openclacky 1.5.0 → 1.5.2

data/lib/clacky/locales/zh.rb

@@ -9,11 +9,12 @@ module Clacky
       "llm.error.403.model_not_allowed" => "当前模型不支持免费试用，请升级套餐或切换其他模型",
       "llm.error.403.api_key_revoked"   => "API 密钥已被撤销，请前往控制台重新生成",
       "llm.error.403.api_key_expired"   => "API 密钥已过期，请前往控制台重新生成",
-      "llm.error.403.quota_exceeded"    => "配额已用完，请升级套餐",
+      "llm.error.403.quota_exceeded"    => "API Key 配额已超限，请在管理后台调整配额或关闭限制",
       "llm.error.403.access_denied"     => "访问被拒绝，请检查 API 密钥权限",
       "llm.error.403.default"           => "访问被拒绝",
       "llm.error.endpoint_not_found"    => "API 端点不存在，请检查服务地址配置",
-      "llm.error.rate_limit_429"        => "请求过于频繁，请稍候重试",
+      "llm.error.rate_limit_429"        => "请求过于频繁，请稍后重试",
+      "llm.error.quota_exhausted"       => "API 配额已用尽（已达 Key 的用量上限），请前往控制台提升配额或升级套餐后继续",
       "llm.error.server_error"          => "服务暂时不可用（%<status>d），正在重试...",
       "llm.error.unexpected"            => "请求失败（%<status>d）",
       "llm.error.html_response"         => "服务暂时不可用（收到 HTML 错误页），正在重试...",
@@ -21,6 +22,7 @@ module Clacky
       "llm.error.request_timeout"       => "请求超时（已重试 %<retries>d 次）",
       "llm.error.network_failed"        => "网络连接失败（已重试 %<retries>d 次）",
       "llm.error.service_unavailable"   => "服务暂时不可用（已重试 %<retries>d 次）",
+      "llm.warn.switching_to_fallback_url" => "主节点无法连接，正在切换到备用节点：%<url>s",
       "platform.error.invalid_proof"        => "许可证密钥无效，请检查后重试。",
       "platform.error.invalid_signature"    => "请求签名无效。",
       "platform.error.nonce_replayed"       => "检测到重复请求，请重试。",
@@ -28,7 +30,7 @@ module Clacky
       "platform.error.license_revoked"      => "该许可证已被吊销，请联系客服。",
       "platform.error.license_expired"      => "该许可证已过期，请续订后继续。",
       "platform.error.device_limit_reached" => "该许可证的设备数量已达上限。",
-      "platform.error.device_revoked"       => "该设备已从许可证中移除。",
+      "platform.error.device_revoked"       => "该设备已从许可证中移除。如需重新绑定，请等待 15 分钟后再试。",
       "platform.error.invalid_license"      => "未找到许可证密钥，请核对后重试。",
       "platform.error.device_not_found"     => "设备未注册，请重新激活。",
       "platform.error.contributor_required" => "发布扩展需要先成为扩展贡献者。请登录平台，打开「我的扩展」页面，点击「成为扩展贡献者」即可开通（无需审核）。",

data/lib/clacky/message_format/anthropic.rb

@@ -66,6 +66,7 @@ module Clacky
         system_text = system_messages.map { |m| extract_text(m[:content]) }.join("\n\n")
 
         api_messages = regular_messages.map { |msg| to_api_message(msg, caching_enabled) }
+        api_messages = merge_consecutive_tool_results(api_messages)
         api_tools    = tools&.map { |t| to_api_tool(t) }
 
         if caching_enabled && api_tools&.any?
@@ -90,6 +91,34 @@ module Clacky
         %w[low medium high].include?(s) ? s : nil
       end
 
+      # Merge consecutive tool_result user messages into a single user message.
+      # Anthropic requires all tool_results for an assistant turn to appear in
+      # a SINGLE user message immediately following the assistant. When an
+      # assistant calls multiple tools, the canonical format produces one
+      # role:"tool" message per result, which to_api_message converts into
+      # separate role:"user" messages — breaking the Anthropic contract.
+      private_class_method def self.merge_consecutive_tool_results(api_messages)
+        result = []
+        pending = nil
+
+        api_messages.each do |msg|
+          if msg[:role] == "user" && msg[:content].is_a?(Array) &&
+             msg[:content].any? { |b| b.is_a?(Hash) && b[:type] == "tool_result" }
+            if pending
+              pending[:content] += msg[:content]
+            else
+              pending = msg
+              result << pending
+            end
+          else
+            pending = nil
+            result << msg
+          end
+        end
+
+        result
+      end
+
       # ── Response parsing ──────────────────────────────────────────────────────
 
       # Parse Anthropic API response into canonical internal format.

data/lib/clacky/message_history.rb

@@ -10,7 +10,7 @@ module Clacky
     # Fields that are internal to the agent and must not be sent to the API.
     INTERNAL_FIELDS = %i[
       task_id created_at system_injected session_context memory_update
-      subagent_instructions subagent_result token_usage
+      subagent_instructions subagent_result subagent_transcript token_usage
       compressed_summary chunk_path truncated transient
       chunk_index chunk_count
     ].freeze
@@ -71,6 +71,20 @@ module Clacky
       self
     end
 
+    # Attach a key/value onto the most recent tool result message matching the
+    # given tool_call_id. Handles both OpenAI-style (role:"tool", tool_call_id)
+    # and Anthropic-style (role:"user" with tool_result blocks) messages.
+    # No-op if no matching message is found.
+    def attach_to_tool_result(tool_call_id, key, value)
+      msg = @messages.reverse.find do |m|
+        (m[:role] == "tool" && m[:tool_call_id] == tool_call_id) ||
+          (m[:role] == "user" && m[:content].is_a?(Array) &&
+            m[:content].any? { |b| b.is_a?(Hash) && b[:type] == "tool_result" && b[:tool_use_id] == tool_call_id })
+      end
+      msg[key] = value if msg
+      self
+    end
+
     # Mutate the last message matching the predicate lambda in-place.
     # Used by execute_skill_with_subagent to update instruction messages.
     def mutate_last_matching(predicate, &block)

data/lib/clacky/providers.rb

@@ -148,6 +148,18 @@ module Clacky
           "abs-claude-fable-5"    => "abs-claude-opus-4-8",
           "abs-claude-sonnet-4-6" => "abs-claude-sonnet-4-5"
         },
+        # Secondary gateway URL used when the primary base_url is unreachable
+        # after max retries. The model name stays the same — only the endpoint
+        # changes. Nil / absent means no URL fallback for this provider.
+        "fallback_base_url" => "https://llm.1024code.com",
+        # Two selectable endpoints exposed in the Base URL dropdown:
+        #   Primary   — global CDN, lowest latency for most regions.
+        #   Secondary — China-optimised relay (1024code.com), useful when
+        #               the primary is unreachable from mainland China.
+        "endpoint_variants" => [
+          { "label" => "Primary (Global)",  "label_key" => "settings.models.baseurl.variant.openclacky_primary",   "base_url" => "https://api.openclacky.com" }.freeze,
+          { "label" => "Secondary (China)", "label_key" => "settings.models.baseurl.variant.openclacky_secondary", "base_url" => "https://llm.1024code.com"   }.freeze
+        ].freeze,
         "website_url" => "https://www.openclacky.com/ai-keys"
       }.freeze,
 
@@ -779,6 +791,16 @@ module Clacky
         preset&.dig("fallback_models", model)
       end
 
+      # Get the fallback base URL for a provider (used when primary endpoint is unreachable).
+      # Returns nil if the provider has no secondary gateway configured.
+      # @param provider_id [String] The provider identifier
+      # @return [String, nil] The fallback base URL or nil
+      def fallback_base_url(provider_id)
+        preset = PRESETS[provider_id]
+        url = preset&.dig("fallback_base_url")
+        url&.empty? ? nil : url
+      end
+
       # Find provider ID by base URL.
       # Matches if the given URL starts with the provider's base_url (after normalisation),
       # so both exact matches and sub-path variants (e.g. "/v1") are recognised.

data/lib/clacky/server/http_server.rb

@@ -103,6 +103,15 @@ module Clacky
                      question: question, context: context, options: options }
       end
 
+      def show_subagent_start(skill: nil, iterations: nil, cost_usd: nil)
+        @events << { type: "subagent_start", session_id: @session_id,
+                     skill: skill, iterations: iterations, cost_usd: cost_usd }
+      end
+
+      def show_subagent_end
+        @events << { type: "subagent_end", session_id: @session_id }
+      end
+
       # Ignore all other UI methods (progress, errors, etc.) during history replay
       def method_missing(name, *args, **kwargs); end
       def respond_to_missing?(name, include_private = false); true; end
@@ -2267,19 +2276,23 @@ module Clacky
 
         Clacky::Logger.debug("[Brand] api_brand_status: expired=#{brand.expired?} grace_exceeded=#{brand.grace_period_exceeded?} expires_at=#{brand.license_expires_at&.iso8601 || "nil"}")
 
-        warning = nil
+        warning      = nil
+        warning_type = nil
         if brand.expired?
-          warning = "Your #{brand.product_name} license has expired. Please renew to continue."
+          warning      = "Your #{brand.product_name} license has expired. Please renew to continue."
+          warning_type = "expired"
         elsif brand.grace_period_exceeded?
-          warning = "License server unreachable for more than 3 days. Please check your connection."
+          warning      = "License server unreachable for more than 3 days. Please check your connection."
+          warning_type = "unreachable"
         elsif brand.license_expires_at && !brand.expired?
           days_remaining = ((brand.license_expires_at - Time.now.utc) / 86_400).ceil
           if days_remaining <= 7
-            warning = "Your #{brand.product_name} license expires in #{days_remaining} day#{"s" if days_remaining != 1}. Please renew soon."
+            warning      = "Your #{brand.product_name} license expires in #{days_remaining} day#{"s" if days_remaining != 1}. Please renew soon."
+            warning_type = "expiring"
           end
         end
 
-        Clacky::Logger.debug("[Brand] api_brand_status: warning=#{warning.inspect}")
+        Clacky::Logger.debug("[Brand] api_brand_status: warning=#{warning.inspect} warning_type=#{warning_type.inspect}")
 
         json_response(res, 200, {
           branded:          true,
@@ -2288,6 +2301,7 @@ module Clacky
           homepage_url:     brand.homepage_url,
           logo_url:         brand.logo_url,
           warning:          warning,
+          warning_type:     warning_type,
           test_mode:        @brand_test,
           user_licensed:    brand.user_licensed?,
           license_user_id:  brand.license_user_id
@@ -2541,10 +2555,11 @@ module Clacky
         units
       end
 
-      # GET /api/store/extension?id=<slug-or-id>
+      # GET /api/store/extension?id=<slug-or-id>[&source=brand]
       #
-      # Public detail for a single marketplace extension (contributes + version
-      # history). Anonymous, proxies BrandConfig#extension_detail!.
+      # Detail for a single extension. Pass source=brand to query brand-private
+      # extensions via the license-gated API; omit (or any other value) for the
+      # public marketplace API.
       def api_store_extension_detail(req, res)
         id = req.query["id"].to_s
         if id.strip.empty?
@@ -2553,10 +2568,11 @@ module Clacky
         end
 
         brand  = Clacky::BrandConfig.load
-        # Brand-private extensions (origin=self) are not visible via the public
-        # /api/v1/extensions/:id endpoint. Activated brand users must use the
-        # license-gated POST /api/v1/licenses/extension instead.
-        result = brand.activated? ? brand.brand_extension_detail!(id) : brand.extension_detail!(id)
+        result = if req.query["source"] == "brand"
+          brand.brand_extension_detail!(id)
+        else
+          brand.extension_detail!(id)
+        end
 
         if result[:success] && result[:extension]
           ext  = result[:extension]
@@ -5394,6 +5410,7 @@ module Clacky
             base_url:         m["base_url"],
             api_key_masked:   mask_api_key(m["api_key"]),
             anthropic_format: m["anthropic_format"] || false,
+            provider_id:      m["provider_id"],
             type:             m["type"]
           }
         end
@@ -5602,7 +5619,8 @@ module Clacky
           "model"            => model,
           "base_url"         => base_url,
           "api_key"          => api_key,
-          "anthropic_format" => body["anthropic_format"] || false
+          "anthropic_format" => body["anthropic_format"] || false,
+          "provider_id"      => body["provider_id"].to_s.strip.then { |v| v.empty? ? nil : v }
         }
         type = body["type"].to_s
         unless type.empty?
@@ -5663,6 +5681,14 @@ module Clacky
         if body.key?("anthropic_format")
           target["anthropic_format"] = !!body["anthropic_format"]
         end
+        if body.key?("provider_id")
+          v = body["provider_id"].to_s.strip
+          if v.empty?
+            target.delete("provider_id")
+          else
+            target["provider_id"] = v
+          end
+        end
         if body.key?("api_key")
           new_key = body["api_key"].to_s
           # Only store a real, unmasked, non-empty value. This is the
@@ -5969,7 +5995,9 @@ module Clacky
 
         if model_name && !model_name.empty?
           info = agent.current_model_info
-          provider_id = info && Clacky::Providers.find_by_base_url(info[:base_url])
+          # Prefer explicitly saved provider_id, fall back to base_url lookup
+          provider_id = info&.dig(:provider_id).to_s.strip.then { |v| v.empty? ? nil : v }
+          provider_id ||= (info && Clacky::Providers.find_by_base_url(info[:base_url]))
           allowed = provider_id ? Clacky::Providers.models(provider_id) : []
           if allowed.empty?
             return json_response(res, 400, { error: "Current model has no provider preset; sub-model switching unavailable" })

data/lib/clacky/server/session_registry.rb

@@ -376,8 +376,10 @@ module Clacky
       # in any preset (e.g. self-hosted custom endpoints) — the WebUI
       # treats that as "no sub-model switcher available".
       private def sub_model_options_for(model_info)
-        return [] unless model_info && model_info[:base_url]
-        provider_id = Clacky::Providers.find_by_base_url(model_info[:base_url])
+        return [] unless model_info
+        # Prefer explicitly saved provider_id, fall back to base_url lookup
+        provider_id = model_info[:provider_id].to_s.strip.then { |v| v.empty? ? nil : v }
+        provider_id ||= (model_info[:base_url] && Clacky::Providers.find_by_base_url(model_info[:base_url]))
         return [] unless provider_id
         Clacky::Providers.models(provider_id)
       end

data/lib/clacky/skill.rb

@@ -537,6 +537,10 @@ module Clacky
         name_invalid = !valid_slug.call(@name) || @name.length > 64
 
         if name_invalid
+          # Preserve the original non-slug name as name_zh (display name) if not already set.
+          # e.g. name: "中英翻译" → name_zh = "中英翻译", name falls back to dir slug.
+          @name_zh ||= @name
+
           if valid_slug.call(dir_slug)
             # Recoverable: fall back to directory name, record a warning
             @warnings << "Invalid name '#{@name}' in metadata; using directory name '#{dir_slug}' instead."

data/lib/clacky/tools/invoke_skill.rb

@@ -77,6 +77,27 @@ module Clacky
         "InvokeSkill(#{skill})"
       end
 
+      # Format the tool result for the LLM.
+      # Converts the raw Hash into a markdown string so the LLM can directly
+      # read the subagent output without parsing a JSON wrapper. JSON-encoding
+      # the result as a nested string caused models to miss the "result" field
+      # and hallucinate that the subagent returned nothing.
+      # @param result [Hash, String] Tool execution result
+      # @return [String] LLM-friendly formatted result
+      def format_result_for_llm(result)
+        if result.is_a?(String)
+          result
+        elsif result[:error]
+          "Error: #{result[:error]}"
+        elsif result[:skill_type] == "subagent"
+          subagent_result = result[:result].to_s.strip
+          subagent_result = "(subagent produced no output)" if subagent_result.empty?
+          "Subagent executed successfully.\n\n#{subagent_result}"
+        else
+          "Skill content expanded"
+        end
+      end
+
       # Format the tool result for display
       # @param result [Hash] Tool execution result
       # @return [String] Formatted result summary

data/lib/clacky/tools/security.rb

@@ -19,17 +19,18 @@ module Clacky
     # Responsibilities (applied to the `command` string BEFORE it is handed
     # to a shell / PTY for execution):
     #
-    #   1. Block hard-dangerous commands:       sudo, pkill clacky, eval, exec,
+    #   1. Block hard-dangerous commands:       pkill clacky, eval, exec,
     #                                           `...`, | sh, | bash,
     #                                           redirect to /etc /usr /bin.
     #   2. Rewrite `curl ... | bash` → save     script to a file for manual
     #                                           review instead of exec.
-    #   3. Protect credential/secret files:     .env, .ssh/, .aws/ — block
+    #   3. Protect credential/secret files:     .ssh/, .aws/ — block
     #                                           writes to these only. Other
     #                                           "project" files (Gemfile,
-    #                                           README.md, package.json, …)
-    #                                           are NOT protected — editing
-    #                                           them is a normal dev task.
+    #                                           README.md, package.json,
+    #                                           .env, …) are NOT protected —
+    #                                           editing them is a normal dev
+    #                                           task.
     #
     # Note on `rm`:
     #   `rm` is NOT rewritten here — it's intercepted at runtime by a shell
@@ -135,7 +136,10 @@ module Clacky
           when /^curl.*\|\s*(sh|bash)/
             replace_curl_pipe_command(command)
           when /^sudo\s+/
-            block_sudo_command(command)
+            # sudo is allowed — the user is in control and takes responsibility.
+            # Still log it for audit trail.
+            log_warning("sudo command executed: #{command}")
+            command
           when />\s*\/dev\/null\s*$/
             allow_dev_null_redirect(command)
           when /^(mv|cp|mkdir|touch|echo)\s+/
@@ -175,10 +179,6 @@ module Clacky
           end
         end
 
-        def block_sudo_command(_command)
-          raise SecurityError, "sudo commands are not allowed for security reasons"
-        end
-
         def allow_dev_null_redirect(command)
           command
         end
@@ -273,8 +273,6 @@ module Clacky
         SECRET_WRITE_PATTERNS = [
           %r{(?:\A|/)\.ssh/},
           %r{(?:\A|/)\.aws/},
-          /(?:\A|\/)\.env(?:\.|\z)/,
-          /\.env\z/
         ].freeze
 
         def validate_secret_write(path)
@@ -319,7 +317,7 @@ module Clacky
         end
 
         private :replace_chmod_command,
-                :replace_curl_pipe_command, :block_sudo_command,
+                :replace_curl_pipe_command,
                 :allow_dev_null_redirect, :validate_and_allow,
                 :validate_general_command,
                 :validate_file_path, :validate_secret_write,

data/lib/clacky/ui_interface.rb

@@ -11,6 +11,8 @@ module Clacky
     # @param files   [Array<Hash>] extracted file refs: [{ name:, path:, inline: }]
     def show_assistant_message(content, files:); end
     def show_feedback_request(question, context, options); end
+    def show_subagent_start(skill: nil, iterations: nil, cost_usd: nil); end
+    def show_subagent_end; end
     def show_tool_call(name, args); end
     def show_tool_result(result); end
     def show_tool_stdout(lines); end

data/lib/clacky/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clacky
-  VERSION = "1.5.0"
+  VERSION = "1.5.2"
 end

data/lib/clacky/web/app.css

@@ -2173,6 +2173,40 @@ body {
   margin-top: -0.625rem;
   padding-left: 0.125rem;
 }
+
+/* ── Starter Prompts ── */
+.new-session-starter-prompts {
+  margin-top: 0.25rem;
+}
+.ns-starter-label {
+  font-size: 0.75rem;
+  color: var(--color-text-tertiary);
+  margin-bottom: 0.5rem;
+}
+.ns-starter-list {
+  display: flex;
+  flex-direction: column;
+  gap: 0.375rem;
+}
+.ns-starter-item {
+  display: block;
+  width: 100%;
+  text-align: left;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--color-border-primary);
+  border-radius: 0.5rem;
+  background: var(--color-bg-primary);
+  color: var(--color-text-secondary);
+  font-size: 0.8125rem;
+  line-height: 1.45;
+  cursor: pointer;
+  transition: border-color 0.14s, background-color 0.14s, color 0.14s;
+}
+.ns-starter-item:hover {
+  border-color: color-mix(in srgb, var(--color-accent-primary) 40%, var(--color-border-primary));
+  background: var(--color-bg-hover);
+  color: var(--color-text-primary);
+}
 .ns-panels-label {
   width: 100%;
   font-size: 0.75rem;
@@ -2637,7 +2671,6 @@ body {
 .session-banner { flex-shrink: 0; }
 .session-composer {
   flex-shrink: 0;
-  margin-bottom: -9px;
   display: flex;
   padding-inline: 24px;
 }
@@ -8967,10 +9000,11 @@ body.setup-mode[data-theme="dark"] {
   padding-top: 0.75rem;
   border-top: 1px solid var(--color-border-primary);
 }
-.badge-active    { color: var(--color-success); }
-.badge-expired   { color: var(--color-error); }
-.badge-expiring  { color: var(--color-warning); }
-.badge-inactive  { color: var(--color-text-secondary); }
+.badge-active       { color: var(--color-success); }
+.badge-expired      { color: var(--color-error); }
+.badge-expiring     { color: var(--color-warning); }
+.badge-unreachable  { color: var(--color-text-secondary); }
+.badge-inactive     { color: var(--color-text-secondary); }
 
 /* Support QR code */
 .brand-support-contact {
@@ -10908,6 +10942,19 @@ body.setup-mode[data-theme="dark"] {
   flex-wrap: wrap;
 }
 
+/* ── Disclaimer notice ──────────────────────────────────────────────── */
+.billing-disclaimer {
+  display: flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-size: 0.75rem;
+  color: var(--color-text-tertiary);
+  padding: 0.4rem 0.75rem;
+  background: var(--color-bg-secondary);
+  border: 1px solid var(--color-border-primary);
+  border-radius: 6px;
+}
+
 /* ── Period Button Group ─────────────────────────────────────────────── */
 .billing-period-group {
   display: flex;
@@ -11084,10 +11131,10 @@ body.setup-mode[data-theme="dark"] {
   justify-content: center;
   flex-shrink: 0;
 }
-.billing-stat-icon-cost     { background: color-mix(in srgb, #10b981 10%, transparent); color: #10b981; }
-.billing-stat-icon-tokens   { background: color-mix(in srgb, #3b82f6 10%, transparent); color: #3b82f6; }
+.billing-stat-icon-cost      { background: color-mix(in srgb, var(--color-accent-primary) 10%, transparent); color: var(--color-accent-primary); }
+.billing-stat-icon-tokens   { background: color-mix(in srgb, #2075ffbf 10%, transparent); color: #2075ffbf; }
 .billing-stat-icon-requests { background: color-mix(in srgb, #f59e0b 10%, transparent); color: #f59e0b; }
-.billing-stat-icon-cache    { background: color-mix(in srgb, var(--color-accent-primary) 10%, transparent); color: var(--color-accent-primary); }
+.billing-stat-icon-cache    { background: color-mix(in srgb, #10b981 10%, transparent); color: #10b981; }
 .billing-stat-icon svg {
   width: 18px;
   height: 18px;
@@ -11318,7 +11365,7 @@ body.setup-mode[data-theme="dark"] {
   align-items: stretch;
 }
 .billing-cache-hit {
-  background: #3b82f6;
+  background: #2075ffbf;
   width: 100%;
   border-radius: 2px 2px 0 0;
   transition: height 0.2s ease;
@@ -11346,7 +11393,7 @@ body.setup-mode[data-theme="dark"] {
 
 /* Legend colors — indigo + emerald */
 .billing-legend-total     { background: var(--color-accent-primary); }
-.billing-legend-cache-hit { background: #3b82f6; }
+.billing-legend-cache-hit { background: #2075ffbf; }
 .billing-legend-cache-miss{ background: #f59e0b; }
 .billing-legend-output    { background: #34d399; }
 
@@ -11397,7 +11444,7 @@ body.setup-mode[data-theme="dark"] {
   flex-shrink: 0;
 }
 .tooltip-total     { background: var(--color-accent-primary); }
-.tooltip-cache-hit { background: #3b82f6; }
+.tooltip-cache-hit { background: #2075ffbf; }
 .tooltip-cache-miss{ background: #f59e0b; }
 .tooltip-output    { background: #34d399; }.tooltip-label {
   flex: 1;
@@ -11472,7 +11519,7 @@ body.setup-mode[data-theme="dark"] {
   background: #34d399;
 }
 .billing-bar-cache-read {
-  background: #3b82f6;
+  background: #2075ffbf;
 }
 .billing-bar-cache-miss {
   background: #f59e0b;
@@ -11951,7 +11998,7 @@ body.setup-mode[data-theme="dark"] {
 }
 
 .swatch-indigo         { background: #4f46e5; }
-.swatch-aurora-blue    { background: #3B82F6; }
+.swatch-aurora-blue    { background: #2075ffbf; }
 .swatch-forest-green   { background: #10B981; }
 .swatch-sunrise-orange { background: #F59E0B; }
 .swatch-rose-violet    { background: #8B5CF6; }
@@ -12172,7 +12219,7 @@ body.setup-mode[data-theme="dark"] {
   color: var(--color-accent-primary);
 }
 .billing-cell-hit {
-  color: #3b82f6;
+  color: #2075ffbf;
 }
 .billing-cell-miss {
   color: #f59e0b;

data/lib/clacky/web/features/billing/view.js

@@ -152,6 +152,11 @@ const BillingView = (() => {
           </div>
         </div>
 
+        <div class="billing-disclaimer">
+          <svg width="13" height="13" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="8" cy="8" r="7" stroke="currentColor" stroke-width="1.4"/><path d="M8 7v4" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"/><circle cx="8" cy="5" r="0.7" fill="currentColor"/></svg>
+          ${I18n.t("billing.disclaimer")}
+        </div>
+
         <div class="billing-stats-row">
           <div class="billing-stat-card">
             <div class="billing-stat-icon billing-stat-icon-cost">

data/lib/clacky/web/features/extensions/store.js

@@ -158,7 +158,11 @@ const ExtensionsStore = (() => {
       try {
         const res  = await fetch("/api/store/extensions/brand");
         const data = await res.json();
-        _extensions = data.extensions || [];
+        const all  = data.extensions || [];
+        _extensions = _query
+          ? all.filter(e => [e.name, e.name_zh, e.description].some(
+              f => f && f.toLowerCase().includes(_query.toLowerCase())))
+          : all;
         _error      = data.warning || null;
         _loading    = false;
         _emit("extensions:changed", { extensions: _extensions, warning: _error });
@@ -181,7 +185,10 @@ const ExtensionsStore = (() => {
       _detailError   = null;
       _emit("extensions:detail");
       try {
-        const res  = await fetch("/api/store/extension?id=" + encodeURIComponent(id));
+        const url  = _filterBrand
+          ? "/api/store/extension?id=" + encodeURIComponent(id) + "&source=brand"
+          : "/api/store/extension?id=" + encodeURIComponent(id);
+        const res  = await fetch(url);
         const data = await res.json();
         if (res.ok && data.ok && data.extension) {
           _detail      = data.extension;