openclacky 1.3.8 → 1.3.10

data/lib/clacky/default_extensions/ext-studio/skills/ext-publish/SKILL.md

@@ -11,8 +11,7 @@ it's live.
 ## Before publishing
 
 - The extension must live in the **local** layer (`~/.clacky/ext/local/<id>/`). Only
-  local containers can be packed. Marketplace-origin and encrypted (`SKILL.md.enc`)
-  containers are rejected.
+  local containers can be packed. Encrypted (`SKILL.md.enc`) containers are rejected.
 - Publishing requires an **activated user license** — it proves creator identity, and
   the platform attributes the extension to that account. If activation is missing, tell
   the user to activate first; don't try to work around it.

data/lib/clacky/default_extensions/general/ext.yml

@@ -5,7 +5,6 @@ version: "0.1.0"
 author: OpenClacky
 homepage: https://www.openclacky.com
 license: MIT
-origin: self
 contributes:
   agents:
     - id: general

data/lib/clacky/default_extensions/git/ext.yml

@@ -5,7 +5,6 @@ version: "0.1.0"
 author: OpenClacky
 homepage: https://www.openclacky.com
 license: MIT
-origin: self
 contributes:
   panels:
     - id: git

data/lib/clacky/default_extensions/meeting/ext.yml

@@ -5,7 +5,6 @@ version: "0.1.0"
 author: OpenClacky
 homepage: https://www.openclacky.com
 license: MIT
-origin: self
 contributes:
   api: api/handler.rb
   panels:

data/lib/clacky/default_extensions/time_machine/ext.yml

@@ -5,7 +5,6 @@ version: "0.1.0"
 author: OpenClacky
 homepage: https://www.openclacky.com
 license: MIT
-origin: self
 contributes:
   panels:
     - id: time_machine

data/lib/clacky/extension/api_extension.rb

@@ -30,13 +30,14 @@ module Clacky
     Route = Struct.new(:method, :pattern, :regex, :param_names, :block, :options, keyword_init: true)
 
     class Halt < StandardError
-      attr_reader :status, :payload, :content_type
+      attr_reader :status, :payload, :content_type, :extra_headers
 
-      def initialize(status, payload, content_type)
+      def initialize(status, payload, content_type, extra_headers: {})
         super("api_ext halt #{status}")
         @status       = status
         @payload      = payload
         @content_type = content_type
+        @extra_headers = extra_headers
       end
     end
 
@@ -201,6 +202,14 @@ module Clacky
       raise Halt.new(status, str.to_s, "text/plain; charset=utf-8")
     end
 
+    def send_data(bytes, content_type:, filename: nil, status: 200)
+      disposition = filename ? "attachment; filename=\"#{filename}\"" : "attachment"
+      raise Halt.new(status, bytes, content_type, extra_headers: {
+        "Content-Disposition" => disposition,
+        "Content-Length"      => bytes.bytesize.to_s
+      })
+    end
+
     def error!(message, status: 400, **extra)
       payload = { error: message.to_s }
       payload.merge!(extra) unless extra.empty?

data/lib/clacky/extension/dispatcher.rb

@@ -97,7 +97,7 @@ module Clacky
           # Handler exited without writing — empty 204
           empty_response(res)
         rescue Clacky::ApiExtension::Halt => halt
-          write_response(res, halt.status, halt.payload, halt.content_type)
+          write_response(res, halt.status, halt.payload, halt.content_type, halt.extra_headers)
         rescue Timeout::Error
           Clacky::Logger.warn("[api_ext:#{klass.ext_id}] Timed out after #{timeout_sec}s on #{route.method.upcase} #{route.pattern}")
           write_json(res, 503, error: "request timed out")
@@ -106,10 +106,11 @@ module Clacky
           write_json(res, 500, error: e.message)
         end
 
-        private def write_response(res, status, body, content_type)
+        private def write_response(res, status, body, content_type, extra_headers = {})
           res.status = status
           res.content_type = content_type
           res["Access-Control-Allow-Origin"] = "*"
+          extra_headers.each { |k, v| res[k] = v }
           res.body = body
         end
 

data/lib/clacky/extension/packager.rb

@@ -98,12 +98,6 @@ module Clacky
       # carrying encrypted skills is produced by the platform pipeline; refuse
       # to re-pack it so we never smuggle marketplace artifacts out of band.
       private def refuse_protected!(slug, container_dir)
-        manifest = YAML.safe_load(File.read(File.join(container_dir, MANIFEST)), permitted_classes: [Symbol]) || {}
-        origin = (manifest["origin"] || "self").to_s
-        if origin == "marketplace"
-          raise Error, "refusing to pack #{slug}: origin=marketplace is produced by the platform, not hand-packed"
-        end
-
         enc = Dir.glob(File.join(container_dir, "**", "SKILL.md.enc"))
         return if enc.empty?
 

data/lib/clacky/locales/en.rb

@@ -5,7 +5,7 @@ module Clacky
     EN = {
       "llm.error.insufficient_credit"   => "Insufficient credit, please top up your account to continue",
       "llm.error.rate_limit_400"        => "Rate limit or service issue, retrying...",
-      "llm.error.invalid_api_key"       => "Invalid API key, please check your configuration",
+      "llm.error.invalid_api_key"       => "API key is invalid or expired, please update it in Settings",
       "llm.error.403.model_not_allowed" => "This model is not available on your current plan",
       "llm.error.403.api_key_revoked"   => "API key has been revoked, please generate a new one",
       "llm.error.403.api_key_expired"   => "API key has expired, please generate a new one",

data/lib/clacky/locales/zh.rb

@@ -5,7 +5,7 @@ module Clacky
     ZH = {
       "llm.error.insufficient_credit"   => "账户余额不足，请前往控制台充值后继续使用",
       "llm.error.rate_limit_400"        => "请求频率过高或服务暂时不可用，正在重试...",
-      "llm.error.invalid_api_key"       => "API 密钥无效，请检查配置",
+      "llm.error.invalid_api_key"       => "API Key 无效或已过期，请到设置中重新配置",
       "llm.error.403.model_not_allowed" => "当前模型不支持免费试用，请升级套餐或切换其他模型",
       "llm.error.403.api_key_revoked"   => "API 密钥已被撤销，请前往控制台重新生成",
       "llm.error.403.api_key_expired"   => "API 密钥已过期，请前往控制台重新生成",

data/lib/clacky/prompts/base.md

@@ -3,7 +3,7 @@
 - Ask clarifying questions if requirements are unclear.
 - Break down complex tasks into manageable steps.
 - **USE TOOLS to create/modify files** — don't just return content.
-- When the user asks to send/download a file or you generate one for them, append `[filename](file://~/path/to/file)` at the end of your reply.
+- When the user asks to send/download a file or you generate one for them, append `[filename](file://~/path/to/file)` at the end of your reply. Use the raw file path as-is (keep non-ASCII characters and spaces literal); never URL-encode it.
 
 ## Tool Usage Rules
 

data/lib/clacky/server/http_server.rb

@@ -117,6 +117,7 @@ module Clacky
       WEB_ROOT = File.expand_path("../web", __dir__)
       EXCHANGE_RATE_PRIMARY_BASE_URL = "https://open.er-api.com/v6/latest"
       EXCHANGE_RATE_FALLBACK_URL = "https://api.frankfurter.app/latest"
+      OSS_CDN_BASE = "https://oss.1024code.com/openclacky"
 
       # Default SOUL.md written when the user skips the onboard conversation.
       # A richer version is created by the Agent during the soul_setup phase.
@@ -538,8 +539,10 @@ module Clacky
         when ["POST",   "/api/onboard/complete"]  then api_onboard_complete(req, res)
         when ["POST",   "/api/onboard/skip-soul"] then api_onboard_skip_soul(req, res)
         when ["GET",    "/api/store/skills"]          then api_store_skills(res)
-        when ["GET",    "/api/store/extensions"]      then api_store_extensions(req, res)
+        when ["GET",    "/api/store/extensions"]          then api_store_extensions(req, res)
+        when ["GET",    "/api/store/extensions/installed"] then api_store_extensions_installed(res)
         when ["GET",    "/api/store/extension"]       then api_store_extension_detail(req, res)
+        when ["POST",   "/api/store/extension/install"]  then api_store_extension_install(req, res)
         when ["POST",   "/api/store/extension/disable"] then api_store_extension_disable(req, res)
         when ["POST",   "/api/store/extension/enable"]  then api_store_extension_enable(req, res)
         when ["DELETE", "/api/store/extension"]         then api_store_extension_uninstall(req, res)
@@ -2346,6 +2349,66 @@ module Clacky
         end
       end
 
+      # GET /api/store/extensions/installed
+      #
+      # Returns all locally installed extensions (all layers: builtin, installed,
+      # local) regardless of whether they are still listed on the marketplace.
+      def api_store_extensions_installed(res)
+        result   = Clacky::ExtensionLoader.load_all
+        disabled = Clacky::ExtensionLoader.disabled_ids
+
+        local_entries = Array(result&.containers).filter_map do |ext_id, container|
+          next unless container[:layer] == :installed
+
+          [ext_id, container]
+        end.to_h
+
+        market_by_slug = fetch_batch_market_data(local_entries.keys)
+
+        extensions = local_entries.map do |ext_id, container|
+          market = market_by_slug[ext_id]
+          {
+            "id"          => ext_id,
+            "name"        => market ? (market["name"] || ext_id) : ext_id,
+            "name_zh"     => market&.dig("name_zh"),
+            "name_en"     => market&.dig("name_en"),
+            "slug"        => ext_id,
+            "version"     => market ? (market["version"] || container[:version]) : container[:version],
+            "description" => market&.dig("description"),
+            "author"      => market&.dig("author"),
+            "icon_url"    => market&.dig("icon_url"),
+            "units"       => market&.dig("units"),
+            "homepage"    => market ? (market["homepage"] || "") : "",
+            "origin"      => market ? (market["origin"] || container[:origin]) : container[:origin],
+            "hub_active"  => market&.dig("hub_active"),
+            "unlisted"    => market.nil?,
+            "layer"       => container[:layer].to_s,
+            "installed"   => true,
+            "removable"   => true,
+            "disabled"    => disabled.include?(ext_id),
+          }
+        end
+
+        json_response(res, 200, { ok: true, extensions: extensions })
+      rescue StandardError => e
+        json_response(res, 500, { ok: false, error: e.message })
+      end
+
+      private def fetch_batch_market_data(slugs)
+        return {} if slugs.empty?
+
+        client = Clacky::PlatformHttpClient.new
+        slugs.each_slice(50).each_with_object({}) do |batch, result|
+          ids_param = batch.join(",")
+          response  = client.get("/api/v1/extensions/batch?ids=#{ids_param}")
+          next unless response[:success]
+
+          Array(response.dig(:data, "extensions")).each { |ext| result[ext["name"]] = ext }
+        end
+      rescue StandardError
+        {}
+      end
+
       # Slugs of every extension container currently loaded (any layer), used to
       # flag "installed" on the public marketplace catalog.
       def installed_extension_slugs
@@ -2380,7 +2443,32 @@ module Clacky
           )
           json_response(res, 200, { ok: true, extension: ext })
         else
-          json_response(res, 404, { ok: false, error: result[:error] || "Not found" })
+          container = extension_container(id)
+          if container && container[:layer] == :installed
+            market = fetch_batch_market_data([id])[id]
+            ext = {
+              "id"          => id,
+              "name"        => market ? (market["name"] || id) : id,
+              "name_zh"     => market&.dig("name_zh"),
+              "name_en"     => market&.dig("name_en"),
+              "slug"        => id,
+              "version"     => market ? (market["version"] || container[:version]) : container[:version],
+              "description" => market&.dig("description"),
+              "author"      => market&.dig("author"),
+              "icon_url"    => market&.dig("icon_url"),
+              "units"       => market&.dig("units"),
+              "homepage"    => market ? (market["homepage"] || "") : "",
+              "origin"      => market ? (market["origin"] || container[:origin]) : container[:origin],
+              "hub_active"  => market&.dig("hub_active"),
+              "unlisted"    => market.nil?,
+              "installed"   => true,
+              "removable"   => true,
+              "disabled"    => container[:disabled] == true,
+            }
+            json_response(res, 200, { ok: true, extension: ext })
+          else
+            json_response(res, 404, { ok: false, error: result[:error] || "Not found" })
+          end
         end
       end
 
@@ -2419,6 +2507,25 @@ module Clacky
       end
 
       # DELETE /api/store/extension   body: { id: <slug> }
+      def api_store_extension_install(req, res)
+        body         = parse_json_body(req)
+        download_url = body["download_url"].to_s.strip
+        name         = body["name"].to_s.strip
+
+        if download_url.empty?
+          json_response(res, 400, { ok: false, error: "Missing download_url." })
+          return
+        end
+
+        Clacky::ExtensionPackager.install(download_url, force: true)
+        Clacky::ExtensionLoader.invalidate_cache!
+        json_response(res, 200, { ok: true, name: name })
+      rescue Clacky::ExtensionPackager::Error => e
+        json_response(res, 422, { ok: false, error: e.message })
+      rescue StandardError => e
+        json_response(res, 500, { ok: false, error: e.message })
+      end
+
       def api_store_extension_uninstall(req, res)
         id = parse_json_body(req)["id"].to_s
         container = extension_container(id)
@@ -2879,7 +2986,7 @@ module Clacky
         require "net/http"
         require "uri"
 
-        oss_base   = "https://oss.1024code.com/openclacky"
+        oss_base   = OSS_CDN_BASE
         latest_url = "#{oss_base}/latest.txt"
 
         Clacky::Logger.info("[Upgrade] Non-official source — fetching latest version from OSS CDN")
@@ -3051,11 +3158,12 @@ module Clacky
       end
 
       # Query the latest openclacky version.
-      # Strategy: try RubyGems official REST API first (most accurate, not affected by mirror lag),
-      # then fall back to `gem list -r` (respects user's configured gem source).
-      # Uses Terminal (PTY + login shell) so rbenv/mise shims and gem mirrors work correctly.
+      # Strategy: OSS CDN latest.txt first (fast, CDN-accelerated), then RubyGems API,
+      # then fall back to `gem list -r` as a last resort.
       private def fetch_latest_version_from_gem
-        fetch_latest_version_from_rubygems_api || fetch_latest_version_from_gem_command
+        fetch_oss_latest_version("#{OSS_CDN_BASE}/latest.txt") ||
+          fetch_latest_version_from_rubygems_api ||
+          fetch_latest_version_from_gem_command
       end
 
       # Try RubyGems official REST API — fast and always up-to-date.

data/lib/clacky/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clacky
-  VERSION = "1.3.8"
+  VERSION = "1.3.10"
 end

data/lib/clacky/web/app.css

@@ -1874,9 +1874,7 @@ body {
   flex-direction: column;
   gap: 1.25rem;
   width: 100%;
-  max-width: 60rem;
-  margin: 0 auto;
-  padding: 5.5rem 1.5rem 1rem;
+  padding: 6rem max(1.5rem, calc(50% - 30rem)) 1rem;
 }
 .new-session-composer {
   position: relative;
@@ -2007,6 +2005,11 @@ body {
   font-size: 0.78125rem;
   color: var(--color-text-tertiary);
   line-height: 1.4;
+  flex: 1;
+  overflow: hidden;
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
 }
 .agent-card-badge {
   position: absolute;
@@ -2026,7 +2029,6 @@ body {
   color: var(--color-accent-primary);
 }
 .agent-card-author {
-  margin-top: 0.25rem;
   font-size: 0.72rem;
   color: var(--color-text-tertiary);
   opacity: 0.8;
@@ -2096,7 +2098,7 @@ body {
   flex-direction: column;
   gap: 0.5rem;
   align-items: flex-start;
-  margin-top: -0.75rem;
+  margin-top: -0.5rem;
 }
 .new-session-advanced-toggle {
   display: inline-flex;
@@ -7079,13 +7081,45 @@ body {
   gap: 1.25rem;
 }
 .extensions-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-bottom: 0.25rem;
+}
+.extensions-toolbar-right {
   display: flex;
   align-items: center;
   gap: 0.5rem;
 }
+.extensions-filter-tabs {
+  display: flex;
+  align-items: center;
+  gap: 0;
+  flex-shrink: 0;
+}
+.extensions-filter-tab {
+  font-size: 0.875rem;
+  font-weight: 500;
+  padding: 0.25rem 0.875rem 0.5rem;
+  border: none;
+  background: transparent;
+  color: var(--color-text-tertiary);
+  cursor: pointer;
+  white-space: nowrap;
+  border-bottom: 2px solid transparent;
+  transition: color .15s, border-color .15s;
+}
+.extensions-filter-tab:hover {
+  color: var(--color-text-primary);
+}
+.extensions-filter-tab-active {
+  color: var(--color-text-primary);
+  border-bottom-color: var(--color-accent, #6366f1);
+}
 .extensions-search {
   flex: 1;
-  min-width: 0;
+  min-width: 15rem;
   font-size: 0.8125rem;
   padding: 0.4375rem 0.75rem;
   border-radius: 6px;
@@ -7137,7 +7171,7 @@ body {
 .extension-card:hover { border-color: var(--color-text-muted); }
 .extension-card-main {
   display: flex;
-  align-items: flex-start;
+  align-items: center;
   gap: 0.75rem;
 }
 .extension-emoji {
@@ -7176,12 +7210,32 @@ body {
   border-radius: 4px;
   padding: 0.0625rem 0.375rem;
 }
+.extension-unlisted {
+  font-size: 0.6875rem;
+  color: var(--color-text-secondary);
+  background: var(--color-surface-2, rgba(0,0,0,0.06));
+  border-radius: 4px;
+  padding: 0.0625rem 0.375rem;
+}
 .extension-desc {
   font-size: 0.75rem;
   color: var(--color-text-secondary);
   line-height: 1.5;
   margin-bottom: 0.375rem;
 }
+.extension-desc-detail {
+  font-size: 0.8125rem;
+  margin-bottom: 0.5rem;
+}
+.extension-detail-author {
+  font-size: 0.6875rem;
+  color: var(--color-text-muted);
+}
+.extension-author {
+  font-size: 0.75rem;
+  color: var(--color-text-muted);
+  font-weight: 400;
+}
 .extension-meta {
   display: flex;
   align-items: center;
@@ -7224,19 +7278,21 @@ body {
 .extension-detail-hero {
   display: flex;
   align-items: flex-start;
-  gap: 0.875rem;
-  padding-bottom: 1rem;
+  gap: 1rem;
+  padding-bottom: 1.25rem;
   border-bottom: 1px solid var(--color-border-primary);
 }
 .extension-detail-heading { flex: 1; min-width: 0; }
-.extension-emoji-lg { font-size: 2.25rem; }
-.extension-name-lg { font-size: 1.0625rem; }
-.extension-detail-block { margin-top: 1.25rem; }
+.extension-emoji-lg { font-size: 2.5rem; line-height: 1; margin-top: 0.125rem; }
+.extension-name-lg { font-size: 1.125rem; font-weight: 700; }
+.extension-detail-block { margin-top: 1.5rem; }
 .extension-detail-block-title {
-  font-size: 0.8125rem;
+  font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-text-primary);
-  margin: 0 0 0.625rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--color-text-muted);
+  margin: 0 0 0.75rem;
 }
 .extension-detail-section { margin-bottom: 0.875rem; }
 .extension-detail-section-title {
@@ -7248,18 +7304,30 @@ body {
   margin: 0 0 0.375rem;
 }
 .extension-contrib-list,
-.extension-version-list { list-style: none; margin: 0; padding: 0; }
-.extension-contrib-item {
-  padding: 0.5rem 0.75rem;
-  background: var(--color-bg-secondary);
+.extension-version-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
   border: 1px solid var(--color-border-primary);
-  border-radius: 6px;
-  margin-bottom: 0.375rem;
+  border-radius: 8px;
+  overflow: hidden;
+  background: var(--color-bg-secondary);
+}
+.extension-contrib-item {
+  padding: 0.625rem 0.875rem;
+  border-bottom: 1px solid var(--color-border-primary);
+  background: transparent;
+  border-radius: 0;
+  border-left: none;
+  border-right: none;
+  border-top: none;
+  margin-bottom: 0;
 }
+.extension-contrib-item:last-child { border-bottom: none; }
 .extension-contrib-title {
   display: block;
   font-size: 0.8125rem;
-  font-weight: 600;
+  font-weight: 500;
   color: var(--color-text-primary);
 }
 .extension-contrib-desc {
@@ -7270,7 +7338,7 @@ body {
   margin-top: 0.125rem;
 }
 .extension-version-item {
-  padding: 0.5rem 0.75rem;
+  padding: 0.625rem 0.875rem;
   border-bottom: 1px solid var(--color-border-primary);
 }
 .extension-version-item:last-child { border-bottom: none; }
@@ -7306,20 +7374,43 @@ body {
   padding: 0.0625rem 0.375rem;
 }
 .extension-action {
+  display: inline-flex;
+  align-items: center;
   font-size: 0.75rem;
-  padding: 0.3125rem 0.75rem;
-  border-radius: 6px;
-  border: 1px solid var(--color-border);
-  background: var(--color-surface);
-  color: var(--color-text);
+  padding: 0.25rem 0.625rem;
+  border-radius: 5px;
+  border: 1px solid var(--color-border-primary);
+  background: var(--color-bg-primary);
+  color: var(--color-text-secondary);
   cursor: pointer;
+  transition: background .15s, border-color .15s, opacity .15s;
+  white-space: nowrap;
+}
+.extension-action:hover { background: var(--color-bg-hover); }
+.extension-action-install {
+  background: var(--color-button-primary);
+  color: var(--color-button-primary-text);
+  border-color: transparent;
+}
+.extension-action-install:hover {
+  background: var(--color-button-primary-hover);
+}
+.extension-action-install:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+.extension-action-disable,
+.extension-action-enable {
+  color: var(--color-text-tertiary);
 }
-.extension-action:hover { background: var(--color-surface-hover, rgba(0,0,0,0.04)); }
 .extension-action-remove {
-  color: var(--color-danger, #dc2626);
-  border-color: var(--color-danger-border, rgba(220,38,38,0.4));
+  color: var(--color-error);
+  border-color: var(--color-error-border);
+}
+.extension-action-remove:hover {
+  background: var(--color-error-bg);
+  border-color: var(--color-error);
 }
-.extension-action-remove:hover { background: var(--color-danger-bg, rgba(220,38,38,0.08)); }
 
 /* Brand Skill card */
 .brand-skill-card {