csdn

# csdn — read & publish on CSDN via your own cookies Drives the user's **real** CSDN account through the same web APIs the site's own editor uses, authenticated by the login cookie they captured with the ACE extension. No browser, no third-party deps — `urllib` + `hmac` (the editor's save endpoint requires an HMAC signature, computed with stdlib). The connector injects the cookie jar as an env var: - `CSDN_COOKIES` — a JSON array of cookies. **Secret — never echo or print it.** The CLI reads it for you. > CSDN fronts its APIs with a WAF; the CLI already sends a full browser > fingerprint so reads aren't 403'd. If you still get a WAF 403, the cookie > expired — have the user reconnect. ## CLI The skill ships [`scripts/csdn.py`](scripts/csdn.py) — self-contained, stdlib only. ```sh # $SKILL_DIR can point at another skill loaded this turn — anchor on our own # script, and re-run this at the top of every Bash block (fresh shell each time). CSDN="$SKILL_DIR/scripts/csdn.py"; [ -f "$CSDN" ] || CSDN=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/csdn.py' 2>/dev/null | head -1) [ -f "$CSDN" ] || { echo "csdn script not found (SKILL_DIR=$SKILL_DIR)" >&2; exit 1; } python3 "$CSDN" whoami # who is logged in (+ total article count) python3 "$CSDN" articles --limit 20 # my published articles + stats python3 "$CSDN" article <article-id> # one article's stats ``` Stats come straight from CSDN: `view_count` (阅读), `digg_count` (点赞), `comment_count` (评论), `collect_count` (收藏). ## Verify the connection first ```sh CSDN="$SKILL_DIR/scripts/csdn.py"; [ -f "$CSDN" ] || CSDN=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/csdn.py' 2>/dev/null | head -1) python3 "$CSDN" whoami # → {"username": "...", "nickname": "...", "articles_total": 0} ``` On a WAF 403 / auth error the cookie is expired — tell the user to reconnect at <https://studio.acedata.cloud/console/connectors>. Do **not** retry in a loop. ## Publishing — GATED (dry-run unless trailing `--confirm`) `publish` writes to the user's real account. Content is **Markdown**. Without a trailing `--confirm` it dry-runs. `--confirm` is honored **only as the last argument**. Always show the dry-run, get an explicit "yes", then re-run with `--confirm` last. ```sh CSDN="$SKILL_DIR/scripts/csdn.py"; [ -f "$CSDN" ] || CSDN=$(find /tmp -maxdepth 8 -path '*/skills/*/scripts/csdn.py' 2>/dev/null | head -1) python3 "$CSDN" publish --title "标题" --content-file a.md # dry-run python3 "$CSDN" publish --title "标题" --content-file a.md --draft-only --confirm # private draft (status=2) python3 "$CSDN" publish --title "标题" --content-file a.md --tags "AI,Python" --confirm # PUBLIC, goes live ``` - `--draft-only` saves a private draft (CSDN `status=2`) — safe, nothing public. - Without `--draft-only` the article is **published publicly** under the user's name. Default to `--draft-only` unless the user clearly asked to go live. - `--tags` is a comma-separated list of article tags. ## Images `publish` automatically re-hosts external markdown images (``) onto CSDN's own CDN (`i-blog.csdnimg.cn`) before saving — CSDN 防盗链 blocks external images, and saving an article full of external URLs can even time out. Images already on `csdnimg.cn` are left alone; pass `--no-rehost-images` to skip. An image that fails to upload keeps its original URL (never blocks the post). ## Gotchas — surface before the user is surprised - **This is the user's real CSDN account.** Confirm before any publish. - **Cookie expiry / WAF 403**: reconnect at studio.acedata.cloud/console/connectors — never loop-retry a WAF block. - The editor save endpoint is signed with an HMAC key baked into CSDN's web bundle; if CSDN rotates it, publish fails loudly (reads still work). - **Never print `CSDN_COOKIES`** — it is full account access. - **ToS**: cookie automation acts only on the user's own account with their own captured cookie; the user owns that risk. ## Record the output After you successfully publish and obtain the live result URL, call the built-in `publish_artifact` tool ONCE so the user can track this deliverable in **My Outputs**: ``` publish_artifact(kind="article", channel="csdn", title="<title>", url="<the REAL returned URL>", status="delivered") ``` Use the real returned URL — never fabricate one. Call it once per published item, only after delivery is confirmed; skip it (or use `status="failed"`) if publishing failed. See `_shared/artifacts.md`.