@acedatacloud/skills 2026.728.3 → 2026.728.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acedatacloud/skills",
-  "version": "2026.728.3",
+  "version": "2026.728.5",
   "description": "Agent Skills for AceDataCloud AI services — music, image, video generation, LLM chat, web search. Compatible with Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and 30+ AI coding agents.",
   "keywords": [
     "agent-skills",

package/skills/github/SKILL.md

@@ -1,16 +1,17 @@
 ---
 name: github
-description: GitHub issues, pull requests, repos, code search, and Actions via the gh CLI. Use when the user mentions GitHub, an issue/PR number, a repo, a commit, or code review.
+description: GitHub issues, pull requests, repos, code search, releases, gists, stars, watching, forks, and Actions via the gh CLI. Use when the user mentions GitHub, an issue/PR number, a repo, a commit, a release, a gist, or code review.
 when_to_use: |
   Trigger when the user wants to read or write something on GitHub —
-  list / view / create / comment on issues or PRs, search code, view
-  a repo, view CI runs, etc.
+  list / view / create / comment on issues or PRs, star / watch / fork a
+  repo, manage releases / gists / labels / milestones, search code, view
+  CI runs, etc.
 connections: [github]
 allowed_tools: [Bash]
 license: Apache-2.0
 metadata:
   author: acedatacloud
-  version: "1.0"
+  version: "1.1"
 ---
 
 Use the `gh` CLI for everything. The user's OAuth access token is exported
@@ -21,16 +22,40 @@ authenticated subcommand works regardless.
 `gh --help` and `gh <subcommand> --help` are always current. When unsure,
 read the help first instead of guessing flags.
 
+## Granted scopes — what you can and cannot do
+
+The connection requests exactly five scopes: `read:user`, `user:email`,
+`repo`, `read:org`, `gist`. Everything in the Recipes below fits inside
+them. These do NOT fit, and will fail no matter how you phrase the call:
+
+| Want to… | Needs scope | Verdict |
+|---|---|---|
+| Follow / unfollow a user | `user:follow` (or full `user`) | ✗ we only have `read:user` |
+| Block / unblock a user | `user` | ✗ |
+| Read / write Projects V2 | `read:project` / `project` | ✗ `INSUFFICIENT_SCOPES` |
+| Manage SSH / GPG keys | `admin:public_key` / `admin:gpg_key` | ✗ |
+| Manage org membership, teams | `write:org` / `admin:org` | ✗ read-only via `read:org` |
+| Manage repo webhooks | `admin:repo_hook` | ✗ |
+
+Users pick scopes at install time and every box is optional, so even the
+five above may be partially granted. A `404` on something you know exists,
+or a `403`, usually means a missing scope — not a wrong URL. Say so plainly
+and point the user at `auth.acedata.cloud/user/connections` to reconnect
+with the box ticked.
+
 ## Two ways to call gh — prefer subcommands
 
 ### Style A: First-class subcommands — START HERE
 
 `gh issue`, `gh pr`, `gh repo`, `gh search`, `gh release`, `gh workflow`,
-`gh run`, `gh status`, `gh project`, `gh label`, `gh secret`,
-`gh variable`, `gh gist`. Use these whenever they cover the task; they
+`gh run`, `gh status`, `gh label`, `gh secret`, `gh variable`, `gh gist`,
+`gh org`, `gh ruleset`. Use these whenever they cover the task; they
 output formatted text by default and structured JSON via
 `--json <fields> [--jq <expr>]`.
 
+There is no `gh star` / `gh watch` subcommand — those go through
+`gh api` (see below). `gh repo fork` does exist.
+
 ### Style B: Raw REST / GraphQL via `gh api`
 
 `gh api <endpoint>` for REST, `gh api graphql -f query='…'` for GraphQL.
@@ -77,13 +102,28 @@ gh issue view 123 --repo OWNER/REPO --json title,body,comments \
 gh issue create --repo OWNER/REPO --title "Bug: foo" --body "Repro steps…" --label bug
 gh issue comment 123 --repo OWNER/REPO --body "LGTM"
 gh issue close 123 --repo OWNER/REPO --comment "Fixed in #456"
+gh issue reopen 123 --repo OWNER/REPO
+```
+
+### Edit an issue — labels, assignees, milestone, title, body
+
+```sh
+gh issue edit 123 --repo OWNER/REPO --add-label bug --add-assignee @me
+gh issue edit 123 --repo OWNER/REPO --remove-label wontfix --milestone "v2.0"
+gh issue edit 123 --repo OWNER/REPO --title "New title" --body "Rewritten body"
+gh issue lock 123 --repo OWNER/REPO --reason spam
+gh issue transfer 123 OWNER/OTHER_REPO --repo OWNER/REPO
 ```
 
+`--add-project` / `--remove-project` need the `project` scope we do not
+have; they will fail. Everything else on this list works.
+
 ### List PRs assigned to / authored by me
 
 ```sh
 gh search prs --assignee=@me --state=open --json number,title,repository,updatedAt
 gh search prs --author=@me --state=open
+gh search prs --review-requested=@me --state=open
 ```
 
 ### View a PR with diff and CI checks
@@ -94,6 +134,16 @@ gh pr diff 456 --repo OWNER/REPO
 gh pr checks 456 --repo OWNER/REPO
 ```
 
+### Create / edit a PR
+
+```sh
+gh pr create --repo OWNER/REPO --base main --head feature-branch \
+  --title "Add foo" --body "Closes #123" --draft
+gh pr edit 456 --repo OWNER/REPO --add-reviewer octocat --add-label review-needed
+gh pr edit 456 --repo OWNER/REPO --base develop --title "Retitled"
+gh pr ready 456 --repo OWNER/REPO          # draft → ready for review
+```
+
 ### Comment / review / merge a PR
 
 ```sh
@@ -101,27 +151,138 @@ gh pr comment 456 --repo OWNER/REPO --body "Please rebase on main."
 gh pr review 456 --repo OWNER/REPO --approve --body "LGTM"
 gh pr review 456 --repo OWNER/REPO --request-changes --body "See nits"
 gh pr merge 456 --repo OWNER/REPO --squash --delete-branch
+gh pr update-branch 456 --repo OWNER/REPO  # merge base into the PR branch
+gh pr close 456 --repo OWNER/REPO
 ```
 
-### Search code across GitHub
+`merge`, `close`, and `review --approve` are irreversible or publicly
+visible. Confirm with the user before running them unless they clearly
+asked for that exact action.
+
+### Star / unstar a repo
+
+No `gh` subcommand exists — use the REST route. A `204` means success,
+and `GET` returns `204` when starred / `404` when not.
 
 ```sh
-gh search code 'someFunction language:typescript' --limit 20 \
-  --json repository,path,url --jq '.[] | "\(.repository.nameWithOwner) \(.path)"'
+gh api -X PUT    user/starred/OWNER/REPO      # star
+gh api -X DELETE user/starred/OWNER/REPO      # unstar
+gh api           user/starred/OWNER/REPO      # 204 = starred, 404 = not
+gh api user/starred --paginate --jq '.[].full_name'   # list my stars
 ```
 
-### Read a file from a repo (raw bytes, no base64 dance)
+### Watch / unwatch a repo (notification subscription)
 
 ```sh
-gh api "repos/OWNER/REPO/contents/path/to/file.ts" \
-  -H 'Accept: application/vnd.github.raw'
+gh api -X PUT repos/OWNER/REPO/subscription -F subscribed=true    # watch
+gh api -X PUT repos/OWNER/REPO/subscription -F ignored=true       # ignore
+gh api -X DELETE repos/OWNER/REPO/subscription                    # unwatch
+gh api user/subscriptions --paginate --jq '.[].full_name'
+```
+
+Watching is distinct from starring: starring is a public bookmark,
+watching only changes what lands in the user's notifications.
+
+### Fork a repo
+
+```sh
+gh repo fork OWNER/REPO --clone=false
+gh repo fork OWNER/REPO --org MY_ORG --default-branch-only
+gh api repos/OWNER/REPO/forks --jq '.[].full_name'
+```
+
+Starring and forking are visible on the user's public profile. Confirm
+before doing either on someone else's repo unless explicitly asked.
+
+### Notifications
+
+```sh
+gh api notifications --jq '.[] | "\(.repository.full_name) \(.subject.type) \(.subject.title)"'
+gh api -X PATCH notifications                                # mark all read
+gh api -X PATCH notifications/threads/<THREAD_ID>            # mark one read
+```
+
+### Create / manage a repo
+
+```sh
+gh repo create OWNER/NEW_REPO --private --description "…"
+gh repo view OWNER/REPO --json description,url,stargazerCount,defaultBranchRef
+gh repo edit OWNER/REPO --description "New desc" --add-topic ai --visibility private
+gh repo list OWNER --limit 30 --json name,visibility,updatedAt
+gh repo archive OWNER/REPO --yes
 ```
 
-### List recent commits on the default branch
+`gh repo delete` needs `delete_repo`, which is NOT granted — it will fail.
+Never reach for it.
+
+### Releases
 
 ```sh
+gh release list --repo OWNER/REPO --limit 10
+gh release view v1.2.0 --repo OWNER/REPO
+gh release create v1.2.0 --repo OWNER/REPO --title "v1.2.0" --notes "Changelog…"
+gh release create v1.2.0 --repo OWNER/REPO --generate-notes ./dist/app.zip
+gh release upload v1.2.0 ./extra-asset.tar.gz --repo OWNER/REPO
+gh release download v1.2.0 --repo OWNER/REPO --pattern '*.zip'
+```
+
+### Gists
+
+```sh
+gh gist list --limit 20
+gh gist create ./script.py --public --desc "Handy script"
+gh gist view <GIST_ID>
+gh gist edit <GIST_ID>
+gh gist delete <GIST_ID>
+```
+
+### Labels and milestones
+
+```sh
+gh label list --repo OWNER/REPO
+gh label create urgent --repo OWNER/REPO --color FF0000 --description "Drop everything"
+gh label edit bug --repo OWNER/REPO --color 00FF00
+gh label clone SOURCE_OWNER/SOURCE_REPO --repo OWNER/REPO
+
+# Milestones have no gh subcommand — use the API
+gh api repos/OWNER/REPO/milestones --jq '.[] | "\(.number) \(.title) \(.open_issues) open"'
+gh api -X POST repos/OWNER/REPO/milestones -f title="v2.0" -f due_on="2026-12-31T23:59:59Z"
+```
+
+### Branches, commits, and comparing
+
+```sh
+gh api repos/OWNER/REPO/branches --jq '.[].name'
 gh api "repos/OWNER/REPO/commits?per_page=20" \
   --jq '.[] | "\(.sha[0:7]) \(.commit.author.date) \(.commit.message | split("\n")[0])"'
+gh api repos/OWNER/REPO/compare/main...feature-branch \
+  --jq '{ahead: .ahead_by, behind: .behind_by, files: [.files[].filename]}'
+gh api -X DELETE repos/OWNER/REPO/git/refs/heads/stale-branch
+```
+
+### Read / write a file in a repo
+
+```sh
+# Read raw bytes, no base64 dance
+gh api "repos/OWNER/REPO/contents/path/to/file.ts" \
+  -H 'Accept: application/vnd.github.raw'
+
+# Write requires base64 content + the current blob sha when replacing
+SHA=$(gh api repos/OWNER/REPO/contents/README.md --jq .sha)
+gh api -X PUT repos/OWNER/REPO/contents/README.md \
+  -f message="docs: update readme" \
+  -f content="$(base64 < ./README.md | tr -d '\n')" \
+  -f sha="$SHA"
+```
+
+### Search across GitHub
+
+```sh
+gh search code 'someFunction language:typescript' --limit 20 \
+  --json repository,path,url --jq '.[] | "\(.repository.nameWithOwner) \(.path)"'
+gh search repos 'topic:mcp stars:>100' --limit 20 --json fullName,stargazersCount
+gh search commits 'fix memory leak' --repo OWNER/REPO --limit 10
+gh search issues 'is:open label:bug' --owner OWNER --limit 20
 ```
 
 ### Trigger / inspect Actions workflows
@@ -131,16 +292,34 @@ gh workflow list --repo OWNER/REPO
 gh workflow run ci.yaml --repo OWNER/REPO --ref main -f key=value
 gh run list --repo OWNER/REPO --workflow ci.yaml --limit 5
 gh run view <RUN_ID> --repo OWNER/REPO --log-failed
+gh run rerun <RUN_ID> --repo OWNER/REPO --failed
+gh run cancel <RUN_ID> --repo OWNER/REPO
+gh run watch <RUN_ID> --repo OWNER/REPO
 ```
 
-### View a repo's metadata
+### Actions secrets and variables
 
 ```sh
-gh repo view OWNER/REPO
-gh repo view OWNER/REPO --json description,url,stargazerCount,defaultBranchRef
+gh secret list --repo OWNER/REPO
+gh secret set MY_TOKEN --repo OWNER/REPO --body "value"
+gh variable list --repo OWNER/REPO
+gh variable set MY_VAR --repo OWNER/REPO --body "value"
+```
+
+Secret values are write-only — you can set and list names, never read a
+value back. Never echo a secret the user gives you into a comment, issue,
+or commit.
+
+### Organizations (read-only under `read:org`)
+
+```sh
+gh org list
+gh api user/orgs --jq '.[].login'
+gh api orgs/ORG/members --jq '.[].login'
+gh api orgs/ORG/repos --paginate --jq '.[].full_name'
 ```
 
-### GraphQL for things REST can't do (e.g. project board items)
+### GraphQL for things REST can't do
 
 ```sh
 gh api graphql -f query='
@@ -156,6 +335,9 @@ gh api graphql -f query='
   }' -f owner=OWNER -f repo=REPO -F num=123
 ```
 
+Projects V2 lives only in GraphQL and needs `read:project` — not granted,
+so those queries return `INSUFFICIENT_SCOPES`. Don't build recipes on it.
+
 ## Notes
 
 - For private repos the user MUST have granted `repo` scope when they
@@ -171,3 +353,10 @@ gh api graphql -f query='
 - `gh api --paginate` only works on endpoints that emit a `Link` header;
   for cursor-paginated endpoints you have to follow `pagination.next`
   yourself.
+- Write endpoints that take no body (star, follow, watch-delete) return
+  `204 No Content` on success — an empty response is the success case,
+  not a failure.
+- This connection can run unattended in a scheduled task. Public actions
+  (star, fork, issue/PR comments, reviews, merges) leave a permanent,
+  publicly attributable trace on the user's account. In an unattended run,
+  stick to exactly what the task authorized.

package/skills/x/SKILL.md

@@ -81,7 +81,13 @@ the default.
 On an actual auth error the cookie is expired — have the user reconnect at
 <https://auth.acedata.cloud/user/connections>. A Cloudflare block is different:
 reconnecting cookies does not fix it. Use `whoami` for identity checks; other
-blocked endpoints need `X_PROXY` or the official X API. Do **not** loop-retry.
+blocked endpoints need `X_PROXY` or the official X API. Do **not** loop-retry a
+Cloudflare block or an auth error.
+
+A **404 is not an auth error.** X's identity endpoints 404 on roughly a quarter
+of calls even with healthy cookies, on every account. `whoami` already retries
+those internally, so if it still reports a 404, wait a moment and run it again —
+do not tell the user to reconnect.
 
 ## Write commands — GATED (dry-run unless trailing `--confirm`)
 

package/skills/x/scripts/x.py

@@ -245,8 +245,52 @@ async def resolve_user(client, target: str):
 
 # ── read commands ───────────────────────────────────────────────────
 
+IDENTITY_ATTEMPTS = 4
+
+
+class _UnraisableSentinel(Exception):
+    """Stands in for twikit's NotFound when twikit is absent, so the unit tests
+    (which mock the client entirely) can exercise these paths."""
+
+
+def not_found_error():
+    try:
+        from twikit.errors import NotFound
+    except Exception:
+        return _UnraisableSentinel
+    return NotFound
+
+
+async def retry_flaky_not_found(client, call, what: str):
+    """Run `call(client)`, retrying X's intermittent 404s on a fresh session.
+
+    X's identity endpoints 404 on roughly a quarter of calls even with healthy
+    cookies (measured over 20-trial batches on three separate accounts), so a
+    404 here is NOT an expired cookie. Returns (result, client) — the client is
+    replaced on each retry because reusing the failing session keeps 404ing.
+    """
+    not_found = not_found_error()
+    last_error = None
+    for attempt in range(IDENTITY_ATTEMPTS):
+        if attempt:
+            await asyncio.sleep(0.6 * attempt)
+            client = make_client()
+        try:
+            return await call(client), client
+        except not_found as e:
+            last_error = e
+    die(
+        f"X returned 404 for {what} on {IDENTITY_ATTEMPTS} consecutive attempts. "
+        "That endpoint is intermittently flaky — a 404 is not an expired cookie, "
+        "so reconnecting will not help. Retry the same command in a moment. "
+        f"({last_error})"
+    )
+
+
 async def cmd_whoami(client, args):
-    settings, _ = await client.v11.settings()
+    (settings, _), client = await retry_flaky_not_found(
+        client, lambda c: c.v11.settings(), "the authenticated account's settings"
+    )
     authenticated_screen_name = settings.get("screen_name") if isinstance(settings, dict) else None
     if not isinstance(authenticated_screen_name, str) or not re.fullmatch(
         r"[A-Za-z0-9_]{1,15}", authenticated_screen_name
@@ -260,7 +304,11 @@ async def cmd_whoami(client, args):
                 f"connected X account is @{authenticated_screen_name}, not @{expected_screen_name}; "
                 "stopped without performing any write"
             )
-    u = await client.get_user_by_screen_name(authenticated_screen_name)
+    u, client = await retry_flaky_not_found(
+        client,
+        lambda c: c.get_user_by_screen_name(authenticated_screen_name),
+        f"@{authenticated_screen_name}'s profile",
+    )
     result = fmt_user(u)
     result.update(
         {