openclacky 1.5.13 → 1.5.14

data/lib/clacky/agent_config.rb

@@ -1161,7 +1161,7 @@ module Clacky
       # find_by_base_url only matches registered preset URLs, so localhost
       # and other non-openclacky endpoints correctly return nil.
       provider_id = Clacky::Providers.find_by_base_url(m["base_url"])
-      return nil unless provider_id == "openclacky"
+      return nil unless provider_id == Clacky::Providers::OPENCLACKY_ID
 
       fallback_url = Clacky::Providers.fallback_base_url(provider_id)
       return nil unless fallback_url

data/lib/clacky/billing/billing_store.rb

@@ -20,7 +20,7 @@ module Clacky
       # list never drifts from providers.rb as models are added or removed.
       def openclacky_models
         @openclacky_models ||= begin
-          preset = Clacky::Providers.get("openclacky")
+          preset = Clacky::Providers.get(Clacky::Providers::OPENCLACKY_ID)
           return [] unless preset
           OPENCLACKY_MODEL_KINDS.flat_map { |kind| preset[kind] || [] }.uniq
         end
@@ -30,7 +30,7 @@ module Clacky
       # carry an explicit provider id; legacy records (written before the
       # field existed) are detected by matching the full openclacky model list.
       def openclacky_record?(record)
-        return true if record.provider == "openclacky"
+        return true if record.provider == Clacky::Providers::OPENCLACKY_ID
         openclacky_models.include?(record.model.to_s)
       end
 

data/lib/clacky/billing/platform_billing.rb

@@ -17,9 +17,15 @@ module Clacky
       # "primary" id where the gateway can dispatch an alias two ways.
       ALIAS_TO_REAL = {
         # deepseek (dsk-)
+        "dsk-deepseek-flash"               => "deepseek-flash",
         "dsk-deepseek-v4-pro"              => "deepseek-v4-pro",
         "dsk-deepseek-v4-flash"            => "deepseek-v4-flash",
         "dsk-deepseek-v4-flash-vision-exp" => "deepseek-v4-flash-vision-exp",
+        # gpt via bedrock (abs-, OpenAI-compatible endpoint)
+        "abs-gpt-6-astra"  => "global.openai.gpt-6-astra",
+        "abs-gpt-5.6-sol"   => "global.openai.gpt-5.6-sol",
+        "abs-gpt-5.6-terra" => "global.openai.gpt-5.6-terra",
+        "abs-gpt-5.6-luna"  => "global.openai.gpt-5.6-luna",
         # claude via bedrock (abs-)
         "abs-claude-fable-5-1"  => "global.anthropic.claude-fable-5-1",
         "abs-claude-fable-5"    => "global.anthropic.claude-fable-5",

data/lib/clacky/brand_config.rb

@@ -53,7 +53,7 @@ module Clacky
     attr_reader :product_name, :package_name, :license_key, :license_activated_at,
                 :license_expires_at, :license_last_heartbeat, :device_id,
                 :logo_url, :support_contact, :license_user_id,
-                :support_qr_url, :theme_color, :homepage_url,
+                :support_qr_url, :theme_color,
                 :distribution_last_refreshed_at, :license_last_heartbeat_failure
 
     def initialize(attrs = {})
@@ -1649,6 +1649,17 @@ module Clacky
       # Non-fatal — metadata write failure should not break the upload flow
     end
 
+    # Vendors may configure a bare domain ("example.com"). Without a scheme the
+    # browser treats it as a relative path and resolves it against the local
+    # server, so normalize on read to cover every consumer at once.
+    def homepage_url
+      raw = @homepage_url.to_s.strip
+      return nil if raw.empty?
+      return raw if raw.match?(%r{\A[a-z][a-z0-9+.\-]*:}i)
+
+      "https://#{raw}"
+    end
+
     # Returns a hash representation for JSON serialization (e.g. /api/brand).
     def to_h
       {
@@ -1658,7 +1669,7 @@ module Clacky
         support_contact:    @support_contact,
         support_qr_url:     @support_qr_url,
         theme_color:        @theme_color,
-        homepage_url:       @homepage_url,
+        homepage_url:       homepage_url,
         branded:            branded?,
         activated:          activated?,
         expired:            expired?,

data/lib/clacky/cli.rb

@@ -345,6 +345,29 @@ module Clacky
         ui_controller.show_success("Switched to model: #{config.model_name}")
       end
 
+      # Handle the `/think` slash command — pick the reasoning effort level
+      # for the current session. "off" normalizes to nil (provider default),
+      # matching the Web UI's reasoning_effort switcher semantics.
+      private def handle_think_command(ui_controller, agent, session_manager = nil)
+        choice = ui_controller.show_reasoning_effort_menu(agent.reasoning_effort)
+        return if choice.nil?
+
+        agent.reasoning_effort = choice
+
+        # The override lives in the session file (not config.yml), so persist
+        # it now — otherwise it would be lost if the user quits before the
+        # next task.
+        session_manager&.save(agent.to_session_data(updated_at: Time.now))
+
+        # Reflect the change in the session bar (appended after the model name)
+        ui_controller.config[:reasoning_effort] = agent.reasoning_effort
+        ui_controller.update_sessionbar
+
+        current = agent.reasoning_effort
+        message = current ? "Thinking level set to #{current}" : "Thinking level: off (provider default)"
+        ui_controller.show_success(message)
+      end
+
       private def handle_time_machine_command(ui_controller, agent, session_manager)
         # Get task history from agent
         history = agent.get_task_history(limit: 10)
@@ -874,6 +897,7 @@ module Clacky
             working_dir: working_dir,
             mode: agent_config.permission_mode.to_s,
             model: agent_config.model_name,
+            reasoning_effort: agent.reasoning_effort,
             theme: theme_name
           )
         end
@@ -997,6 +1021,9 @@ module Clacky
           when "/model"
             handle_model_command(ui_controller, agent_config, agent, session_manager)
             next
+          when "/think"
+            handle_think_command(ui_controller, agent, session_manager)
+            next
           when "/undo"
             handle_time_machine_command(ui_controller, agent, session_manager)
             next

data/lib/clacky/client.rb

@@ -720,12 +720,12 @@ module Clacky
           conn.headers["x-api-key"]      = @api_key
           conn.headers["anthropic-version"] = "2023-06-01"
           conn.headers["anthropic-dangerous-direct-browser-access"] = "true"
-          if @provider_id == "openrouter"
+          if @provider_id == Clacky::Providers::OPENROUTER_ID
             conn.headers["Authorization"] = "Bearer #{@api_key}"
           end
           # Moonshot's Kimi Code (Coding Plan) endpoint enforces a User-Agent
           # prefix whitelist limited to first-party coding agents.
-          if @provider_id == "kimi-coding"
+          if @provider_id == Clacky::Providers::KIMI_CODING_ID
             conn.headers["User-Agent"] = "claude-cli/1.0.51 (external, cli)"
           end
           conn.options.timeout      = @read_timeout || 300

data/lib/clacky/default_extensions/ext-studio/agents/ext-developer/system_prompt.md

@@ -1,147 +1,83 @@
-You are Extension Developer, an AI expert who helps users build, debug, and (when they
-ask) publish OpenClacky extensions through conversation. You drive the whole workflow —
-scaffold, edit, verify, reload — so the user never has to memorize commands or file
-layouts.
-
-Your role is to:
-- Turn a plain-language idea ("I want an extension that shows the weather") into a
-  working extension by scaffolding it, wiring the right contributes, and iterating.
-- Read and edit extension files directly, then verify and hot-reload to confirm.
-- Debug using structured verify errors, fixing manifest and file issues.
-- Publish to the marketplace only when the user explicitly wants to share it.
+You are Extension Developer, an AI expert who helps users build, debug, and, only
+when requested, publish OpenClacky extensions through conversation.
 
 ## How you work
 
-The `ext-develop` skill holds the authoritative extension model, the contributes-type
-map, the verify error codes, the `Clacky.*` WebUI contract, the host APIs a panel can
-call, and the publish commands. It is your knowledge base; this prompt is only your
-behavior. Actively open the skill and read the relevant section at the start of any
-extension work — don't wait for it to surface on its own, and never work from memory when
-the skill has the answer. You own the flow and decide when each section applies:
-
-- **Scaffold** — when the user wants to start a new extension. Clarify the idea in one
-  question if it's ambiguous (what should it DO, and where — a panel, a skill, an agent,
-  a backend?), map it to the smallest set of contributes types, then `clacky ext new`.
-  Don't over-scope: most extensions are one panel + one handler, or one skill.
-- **Debug & verify** — when something is broken, `verify` reports errors, or a change
-  didn't take effect. `clacky ext verify` is your compiler; fix by error code until clean.
-- **Publish** — only when the user explicitly asks to share/ship it. Publishing is NOT a
-  required step; many extensions are built for the user's own use. Never publish on your
-  own initiative or as a "wrap up."
+First call `invoke_skill` for `ext-develop`, including for an approved repair. It owns
+the workflow and reference index; linked articles own interface contracts. Behavior-only
+discussion needs no API inventory. Read only the current decision's reference, reuse it
+while in context, and never rely on remembered fields, endpoints, or reload behavior.
 
-## Working discipline (never break these)
+Discuss the smallest behavior and wait for approval before scaffolding or editing. Before
+approval, call no tool after the skill. Unless internals are requested, send exactly four
+short sections in the user's language—Visible result, Will do, Won't do, Confirm (with at
+most one material choice)—and nothing else. Never include paths, files, commands, fields,
+mount points, APIs, code symbols, ids, frontend/backend (前端/后端), agent/智能体 types,
+parenthetical internal translations, implementation, or verification details.
+After approval, edit real files and verify relevant tests plus the actual result; manifest
+success alone is insufficient. Report missing evidence plainly.
 
-- **Know before you speak, not just before you code.** You are the expert who is supposed
-  to deeply understand OpenClacky extensions — that expertise comes from *looking things
-  up*, not from memory. Before you propose a design OR write a line of code, make sure you
-  actually have the facts: consult the `ext-develop` skill for the model and contracts,
-  and when a field name, event, adapter method, or WebUI/API detail is anything less than
-  certain, `web_fetch` the matching reference doc the skill points to. Never invent field
-  names, endpoints, or behavior from memory. When in doubt, look it up one more time — a
-  wasted lookup is cheap, a confidently wrong answer is not.
-- **Reuse the host before you build.** When a request touches sessions, file recovery
-  (trash), skills, memories, scheduled tasks, billing/usage, or media, assume the host may
-  already expose a ready-made API a panel can call — check the host-API reference the skill
-  points to before you invent a backend. Don't rebuild what the host already provides.
-- **Discuss the plan first, act only after the user agrees.** Every time, walk the user
-  through what you intend to do — what it is, where it lives, and what it will look like —
-  in plain words, and wait for a clear yes before you scaffold or edit anything. Never
-  quietly change files mid-conversation or scaffold before the user has signed off.
-- **Verify before you claim.** "It should work" is not "it works." Run `verify`, or have
-  the user reload and confirm, before you say something is done.
-
-## Talking to the user
+## Extension engineering rules
 
-Most users are not programmers. Talk to them like a helpful teammate, not a compiler.
-This applies to **everything** you say to them — proposing a plan, reporting what you
-changed, or explaining a bug and its fix. The moment you slip into raw code and API names
-is exactly the moment the user gets lost, and those "here's what I fixed" updates are
-where it happens most.
+These are requirements for every design and implementation, even when the skill or
+online documentation is unavailable. Do not defer them to a later documentation lookup.
 
-- **One language at a time.** In a Chinese conversation, speak Chinese; in an English one,
-  speak English. Don't sprinkle the other language's technical jargon through your
-  sentences. When a technical term is unavoidable, add a short plain-language gloss the
-  first time it appears (e.g. "a handler — the small backend file that answers requests").
-- **Translate the jargon.** Words like *contributes*, *slot*, *manifest*, *handler* mean
-  nothing to most users. Say what they DO: a panel is "a screen inside the app," a slot is
-  "a spot in the UI where your thing shows up," `ext.yml` is "the extension's settings
-  file."
-- **Report in outcomes, not code.** When you tell the user what you did or what broke,
-  describe it in terms of what they can SEE or what behavior changed — not the code you
-  touched. Keep symbol names (`ui.mount`, `container.appendChild`, `handler.rb`,
-  `sidebar.nav`), library names, and file internals out of your message unless the user is
-  clearly technical or explicitly asks. If a detail matters, say it in plain words.
-  - ❌ "Fixed it — the `saved city` branch had an early `return` so the DOM never mounted;
-    added `container.appendChild(root)`."
-  - ✅ "Found it — when a saved city was remembered, the panel built its content but never
-    showed it. Fixed, refresh and it'll appear."
-  - ❌ "Changed the architecture: frontend → own backend → Open-Meteo; added a `daily`
-    param to the handler."
-  - ✅ "Reworked it so weather still loads where the direct connection was blocked, and
-    added a 5-day forecast. Give it a refresh."
-- **Map vague locations to real mount points.** Users describe UI by rough position
-  ("put a button in the top-right", "add something to the left sidebar"). Internally,
-  translate that to the actual slot below and build against it — but when you talk to the
-  user, keep saying "top-right" or "middle of the left sidebar," not the slot name. The
-  host renders exactly these named slots:
+- **Security and scope.** Refuse credential theft or unauthorized private-data access/
+  export; never bypass host permissions or expose secrets in client code/logs. Limit file
+  and session access to the approved purpose. Destruction and private-data transfer need
+  explicit approval of data and destination. Read-only/no-file-change also forbids helper
+  files and scripts, including `/tmp`; a tool cache grants no write permission.
+- **Performance.** OpenClacky's host is single-process, so request volume is a safety
+  boundary: prefer events and cached reads, and never create unbounded polling, retries,
+  workers, or overlapping requests.
+- **Lifecycle.** Clean up listeners, timers, and requests across rerenders; hidden panels
+  may stay mounted, so use the documented visibility and unsubscribe behavior instead of
+  assuming a tab or session switch disposes them. Ignore stale async results, and never
+  replay external sends, destructive changes, or paid operations.
+- **Cost.** Model tasks and media generation/transcription can spend the user's money.
+  Require explicit approval for the action and any recurring scope before invoking them;
+  never trigger them merely by mounting, refreshing, or replaying a panel.
+- **Host integration.** Reuse host capabilities before adding a backend. Preserve
+  generated callback signatures/lifecycle wiring unless the matching reference says
+  otherwise. Reuse `btn-*`, `form-*`, `form-input`, `form-textarea`, `Clacky.Modal`, and
+  verified `var(--color-*)` names; omit unverified color overrides rather than inventing
+  tokens or fallbacks. Prefix tab ids/classes with the extension id, scope DOM/styles to
+  its mount, and store persistent data outside the package.
+- **Privileged changes and release.** Develop local extensions, never installed/builtin
+  packages or gem implementation source; version metadata is allowed. Hooks/patches,
+  scope expansion, service restarts, publication and removal each require an explicit
+  request, not general implementation approval.
+- **Missing contracts.** If the relevant reference does not verify an interface, report
+  the missing detail and stop. Do not infer the contract from other extensions or a
+  running host; ask for the reference or permission for the documented fallback.
+- **Browser scope.** Approval to implement or verify an extension does not authorize
+  browser control. Before browser calls, agree on the purpose and a new test/docs tab;
+  do not enumerate, reuse, navigate, or inspect existing tabs without specific consent.
+  If browser use is declined, leave UI verification to the user. Do not enable browser
+  access or substitute console probing for the approved documentation fallback.
 
-  | What the user might say            | Real slot            |
-  | ---------------------------------- | -------------------- |
-  | top bar, left / right              | `header.left` / `header.right` |
-  | left sidebar — top / middle / bottom | `sidebar.nav.top` / `sidebar.nav` / `sidebar.nav.bottom` |
-  | bottom of the left sidebar         | `sidebar.footer`     |
-  | the main area / a full page        | `main.workspace`     |
-  | a banner at the top of a chat      | `session.banner`     |
-  | near the message input box         | `session.composer`   |
-  | the right-hand panel of a chat     | `session.aside` (tabbed) |
-  | a settings tab / its body          | `settings.tabs` / `settings.body` |
+## Talking to the user
 
-  Mounting into any other name silently does nothing — always use one of these.
+Match the user's language. Lead updates, problems, and handoffs with the visible result
+or needed choice; keep tools and internals private unless asked. Be concise about what was
+found, changed, and remains to verify. Ask only when ambiguity changes the result, and do
+not turn “should work” into “works.” At handoff, follow the skill's refresh/aside flow,
+say what was actually verified, and apply the same nontechnical rewrite as before
+approval. Local completion does not imply publication.
 
-## Extension engineering rules
+## Evidence gate
 
-These are requirements, not suggestions. Hold the same engineering bar you would for the
-main product, and apply every rule below whenever you propose or write code:
+Before answering or using an interface, choose Verified or Unverified. Every reference
+lookup may fetch one matching official article and optionally search its cache once;
+then stop—no other search, cache read, terminal, fetch, or browser. A failed manual test
+does not relax this budget: afterward inspect only that extension, never another
+extension or the running host.
 
-- **Performance.** Keep the panel light and the UI responsive. Do NOT spin up extra
-  threads unless there is truly no other way — default to none. The real danger is request
-  volume: don't hammer the host with tight loops, sub-second polling, or requests that
-  never stop, and don't re-fetch the same data over and over — fetch once and cache what
-  you can. Polling is fine when there's genuinely no push channel for the data you need,
-  but keep the interval coarse (seconds, not milliseconds), prefer the host's events if
-  they exist, and stop polling when the panel is hidden or the work is done. Runaway
-  request volume can hit the host's limits, block its own request handling, and bring the
-  whole of OpenClacky down — treat this as a hard safety concern, not a nicety.
-- **Security.** Never help build a malicious extension. If a user asks for something that
-  steals or exfiltrates data — other people's API keys, credentials, private session
-  content, files outside the extension's scope — refuse plainly and explain why. Respect
-  the host's auth boundaries; an extension acts on behalf of its own user, nothing more.
-- **Cost.** Billing and usage endpoints cost the user real money. Call them only on an
-  explicit user action, never automatically and never in a loop.
-- **UI.** Default to the host's CSS classes - `btn-*` buttons, `form-*` inputs,
-  the `modal-*` dialog system, `Clacky.Modal.toast/confirm` feedback, and
-  `var(--color-*)` colors (raw hex breaks the dark theme) - so the extension
-  inherits the theme for free. Anything the host has no class for, build freely
-  with your own prefixed classes.
+- **Verified:** the article body or generated scaffold states the contract. Site chrome,
+  styles, and scripts are not extension examples. State only supported behavior/source.
+- **Unverified:** the reference is unavailable or omits the detail. End with the missing
+  detail, reference checked, and needed evidence/permission. Never repeat a declined
+  permission request; incomplete lookup is not proof of nonexistence.
 
-## Guidance
-- Prefer editing real files over describing what to do (once the user has agreed to the
-  plan). You are hands-on.
-- Never scaffold `patches` or `hooks` unless the user explicitly asks; they run arbitrary
-  Ruby and carry supply-chain risk.- After editing `view.js`, `handler.rb`, or a `SKILL.md`, tell the user to reload the
-  WebUI page — hot reload is per-request, no restart needed.
-- After you finish editing extension files, call this once at the very end to trigger
-  a reload button in the UI (if it doesn't appear, the user can manually refresh the browser):
-  ```
-  curl -s --noproxy '*' -X POST "http://${CLACKY_SERVER_HOST}:${CLACKY_SERVER_PORT}/api/ui/show_ext_refresh" \
-    -H "Content-Type: application/json" \
-    -d "{\"session_id\": \"${CLACKY_SESSION_ID}\"}"
-  ```
-  (`--noproxy '*'` prevents shell proxy env vars from silently intercepting this loopback call.)
-- If the extension contributes a `session.aside` panel, also call this right after the above
-  to open the panel automatically:
-  ```
-  curl -s --noproxy '*' -X POST "http://${CLACKY_SERVER_HOST}:${CLACKY_SERVER_PORT}/api/ui/open_aside" \
-    -H "Content-Type: application/json" \
-    -d "{\"session_id\": \"${CLACKY_SESSION_ID}\"}"
-  ```
+Say “I could not verify this method from this page; please provide its source,” never
+infer absent/private/unsupported. A blocked handoff beats invention or expanded scope.

data/lib/clacky/default_extensions/ext-studio/panels/studio/view.js

@@ -147,6 +147,7 @@
       "extlist.btn.disable": "Disable",
       "extlist.btn.enable": "Enable",
       "extlist.btn.delete": "Delete",
+      "extlist.btn.more": "More actions",
       "extlist.badge.disabled": "Disabled",
       "extlist.delete.confirm": "Delete local extension \"{{id}}\"? This cannot be undone.",
       "extlist.iterate.seed": "Iterate on extension {{id}}",
@@ -345,6 +346,7 @@
       "extlist.btn.disable": "禁止",
       "extlist.btn.enable": "启用",
       "extlist.btn.delete": "删除",
+      "extlist.btn.more": "更多操作",
       "extlist.badge.disabled": "已禁用",
       "extlist.delete.confirm": "确定要删除本地扩展「{{id}}」吗？此操作不可恢复。",
       "extlist.iterate.seed": "迭代扩展 {{id}}",
@@ -501,6 +503,76 @@
     return node;
   }
 
+  // ── Shared: overflow menu ──────────────────────────────────────────────
+  // Mirrors the session list's "⋯" menu so buttons collapsed on narrow screens
+  // stay reachable. Items proxy the real buttons rather than duplicating them,
+  // which keeps transient label/disabled state (e.g. "Packing…") in sync.
+  const OVERFLOW_ICON = `<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="2.5" cy="7" r="1.2" fill="currentColor"/><circle cx="7" cy="7" r="1.2" fill="currentColor"/><circle cx="11.5" cy="7" r="1.2" fill="currentColor"/></svg>`;
+
+  let overflowDismiss = null;
+  let overflowAnchor = null;
+
+  function closeOverflowMenu() {
+    if (overflowDismiss) {
+      document.removeEventListener("click", overflowDismiss, true);
+      overflowDismiss = null;
+    }
+    overflowAnchor = null;
+    const existing = document.querySelector(".studio-overflow-menu");
+    if (existing) existing.remove();
+  }
+
+  function openOverflowMenu(anchor, buttons) {
+    // Re-tapping the same "⋯" toggles; tapping a different card must switch to it
+    // rather than merely dismissing the menu that is already open.
+    if (overflowAnchor === anchor) { closeOverflowMenu(); return; }
+    closeOverflowMenu();
+    overflowAnchor = anchor;
+    const menu = el("div", { class: "session-actions-menu studio-overflow-menu" });
+    buttons.forEach((btn) => {
+      const item = el("div", { class: "session-actions-menu-item" }, [
+        el("span", { class: "session-actions-menu-label", text: btn.textContent }),
+      ]);
+      if (btn.classList.contains("studio-btn-danger")) item.classList.add("session-actions-menu-item--danger");
+      if (btn.disabled) {
+        item.classList.add("is-disabled");
+        const tip = btn.getAttribute("data-tooltip");
+        if (tip) item.setAttribute("data-tooltip", tip);
+      } else {
+        item.addEventListener("click", () => { closeOverflowMenu(); btn.click(); });
+      }
+      menu.appendChild(item);
+    });
+
+    // Take the menu out of normal flow before measuring: as a static block child
+    // of <body> it would stretch to the full body width, so mw would be the
+    // viewport width and the clamp below would fling the menu to the far edge.
+    menu.style.visibility = "hidden";
+    menu.style.position = "fixed";
+    menu.style.top = "0px";
+    menu.style.left = "0px";
+    document.body.appendChild(menu);
+    const rect = anchor.getBoundingClientRect();
+    const mw = menu.offsetWidth;
+    const mh = menu.offsetHeight;
+    let top = rect.bottom + 4;
+    let left = rect.left;
+    if (top + mh > window.innerHeight - 8) top = Math.max(8, rect.top - mh - 4);
+    if (left + mw > window.innerWidth - 8) left = Math.max(8, window.innerWidth - mw - 8);
+    menu.style.top = top + "px";
+    menu.style.left = left + "px";
+    menu.style.visibility = "";
+
+    // Capture phase runs before the anchor's own handler, so the anchor has to be
+    // excluded here or reopening would immediately close and reopen the menu.
+    overflowDismiss = (e) => {
+      const node = e.target instanceof Element ? e.target : null;
+      if (node && (node.closest(".studio-overflow-menu") || node.closest(".studio-actions-overflow"))) return;
+      closeOverflowMenu();
+    };
+    document.addEventListener("click", overflowDismiss, true);
+  }
+
   // ── Shared: modal dialog ───────────────────────────────────────────────
   // A minimal overlay modal used by the publish-confirm and device-binding
   // flows. Returns the body element so callers can drive it live (bind flow),
@@ -1636,7 +1708,7 @@
 
       if (typeof Brand !== "undefined" && Brand.userLicensed) {
         const brandEntry = brandCloud.find((c) => c.id === ext.id);
-        const brandPub = el("button", { class: "studio-btn", text: t("extlist.btn.publishBrand") });
+        const brandPub = el("button", { class: "studio-btn studio-btn-collapsible", text: t("extlist.btn.publishBrand") });
         brandPub.disabled = !!ext.error_count;
         if (ext.error_count) brandPub.setAttribute("data-tooltip", t("extlist.verify.errors", { n: ext.error_count }));
         brandPub.addEventListener("click", () => doPublish(ext, brandEntry ? brandEntry.version : null, "self"));
@@ -1644,12 +1716,12 @@
       }
 
       actions.appendChild(el("button", { class: "studio-btn", text: t("extlist.btn.iterate"), onclick: () => createExtension(t("extlist.iterate.seed", { id: ext.id })) }));
-      const packBtn = el("button", { class: "studio-btn studio-btn-ghost", text: t("extlist.btn.pack") });
+      const packBtn = el("button", { class: "studio-btn studio-btn-ghost studio-btn-collapsible", text: t("extlist.btn.pack") });
       packBtn.addEventListener("click", () => doPack(ext, packBtn));
       actions.appendChild(packBtn);
 
       const toggleBtn = el("button", {
-        class: "studio-btn studio-btn-ghost",
+        class: "studio-btn studio-btn-ghost studio-btn-collapsible",
         text: ext.disabled ? t("extlist.btn.enable") : t("extlist.btn.disable"),
       });
       toggleBtn.addEventListener("click", () => doToggleDisabled(ext, toggleBtn));
@@ -1657,10 +1729,18 @@
       card.appendChild(actions);
 
       if (!published) {
-        const delBtn = el("button", { class: "studio-btn studio-btn-danger", text: t("extlist.btn.delete") });
+        const delBtn = el("button", { class: "studio-btn studio-btn-danger studio-btn-collapsible", text: t("extlist.btn.delete") });
         delBtn.addEventListener("click", () => doDelete(ext, delBtn));
         actions.appendChild(delBtn);
       }
+
+      const overflow = el("button", { class: "studio-btn studio-actions-overflow", "aria-label": t("extlist.btn.more"), title: t("extlist.btn.more") });
+      overflow.innerHTML = OVERFLOW_ICON;
+      overflow.addEventListener("click", (e) => {
+        e.stopPropagation();
+        openOverflowMenu(overflow, Array.from(actions.querySelectorAll(".studio-btn-collapsible")));
+      });
+      actions.appendChild(overflow);
       return card;
     }
 
@@ -2041,7 +2121,7 @@
     .studio-detail-desc { margin: 4px 0 0; font-size: 12px; color: var(--color-text-secondary); line-height: 1.5; }
     .studio-units { display: flex; flex-wrap: wrap; gap: 6px; }
     .studio-unit-chip { display: inline-flex; background: var(--color-bg-hover); color: var(--color-text-primary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-sm); padding: 2px 8px; font-size: 12px; }
-    .studio-actions { display: flex; align-items: center; gap: 8px; margin: 12px 0 0; }
+    .studio-actions { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; margin: 12px 0 0; }
     .studio-skill-promo .studio-actions { margin: 12px 0 0; }
     .studio-btn { padding: 7px 14px; border-radius: var(--radius-sm); border: 1px solid var(--color-border-primary); background: transparent; color: var(--color-text-secondary); cursor: pointer; font-size: 13px; font-weight: 500; }
     .studio-btn:hover { background: var(--color-bg-hover); color: var(--color-text-primary); }
@@ -2150,6 +2230,12 @@
     .studio-readme-preview pre code, .extension-readme-body pre code { background: none; padding: 0; }
     .studio-link-btn { background: none; border: none; padding: 0; font-size: 12px; color: var(--color-accent-primary); cursor: pointer; text-decoration: underline; text-underline-offset: 2px; }
     .studio-link-btn:hover { color: var(--color-accent-hover); }
+    .studio-actions-overflow { display: none; align-items: center; justify-content: center; align-self: stretch; box-sizing: border-box; padding: 7px 12px; }
+    .studio-overflow-menu .session-actions-menu-item.is-disabled { opacity: 0.5; cursor: default; }
+    @media (max-width: 768px) {
+      .studio-actions > .studio-btn-collapsible { display: none; }
+      .studio-actions > .studio-actions-overflow { display: inline-flex; }
+    }
   `;
   document.head.appendChild(style);
 })();