@acedatacloud/skills 2026.725.0 → 2026.726.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.725.0",
+  "version": "2026.726.1",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/oschina/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: oschina
+description: Read the connected 开源中国 / OSChina (my.oschina.net) account and create Markdown blog drafts with the user's own login cookies (BYOC). Use when the user mentions 开源中国 / OSChina, wants to save a 开源中国 draft, or asks who their connected 开源中国 account is.
+when_to_use: |
+  Trigger for the user's 开源中国 (my.oschina.net) account driven by their own
+  login cookie: show the connected account, or turn Markdown into a 开源中国
+  blog draft. 开源中国 exposes no publish API, so this skill stops at a draft
+  and hands the user the editor URL. Writes are gated behind explicit
+  confirmation.
+connections: [oschina]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+# oschina — read & draft on 开源中国 via your own cookies
+
+Drives the user's **real** 开源中国 account through the same
+`apiv1.oschina.net` endpoints the site uses, authenticated by the login cookie
+they captured with the ACE extension. No browser, no third-party deps — just
+`urllib`.
+
+The connector injects the cookie jar as a JSON env var `$OSCHINA_COOKIES`.
+Never print it.
+
+```bash
+python3 "$SKILL_DIR/scripts/oschina.py" whoami
+```
+
+If `$SKILL_DIR` points at a different skill loaded in the same turn, resolve
+this skill's directory explicitly before running the commands below.
+
+## Important: draft only
+
+**开源中国 has no public publish API.** Every open-source client for this
+platform (including the upstream adapter this skill is modelled on) stops at
+draft creation. This skill does the same: it saves the Markdown as a draft and
+returns the editor URL. Tell the user plainly that they must open that URL and
+click publish themselves — do not claim the article was published.
+
+## Verify the connection first
+
+```bash
+python3 "$SKILL_DIR/scripts/oschina.py" whoami
+```
+
+If this fails with an auth error, the cookie has expired. Ask the user to
+reconnect at `https://auth.acedata.cloud/user/connections` rather than retrying.
+
+## Create a draft — GATED
+
+Prepare the complete Markdown in a file. The first call is always a dry run and
+does not write anything.
+
+```bash
+# Dry run — shows exactly what would be written.
+python3 "$SKILL_DIR/scripts/oschina.py" draft \
+  --title "标题" --content-file /tmp/article.md
+
+# Actually create the draft after the user confirms.
+python3 "$SKILL_DIR/scripts/oschina.py" draft \
+  --title "标题" --content-file /tmp/article.md --confirm
+```
+
+`--confirm` is valid only as the final argument. Show the title and full
+content to the user before writing.
+
+## Gotchas
+
+- Content is sent as Markdown (`contentType: 1`). Do not pre-render it to HTML.
+- Images referenced by external URL are not re-hosted. If the source host
+  blocks hotlinking they will not render; mention this when the article has
+  images.
+- `--catalog` takes a 开源中国 catalog id; the default `0` uses the account's
+  default catalog. If the API rejects the catalog, ask the user for the right
+  id rather than guessing.
+- Do not retry a timed-out write automatically — the outcome may be unknown and
+  a retry can create a duplicate draft.
+
+## Record the output
+
+This skill only produces drafts, so do **not** call `publish_artifact`. Report
+the returned `draft_id` and `edit_url` to the user instead.

package/skills/oschina/scripts/oschina.py

@@ -0,0 +1,287 @@
+#!/usr/bin/env python3
+"""
+oschina — read & publish on 开源中国 (my.oschina.net) with the user's own login
+cookies (BYOC). Standard-library only (urllib), no third-party deps, so it runs
+in the bare sandbox without an image change.
+
+The connector injects the user's cookie jar as a JSON env var ``OSCHINA_COOKIES``
+— a list of ``{name, value, domain, ...}`` dicts captured by the ACE extension.
+
+Read commands run directly. ``publish`` is GATED: without a trailing
+``--confirm`` it only dry-runs. ``--confirm`` is honored ONLY as the last
+argument, so a title/content that merely contains "--confirm" can never silently
+go live.
+
+NOTE: 开源中国 exposes no public "publish" API — only draft creation. This CLI
+creates a draft and returns its editor URL; the user finishes publishing in the
+开源中国 editor.
+
+Examples:
+  python3 oschina.py whoami
+  python3 oschina.py draft --title T --content-file a.md --confirm
+"""
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+UA = (
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+    "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+)
+PLATFORM = "oschina"
+API = "https://apiv1.oschina.net/oschinapi"
+ORIGIN = "https://my.oschina.net"
+MAX_CONTENT_BYTES = 10 * 1024 * 1024
+
+_RAW = sys.argv[1:]
+CONFIRM = bool(_RAW) and _RAW[-1] == "--confirm"
+ARGV = _RAW[:-1] if CONFIRM else list(_RAW)
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    """Refuse redirects outright.
+
+    add_unredirected_header only protects the Cookie; urllib copies every other
+    header onto the redirected request, so a 30x to a foreign host could hand
+    over any auth header we add later.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+_OPENER = urllib.request.build_opener(_NoRedirect())
+
+
+def out(obj) -> None:
+    print(json.dumps(obj, ensure_ascii=False, indent=2, default=str))
+
+
+def die(msg: str, code: int = 1) -> None:
+    out({"error": msg})
+    sys.exit(code)
+
+
+# ── Cookie jar (shared pattern across the cookie-BYOC skills) ────────
+
+def load_cookies() -> list:
+    env = f"{PLATFORM.upper()}_COOKIES"
+    raw = os.environ.get(env)
+    if not raw:
+        die(f"{env} is not set — connect 开源中国 at "
+            f"https://auth.acedata.cloud/user/connections, then retry.")
+    try:
+        jar = json.loads(raw)
+    except json.JSONDecodeError as e:
+        die(f"{env} is not valid JSON: {e}")
+    if not isinstance(jar, list):
+        die(f"{env} must be a JSON list of cookies, got {type(jar).__name__}")
+    return jar
+
+
+def _domain_matches(host: str, domain: str) -> bool:
+    d = domain.lstrip(".").lower()
+    h = host.lower()
+    return not d or h == d or h.endswith("." + d)
+
+
+def cookie_header(jar: list, url: str) -> str:
+    host = urllib.parse.urlsplit(url).hostname or ""
+    host_in_scope = any(
+        c.get("domain") and _domain_matches(host, str(c["domain"])) for c in jar
+    )
+    parts = []
+    for c in jar:
+        name, value = c.get("name"), c.get("value")
+        if not name or value is None:
+            continue
+        domain = c.get("domain")
+        if domain:
+            if not _domain_matches(host, str(domain)):
+                continue
+        elif not host_in_scope:
+            continue
+        parts.append(f"{name}={value}")
+    return "; ".join(parts)
+
+
+def request(method: str, url: str, jar: list, *, headers=None, body=None, write: bool = False):
+    hdrs = {
+        "User-Agent": UA,
+        "Accept": "*/*",
+        "Accept-Language": "zh-CN,zh;q=0.9",
+        "Origin": ORIGIN,
+        "Referer": f"{ORIGIN}/",
+    }
+    if headers:
+        hdrs.update(headers)
+    data = None
+    if body is not None:
+        data = json.dumps(body, ensure_ascii=False).encode("utf-8")
+        hdrs.setdefault("Content-Type", "application/json")
+    req = urllib.request.Request(url, data=data, headers=hdrs, method=method)
+    # Unredirected → the cookie is not re-sent if the API 30x-redirects to a
+    # different host (e.g. a login page), so the jar never leaks off-site.
+    req.add_unredirected_header("Cookie", cookie_header(jar, url))
+    try:
+        with _OPENER.open(req, timeout=30) as resp:
+            raw = resp.read()
+            if resp.headers.get("Content-Encoding") == "gzip":
+                raw = gzip.decompress(raw)
+            return resp.status, raw.decode("utf-8", "replace")
+    except urllib.error.HTTPError as e:
+        if e.code in (301, 302, 303, 307, 308):
+            die(f"开源中国 redirected {method} {url} — not followed, so no "
+                f"credential left oschina.net. You are most likely logged out; "
+                f"reconnect at https://auth.acedata.cloud/user/connections."
+                + (" This was a WRITE: its outcome is UNKNOWN — check your "
+                   "drafts before retrying." if write else ""))
+        raw = e.read()
+        try:
+            if e.headers.get("Content-Encoding") == "gzip":
+                raw = gzip.decompress(raw)
+        except Exception:
+            pass
+        return e.code, raw.decode("utf-8", "replace")
+    except urllib.error.URLError as e:
+        if write:
+            die(f"开源中国 write {method} {url} did not return a result "
+                f"({e.reason}); the outcome is UNKNOWN. Check your 开源中国 "
+                f"drafts before retrying so you do not create a duplicate.")
+        die(f"network error reaching {url}: {e.reason}")
+
+
+def api_call(method: str, path: str, jar: list, *, body=None, write: bool = False):
+    """Unwrap the {success, message, code, result} envelope, dying on failure.
+    开源中国 returns HTTP 200 even for logical errors."""
+    url = f"{API}{path}"
+    status, text = request(method, url, jar, body=body, write=write)
+    try:
+        env = json.loads(text)
+    except json.JSONDecodeError:
+        if write:
+            die(f"开源中国 write to {path} returned a non-JSON response ({status}); "
+                f"the outcome is UNKNOWN. Check your drafts before retrying. "
+                f"Body: {text[:200]}")
+        die(f"non-JSON response ({status}) from {path}: {text[:300]}")
+    if not isinstance(env, dict):
+        die(f"unexpected response from {path}: {text[:300]}")
+    if not env.get("success"):
+        msg = str(env.get("message") or "")
+        code = env.get("code")
+        if code in (40001, 401, 403) or "未登录" in msg or "登录" in msg:
+            die(f"auth failed (code={code}: {msg}) — cookie likely expired. "
+                f"Reconnect at https://auth.acedata.cloud/user/connections.")
+        die(f"开源中国 API error on {path} (code={code}): {msg}")
+    return env.get("result")
+
+
+# ── commands ────────────────────────────────────────────────────────
+
+def os_me(jar) -> dict:
+    me = api_call("GET", "/user/myDetails", jar)
+    if not isinstance(me, dict) or not me.get("userId"):
+        die("could not read 开源中国 profile (cookie expired?)")
+    return me
+
+
+def cmd_whoami(jar, _args):
+    me = os_me(jar)
+    vo = me.get("userVo") or {}
+    uid = me.get("userId")
+    out({
+        "user_id": str(uid),
+        "name": vo.get("name"),
+        "url": f"{ORIGIN}/u/{uid}",
+        "avatar": vo.get("portraitUrl"),
+    })
+
+
+def read_content(args) -> str:
+    content = args.content
+    if args.content_file:
+        try:
+            with open(args.content_file, encoding="utf-8") as f:
+                content = f.read()
+        except OSError as e:
+            die(f"cannot read --content-file: {e}")
+    if content is None:
+        die("provide --content-file <path.md> or --content <markdown>")
+    if len(content.encode("utf-8")) > MAX_CONTENT_BYTES:
+        die("content exceeds the 10 MiB safety limit")
+    return content
+
+
+def cmd_draft(jar, args):
+    if not args.title:
+        die("--title is required")
+    content = read_content(args)
+
+    if not CONFIRM:
+        out({
+            "dry_run": True, "command": "draft", "platform": PLATFORM,
+            "title": args.title, "catalog": args.catalog,
+            "private": not args.public,
+            "content_characters": len(content),
+            "note": "开源中国 content is Markdown. Re-run with --confirm as the LAST "
+                    "argument to actually create the draft. 开源中国 exposes no "
+                    "publish API — finish publishing in the 开源中国 editor.",
+        })
+        return
+
+    me = os_me(jar)
+    uid = me.get("userId")
+    result = api_call("POST", "/api/draft/save_draft", jar, write=True, body={
+        "title": args.title,
+        "user": int(uid),
+        "content": content,
+        "contentType": 1,  # 1 = Markdown, 2 = HTML
+        "catalog": args.catalog,
+        "originUrl": "",
+        "privacy": not args.public,
+        "disableComment": False,
+    })
+    draft_id = result.get("id") if isinstance(result, dict) else None
+    if not draft_id:
+        die(f"draft creation failed: {str(result)[:300]}")
+    out({
+        "ok": True,
+        "draft_only": True,
+        "draft_id": str(draft_id),
+        "edit_url": f"{ORIGIN}/u/{uid}/blog/write/draft/{draft_id}",
+        "note": "Draft saved. 开源中国 has no publish API — open edit_url to publish.",
+    })
+
+
+COMMANDS = {
+    "whoami": cmd_whoami,
+    "draft": cmd_draft,
+}
+
+
+def main() -> None:
+    p = argparse.ArgumentParser(prog="oschina.py", description="开源中国 cookie CLI")
+    sub = p.add_subparsers(dest="command", required=True)
+    sub.add_parser("whoami", help="show the logged-in account")
+    sp = sub.add_parser("draft", help="create a draft article (GATED by trailing --confirm)")
+    sp.add_argument("--title")
+    sp.add_argument("--content", help="Markdown content inline")
+    sp.add_argument("--content-file", help="path to a Markdown file")
+    sp.add_argument("--catalog", type=int, default=0, help="开源中国 catalog id (0 = default)")
+    sp.add_argument("--public", action="store_true",
+                    help="mark the draft non-private; it still needs publishing in the editor")
+    args = p.parse_args(ARGV)
+    jar = load_cookies()
+    COMMANDS[args.command](jar, args)
+
+
+if __name__ == "__main__":
+    main()

package/skills/reddit/SKILL.md

@@ -1,18 +1,18 @@
 ---
 name: reddit
-description: Submit posts (link or text) to subreddits and read your Reddit identity / submissions using either official OAuth or your own Reddit login cookies. Use when the user mentions Reddit, posting to a subreddit, submitting a link or self-post, or checking their Reddit profile / submissions.
+description: Search subreddits, read rules, reply to threads, and submit posts (link or text) to Reddit using either official OAuth or your own Reddit login cookies. Use when the user mentions Reddit, posting to a subreddit, replying or commenting on a thread, submitting a link or self-post, or checking their Reddit profile / submissions.
 when_to_use: |
-  Trigger when the user wants to submit a post to a subreddit (link or
-  self/text post), or read their own Reddit identity and submissions.
-  Posting to a subreddit is public and subject to that subreddit's rules
-  / karma requirements — confirm the target subreddit, title and body
-  before submitting.
+  Trigger when the user wants to find relevant Reddit threads, reply to a
+  post or comment, submit a post to a subreddit (link or self/text post),
+  or read their own Reddit identity and submissions. Commenting and posting
+  are public and subject to that subreddit's rules / karma requirements —
+  confirm the target and the exact text before writing.
 connections: [reddit]
 allowed_tools: [Bash, publish_artifact]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "2.0"
+  version: "2.1"
   connection_method_preferences:
     reddit/reddit: [oauth, cookie]
 ---
@@ -54,6 +54,35 @@ python3 "$R" whoami
 python3 "$R" submissions --limit 10
 ```
 
+## Find threads and check the rules
+
+`search` returns each hit's `fullname` (`t3_…`), which is what `comment --parent`
+takes. `subreddit-info` returns the subreddit's rules — **read them before
+writing anything there.**
+
+```sh
+R="${SKILL_DIR:-}/scripts/reddit.py"; [ -f "$R" ] || R=$(find /tmp -maxdepth 8 -path '*/skills/*/reddit/scripts/reddit.py' -print -quit 2>/dev/null)
+[ -f "$R" ] || { echo "reddit script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+
+python3 "$R" search --query "suno api" --time week --limit 10
+python3 "$R" search --query "image generation api" --subreddit SideProject --sort new
+python3 "$R" subreddit-info --subreddit SideProject
+```
+
+## Reply to a thread — GATED
+
+`--parent` accepts a fullname (`t3_…` post, `t1_…` comment) or a reddit.com
+permalink. **Show the target thread and the exact reply text, then obtain
+explicit confirmation.** Without a trailing `--confirm` this is a dry run.
+
+```sh
+R="${SKILL_DIR:-}/scripts/reddit.py"; [ -f "$R" ] || R=$(find /tmp -maxdepth 8 -path '*/skills/*/reddit/scripts/reddit.py' -print -quit 2>/dev/null)
+[ -f "$R" ] || { echo "reddit script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+
+python3 "$R" comment --parent t3_1r9yrtn --body-file reply.md
+python3 "$R" comment --parent t3_1r9yrtn --body-file reply.md --confirm
+```
+
 ## Submit a post — GATED
 
 Posting is public. **Always show the subreddit, final title and final body/URL,
@@ -79,25 +108,47 @@ contains the text `--confirm` can never trigger a write.
 ## Safety and failure handling
 
 - Never print `REDDIT_COOKIES`, `REDDIT_TOKEN`, `reddit_session` or the modhash.
-- Do not vote, send private messages, evade bans, automate engagement, or
-  cross-post identical content. This skill intentionally exposes none of those
-  operations.
-- Follow each subreddit's rules. Account age, karma and flair requirements can
-  reject a post; report the rejection without exposing Reddit's raw authenticated
-  response, which may contain reflected credential material.
+- Do not vote, send private messages, evade bans, or cross-post identical
+  content. This skill intentionally exposes none of those operations.
+- **Never post the same reply text to more than one thread.** Reddit treats
+  repeated identical comments as spam and actions the account, not the comment.
+  Write each reply against the specific thread it answers.
+- Follow each subreddit's rules — run `subreddit-info` first. Account age, karma
+  and flair requirements can reject a post or comment; report the rejection
+  without exposing Reddit's raw authenticated response, which may contain
+  reflected credential material.
 - Do not retry a write automatically. A timeout may occur after Reddit accepted
   it, and replaying could create a duplicate.
-- Respect rate limits and never bulk-submit. Use `r/test` only for a deliberate
-  end-to-end validation.
+- Respect rate limits and never bulk-submit or bulk-comment. Use `r/test` only
+  for a deliberate end-to-end validation.
 - Cookie mode drives Reddit's first-party web JSON endpoints and may drift when
   Reddit changes its site. Report unexpected HTML or route errors as upstream
   drift instead of guessing another private endpoint.
 
+## Self-promotion — read this before marketing anything
+
+Reddit bans accounts for promotion patterns, not for individual links. When the
+user's goal is promoting their own product:
+
+- **Answer the question first.** A reply must stand on its own as useful even if
+  the product link were removed. If it does not, do not send it.
+- **Disclose the affiliation** ("I build X") — undisclosed promotion is the
+  fastest route to a ban.
+- **One link at most, at the end**, and never in a post title.
+- **Do not blanket-reply.** A handful of genuinely relevant threads beats volume,
+  and volume is exactly what spam detection keys on.
+- If a subreddit has a dedicated self-promo / "Showoff" thread, use it — that is
+  the sanctioned channel.
+- A low-karma or new account will have posts auto-removed by AutoModerator in
+  most active subreddits. Check `whoami` karma and warn the user rather than
+  burning the account on a post that will be silently filtered.
+
 
 ## Record the output
 
-After you successfully publish and obtain the live result URL, call the built-in
-`publish_artifact` tool ONCE so the user can track this deliverable in **My Outputs**:
+After you successfully publish a post **or a comment** and obtain the live result
+URL, call the built-in `publish_artifact` tool ONCE so the user can track this
+deliverable in **My Outputs**:
 
 ```
 publish_artifact(kind="message", channel="reddit", title="<title>", url="<the REAL returned URL>", status="delivered")