@acedatacloud/skills 2026.725.0 → 2026.726.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.725.0",
+  "version": "2026.726.0",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/reddit/SKILL.md

@@ -1,18 +1,18 @@
 ---
 name: reddit
-description: Submit posts (link or text) to subreddits and read your Reddit identity / submissions using either official OAuth or your own Reddit login cookies. Use when the user mentions Reddit, posting to a subreddit, submitting a link or self-post, or checking their Reddit profile / submissions.
+description: Search subreddits, read rules, reply to threads, and submit posts (link or text) to Reddit using either official OAuth or your own Reddit login cookies. Use when the user mentions Reddit, posting to a subreddit, replying or commenting on a thread, submitting a link or self-post, or checking their Reddit profile / submissions.
 when_to_use: |
-  Trigger when the user wants to submit a post to a subreddit (link or
-  self/text post), or read their own Reddit identity and submissions.
-  Posting to a subreddit is public and subject to that subreddit's rules
-  / karma requirements — confirm the target subreddit, title and body
-  before submitting.
+  Trigger when the user wants to find relevant Reddit threads, reply to a
+  post or comment, submit a post to a subreddit (link or self/text post),
+  or read their own Reddit identity and submissions. Commenting and posting
+  are public and subject to that subreddit's rules / karma requirements —
+  confirm the target and the exact text before writing.
 connections: [reddit]
 allowed_tools: [Bash, publish_artifact]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "2.0"
+  version: "2.1"
   connection_method_preferences:
     reddit/reddit: [oauth, cookie]
 ---
@@ -54,6 +54,35 @@ python3 "$R" whoami
 python3 "$R" submissions --limit 10
 ```
 
+## Find threads and check the rules
+
+`search` returns each hit's `fullname` (`t3_…`), which is what `comment --parent`
+takes. `subreddit-info` returns the subreddit's rules — **read them before
+writing anything there.**
+
+```sh
+R="${SKILL_DIR:-}/scripts/reddit.py"; [ -f "$R" ] || R=$(find /tmp -maxdepth 8 -path '*/skills/*/reddit/scripts/reddit.py' -print -quit 2>/dev/null)
+[ -f "$R" ] || { echo "reddit script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+
+python3 "$R" search --query "suno api" --time week --limit 10
+python3 "$R" search --query "image generation api" --subreddit SideProject --sort new
+python3 "$R" subreddit-info --subreddit SideProject
+```
+
+## Reply to a thread — GATED
+
+`--parent` accepts a fullname (`t3_…` post, `t1_…` comment) or a reddit.com
+permalink. **Show the target thread and the exact reply text, then obtain
+explicit confirmation.** Without a trailing `--confirm` this is a dry run.
+
+```sh
+R="${SKILL_DIR:-}/scripts/reddit.py"; [ -f "$R" ] || R=$(find /tmp -maxdepth 8 -path '*/skills/*/reddit/scripts/reddit.py' -print -quit 2>/dev/null)
+[ -f "$R" ] || { echo "reddit script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+
+python3 "$R" comment --parent t3_1r9yrtn --body-file reply.md
+python3 "$R" comment --parent t3_1r9yrtn --body-file reply.md --confirm
+```
+
 ## Submit a post — GATED
 
 Posting is public. **Always show the subreddit, final title and final body/URL,
@@ -79,25 +108,47 @@ contains the text `--confirm` can never trigger a write.
 ## Safety and failure handling
 
 - Never print `REDDIT_COOKIES`, `REDDIT_TOKEN`, `reddit_session` or the modhash.
-- Do not vote, send private messages, evade bans, automate engagement, or
-  cross-post identical content. This skill intentionally exposes none of those
-  operations.
-- Follow each subreddit's rules. Account age, karma and flair requirements can
-  reject a post; report the rejection without exposing Reddit's raw authenticated
-  response, which may contain reflected credential material.
+- Do not vote, send private messages, evade bans, or cross-post identical
+  content. This skill intentionally exposes none of those operations.
+- **Never post the same reply text to more than one thread.** Reddit treats
+  repeated identical comments as spam and actions the account, not the comment.
+  Write each reply against the specific thread it answers.
+- Follow each subreddit's rules — run `subreddit-info` first. Account age, karma
+  and flair requirements can reject a post or comment; report the rejection
+  without exposing Reddit's raw authenticated response, which may contain
+  reflected credential material.
 - Do not retry a write automatically. A timeout may occur after Reddit accepted
   it, and replaying could create a duplicate.
-- Respect rate limits and never bulk-submit. Use `r/test` only for a deliberate
-  end-to-end validation.
+- Respect rate limits and never bulk-submit or bulk-comment. Use `r/test` only
+  for a deliberate end-to-end validation.
 - Cookie mode drives Reddit's first-party web JSON endpoints and may drift when
   Reddit changes its site. Report unexpected HTML or route errors as upstream
   drift instead of guessing another private endpoint.
 
+## Self-promotion — read this before marketing anything
+
+Reddit bans accounts for promotion patterns, not for individual links. When the
+user's goal is promoting their own product:
+
+- **Answer the question first.** A reply must stand on its own as useful even if
+  the product link were removed. If it does not, do not send it.
+- **Disclose the affiliation** ("I build X") — undisclosed promotion is the
+  fastest route to a ban.
+- **One link at most, at the end**, and never in a post title.
+- **Do not blanket-reply.** A handful of genuinely relevant threads beats volume,
+  and volume is exactly what spam detection keys on.
+- If a subreddit has a dedicated self-promo / "Showoff" thread, use it — that is
+  the sanctioned channel.
+- A low-karma or new account will have posts auto-removed by AutoModerator in
+  most active subreddits. Check `whoami` karma and warn the user rather than
+  burning the account on a post that will be silently filtered.
+
 
 ## Record the output
 
-After you successfully publish and obtain the live result URL, call the built-in
-`publish_artifact` tool ONCE so the user can track this deliverable in **My Outputs**:
+After you successfully publish a post **or a comment** and obtain the live result
+URL, call the built-in `publish_artifact` tool ONCE so the user can track this
+deliverable in **My Outputs**:
 
 ```
 publish_artifact(kind="message", channel="reddit", title="<title>", url="<the REAL returned URL>", status="delivered")

package/skills/reddit/scripts/reddit.py

@@ -26,9 +26,11 @@ import urllib.request
 WEB_BASE = "https://www.reddit.com"
 OAUTH_BASE = "https://oauth.reddit.com"
 USER_AGENT = "web:cloud.acedata.reddit:v2.0 (by /u/acedatacloud)"
-GATED_COMMANDS = {"submit-text", "submit-link"}
+GATED_COMMANDS = {"submit-text", "submit-link", "comment"}
 SUBREDDIT_RE = re.compile(r"^[A-Za-z0-9_]{2,21}$")
 COOKIE_NAME_RE = re.compile(r"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$")
+# Only a comment (t1_) or a post (t3_) can be replied to.
+THING_ID_RE = re.compile(r"^t[13]_[A-Za-z0-9]{2,16}$")
 
 
 def output(value) -> None:
@@ -206,6 +208,44 @@ def validate_link(value: str) -> str:
     return value.strip()
 
 
+def normalize_thing_id(value: str) -> str:
+    """Accept a fullname (t3_abc123) or a reddit permalink and return a fullname."""
+    candidate = value.strip()
+    if THING_ID_RE.fullmatch(candidate):
+        return candidate
+    parsed = urllib.parse.urlsplit(candidate)
+    if parsed.scheme in {"http", "https"}:
+        if not parsed.hostname or not reddit_cookie_domain(parsed.hostname):
+            die("parent URL must point at reddit.com")
+        # /r/<sub>/comments/<post_id>/<slug>/<comment_id>
+        segments = [segment for segment in (parsed.path or "").split("/") if segment]
+        if "comments" in segments:
+            index = segments.index("comments")
+            if len(segments) > index + 3 and re.fullmatch(r"[A-Za-z0-9]{2,16}", segments[index + 3]):
+                return "t1_" + segments[index + 3]
+            if len(segments) > index + 1 and re.fullmatch(r"[A-Za-z0-9]{2,16}", segments[index + 1]):
+                return "t3_" + segments[index + 1]
+    die("parent must be a post (t3_xxxxxx), a comment (t1_xxxxxx) or a reddit.com permalink")
+
+
+def validate_comment_body(text: str) -> str:
+    body = text.strip()
+    if not body:
+        die("comment body cannot be empty")
+    if len(body) > 10_000:
+        die("comment exceeds Reddit's 10,000-character limit")
+    return body
+
+
+def validate_query(value: str) -> str:
+    query = value.strip()
+    if not query:
+        die("query cannot be empty")
+    if len(query) > 512:
+        die("query exceeds Reddit's 512-character search limit")
+    return query
+
+
 def read_text(args: argparse.Namespace) -> str:
     if args.text_file:
         try:
@@ -220,6 +260,19 @@ def read_text(args: argparse.Namespace) -> str:
     return text
 
 
+def read_body(args: argparse.Namespace) -> str:
+    """Read a comment body from --body or --body-file."""
+    if getattr(args, "body_file", None):
+        try:
+            with open(args.body_file, encoding="utf-8") as file_handle:
+                text = file_handle.read()
+        except OSError as error:
+            die(f"cannot read body file {args.body_file}: {error}")
+    else:
+        text = args.body or ""
+    return validate_comment_body(text)
+
+
 class NoRedirect(urllib.request.HTTPRedirectHandler):
     """Return 30x responses to the caller instead of replaying credentials."""
 
@@ -258,7 +311,7 @@ class RedditClient:
     def base_url(self) -> str:
         return WEB_BASE if self.mode == "cookie" else OAUTH_BASE
 
-    def request(self, method: str, path: str, *, query: dict | None = None, form: dict | None = None):
+    def request(self, method: str, path: str, *, query: dict | None = None, form: dict | None = None, write_kind: str = "post"):
         is_write = method.upper() == "POST"
         url = self.base_url + path
         if query:
@@ -296,24 +349,24 @@ class RedditClient:
                     raw = gzip.decompress(raw)
             except Exception:
                 if is_write:
-                    die_unknown_write_outcome("The Reddit HTTP error response for the write request could not be read")
+                    die_unknown_write_outcome("The Reddit HTTP error response for the write request could not be read", kind=write_kind)
                 die("The Reddit HTTP error response could not be read; authenticated response content was omitted.")
             finally:
                 with contextlib.suppress(Exception):
                     error.close()
         except urllib.error.URLError as error:
             if is_write:
-                die_unknown_write_outcome("A network error interrupted the Reddit write request")
+                die_unknown_write_outcome("A network error interrupted the Reddit write request", kind=write_kind)
             die(f"network error reaching Reddit: {error.reason}")
         except Exception:
             if is_write:
-                die_unknown_write_outcome("The Reddit write response could not be read or decompressed")
+                die_unknown_write_outcome("The Reddit write response could not be read or decompressed", kind=write_kind)
             die("The Reddit response could not be read or decompressed; authenticated response content was omitted.")
 
         text = raw.decode("utf-8", "replace")
         if 300 <= status < 400:
             if is_write:
-                die_unknown_write_outcome("Reddit redirected the write request; credentials were not forwarded")
+                die_unknown_write_outcome("Reddit redirected the write request; credentials were not forwarded", kind=write_kind)
             die("Reddit returned an unexpected redirect; credentials were not forwarded. Reconnect before retrying the read.")
         if status in {401, 403}:
             die(
@@ -324,17 +377,17 @@ class RedditClient:
             die("Reddit rate limit reached (429). Wait before retrying; do not loop-retry.")
         if status >= 400:
             if is_write and status >= 500:
-                die_unknown_write_outcome(f"Reddit returned HTTP {status} for the write request")
+                die_unknown_write_outcome(f"Reddit returned HTTP {status} for the write request", kind=write_kind)
             die(f"Reddit returned HTTP {status}; authenticated response content was omitted.")
         if text.lstrip().startswith("<"):
             if is_write:
-                die_unknown_write_outcome("Reddit returned HTML for the write request")
+                die_unknown_write_outcome("Reddit returned HTML for the write request", kind=write_kind)
             die("Reddit returned HTML instead of JSON — the session expired or the web endpoint changed.")
         try:
             return json.loads(text)
         except json.JSONDecodeError:
             if is_write:
-                die_unknown_write_outcome("Reddit returned invalid JSON for the write request")
+                die_unknown_write_outcome("Reddit returned invalid JSON for the write request", kind=write_kind)
             die(f"Reddit returned non-JSON data ({status}); authenticated response content was omitted.")
 
     def me(self) -> dict:
@@ -421,6 +474,79 @@ class RedditClient:
         return {"ok": True, "posted": True, "id": post.get("id"), "name": post.get("name"), "url": post_url}
 
 
+    def search(self, *, query: str, subreddit: str = "", sort: str = "new", limit: int = 10, time_filter: str = "week") -> list[dict]:
+        suffix = ".json" if self.mode == "cookie" else ""
+        path = f"/r/{subreddit}/search{suffix}" if subreddit else f"/search{suffix}"
+        params = {"q": query, "sort": sort, "limit": limit, "t": time_filter, "raw_json": 1, "type": "link"}
+        if subreddit:
+            params["restrict_sr"] = "true"
+        payload = self.request("GET", path, query=params)
+        if not isinstance(payload, dict) or not isinstance(payload.get("data"), dict):
+            die("Reddit returned a malformed search response; authenticated response content was omitted.")
+        children = payload["data"].get("children")
+        if not isinstance(children, list):
+            die("Reddit returned a malformed search response; authenticated response content was omitted.")
+        return [child["data"] for child in children if isinstance(child, dict) and valid_submission_data(child.get("data"))]
+
+    def subreddit_about(self, subreddit: str) -> dict:
+        suffix = ".json" if self.mode == "cookie" else ""
+        payload = self.request("GET", f"/r/{subreddit}/about{suffix}", query={"raw_json": 1})
+        if not isinstance(payload, dict) or not isinstance(payload.get("data"), dict):
+            die("Reddit returned a malformed subreddit response; authenticated response content was omitted.")
+        about = payload["data"]
+        rules = self.request("GET", f"/r/{subreddit}/about/rules{suffix}", query={"raw_json": 1})
+        rule_items = rules.get("rules") if isinstance(rules, dict) else None
+        return {
+            "subreddit": about.get("display_name"),
+            "subscribers": about.get("subscribers"),
+            "over18": about.get("over18"),
+            "submission_type": about.get("submission_type"),
+            "description": (about.get("public_description") or "")[:600],
+            "rules": [
+                {
+                    "short_name": rule.get("short_name"),
+                    "description": (rule.get("description") or "")[:400],
+                }
+                for rule in (rule_items or [])
+                if isinstance(rule, dict)
+            ],
+        }
+
+    def comment(self, *, parent: str, body: str) -> dict:
+        if self.mode == "cookie" and not self.modhash:
+            self.me()
+        form = {"api_type": "json", "thing_id": parent, "text": body, "raw_json": "1"}
+        if self.mode == "cookie":
+            if not self.modhash:
+                die("Reddit did not return a modhash; the Cookie session cannot perform writes.")
+            form["uh"] = self.modhash
+
+        payload = self.request("POST", "/api/comment", form=form, write_kind="comment")
+        if not isinstance(payload, dict) or not isinstance(payload.get("json"), dict):
+            die_unknown_comment_response()
+        json_payload = payload["json"]
+        errors = json_payload.get("errors")
+        if not isinstance(errors, list):
+            die_unknown_comment_response()
+        if errors:
+            die(
+                "Reddit rejected the comment. Check subreddit rules, account age/karma "
+                "requirements, whether the thread is locked or archived, and rate limits; "
+                "authenticated error details were omitted."
+            )
+        things = (json_payload.get("data") or {}).get("things")
+        if not isinstance(things, list) or not things or not isinstance(things[0], dict):
+            die_unknown_comment_response()
+        created = things[0].get("data")
+        if not isinstance(created, dict):
+            die_unknown_comment_response()
+        permalink = created.get("permalink")
+        comment_url = WEB_BASE + permalink if isinstance(permalink, str) and permalink.startswith("/") else ""
+        if not comment_url:
+            die_unknown_comment_response()
+        return {"ok": True, "commented": True, "id": created.get("id"), "name": created.get("name"), "url": comment_url}
+
+
 def format_profile(data: dict, mode: str) -> dict:
     return {
         "auth_mode": mode,
@@ -442,10 +568,15 @@ def valid_submission_data(item: object) -> bool:
     ).startswith("/")
 
 
-def die_unknown_write_outcome(reason: str) -> None:
+def die_unknown_write_outcome(reason: str, *, kind: str = "post") -> None:
+    where = (
+        "Open the parent thread and look for your reply"
+        if kind == "comment"
+        else "Check recent submissions"
+    )
     die(
-        f"{reason}; authenticated response content was omitted and the post outcome is unknown. "
-        "Check recent submissions before taking any further action and do not replay automatically."
+        f"{reason}; authenticated response content was omitted and the {kind} outcome is unknown. "
+        f"{where} before taking any further action and do not replay automatically."
     )
 
 
@@ -453,6 +584,27 @@ def die_unknown_post_response() -> None:
     die_unknown_write_outcome("Reddit returned a malformed write response")
 
 
+def die_unknown_comment_response() -> None:
+    die_unknown_write_outcome("Reddit returned a malformed comment response", kind="comment")
+
+
+def format_search_hit(item: dict) -> dict:
+    permalink = item.get("permalink")
+    return {
+        "fullname": item.get("name"),
+        "title": item.get("title"),
+        "subreddit": item.get("subreddit"),
+        "author": item.get("author"),
+        "url": WEB_BASE + permalink if isinstance(permalink, str) and permalink.startswith("/") else item.get("url"),
+        "score": item.get("score"),
+        "num_comments": item.get("num_comments"),
+        "created_utc": item.get("created_utc"),
+        "over_18": item.get("over_18"),
+        "link_flair_text": item.get("link_flair_text"),
+        "selftext_excerpt": (item.get("selftext") or "")[:500],
+    }
+
+
 def format_submission(item: dict) -> dict:
     permalink = item.get("permalink")
     return {
@@ -467,12 +619,26 @@ def format_submission(item: dict) -> dict:
 
 
 def dry_run(args: argparse.Namespace) -> None:
+    note = "No request was sent. Re-run with --confirm as the final argument after explicit user approval."
+    if args.command == "comment":
+        body = read_body(args)
+        output(
+            {
+                "dry_run": True,
+                "command": args.command,
+                "parent": normalize_thing_id(args.parent),
+                "body_length": len(body),
+                "body_preview": body[:280],
+                "note": note,
+            }
+        )
+        return
     value = {
         "dry_run": True,
         "command": args.command,
         "subreddit": normalize_subreddit(args.subreddit),
         "title": validate_title(args.title),
-        "note": "No request was sent. Re-run with --confirm as the final argument after explicit user approval.",
+        "note": note,
     }
     if args.command == "submit-text":
         value["text_length"] = len(read_text(args))
@@ -507,6 +673,22 @@ def build_parser() -> argparse.ArgumentParser:
     link_post.add_argument("--subreddit", "-r", required=True)
     link_post.add_argument("--title", required=True)
     link_post.add_argument("--url", required=True)
+
+    search = commands.add_parser("search", help="search public posts to find threads worth replying to")
+    search.add_argument("--query", "-q", required=True)
+    search.add_argument("--subreddit", "-r", default="")
+    search.add_argument("--sort", choices=["new", "relevance", "top", "comments"], default="new")
+    search.add_argument("--time", dest="time_filter", choices=["hour", "day", "week", "month", "year", "all"], default="week")
+    search.add_argument("--limit", type=positive_limit, default=10)
+
+    about = commands.add_parser("subreddit-info", help="read a subreddit's rules and posting requirements")
+    about.add_argument("--subreddit", "-r", required=True)
+
+    reply = commands.add_parser("comment", help="reply to a post or comment (gated)")
+    reply.add_argument("--parent", required=True, help="fullname (t3_xxx / t1_xxx) or a reddit.com permalink")
+    body_source = reply.add_mutually_exclusive_group(required=True)
+    body_source.add_argument("--body")
+    body_source.add_argument("--body-file", dest="body_file")
     return parser
 
 
@@ -527,6 +709,22 @@ def main(argv: list[str] | None = None) -> None:
         items = client.submissions(args.limit)
         output({"auth_mode": client.mode, "count": len(items), "submissions": [format_submission(item) for item in items]})
         return
+    if args.command == "search":
+        hits = client.search(
+            query=validate_query(args.query),
+            subreddit=normalize_subreddit(args.subreddit) if args.subreddit else "",
+            sort=args.sort,
+            limit=args.limit,
+            time_filter=args.time_filter,
+        )
+        output({"auth_mode": client.mode, "count": len(hits), "results": [format_search_hit(item) for item in hits]})
+        return
+    if args.command == "subreddit-info":
+        output(client.subreddit_about(normalize_subreddit(args.subreddit)))
+        return
+    if args.command == "comment":
+        output(client.comment(parent=normalize_thing_id(args.parent), body=read_body(args)))
+        return
 
     subreddit = normalize_subreddit(args.subreddit)
     title = validate_title(args.title)

package/skills/reddit/tests/test_reddit.py

@@ -373,6 +373,189 @@ class RedditSkillTests(unittest.TestCase):
             self.assertIn("do not replay", post_stream.getvalue())
             self.assertNotIn("csrf-secret", post_stream.getvalue())
 
+    def test_normalize_thing_id_accepts_fullnames_and_permalinks(self):
+        self.assertEqual("t3_abc123", reddit.normalize_thing_id("t3_abc123"))
+        self.assertEqual("t1_def456", reddit.normalize_thing_id("t1_def456"))
+        self.assertEqual(
+            "t3_1r9yrtn",
+            reddit.normalize_thing_id("https://www.reddit.com/r/SunoAI/comments/1r9yrtn/reliable_alternative/"),
+        )
+        self.assertEqual(
+            "t1_def456",
+            reddit.normalize_thing_id("https://www.reddit.com/r/test/comments/abc123/some_slug/def456/"),
+        )
+
+    def test_normalize_thing_id_rejects_non_reddit_and_malformed(self):
+        for value in [
+            "https://evil.example.com/r/test/comments/abc123/x/",
+            "t9_abc123",
+            "not-a-thing",
+            "https://www.reddit.com/r/test/",
+            # Only comments (t1_) and posts (t3_) can be replied to.
+            "t2_abc123",
+            "t4_abc123",
+            "t5_abc123",
+            "t6_abc123",
+        ]:
+            stream = io.StringIO()
+            with self.subTest(value=value), self.assertRaises(SystemExit), redirect_stdout(stream):
+                reddit.normalize_thing_id(value)
+
+    def test_comment_dry_run_never_calls_network(self):
+        stream = io.StringIO()
+        with patch.dict(os.environ, {}, clear=True), patch.object(reddit, "open_request") as urlopen, redirect_stdout(
+            stream
+        ):
+            reddit.main(["comment", "--parent", "t3_abc123", "--body", "Body"])
+
+        value = json.loads(stream.getvalue())
+        self.assertTrue(value["dry_run"])
+        self.assertEqual("t3_abc123", value["parent"])
+        self.assertEqual(4, value["body_length"])
+        urlopen.assert_not_called()
+
+    def test_comment_body_containing_confirm_cannot_trigger_a_write(self):
+        stream = io.StringIO()
+        with patch.dict(os.environ, {"REDDIT_COOKIES": COOKIE_JAR}, clear=True), patch.object(
+            reddit, "open_request"
+        ) as urlopen, redirect_stdout(stream):
+            reddit.main(["comment", "--parent", "t3_abc123", "--body", "please --confirm this"])
+
+        self.assertTrue(json.loads(stream.getvalue())["dry_run"])
+        urlopen.assert_not_called()
+
+    def test_cookie_mode_comment_sends_modhash_and_returns_permalink(self):
+        responses = [
+            FakeResponse({"data": {"id": "abc", "name": "tester", "modhash": "csrf-secret"}}),
+            FakeResponse(
+                {
+                    "json": {
+                        "errors": [],
+                        "data": {
+                            "things": [
+                                {
+                                    "data": {
+                                        "id": "c1",
+                                        "name": "t1_c1",
+                                        "permalink": "/r/test/comments/post1/title/c1/",
+                                    }
+                                }
+                            ]
+                        },
+                    }
+                }
+            ),
+        ]
+        with patch.dict(os.environ, {"REDDIT_COOKIES": COOKIE_JAR}, clear=True), patch.object(
+            reddit, "open_request", side_effect=responses
+        ) as urlopen:
+            client = reddit.RedditClient.from_environment()
+            result = client.comment(parent="t3_post1", body="Reply body")
+
+        self.assertTrue(result["commented"])
+        self.assertEqual("https://www.reddit.com/r/test/comments/post1/title/c1/", result["url"])
+        comment_request = urlopen.call_args_list[1].args[0]
+        self.assertEqual("https://www.reddit.com/api/comment", comment_request.full_url)
+        form = urllib.parse.parse_qs(comment_request.data.decode())
+        self.assertEqual(["csrf-secret"], form["uh"])
+        self.assertEqual(["t3_post1"], form["thing_id"])
+        self.assertEqual(["Reply body"], form["text"])
+
+    def test_comment_rejection_and_malformed_shapes_hide_authenticated_details(self):
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.modhash = "csrf-secret"
+        payloads = [
+            {"json": {"errors": [["RATELIMIT", "you are doing that too much csrf-secret", None]]}},
+            {"json": {"errors": []}},
+            {"json": {"errors": [], "data": {"things": []}}},
+            {"json": {"errors": [], "data": {"things": [{"data": {"id": "c1"}}]}}},
+        ]
+        for payload in payloads:
+            stream = io.StringIO()
+            with self.subTest(payload=payload), patch.object(
+                client, "request", return_value=payload
+            ), self.assertRaises(SystemExit), redirect_stdout(stream):
+                client.comment(parent="t3_post1", body="Body")
+            self.assertNotIn("csrf-secret", stream.getvalue())
+
+    def test_comment_body_limits_are_enforced(self):
+        for body in ["", "   ", "x" * 10_001]:
+            stream = io.StringIO()
+            with self.subTest(body=len(body)), self.assertRaises(SystemExit), redirect_stdout(stream):
+                reddit.validate_comment_body(body)
+
+    def test_search_returns_fullnames_for_reply_targets(self):
+        payload = {
+            "data": {
+                "children": [
+                    {
+                        "data": {
+                            "id": "p1",
+                            "name": "t3_p1",
+                            "title": "Looking for a Suno API",
+                            "subreddit": "SunoAI",
+                            "permalink": "/r/SunoAI/comments/p1/looking/",
+                            "selftext": "x" * 900,
+                        }
+                    },
+                    {"data": {"id": "bad"}},
+                ]
+            }
+        }
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        with patch.object(client, "request", return_value=payload):
+            hits = client.search(query="suno api", limit=5)
+
+        self.assertEqual(1, len(hits))
+        formatted = reddit.format_search_hit(hits[0])
+        self.assertEqual("t3_p1", formatted["fullname"])
+        self.assertEqual("https://www.reddit.com/r/SunoAI/comments/p1/looking/", formatted["url"])
+        self.assertEqual(500, len(formatted["selftext_excerpt"]))
+
+    def test_search_is_a_read_and_rejects_malformed_shape(self):
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        stream = io.StringIO()
+        with patch.object(client, "request", return_value={"data": {}}), self.assertRaises(
+            SystemExit
+        ), redirect_stdout(stream):
+            client.search(query="suno api")
+        self.assertIn("malformed search response", stream.getvalue())
+
+
+    def test_comment_write_failures_never_advise_checking_submissions(self):
+        """A comment never appears in `submissions`; that advice would cause a duplicate reply."""
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.modhash = "csrf-secret"
+
+        # Malformed shape.
+        stream = io.StringIO()
+        with patch.object(client, "request", return_value={"json": {"errors": []}}), self.assertRaises(
+            SystemExit
+        ), redirect_stdout(stream):
+            client.comment(parent="t3_post1", body="Body")
+        self.assertIn("comment outcome is unknown", stream.getvalue())
+        self.assertIn("parent thread", stream.getvalue())
+        self.assertNotIn("recent submissions", stream.getvalue())
+
+        # Transport failure inside request().
+        stream = io.StringIO()
+        with patch.object(
+            reddit, "open_request", side_effect=urllib.error.URLError("boom")
+        ), self.assertRaises(SystemExit), redirect_stdout(stream):
+            client.request("POST", "/api/comment", form={"text": "x"}, write_kind="comment")
+        self.assertIn("comment outcome is unknown", stream.getvalue())
+        self.assertNotIn("recent submissions", stream.getvalue())
+
+    def test_post_write_failures_still_advise_checking_submissions(self):
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        stream = io.StringIO()
+        with patch.object(
+            reddit, "open_request", side_effect=urllib.error.URLError("boom")
+        ), self.assertRaises(SystemExit), redirect_stdout(stream):
+            client.request("POST", "/api/submit", form={"title": "x"})
+        self.assertIn("post outcome is unknown", stream.getvalue())
+        self.assertIn("recent submissions", stream.getvalue())
+
 
 if __name__ == "__main__":
     unittest.main()