openclacky 1.5.1 → 1.5.3

data/lib/clacky/server/http_server.rb

@@ -103,6 +103,15 @@ module Clacky
                      question: question, context: context, options: options }
       end
 
+      def show_subagent_start(skill: nil, iterations: nil, cost_usd: nil)
+        @events << { type: "subagent_start", session_id: @session_id,
+                     skill: skill, iterations: iterations, cost_usd: cost_usd }
+      end
+
+      def show_subagent_end
+        @events << { type: "subagent_end", session_id: @session_id }
+      end
+
       # Ignore all other UI methods (progress, errors, etc.) during history replay
       def method_missing(name, *args, **kwargs); end
       def respond_to_missing?(name, include_private = false); true; end
@@ -2267,19 +2276,23 @@ module Clacky
 
         Clacky::Logger.debug("[Brand] api_brand_status: expired=#{brand.expired?} grace_exceeded=#{brand.grace_period_exceeded?} expires_at=#{brand.license_expires_at&.iso8601 || "nil"}")
 
-        warning = nil
+        warning      = nil
+        warning_type = nil
         if brand.expired?
-          warning = "Your #{brand.product_name} license has expired. Please renew to continue."
+          warning      = "Your #{brand.product_name} license has expired. Please renew to continue."
+          warning_type = "expired"
         elsif brand.grace_period_exceeded?
-          warning = "License server unreachable for more than 3 days. Please check your connection."
+          warning      = "License server unreachable for more than 3 days. Please check your connection."
+          warning_type = "unreachable"
         elsif brand.license_expires_at && !brand.expired?
           days_remaining = ((brand.license_expires_at - Time.now.utc) / 86_400).ceil
           if days_remaining <= 7
-            warning = "Your #{brand.product_name} license expires in #{days_remaining} day#{"s" if days_remaining != 1}. Please renew soon."
+            warning      = "Your #{brand.product_name} license expires in #{days_remaining} day#{"s" if days_remaining != 1}. Please renew soon."
+            warning_type = "expiring"
           end
         end
 
-        Clacky::Logger.debug("[Brand] api_brand_status: warning=#{warning.inspect}")
+        Clacky::Logger.debug("[Brand] api_brand_status: warning=#{warning.inspect} warning_type=#{warning_type.inspect}")
 
         json_response(res, 200, {
           branded:          true,
@@ -2288,6 +2301,7 @@ module Clacky
           homepage_url:     brand.homepage_url,
           logo_url:         brand.logo_url,
           warning:          warning,
+          warning_type:     warning_type,
           test_mode:        @brand_test,
           user_licensed:    brand.user_licensed?,
           license_user_id:  brand.license_user_id
@@ -2478,11 +2492,11 @@ module Clacky
             "origin"            => market ? (market["origin"] || container[:origin]) : container[:origin],
             "hub_active"        => market&.dig("hub_active"),
             "download_count"    => market&.dig("download_count").to_i,
-            # Only mark as unlisted when the extension was published to the
-            # marketplace (origin != "self") but is no longer listed there.
-            # Self-authored extensions (origin: self) have never been published
-            # and should never show the "unlisted" badge.
-            "unlisted"          => market.nil? && container[:origin].to_s != "self",
+            # Mark as unlisted when:
+            # - market is nil (extension no longer exists on the platform), OR
+            # - platform batch API explicitly returned unlisted:true (brand-private
+            #   extension removed from all distributions but not yet soft-deleted).
+            "unlisted"          => market.nil? || market["unlisted"] == true,
             "layer"             => container[:layer].to_s,
             "installed"         => true,
             "removable"         => true,
@@ -2541,10 +2555,11 @@ module Clacky
         units
       end
 
-      # GET /api/store/extension?id=<slug-or-id>
+      # GET /api/store/extension?id=<slug-or-id>[&source=brand]
       #
-      # Public detail for a single marketplace extension (contributes + version
-      # history). Anonymous, proxies BrandConfig#extension_detail!.
+      # Detail for a single extension. Pass source=brand to query brand-private
+      # extensions via the license-gated API; omit (or any other value) for the
+      # public marketplace API.
       def api_store_extension_detail(req, res)
         id = req.query["id"].to_s
         if id.strip.empty?
@@ -2553,13 +2568,10 @@ module Clacky
         end
 
         brand  = Clacky::BrandConfig.load
-        # Always try the public endpoint first — it covers all marketplace
-        # extensions regardless of brand status. Only fall back to the
-        # license-gated brand endpoint when the public lookup fails (e.g. for
-        # origin=self brand-private extensions not exposed on the public API).
-        result = brand.extension_detail!(id)
-        if !result[:success] && brand.activated?
-          result = brand.brand_extension_detail!(id)
+        result = if req.query["source"] == "brand"
+          brand.brand_extension_detail!(id)
+        else
+          brand.extension_detail!(id)
         end
 
         if result[:success] && result[:extension]
@@ -2570,7 +2582,7 @@ module Clacky
             "installed"         => !container.nil?,
             "installed_version" => container&.dig(:version),
             "removable"         => container && container[:layer] == :installed,
-            "disabled"          => container ? container[:disabled] == true : false
+            "disabled"          => container ? container[:disabled] == true : false,
           )
           json_response(res, 200, { ok: true, extension: ext })
         else
@@ -2597,9 +2609,7 @@ module Clacky
               "homepage"          => market ? (market["homepage"] || "") : container[:homepage].to_s,
               "origin"            => market ? (market["origin"] || container[:origin]) : container[:origin],
               "hub_active"        => market&.dig("hub_active"),
-              # Only mark as unlisted when the extension was published to the
-              # marketplace (origin != "self") but is no longer listed there.
-              "unlisted"          => market.nil? && container[:origin].to_s != "self",
+              "unlisted"          => market.nil? || market["unlisted"] == true,
               "installed"         => true,
               "removable"         => true,
               "disabled"          => container[:disabled] == true,
@@ -3773,9 +3783,10 @@ module Clacky
 
       # POST /api/file-action
       # Unified file action endpoint — open locally or download.
-      # Body: { path: String, action: "open" | "download" }
+      # Body: { path: String, action: "open" | "download" | "save" }
       #   open:     opens the file with the OS default handler (local deployments).
       #   download: returns the file as a download (remote deployments).
+      #   save:     writes content back to the file. Body must include { content: String }.
       def api_file_action(req, res)
         body = parse_json_body(req)
         path = body["path"]
@@ -3789,7 +3800,10 @@ module Clacky
         linux_path = Utils::EnvironmentDetector.win_to_linux_path(path)
         linux_path = File.expand_path(linux_path)
 
-        return json_response(res, 404, { error: "file not found" }) unless File.exist?(linux_path)
+        # For save action, the file may not exist yet — skip the existence check.
+        unless action == "save"
+          return json_response(res, 404, { error: "file not found" }) unless File.exist?(linux_path)
+        end
 
         case action
         when "open"
@@ -3804,8 +3818,14 @@ module Clacky
         when "display-path"
           display = Utils::EnvironmentDetector.linux_to_win_path(linux_path)
           json_response(res, 200, { ok: true, path: display })
+        when "save"
+          content = body["content"]
+          return json_response(res, 400, { error: "content is required" }) if content.nil?
+          FileUtils.mkdir_p(File.dirname(linux_path))
+          File.write(linux_path, content, encoding: "UTF-8")
+          json_response(res, 200, { ok: true })
         else
-          json_response(res, 400, { error: "invalid action. Must be 'open', 'reveal', 'download' or 'display-path'" })
+          json_response(res, 400, { error: "invalid action. Must be 'open', 'reveal', 'download', 'display-path' or 'save'" })
         end
       rescue => e
         json_response(res, 500, { ok: false, error: e.message })
@@ -5398,6 +5418,7 @@ module Clacky
             base_url:         m["base_url"],
             api_key_masked:   mask_api_key(m["api_key"]),
             anthropic_format: m["anthropic_format"] || false,
+            provider_id:      m["provider_id"],
             type:             m["type"]
           }
         end
@@ -5606,7 +5627,8 @@ module Clacky
           "model"            => model,
           "base_url"         => base_url,
           "api_key"          => api_key,
-          "anthropic_format" => body["anthropic_format"] || false
+          "anthropic_format" => body["anthropic_format"] || false,
+          "provider_id"      => body["provider_id"].to_s.strip.then { |v| v.empty? ? nil : v }
         }
         type = body["type"].to_s
         unless type.empty?
@@ -5667,6 +5689,14 @@ module Clacky
         if body.key?("anthropic_format")
           target["anthropic_format"] = !!body["anthropic_format"]
         end
+        if body.key?("provider_id")
+          v = body["provider_id"].to_s.strip
+          if v.empty?
+            target.delete("provider_id")
+          else
+            target["provider_id"] = v
+          end
+        end
         if body.key?("api_key")
           new_key = body["api_key"].to_s
           # Only store a real, unmasked, non-empty value. This is the
@@ -5973,7 +6003,9 @@ module Clacky
 
         if model_name && !model_name.empty?
           info = agent.current_model_info
-          provider_id = info && Clacky::Providers.find_by_base_url(info[:base_url])
+          # Prefer explicitly saved provider_id, fall back to base_url lookup
+          provider_id = info&.dig(:provider_id).to_s.strip.then { |v| v.empty? ? nil : v }
+          provider_id ||= (info && Clacky::Providers.find_by_base_url(info[:base_url]))
           allowed = provider_id ? Clacky::Providers.models(provider_id) : []
           if allowed.empty?
             return json_response(res, 400, { error: "Current model has no provider preset; sub-model switching unavailable" })

data/lib/clacky/server/session_registry.rb

@@ -376,8 +376,10 @@ module Clacky
       # in any preset (e.g. self-hosted custom endpoints) — the WebUI
       # treats that as "no sub-model switcher available".
       private def sub_model_options_for(model_info)
-        return [] unless model_info && model_info[:base_url]
-        provider_id = Clacky::Providers.find_by_base_url(model_info[:base_url])
+        return [] unless model_info
+        # Prefer explicitly saved provider_id, fall back to base_url lookup
+        provider_id = model_info[:provider_id].to_s.strip.then { |v| v.empty? ? nil : v }
+        provider_id ||= (model_info[:base_url] && Clacky::Providers.find_by_base_url(model_info[:base_url]))
         return [] unless provider_id
         Clacky::Providers.models(provider_id)
       end

data/lib/clacky/skill.rb

@@ -537,6 +537,10 @@ module Clacky
         name_invalid = !valid_slug.call(@name) || @name.length > 64
 
         if name_invalid
+          # Preserve the original non-slug name as name_zh (display name) if not already set.
+          # e.g. name: "中英翻译" → name_zh = "中英翻译", name falls back to dir slug.
+          @name_zh ||= @name
+
           if valid_slug.call(dir_slug)
             # Recoverable: fall back to directory name, record a warning
             @warnings << "Invalid name '#{@name}' in metadata; using directory name '#{dir_slug}' instead."

data/lib/clacky/tools/invoke_skill.rb

@@ -77,6 +77,27 @@ module Clacky
         "InvokeSkill(#{skill})"
       end
 
+      # Format the tool result for the LLM.
+      # Converts the raw Hash into a markdown string so the LLM can directly
+      # read the subagent output without parsing a JSON wrapper. JSON-encoding
+      # the result as a nested string caused models to miss the "result" field
+      # and hallucinate that the subagent returned nothing.
+      # @param result [Hash, String] Tool execution result
+      # @return [String] LLM-friendly formatted result
+      def format_result_for_llm(result)
+        if result.is_a?(String)
+          result
+        elsif result[:error]
+          "Error: #{result[:error]}"
+        elsif result[:skill_type] == "subagent"
+          subagent_result = result[:result].to_s.strip
+          subagent_result = "(subagent produced no output)" if subagent_result.empty?
+          "Subagent executed successfully.\n\n#{subagent_result}"
+        else
+          "Skill content expanded"
+        end
+      end
+
       # Format the tool result for display
       # @param result [Hash] Tool execution result
       # @return [String] Formatted result summary

data/lib/clacky/tools/security.rb

@@ -19,17 +19,18 @@ module Clacky
     # Responsibilities (applied to the `command` string BEFORE it is handed
     # to a shell / PTY for execution):
     #
-    #   1. Block hard-dangerous commands:       sudo, pkill clacky, eval, exec,
+    #   1. Block hard-dangerous commands:       pkill clacky, eval, exec,
     #                                           `...`, | sh, | bash,
     #                                           redirect to /etc /usr /bin.
     #   2. Rewrite `curl ... | bash` → save     script to a file for manual
     #                                           review instead of exec.
-    #   3. Protect credential/secret files:     .env, .ssh/, .aws/ — block
+    #   3. Protect credential/secret files:     .ssh/, .aws/ — block
     #                                           writes to these only. Other
     #                                           "project" files (Gemfile,
-    #                                           README.md, package.json, …)
-    #                                           are NOT protected — editing
-    #                                           them is a normal dev task.
+    #                                           README.md, package.json,
+    #                                           .env, …) are NOT protected —
+    #                                           editing them is a normal dev
+    #                                           task.
     #
     # Note on `rm`:
     #   `rm` is NOT rewritten here — it's intercepted at runtime by a shell
@@ -135,7 +136,10 @@ module Clacky
           when /^curl.*\|\s*(sh|bash)/
             replace_curl_pipe_command(command)
           when /^sudo\s+/
-            block_sudo_command(command)
+            # sudo is allowed — the user is in control and takes responsibility.
+            # Still log it for audit trail.
+            log_warning("sudo command executed: #{command}")
+            command
           when />\s*\/dev\/null\s*$/
             allow_dev_null_redirect(command)
           when /^(mv|cp|mkdir|touch|echo)\s+/
@@ -175,10 +179,6 @@ module Clacky
           end
         end
 
-        def block_sudo_command(_command)
-          raise SecurityError, "sudo commands are not allowed for security reasons"
-        end
-
         def allow_dev_null_redirect(command)
           command
         end
@@ -273,8 +273,6 @@ module Clacky
         SECRET_WRITE_PATTERNS = [
           %r{(?:\A|/)\.ssh/},
           %r{(?:\A|/)\.aws/},
-          /(?:\A|\/)\.env(?:\.|\z)/,
-          /\.env\z/
         ].freeze
 
         def validate_secret_write(path)
@@ -319,7 +317,7 @@ module Clacky
         end
 
         private :replace_chmod_command,
-                :replace_curl_pipe_command, :block_sudo_command,
+                :replace_curl_pipe_command,
                 :allow_dev_null_redirect, :validate_and_allow,
                 :validate_general_command,
                 :validate_file_path, :validate_secret_write,

data/lib/clacky/ui_interface.rb

@@ -11,6 +11,8 @@ module Clacky
     # @param files   [Array<Hash>] extracted file refs: [{ name:, path:, inline: }]
     def show_assistant_message(content, files:); end
     def show_feedback_request(question, context, options); end
+    def show_subagent_start(skill: nil, iterations: nil, cost_usd: nil); end
+    def show_subagent_end; end
     def show_tool_call(name, args); end
     def show_tool_result(result); end
     def show_tool_stdout(lines); end

data/lib/clacky/utils/model_pricing.rb

@@ -472,6 +472,12 @@ module Clacky
       # endpoints don't charge separately for cache writes (Z.ai's page lists
       # "Cached Input Storage: Limited-time Free"), so bill writes at the
       # regular input miss rate for safe "displayed ≤ actual" behaviour.
+      "glm-5.2" => {
+        input:  { default: 1.40, over_200k: 1.40 },
+        output: { default: 4.40, over_200k: 4.40 },
+        cache:  { write: 1.40, read: 0.26 }
+      },
+
       "glm-5.1" => {
         input:  { default: 1.40, over_200k: 1.40 },
         output: { default: 4.40, over_200k: 4.40 },
@@ -786,6 +792,8 @@ module Clacky
         # (mainland bigmodel.cn vs intl z.ai) the user configured.
         # Strict anchored match so unrelated strings like "glm-5-x-foo"
         # don't silently borrow a nearby model's rate.
+        when /^glm-5\.2$/i
+          "glm-5.2"
         when /^glm-5\.1$/i
           "glm-5.1"
         when /^glm-5v-turbo$/i

data/lib/clacky/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clacky
-  VERSION = "1.5.1"
+  VERSION = "1.5.3"
 end