@acedatacloud/skills 2026.726.2 → 2026.726.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.726.2",
+  "version": "2026.726.4",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/kuaishou/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: kuaishou
+description: Publish video to the user's own 快手 (Kuaishou) account and read their works via the Kuaishou open platform. Use when the user mentions 快手, Kuaishou, 发快手, 发布到快手, 我的快手作品, or wants to post a generated video to their Kuaishou account.
+when_to_use: |
+  Trigger for anything on the user's own 快手 account through the official
+  open platform: publishing a video (e.g. one generated by the video
+  skills), listing their works with play/like/comment counts, inspecting
+  one work, or checking their account. Publishing is a real, immediately
+  public post — always confirm the caption AND that the video is the
+  user's own original work before running with --confirm.
+connections: [kuaishou]
+allowed_tools: [Bash]
+license: Apache-2.0
+metadata:
+  author: acedatacloud
+  version: "1.0"
+---
+
+All calls go through `scripts/kuaishou.py` (stdlib-only). The user's OAuth token
+arrives as `$KUAISHOU_TOKEN` and the app id as `$KUAISHOU_APP_ID` (injected from
+the connector's `metadata.platform_env`); the script reads both and fails fast
+with a clear message if either is missing — never print either.
+
+Resolve the script first (`$SKILL_DIR` may point at a different skill loaded the
+same turn), and repeat this preamble in every Bash block:
+
+```bash
+KS="$SKILL_DIR/scripts/kuaishou.py"; [ -f "$KS" ] || KS=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/kuaishou.py' 2>/dev/null | head -1)
+[ -f "$KS" ] || { echo "kuaishou script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
+```
+
+## Read
+
+```bash
+python3 "$KS" whoami                  # nickname, avatar, fans, follows, city
+python3 "$KS" works --limit 20        # works + play/like/comment counts
+python3 "$KS" works --limit 20 --cursor <photo_id>   # next page
+python3 "$KS" work <photo-id>         # one work
+python3 "$KS" counts                  # public / friend / private / total
+```
+
+## Publish a video
+
+**This posts publicly to the user's real account — there is no draft mode.**
+Before publishing, confirm with the user in chat:
+
+1. the caption (required by 快手), and
+2. that the video is **their own original work** — 快手 bans accounts that
+   publish non-original video, and the ban lands on *the user's* account.
+
+Without a trailing `--confirm` the command only dry-runs and publishes nothing.
+`--confirm` must be the **last** argument.
+
+```bash
+# 1) Dry run — show the user exactly what will be posted
+python3 "$KS" publish --caption "标题" --video-url "https://cdn.acedata.cloud/....mp4" \
+  --cover-url "https://cdn.acedata.cloud/....jpg"
+
+# 2) After they confirm in chat
+python3 "$KS" publish --caption "标题" --video-url "https://cdn.acedata.cloud/....mp4" \
+  --cover-url "https://cdn.acedata.cloud/....jpg" --confirm
+```
+
+A cover image is **required** (`--cover-url` or `--cover-file`, < 10MB). Local
+files work too via `--video-file` / `--cover-file`. Optional: `--stereo-type`
+for 360/180 panoramic video, `--product-id` to attach a 小黄车 product.
+
+Remote `--*-url` inputs must live on **`cdn.acedata.cloud`** (or Kuaishou's own
+image hosts). Anything else is rejected — upload it to our CDN first, or pass a
+local path. This blocks a hostile URL from turning the upload step into an SSRF.
+
+After a successful publish, record the deliverable once (see
+`_shared/artifacts.md`):
+
+```
+publish_artifact(kind="video", channel="kuaishou", title="<caption>",
+                 url="<the url returned by the script>", status="delivered")
+```
+
+## Gotchas
+
+- **Upload success ≠ playable video.** The upload step only confirms bytes
+  arrived; a malformed file fails later at transcode with `视频发布失败`
+  (120003) or `视频未上传成功` (120002). Report those verbatim.
+- Rate limits: **1000 calls/day per user**, 100k/day per app. `100100402` means
+  the limit was hit *or* the account is banned.
+- `ACCESS_DENIED` = the authorization is missing that endpoint's scope →
+  reconnect 快手 and grant it. Token expiry (`100200108`) also means reconnect.
+- Kuaishou answers HTTP 200 even on failure — the script already checks
+  `result != 1`, so trust its `error` field rather than the exit status alone.
+- Connections need re-authorizing roughly every 180 days: the refresh token does
+  not extend on refresh. If the user hits an auth error, have them reconnect.

package/skills/kuaishou/scripts/kuaishou.py

@@ -0,0 +1,376 @@
+#!/usr/bin/env python3
+"""kuaishou — publish video to & read works from the user's 快手 account.
+
+Standard-library only (urllib), no third-party deps. The connector injects the
+user's OAuth token as ``KUAISHOU_TOKEN``; ``KUAISHOU_APP_ID`` carries the app id
+that every open-platform call also requires.
+
+Publishing is three stateful calls (start_upload → upload → publish), which is
+why this is a script and not raw curl. ``publish`` is GATED: without a trailing
+``--confirm`` it only dry-runs. ``--confirm`` is honored ONLY as the last
+argument, so a caption that merely contains "--confirm" can never self-authorize.
+
+Examples:
+  python3 kuaishou.py whoami
+  python3 kuaishou.py works --limit 20
+  python3 kuaishou.py work <photo-id>
+  python3 kuaishou.py counts
+  python3 kuaishou.py publish --video-url URL --cover-url URL --caption T --confirm
+"""
+
+from __future__ import annotations
+
+import argparse
+import ipaddress
+import json
+import mimetypes
+import os
+import re
+import socket
+import sys
+import tempfile
+import urllib.error
+import urllib.parse
+import urllib.request
+
+API = "https://open.kuaishou.com"
+UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
+MAX_COVER_BYTES = 10 * 1024 * 1024
+MAX_VIDEO_BYTES = 500 * 1024 * 1024
+CHUNK = 8 * 1024 * 1024  # Kuaishou recommends fragments <= 10MB.
+DIRECT_UPLOAD_MAX = 10 * 1024 * 1024
+
+_RAW = sys.argv[1:]
+CONFIRM = bool(_RAW) and _RAW[-1] == "--confirm"
+ARGV = _RAW[:-1] if CONFIRM else list(_RAW)
+
+
+def out(obj) -> None:
+    print(json.dumps(obj, ensure_ascii=False, indent=2, default=str))
+
+
+def die(msg: str, code: int = 1) -> None:
+    out({"error": msg})
+    sys.exit(code)
+
+
+def _creds():
+    token = os.environ.get("KUAISHOU_TOKEN", "").strip()
+    app_id = os.environ.get("KUAISHOU_APP_ID", "").strip()
+    if not token:
+        die("KUAISHOU_TOKEN is not set — connect 快手 first")
+    if not app_id:
+        die("KUAISHOU_APP_ID is not set — the connector must inject the app id")
+    return token, app_id
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    # A 30x could otherwise reach an internal host _assert_public_url() never saw.
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise RuntimeError(f"media redirect blocked ({code}) -> {newurl[:80]}")
+
+
+_MEDIA_OPENER = urllib.request.build_opener(_NoRedirect)
+
+
+MEDIA_HOST_ALLOWLIST = ("cdn.acedata.cloud", "acedata.cloud", "kwimgs.com", "yximgs.com")
+
+
+def _assert_public_url(url: str) -> None:
+    parts = urllib.parse.urlsplit(url)
+    if parts.scheme not in ("http", "https") or not parts.hostname:
+        raise RuntimeError(f"unsupported media URL: {url[:80]}")
+    host = parts.hostname.lower()
+    # Allowlist, not just an IP check: a bare IP check is defeated by DNS
+    # rebinding (pass on the first resolve, point at 169.254.169.254 on the
+    # second). Media we publish comes from our own CDN anyway.
+    if not any(host == h or host.endswith("." + h) for h in MEDIA_HOST_ALLOWLIST):
+        raise RuntimeError(
+            f"media host not allowed: {host} — upload the file to cdn.acedata.cloud first, or pass a local path"
+        )
+    try:
+        addrs = socket.getaddrinfo(host, None)
+    except OSError as e:
+        raise RuntimeError(f"cannot resolve {host}: {e}")
+    for info in addrs:
+        ip = ipaddress.ip_address(info[4][0])
+        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved or ip.is_multicast or ip.is_unspecified:
+            raise RuntimeError(f"blocked non-public media host: {host}")
+
+
+def _download_to(url: str, limit: int, dest) -> int:
+    """Stream to *dest* so a 500MB video never sits in memory."""
+    _assert_public_url(url)
+    req = urllib.request.Request(url, headers={"User-Agent": UA})
+    total = 0
+    with _MEDIA_OPENER.open(req, timeout=300) as r:
+        while True:
+            buf = r.read(1024 * 1024)
+            if not buf:
+                break
+            total += len(buf)
+            if total > limit:
+                raise RuntimeError(f"media exceeds {limit} bytes")
+            dest.write(buf)
+    dest.flush()
+    return total
+
+
+def _download(url: str, limit: int) -> bytes:
+    _assert_public_url(url)
+    req = urllib.request.Request(url, headers={"User-Agent": UA})
+    with _MEDIA_OPENER.open(req, timeout=120) as r:
+        data = r.read(limit + 1)
+    if len(data) > limit:
+        raise RuntimeError(f"media exceeds {limit} bytes")
+    return data
+
+
+def _read_media(url: str | None, path: str | None, limit: int, what: str) -> bytes:
+    """Small media (covers) only — video streams to disk via ``_download_to``."""
+    if url:
+        return _download(url, limit)
+    if path:
+        with open(path, "rb") as fh:
+            data = fh.read(limit + 1)
+        if len(data) > limit:
+            raise RuntimeError(f"{what} exceeds {limit} bytes")
+        return data
+    raise RuntimeError(f"no {what} provided")
+
+
+def _redact(text: str) -> str:
+    """Strip credentials before anything upstream-echoed reaches stdout."""
+    for name in ("access_token", "upload_token", "app_secret", "refresh_token"):
+        text = re.sub(rf"({name}[\"'=:\s]+)[^\s\"'&,}}]+", r"\1<redacted>", text)
+    for var in ("KUAISHOU_TOKEN", "KUAISHOU_APP_ID"):
+        secret = os.environ.get(var, "")
+        if len(secret) >= 6:
+            text = text.replace(secret, "<redacted>")
+    return text
+
+
+def _check(payload: dict, what: str) -> dict:
+    # Kuaishou answers HTTP 200 even on failure; ``result`` is the real status.
+    if payload.get("result") != 1:
+        raise RuntimeError(_redact(f"{what} failed: {json.dumps(payload, ensure_ascii=False)}"))
+    return payload
+
+
+def _api(path: str, params: dict, method: str = "GET", body: bytes | None = None, ctype: str | None = None) -> dict:
+    url = f"{API}{path}?{urllib.parse.urlencode(params)}"
+    headers = {"User-Agent": UA}
+    if ctype:
+        headers["Content-Type"] = ctype
+    req = urllib.request.Request(url, data=body, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=120) as r:
+            return json.loads(r.read().decode("utf-8", "replace"))
+    except urllib.error.HTTPError as e:
+        detail = e.read().decode("utf-8", "replace")[:400]
+        raise RuntimeError(_redact(f"HTTP {e.code} from {path}: {detail}"))
+
+
+def _multipart(fields: dict, files: dict) -> tuple[bytes, str]:
+    boundary = "----AceDataKuaishou" + os.urandom(8).hex()
+    buf = bytearray()
+    for name, value in fields.items():
+        if value is None:
+            continue
+        buf += f"--{boundary}\r\nContent-Disposition: form-data; name=\"{name}\"\r\n\r\n{value}\r\n".encode()
+    for name, (filename, blob) in files.items():
+        ctype = mimetypes.guess_type(filename)[0] or "application/octet-stream"
+        buf += (
+            f"--{boundary}\r\nContent-Disposition: form-data; name=\"{name}\"; filename=\"{filename}\"\r\n"
+            f"Content-Type: {ctype}\r\n\r\n"
+        ).encode()
+        buf += blob + b"\r\n"
+    buf += f"--{boundary}--\r\n".encode()
+    return bytes(buf), f"multipart/form-data; boundary={boundary}"
+
+
+def _upload_binary(endpoint: str, upload_token: str, path: str, size: int) -> None:
+    """Step 2 — direct for small files, fragmented otherwise. Reads from disk
+    one chunk at a time so peak memory stays at one fragment."""
+    # The gateway is plain http per the docs and the host is issued fresh by
+    # start_upload — never hardcode it.
+    base = f"http://{endpoint}"
+    if size <= DIRECT_UPLOAD_MAX:
+        with open(path, "rb") as fh:
+            blob = fh.read()
+        url = f"{base}/api/upload?{urllib.parse.urlencode({'upload_token': upload_token})}"
+        req = urllib.request.Request(url, data=blob, headers={"Content-Type": "video/mp4"}, method="POST")
+        with urllib.request.urlopen(req, timeout=600) as r:
+            _check(json.loads(r.read().decode("utf-8", "replace")), "upload")
+        return
+
+    count = 0
+    with open(path, "rb") as fh:
+        while True:
+            part = fh.read(CHUNK)
+            if not part:
+                break
+            q = urllib.parse.urlencode({"upload_token": upload_token, "fragment_id": count})  # starts at 0
+            req = urllib.request.Request(
+                f"{base}/api/upload/fragment?{q}", data=part, headers={"Content-Type": "video/mp4"}, method="POST"
+            )
+            with urllib.request.urlopen(req, timeout=600) as r:
+                _check(json.loads(r.read().decode("utf-8", "replace")), f"fragment {count}")
+            count += 1
+    q = urllib.parse.urlencode({"upload_token": upload_token, "fragment_count": count})
+    req = urllib.request.Request(f"{base}/api/upload/complete?{q}", data=b"", method="POST")
+    with urllib.request.urlopen(req, timeout=300) as r:
+        _check(json.loads(r.read().decode("utf-8", "replace")), "complete")
+
+
+def cmd_whoami() -> None:
+    token, app_id = _creds()
+    data = _check(_api("/openapi/user_info", {"app_id": app_id, "access_token": token}), "user_info")
+    out(data.get("user_info") or {})
+
+
+def cmd_works(limit: int, cursor: str | None) -> None:
+    token, app_id = _creds()
+    params = {"app_id": app_id, "access_token": token, "count": max(1, min(limit, 200))}
+    if cursor:
+        params["cursor"] = cursor
+    data = _check(_api("/openapi/photo/list", params), "photo/list")
+    out({"video_list": data.get("video_list") or []})
+
+
+def cmd_work(photo_id: str) -> None:
+    token, app_id = _creds()
+    data = _check(
+        _api("/openapi/photo/info", {"app_id": app_id, "access_token": token, "photo_id": photo_id}), "photo/info"
+    )
+    out(data.get("video_info") or {})
+
+
+def cmd_counts() -> None:
+    token, app_id = _creds()
+    data = _check(_api("/openapi/photo/count", {"app_id": app_id, "access_token": token}), "photo/count")
+    data.pop("result", None)
+    out(data)
+
+
+def cmd_publish(args) -> None:
+    token, app_id = _creds()
+    if not args.caption:
+        die("--caption is required (快手 requires a title)")
+    if not (args.cover_url or args.cover_file):
+        die("--cover-url or --cover-file is required (快手 requires a cover image)")
+    if not (args.video_url or args.video_file):
+        die("--video-url or --video-file is required")
+
+    if not CONFIRM:
+        out(
+            {
+                "dry_run": True,
+                "caption": args.caption,
+                "video": args.video_url or args.video_file,
+                "cover": args.cover_url or args.cover_file,
+                "note": (
+                    "Nothing was published. Confirm the content is the user's own original work — "
+                    "快手 bans accounts that publish non-original video. Re-run with --confirm as the LAST argument."
+                ),
+            }
+        )
+        return
+
+    tmp = None
+    try:
+        cover = _read_media(args.cover_url, args.cover_file, MAX_COVER_BYTES, "cover")
+        if args.video_url:
+            tmp = tempfile.NamedTemporaryFile(suffix=".mp4", delete=False)
+            size = _download_to(args.video_url, MAX_VIDEO_BYTES, tmp)
+            tmp.close()
+            video_path = tmp.name
+        else:
+            video_path = args.video_file
+            size = os.path.getsize(video_path)
+            if size > MAX_VIDEO_BYTES:
+                raise RuntimeError(f"video exceeds {MAX_VIDEO_BYTES} bytes")
+
+        started = _check(
+            _api("/openapi/photo/start_upload", {"app_id": app_id, "access_token": token}, method="POST"),
+            "start_upload",
+        )
+        upload_token = started["upload_token"]
+        _upload_binary(started["endpoint"], upload_token, video_path, size)
+
+        fields = {"caption": args.caption}
+        if args.stereo_type:
+            fields["stereo_type"] = args.stereo_type
+        if args.product_id:
+            fields["merchant_product_id"] = args.product_id
+        body, ctype = _multipart(fields, {"cover": ("cover.jpg", cover)})
+        published = _check(
+            _api(
+                "/openapi/photo/publish",
+                {"app_id": app_id, "access_token": token, "upload_token": upload_token},
+                method="POST",
+                body=body,
+                ctype=ctype,
+            ),
+            "photo/publish",
+        )
+    except (RuntimeError, OSError) as e:
+        die(_redact(str(e)))
+    finally:
+        if tmp is not None:
+            try:
+                os.unlink(tmp.name)
+            except OSError:
+                pass
+
+    info = published.get("video_info") or {}
+    photo_id = info.get("photo_id")
+    out(
+        {
+            "published": True,
+            "photo_id": photo_id,
+            "caption": info.get("caption"),
+            "url": f"https://www.kuaishou.com/short-video/{photo_id}" if photo_id else None,
+            "pending": info.get("pending"),
+        }
+    )
+
+
+def main() -> None:
+    p = argparse.ArgumentParser(prog="kuaishou", description="快手 open-platform client")
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    sub.add_parser("whoami")
+    sub.add_parser("counts")
+
+    w = sub.add_parser("works")
+    w.add_argument("--limit", type=int, default=20)
+    w.add_argument("--cursor")
+
+    one = sub.add_parser("work")
+    one.add_argument("photo_id")
+
+    pub = sub.add_parser("publish")
+    pub.add_argument("--caption", required=False)
+    pub.add_argument("--video-url")
+    pub.add_argument("--video-file")
+    pub.add_argument("--cover-url")
+    pub.add_argument("--cover-file")
+    pub.add_argument("--stereo-type", choices=["NOT_SPHERICAL_VIDEO", "SPHERICAL_VIDEO_360", "SPHERICAL_VIDEO_180"])
+    pub.add_argument("--product-id")
+
+    args = p.parse_args(ARGV)
+    if args.cmd == "whoami":
+        cmd_whoami()
+    elif args.cmd == "counts":
+        cmd_counts()
+    elif args.cmd == "works":
+        cmd_works(args.limit, args.cursor)
+    elif args.cmd == "work":
+        cmd_work(args.photo_id)
+    elif args.cmd == "publish":
+        cmd_publish(args)
+
+
+if __name__ == "__main__":
+    main()

package/skills/kuaishou/tests/test_kuaishou.py

@@ -0,0 +1,245 @@
+"""Guards for the kuaishou skill script — no network, stdlib only."""
+
+from __future__ import annotations
+
+import contextlib
+import importlib.util
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+import unittest.mock
+from pathlib import Path
+
+SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "kuaishou.py"
+
+
+def _load(argv):
+    """Import the script fresh with a given argv so module-level CONFIRM re-evaluates."""
+    old = sys.argv
+    sys.argv = ["kuaishou.py", *argv]
+    try:
+        spec = importlib.util.spec_from_file_location(f"ks_{len(argv)}_{abs(hash(tuple(argv)))}", SCRIPT)
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        return mod
+    finally:
+        sys.argv = old
+
+
+def _run(args, env=None):
+    e = {**os.environ, "KUAISHOU_TOKEN": "tok", "KUAISHOU_APP_ID": "aid", **(env or {})}
+    return subprocess.run([sys.executable, str(SCRIPT), *args], capture_output=True, text=True, env=e)
+
+
+class TestConfirmGate(unittest.TestCase):
+    def test_confirm_only_honored_as_last_argument(self):
+        self.assertTrue(_load(["publish", "--caption", "t", "--confirm"]).CONFIRM)
+        # A caption that merely contains the flag must NOT self-authorize.
+        mod = _load(["publish", "--caption", "--confirm", "--video-url", "u"])
+        self.assertFalse(mod.CONFIRM)
+
+    def test_publish_without_confirm_is_a_dry_run(self):
+        r = _run(
+            [
+                "publish",
+                "--caption",
+                "标题",
+                "--video-url",
+                "https://cdn.acedata.cloud/a.mp4",
+                "--cover-url",
+                "https://cdn.acedata.cloud/a.jpg",
+            ]
+        )
+        self.assertEqual(r.returncode, 0)
+        self.assertTrue(json.loads(r.stdout)["dry_run"])
+
+
+class TestRequiredInputs(unittest.TestCase):
+    def test_missing_token_fails_clearly(self):
+        r = _run(["whoami"], env={"KUAISHOU_TOKEN": ""})
+        self.assertEqual(r.returncode, 1)
+        self.assertIn("KUAISHOU_TOKEN", json.loads(r.stdout)["error"])
+
+    def test_missing_app_id_fails_clearly(self):
+        r = _run(["whoami"], env={"KUAISHOU_APP_ID": ""})
+        self.assertEqual(r.returncode, 1)
+        self.assertIn("KUAISHOU_APP_ID", json.loads(r.stdout)["error"])
+
+    def test_cover_is_required(self):
+        r = _run(["publish", "--caption", "t", "--video-url", "https://cdn.acedata.cloud/a.mp4"])
+        self.assertEqual(r.returncode, 1)
+        self.assertIn("cover", json.loads(r.stdout)["error"])
+
+
+class TestUpstreamSemantics(unittest.TestCase):
+    def test_result_not_one_is_a_failure_despite_http_200(self):
+        mod = _load(["whoami"])
+        with self.assertRaises(RuntimeError):
+            mod._check({"result": 100200108, "error_msg": "expired"}, "user_info")
+        self.assertEqual(mod._check({"result": 1, "x": 2}, "ok")["x"], 2)
+
+    def test_private_media_hosts_are_blocked(self):
+        mod = _load(["whoami"])
+        for url in (
+            "http://127.0.0.1/a.mp4",
+            "http://localhost/a.mp4",
+            "file:///etc/passwd",
+            "http://2130706433/a.mp4",  # decimal
+            "http://0x7f000001/a.mp4",  # hex
+            "http://[::1]/a.mp4",  # IPv6 loopback
+            "http://169.254.169.254/latest/meta-data/",  # cloud metadata
+            # Allowlisted-looking but not actually ours (DNS rebinding vector).
+            "https://evil.example/a.mp4",
+            "https://cdn.acedata.cloud.evil.example/a.mp4",
+        ):
+            with self.assertRaises(RuntimeError, msg=url):
+                mod._assert_public_url(url)
+
+    def test_own_cdn_is_allowed(self):
+        mod = _load(["whoami"])
+        # Mocked so the suite stays offline-safe.
+        with unittest.mock.patch.object(
+            mod.socket, "getaddrinfo", return_value=[(2, 1, 6, "", ("93.184.216.34", 0))]
+        ):
+            mod._assert_public_url("https://cdn.acedata.cloud/x.mp4")  # must not raise
+
+    def test_credentials_are_redacted_from_errors(self):
+        mod = _load(["whoami"])
+        leaked = '{"error_msg":"bad","access_token":"secret-abc","upload_token":"up-xyz"}'
+        red = mod._redact(leaked)
+        self.assertNotIn("secret-abc", red)
+        self.assertNotIn("up-xyz", red)
+        with self.assertRaises(RuntimeError) as cm:
+            mod._check({"result": 2, "access_token": "secret-abc"}, "publish")
+        self.assertNotIn("secret-abc", str(cm.exception))
+
+
+class _FakeResp:
+    def __init__(self, payload):
+        self._b = json.dumps(payload).encode()
+
+    def read(self, *a):
+        return self._b
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *a):
+        return False
+
+
+class TestHttpContract(unittest.TestCase):
+    """Assert the actual requests, so a wrong param/verb can't pass silently."""
+
+    def _capture(self, mod, payload=None):
+        calls = []
+
+        def fake(req, timeout=None):
+            calls.append(req)
+            return _FakeResp(payload if payload is not None else {"result": 1})
+
+        return calls, fake
+
+    def test_direct_upload_posts_raw_bytes_with_token_in_query(self):
+        mod = _load(["whoami"])
+        calls, fake = self._capture(mod)
+        with tempfile.NamedTemporaryFile(suffix=".mp4", delete=False) as fh:
+            fh.write(b"v" * 1024)
+            path = fh.name
+        try:
+            with unittest.mock.patch.object(mod.urllib.request, "urlopen", fake):
+                mod._upload_binary("up.example.com", "utok", path, 1024)
+        finally:
+            os.unlink(path)
+        self.assertEqual(len(calls), 1)
+        req = calls[0]
+        self.assertEqual(req.get_method(), "POST")
+        self.assertTrue(req.full_url.startswith("http://up.example.com/api/upload?"))
+        self.assertIn("upload_token=utok", req.full_url)
+        self.assertEqual(req.data, b"v" * 1024)  # raw body, not multipart
+
+    def test_fragmented_upload_ids_start_at_zero_then_completes(self):
+        mod = _load(["whoami"])
+        calls, fake = self._capture(mod)
+        size = mod.CHUNK * 2 + 7
+        with tempfile.NamedTemporaryFile(suffix=".mp4", delete=False) as fh:
+            fh.write(b"v" * size)
+            path = fh.name
+        try:
+            with unittest.mock.patch.object(mod.urllib.request, "urlopen", fake):
+                mod._upload_binary("up.example.com", "utok", path, size)
+        finally:
+            os.unlink(path)
+        urls = [c.full_url for c in calls]
+        self.assertEqual(len(urls), 4)  # 3 fragments + complete
+        self.assertIn("fragment_id=0", urls[0])
+        self.assertIn("fragment_id=2", urls[2])
+        self.assertIn("fragment_count=3", urls[3])
+        self.assertTrue(urls[3].startswith("http://up.example.com/api/upload/complete?"))
+        # EVERY fragment carries at most one chunk, never the whole remainder.
+        frags = [c for c in calls if "/api/upload/fragment?" in c.full_url]
+        self.assertEqual(len(frags), 3)
+        for i, f in enumerate(frags):
+            self.assertLessEqual(len(f.data), mod.CHUNK, f"fragment {i} too big")
+        self.assertEqual(sum(len(f.data) for f in frags), size)
+
+    def test_publish_sends_upload_token_in_query_and_cover_in_multipart(self):
+        mod = _load(["whoami"])
+        calls = []
+
+        def fake(req, timeout=None):
+            calls.append(req)
+            if "start_upload" in req.full_url:
+                return _FakeResp({"result": 1, "upload_token": "utok", "endpoint": "up.example.com"})
+            if "photo/publish" in req.full_url:
+                return _FakeResp({"result": 1, "video_info": {"photo_id": "pid", "caption": "标题"}})
+            return _FakeResp({"result": 1})
+
+        with tempfile.NamedTemporaryFile(suffix=".mp4", delete=False) as v:
+            v.write(b"v" * 512)
+            vpath = v.name
+        with tempfile.NamedTemporaryFile(suffix=".jpg", delete=False) as c:
+            c.write(b"c" * 32)
+            cpath = c.name
+        try:
+            with unittest.mock.patch.object(mod.urllib.request, "urlopen", fake), unittest.mock.patch.dict(
+                os.environ, {"KUAISHOU_TOKEN": "tok", "KUAISHOU_APP_ID": "aid"}
+            ):
+                args = mod.argparse.Namespace(
+                    caption="标题",
+                    video_url=None,
+                    video_file=vpath,
+                    cover_url=None,
+                    cover_file=cpath,
+                    stereo_type=None,
+                    product_id=None,
+                )
+                mod.CONFIRM = True
+                buf = io.StringIO()
+                with contextlib.redirect_stdout(buf):
+                    mod.cmd_publish(args)
+                result = json.loads(buf.getvalue())
+        finally:
+            os.unlink(vpath)
+            os.unlink(cpath)
+
+        self.assertTrue(result["published"])
+        self.assertEqual(result["photo_id"], "pid")
+        pub = [c for c in calls if "photo/publish" in c.full_url][0]
+        self.assertEqual(pub.get_method(), "POST")
+        # upload_token rides the query string; cover/caption ride the body.
+        self.assertIn("upload_token=utok", pub.full_url)
+        self.assertIn("access_token=tok", pub.full_url)
+        self.assertTrue(pub.headers["Content-type"].startswith("multipart/form-data; boundary="))
+        self.assertIn(b'name="cover"; filename="cover.jpg"', pub.data)
+        self.assertIn("标题".encode(), pub.data)
+        start = [c for c in calls if "start_upload" in c.full_url][0]
+        self.assertEqual(start.get_method(), "POST")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/wordpress/SKILL.md

@@ -9,11 +9,11 @@ when_to_use: |
   This skill is for self-hosted WordPress (Application Password auth),
   not WordPress.com.
 connections: [wordpress]
-allowed_tools: [Bash]
+allowed_tools: [Bash, publish_artifact]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "1.0"
+  version: "1.1"
 ---
 
 Drive the **WordPress REST API** (`/wp-json/wp/v2`) with `curl + jq`.
@@ -36,27 +36,54 @@ API="$SITE/wp-json/wp/v2"
 WP=(curl -sS --fail-with-body -u "$WORDPRESS_USERNAME:$WORDPRESS_APP_PASSWORD")
 ```
 
+> **Don't add `-L`/`--location` to these calls.** A redirect usually means the
+> site URL is wrong. curl strips the `Authorization` header when a redirect
+> crosses host or scheme (e.g. `http`→`https`, apex→`www`) — exactly the cases
+> that occur here — so the followed request runs **unauthenticated** and can
+> return the site's HTML page with HTTP 200: it looks like success but wrote
+> nothing. Fix the URL instead (see the `/wp-json` gotcha below).
+
+
 Errors come back as `{"code": "...", "message": "...", "data": {"status": 401}}` —
 show `message` verbatim. Common codes:
 
 | HTTP | Meaning | What to tell the user |
 |------|---------|-----------------------|
 | 401 | `incorrect_password` / bad Basic auth | Application Password wrong or revoked → regenerate it and reconnect the WordPress connector |
+| 401 | `rest_not_logged_in` on a plain-`http://` site | Application Passwords are disabled without HTTPS → the user must enable HTTPS |
 | 403 | `rest_cannot_create` / insufficient role | The user's role can't publish; needs Author/Editor/Admin, or Application Passwords are disabled on the site |
 | 404 | `rest_no_route` | REST API disabled or a security plugin blocks `/wp-json` → the user must re-enable it |
 | 400 | `rest_invalid_param` | Bad field (e.g. unknown category id) → fix and retry |
+| 500 | `rest_upload_sideload_error` | `wp-content/uploads` isn't writable by the web server → the user must fix directory permissions |
+
+> **`content` is HTML, not Markdown.** Raw Markdown renders literally. `pandoc` is
+> **not installed** — convert with Python's `markdown` package (preinstalled in the
+> sandbox). If the import ever fails, `pip install markdown` first, then:
+>
+> ```bash
+> HTML=$(python3 -c "
+> import sys, markdown
+> print(markdown.markdown(sys.stdin.read(), extensions=['fenced_code','tables']))
+> " <<'MD'
+> ## 标题
+>
+> 正文 **粗体**
+> MD
+> )
+> ```
 
-> **`content` is HTML, not Markdown.** Convert Markdown to HTML first
-> (`pandoc -f markdown -t html`, or a simple converter). Raw Markdown renders literally.
 
 ## Step 0 — verify the connection first
 
 ```bash
-"${WP[@]}" "$API/users/me" | jq '{id, name, slug, roles: (.roles // [])}'
+"${WP[@]}" "$API/users/me?context=edit" | jq '{id, name, slug, roles}'
 ```
 
-A 200 with your user object confirms the site URL, username, and Application
-Password all work. If this fails, stop and surface the error — don't attempt writes.
+`context=edit` is required — without it WP omits `roles`/`capabilities` entirely,
+so you cannot tell whether the account may publish. A 200 with `roles` containing
+`administrator`, `editor` or `author` confirms the site URL, username, Application
+Password **and** publish permission. If this fails, stop and surface the error —
+don't attempt writes.
 
 ## Publish or draft a post
 
@@ -87,6 +114,62 @@ jq -n --arg t "标题" --arg c "<p>正文</p>" --arg e "一句话摘要" \
 - Update a post: `POST $API/posts/<id>` with any subset of fields (WP REST uses
   POST, not PUT, for updates).
 - Delete (trash) a post: `"${WP[@]}" -X DELETE "$API/posts/<id>"`.
+- Schedule a post: `{"status":"future","date_gmt":"2030-01-01T00:00:00"}` (UTC,
+  no trailing `Z`).
+
+## SEO fields that actually matter
+
+WordPress core emits `<link rel="canonical">` on its own but ships **no meta
+description tag at all** — that only appears if the site runs an SEO plugin
+(Yoast, Rank Math, SEOPress) or a theme that renders one. Those consume the
+post's `excerpt`, so setting `excerpt` is what makes a good description possible;
+it does nothing on a bare core install. For an SEO post always set:
+
+| Field | Why |
+|---|---|
+| `slug` | The permalink. Set it explicitly to a short ASCII keyword phrase — otherwise a CJK title becomes a percent-encoded URL. |
+| `excerpt` | Source for the SEO plugin's meta description and for list-page summaries. One sentence. |
+| `categories` / `tags` | Internal linking + topic clustering. |
+| `featured_media` | Social/OG card image. |
+| media `alt_text` | Image SEO + accessibility. Set it on the media object (below). |
+
+
+```bash
+jq -n --arg s "claude-api-guide" --argjson c 3 --argjson m 9 \
+  '{title:"如何稳定调用 Claude API：完整对接指南",
+    slug:$s,
+    content:"<h2>小标题</h2><p>正文</p>",
+    excerpt:"一句话摘要，用于 meta description。",
+    status:"publish", categories:[$c], featured_media:$m}' \
+| "${WP[@]}" -X POST "$API/posts" -H "Content-Type: application/json" -d @- \
+| jq '{id, status, slug, link}'
+```
+
+## Before publishing: check for a duplicate
+
+**WordPress will NOT reject a duplicate slug — it silently appends `-2`,** so an
+unattended/scheduled run that reposts the same article creates an endless trail of
+near-identical URLs that compete with each other in search. Always pre-check:
+
+```bash
+SLUG="claude-api-guide"
+# Fail CLOSED at BOTH steps: a failed request, or a 200 that isn't a JSON array
+# (HTML from a redirect/permalink issue, or an error object), must abort — never
+# fall through and create the duplicate this check exists to prevent.
+if ! LOOKUP=$("${WP[@]}" "$API/posts?slug=$SLUG&status=publish,draft,future&_fields=id,link"); then
+  echo "duplicate check failed (request error) — aborting" >&2; exit 1
+fi
+if ! EXISTING=$(printf '%s' "$LOOKUP" | jq -er 'if type=="array" then (.[0].id // "") else error("not a JSON array") end'); then
+  echo "duplicate check failed (unexpected response) — aborting" >&2; exit 1
+fi
+if [ -n "$EXISTING" ]; then
+  echo "already exists as post $EXISTING — update it instead of creating a new one"
+  # update:  "${WP[@]}" -X POST "$API/posts/$EXISTING" ...
+fi
+```
+
+Prefer **updating** the existing post over creating a near-duplicate. This matters
+most in Scheduled Tasks, where nobody is watching the output.
 
 ## List / read posts
 
@@ -125,22 +208,40 @@ MEDIA_ID=$("${WP[@]}" -X POST "$API/media" \
   -H "Content-Type: image/png" \
   --data-binary @"$FILE" | jq -r '.id')
 echo "media id=$MEDIA_ID"
+
+# Set alt text (image SEO + accessibility) — a separate call on the media object.
+jq -n --arg a "Claude API 架构图" '{alt_text:$a}' \
+| "${WP[@]}" -X POST "$API/media/$MEDIA_ID" \
+    -H "Content-Type: application/json" -d @- | jq '{id, alt_text}'
+
 # Attach as the post's featured image:
 #   add  "featured_media": <MEDIA_ID>  to the post body.
 ```
 
 ## Gotchas
 
-- **HTTPS + Application Passwords are required.** On plain `http://`, WordPress
-  disables Application Passwords → every call 401s. Tell the user to enable HTTPS.
+- **HTTPS is effectively required for Application Passwords.** WP gates them on
+  `wp_is_application_passwords_available()`, which is false on a plain-`http://`
+  production site → authenticated calls fail with `rest_not_logged_in` (401). (The
+  gate is filterable and is bypassed when `WP_ENVIRONMENT_TYPE` is `local`, so a
+  dev box may still work — but any real site the user connects must serve HTTPS.)
+- **`$WORDPRESS_SITE_URL` must exactly match the site's configured address.** If
+  it differs (missing/extra `www`, `http` vs `https`), WP answers `/wp-json/...`
+  with a **301** to the canonical host. Fix the stored site URL in the connector
+  rather than papering over it with `-L`.
+
 - **A security plugin / host may block `/wp-json`** (Wordfence, "disable REST
   API" plugins, some managed hosts). Symptom: 404 `rest_no_route` or an HTML
   login page instead of JSON. The user must allow REST API access.
+- **Pretty permalinks may be off.** If `/wp-json/wp/v2/...` returns the site's
+  HTML instead of JSON, the site is on plain permalinks — use the always-available
+  query form instead: `$SITE/?rest_route=/wp/v2/posts`.
 - **The Application Password contains spaces** (e.g. `abcd efgh ijkl mnop`).
   Keep them — `curl -u` handles the spaces fine; don't strip them.
 - **Never publish silently.** Even if the user says "post it", prefer creating a
   draft and returning the `wp-admin` edit link unless they explicitly asked to
-  go live.
+  go live. (In an unattended Scheduled Task the user has pre-authorized the run,
+  so publishing directly is expected there — but still run the duplicate check.)
 
 
 ## Record the output