@acedatacloud/skills 2026.726.2 → 2026.726.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.726.2",
+  "version": "2026.726.3",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/kuaishou/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: kuaishou
+description: Publish video to the user's own 快手 (Kuaishou) account and read their works via the Kuaishou open platform. Use when the user mentions 快手, Kuaishou, 发快手, 发布到快手, 我的快手作品, or wants to post a generated video to their Kuaishou account.
+when_to_use: |
+  Trigger for anything on the user's own 快手 account through the official
+  open platform: publishing a video (e.g. one generated by the video
+  skills), listing their works with play/like/comment counts, inspecting
+  one work, or checking their account. Publishing is a real, immediately
+  public post — always confirm the caption AND that the video is the
+  user's own original work before running with --confirm.
+connections: [kuaishou]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+All calls go through `scripts/kuaishou.py` (stdlib-only). The user's OAuth token
+arrives as `$KUAISHOU_TOKEN` and the app id as `$KUAISHOU_APP_ID` (injected from
+the connector's `metadata.platform_env`); the script reads both and fails fast
+with a clear message if either is missing — never print either.
+
+Resolve the script first (`$SKILL_DIR` may point at a different skill loaded the
+same turn), and repeat this preamble in every Bash block:
+
+```bash
+KS="$SKILL_DIR/scripts/kuaishou.py"; [ -f "$KS" ] || KS=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/kuaishou.py' 2>/dev/null | head -1)
+[ -f "$KS" ] || { echo "kuaishou script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+```
+
+## Read
+
+```bash
+python3 "$KS" whoami                  # nickname, avatar, fans, follows, city
+python3 "$KS" works --limit 20        # works + play/like/comment counts
+python3 "$KS" works --limit 20 --cursor <photo_id>   # next page
+python3 "$KS" work <photo-id>         # one work
+python3 "$KS" counts                  # public / friend / private / total
+```
+
+## Publish a video
+
+**This posts publicly to the user's real account — there is no draft mode.**
+Before publishing, confirm with the user in chat:
+
+1. the caption (required by 快手), and
+2. that the video is **their own original work** — 快手 bans accounts that
+   publish non-original video, and the ban lands on *the user's* account.
+
+Without a trailing `--confirm` the command only dry-runs and publishes nothing.
+`--confirm` must be the **last** argument.
+
+```bash
+# 1) Dry run — show the user exactly what will be posted
+python3 "$KS" publish --caption "标题" --video-url "https://cdn.acedata.cloud/....mp4" \
+  --cover-url "https://cdn.acedata.cloud/....jpg"
+
+# 2) After they confirm in chat
+python3 "$KS" publish --caption "标题" --video-url "https://cdn.acedata.cloud/....mp4" \
+  --cover-url "https://cdn.acedata.cloud/....jpg" --confirm
+```
+
+A cover image is **required** (`--cover-url` or `--cover-file`, < 10MB). Local
+files work too via `--video-file` / `--cover-file`. Optional: `--stereo-type`
+for 360/180 panoramic video, `--product-id` to attach a 小黄车 product.
+
+Remote `--*-url` inputs must live on **`cdn.acedata.cloud`** (or Kuaishou's own
+image hosts). Anything else is rejected — upload it to our CDN first, or pass a
+local path. This blocks a hostile URL from turning the upload step into an SSRF.
+
+After a successful publish, record the deliverable once (see
+`_shared/artifacts.md`):
+
+```
+publish_artifact(kind="video", channel="kuaishou", title="<caption>",
+                 url="<the url returned by the script>", status="delivered")
+```
+
+## Gotchas
+
+- **Upload success ≠ playable video.** The upload step only confirms bytes
+  arrived; a malformed file fails later at transcode with `视频发布失败`
+  (120003) or `视频未上传成功` (120002). Report those verbatim.
+- Rate limits: **1000 calls/day per user**, 100k/day per app. `100100402` means
+  the limit was hit *or* the account is banned.
+- `ACCESS_DENIED` = the authorization is missing that endpoint's scope →
+  reconnect 快手 and grant it. Token expiry (`100200108`) also means reconnect.
+- Kuaishou answers HTTP 200 even on failure — the script already checks
+  `result != 1`, so trust its `error` field rather than the exit status alone.
+- Connections need re-authorizing roughly every 180 days: the refresh token does
+  not extend on refresh. If the user hits an auth error, have them reconnect.

package/skills/kuaishou/scripts/kuaishou.py

@@ -0,0 +1,376 @@
+#!/usr/bin/env python3
+"""kuaishou — publish video to & read works from the user's 快手 account.
+
+Standard-library only (urllib), no third-party deps. The connector injects the
+user's OAuth token as ``KUAISHOU_TOKEN``; ``KUAISHOU_APP_ID`` carries the app id
+that every open-platform call also requires.
+
+Publishing is three stateful calls (start_upload → upload → publish), which is
+why this is a script and not raw curl. ``publish`` is GATED: without a trailing
+``--confirm`` it only dry-runs. ``--confirm`` is honored ONLY as the last
+argument, so a caption that merely contains "--confirm" can never self-authorize.
+
+Examples:
+  python3 kuaishou.py whoami
+  python3 kuaishou.py works --limit 20
+  python3 kuaishou.py work <photo-id>
+  python3 kuaishou.py counts
+  python3 kuaishou.py publish --video-url URL --cover-url URL --caption T --confirm
+"""
+
+from __future__ import annotations
+
+import argparse
+import ipaddress
+import json
+import mimetypes
+import os
+import re
+import socket
+import sys
+import tempfile
+import urllib.error
+import urllib.parse
+import urllib.request
+
+API = "https://open.kuaishou.com"
+UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
+MAX_COVER_BYTES = 10 * 1024 * 1024
+MAX_VIDEO_BYTES = 500 * 1024 * 1024
+CHUNK = 8 * 1024 * 1024  # Kuaishou recommends fragments <= 10MB.
+DIRECT_UPLOAD_MAX = 10 * 1024 * 1024
+
+_RAW = sys.argv[1:]
+CONFIRM = bool(_RAW) and _RAW[-1] == "--confirm"
+ARGV = _RAW[:-1] if CONFIRM else list(_RAW)
+
+
+def out(obj) -> None:
+    print(json.dumps(obj, ensure_ascii=False, indent=2, default=str))
+
+
+def die(msg: str, code: int = 1) -> None:
+    out({"error": msg})
+    sys.exit(code)
+
+
+def _creds():
+    token = os.environ.get("KUAISHOU_TOKEN", "").strip()
+    app_id = os.environ.get("KUAISHOU_APP_ID", "").strip()
+    if not token:
+        die("KUAISHOU_TOKEN is not set — connect 快手 first")
+    if not app_id:
+        die("KUAISHOU_APP_ID is not set — the connector must inject the app id")
+    return token, app_id
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    # A 30x could otherwise reach an internal host _assert_public_url() never saw.
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise RuntimeError(f"media redirect blocked ({code}) -> {newurl[:80]}")
+
+
+_MEDIA_OPENER = urllib.request.build_opener(_NoRedirect)
+
+
+MEDIA_HOST_ALLOWLIST = ("cdn.acedata.cloud", "acedata.cloud", "kwimgs.com", "yximgs.com")
+
+
+def _assert_public_url(url: str) -> None:
+    parts = urllib.parse.urlsplit(url)
+    if parts.scheme not in ("http", "https") or not parts.hostname:
+        raise RuntimeError(f"unsupported media URL: {url[:80]}")
+    host = parts.hostname.lower()
+    # Allowlist, not just an IP check: a bare IP check is defeated by DNS
+    # rebinding (pass on the first resolve, point at 169.254.169.254 on the
+    # second). Media we publish comes from our own CDN anyway.
+    if not any(host == h or host.endswith("." + h) for h in MEDIA_HOST_ALLOWLIST):
+        raise RuntimeError(
+            f"media host not allowed: {host} — upload the file to cdn.acedata.cloud first, or pass a local path"
+        )
+    try:
+        addrs = socket.getaddrinfo(host, None)
+    except OSError as e:
+        raise RuntimeError(f"cannot resolve {host}: {e}")
+    for info in addrs:
+        ip = ipaddress.ip_address(info[4][0])
+        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved or ip.is_multicast or ip.is_unspecified:
+            raise RuntimeError(f"blocked non-public media host: {host}")
+
+
+def _download_to(url: str, limit: int, dest) -> int:
+    """Stream to *dest* so a 500MB video never sits in memory."""
+    _assert_public_url(url)
+    req = urllib.request.Request(url, headers={"User-Agent": UA})
+    total = 0
+    with _MEDIA_OPENER.open(req, timeout=300) as r:
+        while True:
+            buf = r.read(1024 * 1024)
+            if not buf:
+                break
+            total += len(buf)
+            if total > limit:
+                raise RuntimeError(f"media exceeds {limit} bytes")
+            dest.write(buf)
+    dest.flush()
+    return total
+
+
+def _download(url: str, limit: int) -> bytes:
+    _assert_public_url(url)
+    req = urllib.request.Request(url, headers={"User-Agent": UA})
+    with _MEDIA_OPENER.open(req, timeout=120) as r:
+        data = r.read(limit + 1)
+    if len(data) > limit:
+        raise RuntimeError(f"media exceeds {limit} bytes")
+    return data
+
+
+def _read_media(url: str | None, path: str | None, limit: int, what: str) -> bytes:
+    """Small media (covers) only — video streams to disk via ``_download_to``."""
+    if url:
+        return _download(url, limit)
+    if path:
+        with open(path, "rb") as fh:
+            data = fh.read(limit + 1)
+        if len(data) > limit:
+            raise RuntimeError(f"{what} exceeds {limit} bytes")
+        return data
+    raise RuntimeError(f"no {what} provided")
+
+
+def _redact(text: str) -> str:
+    """Strip credentials before anything upstream-echoed reaches stdout."""
+    for name in ("access_token", "upload_token", "app_secret", "refresh_token"):
+        text = re.sub(rf"({name}[\"'=:\s]+)[^\s\"'&,}}]+", r"\1<redacted>", text)
+    for var in ("KUAISHOU_TOKEN", "KUAISHOU_APP_ID"):
+        secret = os.environ.get(var, "")
+        if len(secret) >= 6:
+            text = text.replace(secret, "<redacted>")
+    return text
+
+
+def _check(payload: dict, what: str) -> dict:
+    # Kuaishou answers HTTP 200 even on failure; ``result`` is the real status.
+    if payload.get("result") != 1:
+        raise RuntimeError(_redact(f"{what} failed: {json.dumps(payload, ensure_ascii=False)}"))
+    return payload
+
+
+def _api(path: str, params: dict, method: str = "GET", body: bytes | None = None, ctype: str | None = None) -> dict:
+    url = f"{API}{path}?{urllib.parse.urlencode(params)}"
+    headers = {"User-Agent": UA}
+    if ctype:
+        headers["Content-Type"] = ctype
+    req = urllib.request.Request(url, data=body, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=120) as r:
+            return json.loads(r.read().decode("utf-8", "replace"))
+    except urllib.error.HTTPError as e:
+        detail = e.read().decode("utf-8", "replace")[:400]
+        raise RuntimeError(_redact(f"HTTP {e.code} from {path}: {detail}"))
+
+
+def _multipart(fields: dict, files: dict) -> tuple[bytes, str]:
+    boundary = "----AceDataKuaishou" + os.urandom(8).hex()
+    buf = bytearray()
+    for name, value in fields.items():
+        if value is None:
+            continue
+        buf += f"--{boundary}\r\nContent-Disposition: form-data; name=\"{name}\"\r\n\r\n{value}\r\n".encode()
+    for name, (filename, blob) in files.items():
+        ctype = mimetypes.guess_type(filename)[0] or "application/octet-stream"
+        buf += (
+            f"--{boundary}\r\nContent-Disposition: form-data; name=\"{name}\"; filename=\"{filename}\"\r\n"
+            f"Content-Type: {ctype}\r\n\r\n"
+        ).encode()
+        buf += blob + b"\r\n"
+    buf += f"--{boundary}--\r\n".encode()
+    return bytes(buf), f"multipart/form-data; boundary={boundary}"
+
+
+def _upload_binary(endpoint: str, upload_token: str, path: str, size: int) -> None:
+    """Step 2 — direct for small files, fragmented otherwise. Reads from disk
+    one chunk at a time so peak memory stays at one fragment."""
+    # The gateway is plain http per the docs and the host is issued fresh by
+    # start_upload — never hardcode it.
+    base = f"http://{endpoint}"
+    if size <= DIRECT_UPLOAD_MAX:
+        with open(path, "rb") as fh:
+            blob = fh.read()
+        url = f"{base}/api/upload?{urllib.parse.urlencode({'upload_token': upload_token})}"
+        req = urllib.request.Request(url, data=blob, headers={"Content-Type": "video/mp4"}, method="POST")
+        with urllib.request.urlopen(req, timeout=600) as r:
+            _check(json.loads(r.read().decode("utf-8", "replace")), "upload")
+        return
+
+    count = 0
+    with open(path, "rb") as fh:
+        while True:
+            part = fh.read(CHUNK)
+            if not part:
+                break
+            q = urllib.parse.urlencode({"upload_token": upload_token, "fragment_id": count})  # starts at 0
+            req = urllib.request.Request(
+                f"{base}/api/upload/fragment?{q}", data=part, headers={"Content-Type": "video/mp4"}, method="POST"
+            )
+            with urllib.request.urlopen(req, timeout=600) as r:
+                _check(json.loads(r.read().decode("utf-8", "replace")), f"fragment {count}")
+            count += 1
+    q = urllib.parse.urlencode({"upload_token": upload_token, "fragment_count": count})
+    req = urllib.request.Request(f"{base}/api/upload/complete?{q}", data=b"", method="POST")
+    with urllib.request.urlopen(req, timeout=300) as r:
+        _check(json.loads(r.read().decode("utf-8", "replace")), "complete")
+
+
+def cmd_whoami() -> None:
+    token, app_id = _creds()
+    data = _check(_api("/openapi/user_info", {"app_id": app_id, "access_token": token}), "user_info")
+    out(data.get("user_info") or {})
+
+
+def cmd_works(limit: int, cursor: str | None) -> None:
+    token, app_id = _creds()
+    params = {"app_id": app_id, "access_token": token, "count": max(1, min(limit, 200))}
+    if cursor:
+        params["cursor"] = cursor
+    data = _check(_api("/openapi/photo/list", params), "photo/list")
+    out({"video_list": data.get("video_list") or []})
+
+
+def cmd_work(photo_id: str) -> None:
+    token, app_id = _creds()
+    data = _check(
+        _api("/openapi/photo/info", {"app_id": app_id, "access_token": token, "photo_id": photo_id}), "photo/info"
+    )
+    out(data.get("video_info") or {})
+
+
+def cmd_counts() -> None:
+    token, app_id = _creds()
+    data = _check(_api("/openapi/photo/count", {"app_id": app_id, "access_token": token}), "photo/count")
+    data.pop("result", None)
+    out(data)
+
+
+def cmd_publish(args) -> None:
+    token, app_id = _creds()
+    if not args.caption:
+        die("--caption is required (快手 requires a title)")
+    if not (args.cover_url or args.cover_file):
+        die("--cover-url or --cover-file is required (快手 requires a cover image)")
+    if not (args.video_url or args.video_file):
+        die("--video-url or --video-file is required")
+
+    if not CONFIRM:
+        out(
+            {
+                "dry_run": True,
+                "caption": args.caption,
+                "video": args.video_url or args.video_file,
+                "cover": args.cover_url or args.cover_file,
+                "note": (
+                    "Nothing was published. Confirm the content is the user's own original work — "
+                    "快手 bans accounts that publish non-original video. Re-run with --confirm as the LAST argument."
+                ),
+            }
+        )
+        return
+
+    tmp = None
+    try:
+        cover = _read_media(args.cover_url, args.cover_file, MAX_COVER_BYTES, "cover")
+        if args.video_url:
+            tmp = tempfile.NamedTemporaryFile(suffix=".mp4", delete=False)
+            size = _download_to(args.video_url, MAX_VIDEO_BYTES, tmp)
+            tmp.close()
+            video_path = tmp.name
+        else:
+            video_path = args.video_file
+            size = os.path.getsize(video_path)
+            if size > MAX_VIDEO_BYTES:
+                raise RuntimeError(f"video exceeds {MAX_VIDEO_BYTES} bytes")
+
+        started = _check(
+            _api("/openapi/photo/start_upload", {"app_id": app_id, "access_token": token}, method="POST"),
+            "start_upload",
+        )
+        upload_token = started["upload_token"]
+        _upload_binary(started["endpoint"], upload_token, video_path, size)
+
+        fields = {"caption": args.caption}
+        if args.stereo_type:
+            fields["stereo_type"] = args.stereo_type
+        if args.product_id:
+            fields["merchant_product_id"] = args.product_id
+        body, ctype = _multipart(fields, {"cover": ("cover.jpg", cover)})
+        published = _check(
+            _api(
+                "/openapi/photo/publish",
+                {"app_id": app_id, "access_token": token, "upload_token": upload_token},
+                method="POST",
+                body=body,
+                ctype=ctype,
+            ),
+            "photo/publish",
+        )
+    except (RuntimeError, OSError) as e:
+        die(_redact(str(e)))
+    finally:
+        if tmp is not None:
+            try:
+                os.unlink(tmp.name)
+            except OSError:
+                pass
+
+    info = published.get("video_info") or {}
+    photo_id = info.get("photo_id")
+    out(
+        {
+            "published": True,
+            "photo_id": photo_id,
+            "caption": info.get("caption"),
+            "url": f"https://www.kuaishou.com/short-video/{photo_id}" if photo_id else None,
+            "pending": info.get("pending"),
+        }
+    )
+
+
+def main() -> None:
+    p = argparse.ArgumentParser(prog="kuaishou", description="快手 open-platform client")
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    sub.add_parser("whoami")
+    sub.add_parser("counts")
+
+    w = sub.add_parser("works")
+    w.add_argument("--limit", type=int, default=20)
+    w.add_argument("--cursor")
+
+    one = sub.add_parser("work")
+    one.add_argument("photo_id")
+
+    pub = sub.add_parser("publish")
+    pub.add_argument("--caption", required=False)
+    pub.add_argument("--video-url")
+    pub.add_argument("--video-file")
+    pub.add_argument("--cover-url")
+    pub.add_argument("--cover-file")
+    pub.add_argument("--stereo-type", choices=["NOT_SPHERICAL_VIDEO", "SPHERICAL_VIDEO_360", "SPHERICAL_VIDEO_180"])
+    pub.add_argument("--product-id")
+
+    args = p.parse_args(ARGV)
+    if args.cmd == "whoami":
+        cmd_whoami()
+    elif args.cmd == "counts":
+        cmd_counts()
+    elif args.cmd == "works":
+        cmd_works(args.limit, args.cursor)
+    elif args.cmd == "work":
+        cmd_work(args.photo_id)
+    elif args.cmd == "publish":
+        cmd_publish(args)
+
+
+if __name__ == "__main__":
+    main()

package/skills/kuaishou/tests/test_kuaishou.py

@@ -0,0 +1,245 @@
+"""Guards for the kuaishou skill script — no network, stdlib only."""
+
+from __future__ import annotations
+
+import contextlib
+import importlib.util
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+import unittest.mock
+from pathlib import Path
+
+SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "kuaishou.py"
+
+
+def _load(argv):
+    """Import the script fresh with a given argv so module-level CONFIRM re-evaluates."""
+    old = sys.argv
+    sys.argv = ["kuaishou.py", *argv]
+    try:
+        spec = importlib.util.spec_from_file_location(f"ks_{len(argv)}_{abs(hash(tuple(argv)))}", SCRIPT)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        return mod
+    finally:
+        sys.argv = old
+
+
+def _run(args, env=None):
+    e = {**os.environ, "KUAISHOU_TOKEN": "tok", "KUAISHOU_APP_ID": "aid", **(env or {})}
+    return subprocess.run([sys.executable, str(SCRIPT), *args], capture_output=True, text=True, env=e)
+
+
+class TestConfirmGate(unittest.TestCase):
+    def test_confirm_only_honored_as_last_argument(self):
+        self.assertTrue(_load(["publish", "--caption", "t", "--confirm"]).CONFIRM)
+        # A caption that merely contains the flag must NOT self-authorize.
+        mod = _load(["publish", "--caption", "--confirm", "--video-url", "u"])
+        self.assertFalse(mod.CONFIRM)
+
+    def test_publish_without_confirm_is_a_dry_run(self):
+        r = _run(
+            [
+                "publish",
+                "--caption",
+                "标题",
+                "--video-url",
+                "https://cdn.acedata.cloud/a.mp4",
+                "--cover-url",
+                "https://cdn.acedata.cloud/a.jpg",
+            ]
+        )
+        self.assertEqual(r.returncode, 0)
+        self.assertTrue(json.loads(r.stdout)["dry_run"])
+
+
+class TestRequiredInputs(unittest.TestCase):
+    def test_missing_token_fails_clearly(self):
+        r = _run(["whoami"], env={"KUAISHOU_TOKEN": ""})
+        self.assertEqual(r.returncode, 1)
+        self.assertIn("KUAISHOU_TOKEN", json.loads(r.stdout)["error"])
+
+    def test_missing_app_id_fails_clearly(self):
+        r = _run(["whoami"], env={"KUAISHOU_APP_ID": ""})
+        self.assertEqual(r.returncode, 1)
+        self.assertIn("KUAISHOU_APP_ID", json.loads(r.stdout)["error"])
+
+    def test_cover_is_required(self):
+        r = _run(["publish", "--caption", "t", "--video-url", "https://cdn.acedata.cloud/a.mp4"])
+        self.assertEqual(r.returncode, 1)
+        self.assertIn("cover", json.loads(r.stdout)["error"])
+
+
+class TestUpstreamSemantics(unittest.TestCase):
+    def test_result_not_one_is_a_failure_despite_http_200(self):
+        mod = _load(["whoami"])
+        with self.assertRaises(RuntimeError):
+            mod._check({"result": 100200108, "error_msg": "expired"}, "user_info")
+        self.assertEqual(mod._check({"result": 1, "x": 2}, "ok")["x"], 2)
+
+    def test_private_media_hosts_are_blocked(self):
+        mod = _load(["whoami"])
+        for url in (
+            "http://127.0.0.1/a.mp4",
+            "http://localhost/a.mp4",
+            "file:///etc/passwd",
+            "http://2130706433/a.mp4",  # decimal
+            "http://0x7f000001/a.mp4",  # hex
+            "http://[::1]/a.mp4",  # IPv6 loopback
+            "http://169.254.169.254/latest/meta-data/",  # cloud metadata
+            # Allowlisted-looking but not actually ours (DNS rebinding vector).
+            "https://evil.example/a.mp4",
+            "https://cdn.acedata.cloud.evil.example/a.mp4",
+        ):
+            with self.assertRaises(RuntimeError, msg=url):
+                mod._assert_public_url(url)
+
+    def test_own_cdn_is_allowed(self):
+        mod = _load(["whoami"])
+        # Mocked so the suite stays offline-safe.
+        with unittest.mock.patch.object(
+            mod.socket, "getaddrinfo", return_value=[(2, 1, 6, "", ("93.184.216.34", 0))]
+        ):
+            mod._assert_public_url("https://cdn.acedata.cloud/x.mp4")  # must not raise
+
+    def test_credentials_are_redacted_from_errors(self):
+        mod = _load(["whoami"])
+        leaked = '{"error_msg":"bad","access_token":"secret-abc","upload_token":"up-xyz"}'
+        red = mod._redact(leaked)
+        self.assertNotIn("secret-abc", red)
+        self.assertNotIn("up-xyz", red)
+        with self.assertRaises(RuntimeError) as cm:
+            mod._check({"result": 2, "access_token": "secret-abc"}, "publish")
+        self.assertNotIn("secret-abc", str(cm.exception))
+
+
+class _FakeResp:
+    def __init__(self, payload):
+        self._b = json.dumps(payload).encode()
+
+    def read(self, *a):
+        return self._b
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *a):
+        return False
+
+
+class TestHttpContract(unittest.TestCase):
+    """Assert the actual requests, so a wrong param/verb can't pass silently."""
+
+    def _capture(self, mod, payload=None):
+        calls = []
+
+        def fake(req, timeout=None):
+            calls.append(req)
+            return _FakeResp(payload if payload is not None else {"result": 1})
+
+        return calls, fake
+
+    def test_direct_upload_posts_raw_bytes_with_token_in_query(self):
+        mod = _load(["whoami"])
+        calls, fake = self._capture(mod)
+        with tempfile.NamedTemporaryFile(suffix=".mp4", delete=False) as fh:
+            fh.write(b"v" * 1024)
+            path = fh.name
+        try:
+            with unittest.mock.patch.object(mod.urllib.request, "urlopen", fake):
+                mod._upload_binary("up.example.com", "utok", path, 1024)
+        finally:
+            os.unlink(path)
+        self.assertEqual(len(calls), 1)
+        req = calls[0]
+        self.assertEqual(req.get_method(), "POST")
+        self.assertTrue(req.full_url.startswith("http://up.example.com/api/upload?"))
+        self.assertIn("upload_token=utok", req.full_url)
+        self.assertEqual(req.data, b"v" * 1024)  # raw body, not multipart
+
+    def test_fragmented_upload_ids_start_at_zero_then_completes(self):
+        mod = _load(["whoami"])
+        calls, fake = self._capture(mod)
+        size = mod.CHUNK * 2 + 7
+        with tempfile.NamedTemporaryFile(suffix=".mp4", delete=False) as fh:
+            fh.write(b"v" * size)
+            path = fh.name
+        try:
+            with unittest.mock.patch.object(mod.urllib.request, "urlopen", fake):
+                mod._upload_binary("up.example.com", "utok", path, size)
+        finally:
+            os.unlink(path)
+        urls = [c.full_url for c in calls]
+        self.assertEqual(len(urls), 4)  # 3 fragments + complete
+        self.assertIn("fragment_id=0", urls[0])
+        self.assertIn("fragment_id=2", urls[2])
+        self.assertIn("fragment_count=3", urls[3])
+        self.assertTrue(urls[3].startswith("http://up.example.com/api/upload/complete?"))
+        # EVERY fragment carries at most one chunk, never the whole remainder.
+        frags = [c for c in calls if "/api/upload/fragment?" in c.full_url]
+        self.assertEqual(len(frags), 3)
+        for i, f in enumerate(frags):
+            self.assertLessEqual(len(f.data), mod.CHUNK, f"fragment {i} too big")
+        self.assertEqual(sum(len(f.data) for f in frags), size)
+
+    def test_publish_sends_upload_token_in_query_and_cover_in_multipart(self):
+        mod = _load(["whoami"])
+        calls = []
+
+        def fake(req, timeout=None):
+            calls.append(req)
+            if "start_upload" in req.full_url:
+                return _FakeResp({"result": 1, "upload_token": "utok", "endpoint": "up.example.com"})
+            if "photo/publish" in req.full_url:
+                return _FakeResp({"result": 1, "video_info": {"photo_id": "pid", "caption": "标题"}})
+            return _FakeResp({"result": 1})
+
+        with tempfile.NamedTemporaryFile(suffix=".mp4", delete=False) as v:
+            v.write(b"v" * 512)
+            vpath = v.name
+        with tempfile.NamedTemporaryFile(suffix=".jpg", delete=False) as c:
+            c.write(b"c" * 32)
+            cpath = c.name
+        try:
+            with unittest.mock.patch.object(mod.urllib.request, "urlopen", fake), unittest.mock.patch.dict(
+                os.environ, {"KUAISHOU_TOKEN": "tok", "KUAISHOU_APP_ID": "aid"}
+            ):
+                args = mod.argparse.Namespace(
+                    caption="标题",
+                    video_url=None,
+                    video_file=vpath,
+                    cover_url=None,
+                    cover_file=cpath,
+                    stereo_type=None,
+                    product_id=None,
+                )
+                mod.CONFIRM = True
+                buf = io.StringIO()
+                with contextlib.redirect_stdout(buf):
+                    mod.cmd_publish(args)
+                result = json.loads(buf.getvalue())
+        finally:
+            os.unlink(vpath)
+            os.unlink(cpath)
+
+        self.assertTrue(result["published"])
+        self.assertEqual(result["photo_id"], "pid")
+        pub = [c for c in calls if "photo/publish" in c.full_url][0]
+        self.assertEqual(pub.get_method(), "POST")
+        # upload_token rides the query string; cover/caption ride the body.
+        self.assertIn("upload_token=utok", pub.full_url)
+        self.assertIn("access_token=tok", pub.full_url)
+        self.assertTrue(pub.headers["Content-type"].startswith("multipart/form-data; boundary="))
+        self.assertIn(b'name="cover"; filename="cover.jpg"', pub.data)
+        self.assertIn("标题".encode(), pub.data)
+        start = [c for c in calls if "start_upload" in c.full_url][0]
+        self.assertEqual(start.get_method(), "POST")
+
+
+if __name__ == "__main__":
+    unittest.main()