw:
+        return None
+    try:
+        return json.loads(raw.decode())
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise DiscordBotError("Discord API returned invalid JSON") from exc
+
+
+def send_opt_in_dm(
+    recipient_id: str,
+    consent_channel_id: str,
+    consent_message_id: str,
+    consent_keyword: str,
+    content: str,
+) -> dict[str, Any]:
+    values = validate_send_input(
+        recipient_id,
+        consent_channel_id,
+        consent_message_id,
+        consent_keyword,
+        content,
+    )
+    recipient_id = values["recipient_id"]
+    consent_channel_id = values["consent_channel_id"]
+    consent_message_id = values["consent_message_id"]
+    consent_keyword = values["consent_keyword"]
+    content = values["content"]
+
+    bot = api_request("GET", "/users/@me")
+    bot_id = validate_snowflake("bot id", str(bot.get("id", "")))
+    if not bot.get("bot"):
+        raise DiscordBotError("connected credential is not a Discord bot token")
+
+    source = api_request("GET", f"/channels/{consent_channel_id}/messages/{consent_message_id}")
+    if str(source.get("id", "")) != consent_message_id:
+        raise DiscordBotError("Discord returned a different consent message")
+    author = source.get("author") or {}
+    if str(author.get("id", "")) != recipient_id:
+        raise DiscordBotError("consent message author does not match recipient_id")
+    if author.get("bot"):
+        raise DiscordBotError("bot-authored messages cannot grant DM consent")
+    if normalize_text(str(source.get("content", ""))) != normalize_text(consent_keyword):
+        raise DiscordBotError("consent message does not exactly match consent_keyword")
+
+    dm = api_request("POST", "/users/@me/channels", {"recipient_id": recipient_id})
+    dm_channel_id = validate_snowflake("DM channel id", str(dm.get("id", "")))
+
+    history = api_request("GET", f"/channels/{dm_channel_id}/messages?limit=100")
+    if not isinstance(history, list):
+        raise DiscordBotError("Discord returned invalid DM history")
+    duplicate = next(
+        (
+            message
+            for message in history
+            if str((message.get("author") or {}).get("id", "")) == bot_id
+            and str(message.get("content", "")) == content
+        ),
+        None,
+    )
+    if duplicate:
+        return {
+            "status": "duplicate_skipped",
+            "recipient_id": recipient_id,
+            "consent_message_id": consent_message_id,
+            "dm_channel_id": dm_channel_id,
+            "message_id": duplicate.get("id"),
+        }
+
+    sent = api_request("POST", f"/channels/{dm_channel_id}/messages", {"content": content})
+    return {
+        "status": "sent",
+        "recipient_id": recipient_id,
+        "consent_message_id": consent_message_id,
+        "dm_channel_id": dm_channel_id,
+        "message_id": sent.get("id"),
+    }
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    send = commands.add_parser("send-opt-in-dm", help="send one DM after verifying an exact opt-in message")
+    send.add_argument("--recipient-id", required=True)
+    send.add_argument("--consent-channel-id", required=True)
+    send.add_argument("--consent-message-id", required=True)
+    send.add_argument("--consent-keyword", required=True)
+    send.add_argument("--content", required=True)
+    send.add_argument("--confirm", action="store_true", help=argparse.SUPPRESS)
+    send.add_argument("--unattended-confirm", action="store_true", help=argparse.SUPPRESS)
+    return parser
+
+
+def parse_cli(raw: list[str] | None = None) -> tuple[argparse.Namespace, str]:
+    raw = list(sys.argv[1:] if raw is None else raw)
+    parser = build_parser()
+    args = parser.parse_args(raw)
+    if args.confirm and args.unattended_confirm:
+        parser.error("choose only one confirmation mode")
+    confirm_mode = "--confirm" if args.confirm else "--unattended-confirm" if args.unattended_confirm else ""
+    if confirm_mode and (not raw or raw[-1] != confirm_mode):
+        parser.error(f"{confirm_mode} must be the final argument")
+    return args, confirm_mode
+
+
+def main() -> None:
+    args, confirm_mode = parse_cli()
+    try:
+        values = validate_send_input(
+            args.recipient_id,
+            args.consent_channel_id,
+            args.consent_message_id,
+            args.consent_keyword,
+            args.content,
+        )
+        if not confirm_mode:
+            out(
+                {
+                    "status": "dry_run",
+                    "recipient_id": values["recipient_id"],
+                    "consent_channel_id": values["consent_channel_id"],
+                    "consent_message_id": values["consent_message_id"],
+                    "consent_keyword": values["consent_keyword"],
+                    "content": values["content"],
+                    "next": "rerun with trailing --confirm after user approval",
+                }
+            )
+            return
+        out(send_opt_in_dm(**values))
+    except DiscordBotError as exc:
+        out({"error": str(exc)})
+        raise SystemExit(1) from exc
+
+
+if __name__ == "__main__":
+    main()