substack

# substack — read & publish on Substack via your own cookies Drives the user's **real** Substack account through the same internal web API the site uses (Substack has no official public write API), authenticated by the login cookie they captured with the ACE extension. No browser, no third-party deps — just `urllib`. The publish flow mirrors the community `python-substack` library: **create draft → prepublish → publish**. The connector injects the cookie jar as an env var: - `SUBSTACK_COOKIES` — a JSON array of cookies (`substack.sid`, `substack.lli`, …). **Secret — never echo or print it.** Substack authenticates writes with the session cookie alone (no CSRF token header needed). ## CLI The skill ships [`scripts/substack.py`](scripts/substack.py) — self-contained, stdlib only. ```sh # $SKILL_DIR can point at another skill loaded this turn — anchor on our own # script, and re-run this at the top of every Bash block (fresh shell each time). SUB="$SKILL_DIR/scripts/substack.py"; [ -f "$SUB" ] || SUB=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/substack.py' 2>/dev/null | head -1) [ -f "$SUB" ] || { echo "substack script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; } python3 "$SUB" whoami # who is logged in + primary publication python3 "$SUB" articles --limit 20 # my published posts + stats ``` ## Verify the connection first ```sh SUB="$SKILL_DIR/scripts/substack.py"; [ -f "$SUB" ] || SUB=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/substack.py' 2>/dev/null | head -1) python3 "$SUB" whoami # → {"user_id": ..., "name": "...", "handle": "...", "publication": "...", "publication_url": "https://<sub>.substack.com"} ``` On an auth error the cookie is expired — have the user reconnect at <https://studio.acedata.cloud/console/connectors>. Do **not** loop-retry. ## Publishing — GATED (dry-run unless trailing `--confirm`) `publish` writes to the user's real account. Content is **Markdown**, converted to Substack's ProseMirror blocks: `#`..`######`→heading, ```` ``` ````→code block, `>`→blockquote, `-`/`*`/`1.`→lists, `---`→horizontal rule, everything else →paragraphs. Inline **bold**, *italic*, `code`, ~~strike~~, and `[links](url)` render as real Substack formatting; bare `https://…` URLs are auto-linked. Without a trailing `--confirm` it dry-runs. `--confirm` is honored **only as the last argument**. Always show the dry-run, get an explicit "yes", then re-run. ```sh SUB="$SKILL_DIR/scripts/substack.py"; [ -f "$SUB" ] || SUB=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/substack.py' 2>/dev/null | head -1) # dry-run (shows the plan, writes nothing) python3 "$SUB" publish --title "Title" --content-file post.md # private draft (visible only in the user's dashboard) python3 "$SUB" publish --title "Title" --content-file post.md --draft-only --confirm # go LIVE on the web (does NOT email subscribers) python3 "$SUB" publish --title "Title" --content-file post.md --confirm # go LIVE and email subscribers (use only when the user explicitly asks) python3 "$SUB" publish --title "Title" --content-file post.md --send-email --confirm ``` - `--draft-only` stops at a draft — **default to this** unless the user asked to go live. Returns an `edit_url` to review in the Substack editor. - Publishing **does NOT email subscribers** unless `--send-email` is passed. Emailing a newsletter is irreversible and hits every subscriber's inbox — never add `--send-email` without an explicit request. - `--subtitle` sets the post subtitle; `--audience` is one of `everyone` (default, free/public), `only_paid`, `founding`, `only_free`. ## Gotchas - **This is the user's real Substack account.** Confirm before any publish, and keep `--draft-only` as the safe default. - **`--send-email` blasts the whole subscriber list** and cannot be undone — opt in only on explicit request. - Substack sits behind Cloudflare; an occasional 403/429 on a read is transient — the CLI auto-retries reads once. A *persistent* 401/403 means the cookie is genuinely expired (reconnect); the CLI never retries a write. - **Never print `SUBSTACK_COOKIES`** — it is full account access. - **ToS**: acts only on the user's own account with their own captured cookie. ## Record the output After you successfully publish and obtain the live result URL, call the built-in `publish_artifact` tool ONCE so the user can track this deliverable in **My Outputs**: ``` publish_artifact(kind="article", channel="substack", title="<title>", url="<the REAL returned URL>", status="delivered") ``` Use the real returned URL — never fabricate one. Call it once per published item, only after delivery is confirmed; skip it (or use `status="failed"`) if publishing failed. See `_shared/artifacts.md`.