@acedatacloud/skills 2026.726.9 → 2026.726.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.726.9",
+  "version": "2026.726.11",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/reddit/SKILL.md

@@ -52,8 +52,12 @@ R="${SKILL_DIR:-}/scripts/reddit.py"; [ -f "$R" ] || R=$(find /tmp -maxdepth 8 -
 [ -f "$R" ] || { echo "reddit script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; }
 python3 "$R" whoami
 python3 "$R" submissions --limit 10
+python3 "$R" comments --limit 10
 ```
 
+If a `comment` write ever reports an unknown outcome, run `comments` to check
+whether it actually landed **before** considering any retry.
+
 ## Find threads and check the rules
 
 `search` returns each hit's `fullname` (`t3_…`), which is what `comment --parent`

package/skills/reddit/scripts/reddit.py

@@ -474,6 +474,26 @@ class RedditClient:
         return {"ok": True, "posted": True, "id": post.get("id"), "name": post.get("name"), "url": post_url}
 
 
+    def comments(self, limit: int) -> list[dict]:
+        """List my own recent comments — used to verify an ambiguous write."""
+        username = self.username or str(self.me().get("name") or "")
+        suffix = ".json" if self.mode == "cookie" else ""
+        payload = self.request(
+            "GET",
+            f"/user/{urllib.parse.quote(username, safe='')}/comments{suffix}",
+            query={"limit": limit, "raw_json": 1},
+        )
+        if not isinstance(payload, dict) or not isinstance(payload.get("data"), dict):
+            die("Reddit returned a malformed comments response; authenticated response content was omitted.")
+        children = payload["data"].get("children")
+        # Fail closed: a silently-empty list reads as "the write did not land"
+        # and invites the duplicate reply this command exists to prevent.
+        if not isinstance(children, list) or any(
+            not isinstance(child, dict) or not valid_comment_data(child.get("data")) for child in children
+        ):
+            die("Reddit returned a malformed comments response; authenticated response content was omitted.")
+        return [child["data"] for child in children]
+
     def search(self, *, query: str, subreddit: str = "", sort: str = "relevance", limit: int = 10, time_filter: str = "month") -> list[dict]:
         suffix = ".json" if self.mode == "cookie" else ""
         path = f"/r/{subreddit}/search{suffix}" if subreddit else f"/search{suffix}"
@@ -540,11 +560,37 @@ class RedditClient:
         created = things[0].get("data")
         if not isinstance(created, dict):
             die_unknown_comment_response()
+        comment_name = created.get("name")
+        comment_id = created.get("id")
+        if not isinstance(comment_id, str) or not comment_id:
+            # `name` is the fullname (t1_<id>), so it carries the id too.
+            comment_id = comment_name[3:] if isinstance(comment_name, str) and comment_name.startswith("t1_") else ""
+
+        # A permalink alone proves creation — accept it even without an id.
         permalink = created.get("permalink")
-        comment_url = WEB_BASE + permalink if isinstance(permalink, str) and permalink.startswith("/") else ""
-        if not comment_url:
+        if isinstance(permalink, str) and permalink.startswith("/"):
+            return {"ok": True, "commented": True, "id": comment_id or None, "name": comment_name, "url": WEB_BASE + permalink}
+
+        if not comment_id:
             die_unknown_comment_response()
-        return {"ok": True, "commented": True, "id": created.get("id"), "name": created.get("name"), "url": comment_url}
+
+        # link_id is the thread even when replying to a comment (t1_ parent).
+        link_id = created.get("link_id")
+        thread = link_id[3:] if isinstance(link_id, str) and link_id.startswith("t3_") else ""
+        if not thread and parent.startswith("t3_"):
+            thread = parent[3:]
+        if not thread:
+            # Created for sure (we hold its id) but the thread is unknown; never
+            # report this as a failed write — that is what invites a duplicate.
+            return {
+                "ok": True,
+                "commented": True,
+                "id": comment_id,
+                "name": comment_name,
+                "url": None,
+                "note": "Reddit did not return a permalink. Run `comments` to locate it; do not resend.",
+            }
+        return {"ok": True, "commented": True, "id": comment_id, "name": comment_name, "url": derive_comment_url(thread, comment_id)}
 
 
 def format_profile(data: dict, mode: str) -> dict:
@@ -584,10 +630,41 @@ def die_unknown_post_response() -> None:
     die_unknown_write_outcome("Reddit returned a malformed write response")
 
 
+COMMENT_ID_RE = re.compile(r"^[A-Za-z0-9]{2,16}$")
+
+
+def derive_comment_url(thread_id: str, comment_id: str) -> str:
+    """Build Reddit's slug-less permalink when the write response omits one."""
+    if not COMMENT_ID_RE.fullmatch(thread_id) or not COMMENT_ID_RE.fullmatch(comment_id):
+        die_unknown_comment_response()
+    return f"{WEB_BASE}/comments/{thread_id}/_/{comment_id}/"
+
+
+def valid_comment_data(item: object) -> bool:
+    if not isinstance(item, dict):
+        return False
+    if not isinstance(item.get("id"), str) or not item["id"]:
+        return False
+    return isinstance(item.get("body"), str) and isinstance(item.get("permalink"), (str, type(None)))
+
+
 def die_unknown_comment_response() -> None:
     die_unknown_write_outcome("Reddit returned a malformed comment response", kind="comment")
 
 
+def format_comment(item: dict) -> dict:
+    permalink = item.get("permalink")
+    return {
+        "id": item.get("id"),
+        "body": str(item.get("body") or "")[:300],
+        "link_title": item.get("link_title"),
+        "subreddit": item.get("subreddit"),
+        "url": WEB_BASE + permalink if isinstance(permalink, str) and permalink.startswith("/") else None,
+        "score": item.get("score"),
+        "created_utc": item.get("created_utc"),
+    }
+
+
 def format_search_hit(item: dict) -> dict:
     permalink = item.get("permalink")
     return {
@@ -674,6 +751,9 @@ def build_parser() -> argparse.ArgumentParser:
     link_post.add_argument("--title", required=True)
     link_post.add_argument("--url", required=True)
 
+    my_comments = commands.add_parser("comments", help="list my recent comments (verify an ambiguous write)")
+    my_comments.add_argument("--limit", type=positive_limit, default=10)
+
     search = commands.add_parser("search", help="search public posts to find threads worth replying to")
     search.add_argument("--query", "-q", required=True)
     search.add_argument("--subreddit", "-r", default="")
@@ -709,6 +789,10 @@ def main(argv: list[str] | None = None) -> None:
         items = client.submissions(args.limit)
         output({"auth_mode": client.mode, "count": len(items), "submissions": [format_submission(item) for item in items]})
         return
+    if args.command == "comments":
+        items = client.comments(args.limit)
+        output({"auth_mode": client.mode, "count": len(items), "comments": [format_comment(item) for item in items]})
+        return
     if args.command == "search":
         hits = client.search(
             query=validate_query(args.query),

package/skills/reddit/tests/test_reddit.py

@@ -468,7 +468,8 @@ class RedditSkillTests(unittest.TestCase):
             {"json": {"errors": [["RATELIMIT", "you are doing that too much csrf-secret", None]]}},
             {"json": {"errors": []}},
             {"json": {"errors": [], "data": {"things": []}}},
-            {"json": {"errors": [], "data": {"things": [{"data": {"id": "c1"}}]}}},
+            # No id at all -> genuinely unknown outcome.
+            {"json": {"errors": [], "data": {"things": [{"data": {"body": "x"}}]}}},
         ]
         for payload in payloads:
             stream = io.StringIO()
@@ -478,6 +479,136 @@ class RedditSkillTests(unittest.TestCase):
                 client.comment(parent="t3_post1", body="Body")
             self.assertNotIn("csrf-secret", stream.getvalue())
 
+    def test_comment_without_permalink_is_a_success_not_an_unknown_outcome(self):
+        """Cookie mode often omits permalink; an id means Reddit created the comment."""
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.modhash = "csrf-secret"
+        payload = {
+            "json": {"errors": [], "data": {"things": [{"data": {"id": "nabc123", "name": "t1_nabc123"}}]}}
+        }
+        with patch.object(client, "request", return_value=payload):
+            result = client.comment(parent="t3_1v711cj", body="Looks good")
+
+        self.assertTrue(result["commented"])
+        self.assertEqual("nabc123", result["id"])
+        self.assertEqual("https://www.reddit.com/comments/1v711cj/_/nabc123/", result["url"])
+
+    def test_comments_fails_closed_on_drifted_shape(self):
+        """A silently-empty list would read as 'the write did not land' -> duplicate reply."""
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.username = "tester"
+        drifted = {"data": {"children": [{"kind": "t1", "comment": {"id": "c1", "body": "x"}}]}}
+        stream = io.StringIO()
+        with patch.object(client, "request", return_value=drifted), self.assertRaises(
+            SystemExit
+        ), redirect_stdout(stream):
+            client.comments(10)
+        self.assertIn("malformed comments response", stream.getvalue())
+
+    def test_comments_accepts_documented_shape_and_survives_odd_body(self):
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.username = "tester"
+        payload = {
+            "data": {
+                "children": [
+                    {
+                        "kind": "t1",
+                        "data": {
+                            "id": "c1",
+                            "body": "Looks good",
+                            "permalink": "/r/test/comments/p1/t/c1/",
+                            "link_title": "Test",
+                            "subreddit": "test",
+                        },
+                    }
+                ]
+            }
+        }
+        with patch.object(client, "request", return_value=payload):
+            items = client.comments(10)
+        self.assertEqual(1, len(items))
+        formatted = reddit.format_comment(items[0])
+        self.assertEqual("Looks good", formatted["body"])
+        self.assertEqual("https://www.reddit.com/r/test/comments/p1/t/c1/", formatted["url"])
+
+    def test_reply_to_a_comment_derives_a_real_permalink_from_link_id(self):
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.modhash = "csrf-secret"
+        payload = {
+            "json": {
+                "errors": [],
+                "data": {"things": [{"data": {"id": "nc2", "name": "t1_nc2", "link_id": "t3_1v711cj"}}]},
+            }
+        }
+        with patch.object(client, "request", return_value=payload):
+            result = client.comment(parent="t1_parent1", body="Reply")
+        self.assertEqual("https://www.reddit.com/comments/1v711cj/_/nc2/", result["url"])
+
+    def test_derive_comment_url_rejects_ids_that_could_escape_reddit(self):
+        for thread, comment_id in [
+            ("abc123", "x/../../../@evil.example.com"),
+            ("../../evil", "c1"),
+            ("abc123", ""),
+        ]:
+            stream = io.StringIO()
+            with self.subTest(thread=thread, comment_id=comment_id), self.assertRaises(
+                SystemExit
+            ), redirect_stdout(stream):
+                reddit.derive_comment_url(thread, comment_id)
+
+    def test_comment_accepts_permalink_only_and_name_only_responses(self):
+        """Proof of creation in any form must never be reported as unknown."""
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.modhash = "csrf-secret"
+
+        # permalink but no id
+        payload = {"json": {"errors": [], "data": {"things": [
+            {"data": {"name": "t1_nabc12", "permalink": "/r/test/comments/1v711cj/slug/nabc12/"}}]}}}
+        with patch.object(client, "request", return_value=payload):
+            result = client.comment(parent="t3_1v711cj", body="B")
+        self.assertTrue(result["commented"])
+        self.assertEqual("https://www.reddit.com/r/test/comments/1v711cj/slug/nabc12/", result["url"])
+
+        # name but no id and no permalink
+        payload = {"json": {"errors": [], "data": {"things": [
+            {"data": {"name": "t1_nabc12", "link_id": "t3_1v711cj"}}]}}}
+        with patch.object(client, "request", return_value=payload):
+            result = client.comment(parent="t1_x1", body="B")
+        self.assertTrue(result["commented"])
+        self.assertEqual("https://www.reddit.com/comments/1v711cj/_/nabc12/", result["url"])
+
+    def test_comment_with_unknown_thread_still_reports_success(self):
+        """We hold the id, so it was created; a 'failure' here would invite a duplicate."""
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.modhash = "csrf-secret"
+        payload = {"json": {"errors": [], "data": {"things": [{"data": {"id": "nc9", "name": "t1_nc9"}}]}}}
+        with patch.object(client, "request", return_value=payload):
+            result = client.comment(parent="t1_parent1", body="Reply")
+        self.assertTrue(result["commented"])
+        self.assertEqual("nc9", result["id"])
+        self.assertIsNone(result["url"])
+        self.assertIn("do not resend", result["note"])
+
+    def test_valid_comment_data_rejects_bad_types_but_allows_null_permalink(self):
+        self.assertTrue(reddit.valid_comment_data({"id": "c1", "body": "x", "permalink": None}))
+        self.assertTrue(reddit.valid_comment_data({"id": "c1", "body": "[deleted]"}))
+        self.assertFalse(reddit.valid_comment_data({"id": "c1", "body": {"nested": 1}}))
+        self.assertFalse(reddit.valid_comment_data({"id": "c1", "body": 123}))
+        self.assertFalse(reddit.valid_comment_data({"id": "", "body": "x"}))
+        self.assertFalse(reddit.valid_comment_data({"body": "x"}))
+
+    def test_comments_listing_survives_a_null_permalink_sibling(self):
+        client = reddit.RedditClient("cookie", cookies=reddit.parse_cookie_jar(COOKIE_JAR))
+        client.username = "tester"
+        payload = {"data": {"children": [
+            {"data": {"id": "c1", "body": "Looks good", "permalink": "/r/test/comments/p1/t/c1/"}},
+            {"data": {"id": "c2", "body": "older", "permalink": None}},
+        ]}}
+        with patch.object(client, "request", return_value=payload):
+            items = client.comments(10)
+        self.assertEqual(2, len(items))
+        self.assertIsNone(reddit.format_comment(items[1])["url"])
+
     def test_comment_body_limits_are_enforced(self):
         for body in ["", "   ", "x" * 10_001]:
             stream = io.StringIO()

package/skills/toutiao/scripts/toutiao.py

@@ -334,17 +334,23 @@ class _ImgFinder(_HTMLParser):
         text = self.get_starttag_text() or ""
         line, col = self.getpos()
         start = self._line_starts[line - 1] + col
+        # If the computed offset doesn't land on the tag we were handed, the
+        # line mapping is wrong and splicing would corrupt the article. Refuse
+        # rather than write a mangled body.
+        if self._html[start:start + len(text)] != text:
+            raise ValueError(f"offset mismatch at line {line} col {col}")
         self.spans.append((start, start + len(text), attrs))
 
     handle_starttag = _record
     handle_startendtag = _record
 
     def find(self, html):
-        # getpos() is (line, col); precompute line offsets to map to an index.
-        self._line_starts, pos = [0], 0
-        for ln in html.splitlines(keepends=True):on \r, \v, \f, \x1c-\x1e, \x85, 
, 
, and every
-            pos += len(ln)
-            self._line_starts.append(pos)
+        # getpos() is (line, col); map that to an index. HTMLParser counts
+        # lines with rawdata.count("\n"), so index on "\n" ONLY — str.splitlines
+        # also breaks on \r, \v, \f, \x1c-\x1e, \x85, 
, 
, and every
+        # such character would shift every subsequent offset.
+        self._html = html
+        self._line_starts = [0] + [mt.end() for mt in re.finditer("\n", html)]
         self.feed(html)
         self.close()
         return self.spans
@@ -490,6 +496,22 @@ def rehost_images(jar, html, drop_failed=False):
             failures.append(f"{src[:80]} ({e})")
     out.append(html[cursor:])
     result = "".join(out)
+    # Backstop: the tokenizer silently sees nothing inside an unterminated tag
+    # or an unterminated <script>/<style>/<textarea>/<title>, so an external
+    # <img> there would ship verbatim and 头条 rejects the whole article (7115).
+    # Our own rewrites all carry web_uri=, so any other <img left in the output
+    # is one we never processed. Fatal even under drop_failed — a tag the
+    # parser cannot see is also one we cannot remove.
+    unseen = [seg[:120] for seg in re.split(r"(?i)(?=<img\b)", result)[1:]
+              if 'web_uri="' not in seg.split(">", 1)[0][:2000]]
+    if unseen:
+        die("the article contains an <img> tag this skill could not parse, so "
+            "it can neither be uploaded to 头条 nor safely removed — and 头条 "
+            "rejects any article with an external image. Nothing was "
+            "published:\n  - " + "\n  - ".join(unseen)
+            + "\nUsually an unterminated tag, or an unclosed <script>/<style> "
+              "earlier in the body hiding it from the parser. "
+              "--drop-failed-images does NOT bypass this.")
     if failures and not drop_failed:
         die("could not upload these images to 头条, and 头条 rejects any article "
             "with an external image, so nothing was published:\n  - "