openclacky 1.5.21 → 1.5.22

data/lib/clacky/default_extensions/preview/panels/preview/view.js

@@ -8,12 +8,15 @@
 // chat stream calls Clacky.Preview.open(), which opens the aside, activates
 // this tab and (re)loads the page.
 //
-// Host-origin pages (proxied workspace files and proxied dev servers) are
-// sandboxed WITHOUT allow-same-origin so AI-generated pages can run
-// scripts/forms/popups but never touch the host origin (cookies, localStorage,
-// DOM). Third-party URLs loaded directly (e.g. a Vite dev server) get
-// allow-same-origin added, otherwise their ES-module imports fail and the
-// frame stays blank. Because the sandbox hides load errors, the panel HEADs
+// Proxied pages (workspace files and dev servers) are served from
+// `preview.localhost` instead of the host origin: same server, different
+// origin. That keeps them unable to read the host's cookies, localStorage or
+// DOM while still giving them a real (non-opaque) origin — an opaque origin
+// turns every <script type="module"> into a CORS request that fails, and makes
+// localStorage/sessionStorage/cookie throw SecurityError, so any framework
+// (Rails+Stimulus, Turbo, React) would render but never become interactive.
+// Third-party URLs are loaded directly and only get allow-same-origin when
+// they are cross-origin. Because the sandbox hides load errors, the panel HEADs
 // the URL first and shows a friendly 404 card instead of a blank frame.
 // ───────────────────────────────────────────────────────────────────────────
 
@@ -21,7 +24,13 @@
   if (!window.Clacky || !Clacky.ext) return;
 
   const PREVIEW_ASIDE_WIDTH = 620;
+  // Chrome resolves every *.localhost name to loopback, so the preview proxy
+  // is reachable under a second origin without a second listener.
+  const ISOLATED_PREVIEW_HOST = "preview.localhost";
   const SANDBOX = "allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-modals";
+  const ZOOM_MIN = 50;
+  const ZOOM_MAX = 200;
+  const ZOOM_STEP = 10;
 
   const ICON_GLOBE = '<svg viewBox="0 0 24 24" width="40" height="40" fill="none" stroke="currentColor" stroke-width="1.2"><circle cx="12" cy="12" r="9"/><path d="M3 12h18"/><path d="M12 3a15 15 0 0 1 0 18M12 3a15 15 0 0 0 0 18"/></svg>';
   const ICON_BACK = '<svg viewBox="0 0 24 24" width="15" height="15" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M19 12H5"/><path d="M12 19l-7-7 7-7"/></svg>';
@@ -29,6 +38,8 @@
   const ICON_RELOAD = '<svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12a9 9 0 1 1-2.64-6.36L21 8"/><path d="M21 3v5h-5"/></svg>';
   const ICON_GO = '<svg viewBox="0 0 24 24" width="13" height="13" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14"/><path d="M12 5l7 7-7 7"/></svg>';
   const ICON_EXTERNAL = '<svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><path d="M15 3h6v6"/><path d="M10 14L21 3"/></svg>';
+  const ICON_MORE = '<svg viewBox="0 0 24 24" width="16" height="16" fill="currentColor"><circle cx="12" cy="5" r="1.7"/><circle cx="12" cy="12" r="1.7"/><circle cx="12" cy="19" r="1.7"/></svg>';
+  const ICON_ZOOM_RESET = '<svg viewBox="0 0 24 24" width="13" height="13" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 12a9 9 0 1 0 3-6.7"/><path d="M3 4v5h5"/></svg>';
 
   const t = (k, fallback) => {
     const v = (typeof I18n !== "undefined") ? I18n.t(k) : null;
@@ -54,20 +65,30 @@
     style.id = "preview-panel-style";
     style.textContent = `
       .preview-root { display: flex; flex-direction: column; flex: 1; min-height: 0; }
-      .preview-bar { flex: none; display: flex; align-items: center; gap: 4px; padding: 6px 8px; border-bottom: 1px solid var(--color-border-secondary); }
-      .preview-nav-btn { flex: none; display: inline-flex; align-items: center; justify-content: center; width: 26px; height: 26px; border: none; border-radius: var(--radius-sm); background: transparent; color: var(--color-text-tertiary); cursor: pointer; }
+      .preview-bar { flex: none; position: relative; z-index: 10; display: flex; align-items: center; gap: 2px; padding: 7px 8px; border-bottom: 1px solid var(--color-border-secondary); }
+      .preview-nav-btn { flex: none; display: inline-flex; align-items: center; justify-content: center; width: 28px; height: 28px; border: none; border-radius: 50%; background: transparent; color: var(--color-text-secondary); cursor: pointer; transition: background var(--transition-fast), color var(--transition-fast); }
       .preview-nav-btn:hover:not(:disabled) { background: var(--color-bg-hover); color: var(--color-text-primary); }
-      .preview-nav-btn:disabled { opacity: .35; cursor: default; }
-      .preview-address-wrap { flex: 1; min-width: 0; position: relative; display: flex; align-items: center; }
-      .preview-address { width: 100%; height: 27px; padding: 0 32px 0 14px; border: none; border-radius: 14px; background: var(--color-bg-secondary); color: var(--color-text-primary); font-size: 12px; font-family: ui-monospace, monospace; text-align: center; transition: box-shadow var(--transition-fast), background var(--transition-fast); }
+      .preview-nav-btn:disabled { opacity: .3; cursor: default; }
+      .preview-address-wrap { flex: 1; min-width: 0; position: relative; display: flex; align-items: center; margin: 0 6px; }
+      .preview-address { width: 100%; height: 30px; padding: 0 30px 0 16px; border: 1px solid transparent; border-radius: var(--radius-pill); background: var(--color-bg-primary); color: var(--color-text-primary); font-size: 12px; font-family: ui-monospace, monospace; text-align: center; transition: background var(--transition-fast), box-shadow var(--transition-fast), border-color var(--transition-fast); }
       .preview-address::placeholder { color: var(--color-text-tertiary); font-family: -apple-system, sans-serif; }
-      .preview-address:hover:not(:focus) { box-shadow: 0 0 0 1px var(--color-border-strong); }
-      .preview-address:focus { outline: none; box-shadow: 0 0 0 1px var(--color-accent-primary); background: var(--color-bg-primary); }
-      .preview-go { position: absolute; right: 5px; display: inline-flex; align-items: center; justify-content: center; width: 20px; height: 20px; padding: 0; border: none; border-radius: 50%; background: transparent; color: var(--color-text-tertiary); cursor: pointer; }
+      .preview-address:hover:not(:focus) { background: var(--color-bg-hover); }
+      .preview-address:focus { outline: none; background: var(--color-bg-secondary); border-color: var(--color-border-strong); box-shadow: var(--shadow-sm); }
+      .preview-go { position: absolute; right: 6px; display: inline-flex; align-items: center; justify-content: center; width: 20px; height: 20px; padding: 0; border: none; border-radius: 50%; background: transparent; color: var(--color-text-tertiary); cursor: pointer; }
       .preview-go:hover { background: var(--color-bg-hover); color: var(--color-text-primary); }
-      .preview-icon-btn { flex: none; display: inline-flex; align-items: center; justify-content: center; width: 26px; height: 26px; border: none; border-radius: var(--radius-sm); background: transparent; color: var(--color-text-tertiary); cursor: pointer; }
+      .preview-icon-btn { flex: none; display: inline-flex; align-items: center; justify-content: center; width: 28px; height: 28px; border: none; border-radius: 50%; background: transparent; color: var(--color-text-secondary); cursor: pointer; transition: background var(--transition-fast), color var(--transition-fast); }
       .preview-icon-btn:hover { background: var(--color-bg-hover); color: var(--color-text-primary); }
-      .preview-frame-wrap { flex: 1; min-height: 0; overflow: hidden; }
+      .preview-menu { position: absolute; top: calc(100% - 2px); right: 10px; z-index: 20; width: 236px; padding: 5px; background: var(--color-bg-secondary); border: 1px solid var(--color-border-primary); border-radius: var(--radius-md); box-shadow: var(--shadow-lg); }
+      .preview-menu[hidden] { display: none; }
+      .preview-menu-label { flex: 1; }
+      .preview-menu-row { display: flex; align-items: center; justify-content: space-between; gap: 8px; padding: 3px 6px 3px 10px; font-size: 12.5px; color: var(--color-text-primary); }
+      .preview-zoom { display: flex; align-items: center; gap: 1px; padding: 1px; border-radius: var(--radius-pill); background: var(--color-bg-hover); }
+      .preview-zoom-btn { display: inline-flex; align-items: center; justify-content: center; width: 22px; height: 22px; padding: 0; border: none; border-radius: 50%; background: transparent; color: var(--color-text-secondary); font-size: 13px; line-height: 1; cursor: pointer; }
+      .preview-zoom-btn:hover:not(:disabled) { background: var(--color-bg-secondary); color: var(--color-text-primary); }
+      .preview-zoom-btn:disabled { opacity: .35; cursor: default; }
+      .preview-zoom-value { min-width: 46px; height: 22px; padding: 0 4px; border: none; border-radius: var(--radius-pill); background: transparent; color: var(--color-text-primary); font-size: 11.5px; font-variant-numeric: tabular-nums; cursor: pointer; }
+      .preview-zoom-value:hover { background: var(--color-bg-secondary); }
+      .preview-frame-wrap { flex: 1; min-height: 0; overflow: auto; }
       .preview-frame { display: block; width: 100%; height: 100%; border: none; background: #fff; }
       .preview-empty, .preview-notfound { flex: 1; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 8px; padding: 24px; text-align: center; }
       .preview-empty-icon { color: var(--color-text-tertiary); opacity: .5; margin-bottom: 4px; }
@@ -91,6 +112,7 @@
   let forwardStack = [];        // rels reachable via forward, newest → oldest
   let pending = null;           // { sid, rel } arrived before that body rendered
   let releaseAsideWidth = null; // set while the aside is widened for the preview
+  let zoom = 100;               // preview zoom, in percent; survives tab re-renders
 
   function isExternal(rel) {
     return /^https?:\/\//i.test(rel);
@@ -197,21 +219,39 @@
     els.forwardBtn.disabled = forwardStack.length === 0;
   }
 
-  // Follows in-frame navigation. A sandboxed frame without allow-same-origin
-  // cannot be inspected: contentWindow.location is sealed and the src property
-  // does not follow internal navigations. Instead the server injects a
-  // reporter into every preview HTML page that announces its URL on load, so
-  // link clicks inside the frame keep the address bar and the back/forward
-  // stacks in sync with what is actually on screen.
+  // Follows in-frame navigation. The frame is cross-origin to the host page,
+  // so contentWindow.location is unreadable and the src property does not
+  // follow internal navigations. Instead the server injects a reporter into
+  // every preview HTML page that announces its URL whenever it changes, so
+  // link clicks and SPA/Turbo transitions keep the address bar and the
+  // back/forward stacks in sync with what is actually on screen.
   function relFromUrl(url) {
     try {
       const u = new URL(url, location.href);
-      const m = u.pathname.match(/^\/preview\/s\/[^/]+\/(.*)$/);
-      if (!m || !m[1]) return null;
-      return m[1].split("/").map(decodeURIComponent).join("/");
+
+      const file = u.pathname.match(/^\/preview\/f(\/.*)$/);
+      if (file) return file[1].split("/").map(decodeURIComponent).join("/");
+
+      const dev = u.pathname.match(/^\/preview\/p\/(\d+)(\/.*)?$/);
+      if (dev) return `http://${devHostFor(dev[1])}:${dev[1]}${dev[2] || "/"}${u.search}`;
+
+      const ws = u.pathname.match(/^\/preview\/s\/([^/]+)\/(.*)$/);
+      if (!ws || !ws[2]) return null;
+      if (activeSessionId && ws[1] !== encodeURIComponent(activeSessionId)) return null;
+      return ws[2].split("/").map(decodeURIComponent).join("/");
     } catch (_e) { return null; }
   }
 
+  // A dev server is reachable as either localhost or 127.0.0.1; keep whichever
+  // the address bar was already showing so the URL doesn't flip on every click.
+  function devHostFor(port) {
+    try {
+      const u = new URL(currentRel);
+      if (u.port === String(port) && u.hostname) return u.hostname;
+    } catch (_e) { /* currentRel is a workspace path */ }
+    return "localhost";
+  }
+
   if (!window.__clackyPreviewNav) {
     window.__clackyPreviewNav = true;
     window.addEventListener("message", (e) => {
@@ -231,17 +271,69 @@
   // A brand-new element is the only reload primitive that works uniformly:
   // re-assigning an identical src is a no-op, and contentWindow is sealed by
   // the sandbox.
-  function freshFrame(url, opaque) {
-    const sandbox = opaque ? SANDBOX : (SANDBOX + " allow-same-origin");
+  function freshFrame(url, isolated) {
+    const src = isolated ? isolateOrigin(url) : url;
     const f = el("iframe", {
       class: "preview-frame",
-      sandbox: sandbox,
+      sandbox: sandboxFor(src),
       referrerpolicy: "no-referrer",
       title: t("preview.tab", "预览"),
     });
     els.frame.replaceChildren(f);
     els.iframe = f;
-    f.src = url;
+    applyZoom();
+    f.src = src;
+  }
+
+  // Swaps the loopback host for `preview.localhost`, keeping port and path so
+  // the same server answers. Non-loopback hosts (a remote clacky UI) have no
+  // second name to use and are left alone.
+  function isolateOrigin(url) {
+    try {
+      const u = new URL(url, location.href);
+      if (!isLoopbackHost(location.hostname) || !isLoopbackHost(u.hostname)) return url;
+      if (u.hostname === ISOLATED_PREVIEW_HOST) return u.href;
+      u.hostname = ISOLATED_PREVIEW_HOST;
+      return u.href;
+    } catch (_e) { return url; }
+  }
+
+  function isLoopbackHost(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+  }
+
+  // allow-same-origin is only withheld when the frame would share the host's
+  // origin, which is the one case where it would escape the sandbox.
+  function sandboxFor(url) {
+    try {
+      return new URL(url, location.href).origin === location.origin ? SANDBOX : (SANDBOX + " allow-same-origin");
+    } catch (_e) { return SANDBOX; }
+  }
+
+  // CSS zoom on an iframe keeps the element box at its laid-out size while
+  // shrinking the layout viewport inside it, so the page reflows at
+  // (width / scale) and is then drawn scaled — exactly what browser page zoom
+  // does. The box must stay at 100% or the frame detaches from the panel edge.
+  function applyZoom() {
+    if (!els) return;
+    if (els.iframe) els.iframe.style.zoom = String(zoom / 100);
+    if (els.zoomValue) els.zoomValue.textContent = zoom + "%";
+    if (els.zoomOutBtn) els.zoomOutBtn.disabled = zoom <= ZOOM_MIN;
+    if (els.zoomInBtn) els.zoomInBtn.disabled = zoom >= ZOOM_MAX;
+    if (els.zoomResetBtn) els.zoomResetBtn.disabled = zoom === 100;
+  }
+
+  function stepZoom(delta) {
+    const next = Math.min(ZOOM_MAX, Math.max(ZOOM_MIN, zoom + delta));
+    if (next === zoom) return;
+    zoom = next;
+    applyZoom();
+  }
+
+  function resetZoom() {
+    if (zoom === 100) return;
+    zoom = 100;
+    applyZoom();
   }
 
   async function openRel(sid, rel, record) {
@@ -290,10 +382,8 @@
     showOverlay(null);
     syncAddress(rel);
     ensureAsideWidth();
-    // Only third-party origins may self-identify: Vite-style dev servers
-    // need allow-same-origin for their ES-module graph to load. Proxy URLs
-    // (/preview/p/, /preview/s/) stay on the host origin and must remain
-    // opaque so AI pages can never touch the host's cookies or localStorage.
+    // Proxy URLs move to the isolated preview origin; direct third-party URLs
+    // stay as-is and are already cross-origin.
     freshFrame(frameUrl, isProxied(frameUrl));
   }
 
@@ -331,6 +421,40 @@
     window.open(url, "_blank", "noopener");
   }
 
+  // ── More menu ──────────────────────────────────────────────────────────
+  // Menu state is read from the DOM rather than the module-level `els` ref:
+  // when the aside re-renders (session switch, layout restore) the old `els`
+  // points at detached nodes and a click on the fresh toolbar would silently
+  // toggle a menu nobody can see.
+  function closeMenu() {
+    document.querySelectorAll(".preview-menu:not([hidden])").forEach((menu) => {
+      menu.hidden = true;
+      const btn = menu.parentElement && menu.parentElement.querySelector('[aria-haspopup="true"]');
+      if (btn) btn.setAttribute("aria-expanded", "false");
+    });
+  }
+
+  function toggleMenu(menu, btn) {
+    if (!menu) return;
+    menu.hidden = !menu.hidden;
+    if (btn) btn.setAttribute("aria-expanded", String(!menu.hidden));
+  }
+
+  if (!window.__clackyPreviewMenuDismiss) {
+    window.__clackyPreviewMenuDismiss = true;
+    document.addEventListener("mousedown", (e) => {
+      if (!document.querySelector(".preview-menu:not([hidden])")) return;
+      if (e.target.closest(".preview-menu") || e.target.closest('[aria-haspopup="true"]')) return;
+      closeMenu();
+    });
+    document.addEventListener("keydown", (e) => {
+      if (e.key === "Escape") closeMenu();
+    });
+    // Clicking into the preview frame moves focus to the iframe's document,
+    // which the host never sees; the window blur is the only signal available.
+    window.addEventListener("blur", () => closeMenu());
+  }
+
   Clacky.ext.ui.mount("session.aside", (container, ctx) => {
     if (!ctx || !ctx.sessionId) return;
 
@@ -382,7 +506,45 @@
     });
     extBtn.innerHTML = ICON_EXTERNAL;
 
-    const bar = el("div", { class: "preview-bar" }, backBtn, forwardBtn, reloadBtn, addressWrap, extBtn);
+    const moreBtn = el("button", {
+      class: "preview-icon-btn", type: "button",
+      title: t("preview.more", "更多"), "aria-haspopup": "true", "aria-expanded": "false",
+      onclick: (e) => { e.stopPropagation(); toggleMenu(menu, moreBtn); },
+    });
+    moreBtn.innerHTML = ICON_MORE;
+
+    const zoomOutBtn = el("button", {
+      class: "preview-zoom-btn", type: "button",
+      title: t("preview.zoom.out", "缩小"), text: "−",
+      onclick: () => stepZoom(-ZOOM_STEP),
+    });
+    const zoomValue = el("button", {
+      class: "preview-zoom-value", type: "button",
+      title: t("preview.zoom.reset", "重置为 100%"), text: zoom + "%",
+      onclick: resetZoom,
+    });
+    const zoomInBtn = el("button", {
+      class: "preview-zoom-btn", type: "button",
+      title: t("preview.zoom.in", "放大"), text: "+",
+      onclick: () => stepZoom(ZOOM_STEP),
+    });
+    const zoomResetBtn = el("button", {
+      class: "preview-zoom-btn", type: "button",
+      title: t("preview.zoom.reset", "重置为 100%"),
+      onclick: resetZoom,
+    });
+    zoomResetBtn.innerHTML = ICON_ZOOM_RESET;
+    const zoomRow = el("div", { class: "preview-menu-row" },
+      el("span", { class: "preview-menu-label", text: t("preview.zoom", "缩放") }),
+      el("div", { class: "preview-zoom" }, zoomOutBtn, zoomValue, zoomInBtn),
+      zoomResetBtn);
+
+    const menu = el("div", { class: "preview-menu" },
+      zoomRow);
+    menu.hidden = true;
+
+    const bar = el("div", { class: "preview-bar" },
+      backBtn, forwardBtn, reloadBtn, addressWrap, extBtn, moreBtn, menu);
     const frame = el("div", { class: "preview-frame-wrap" });
 
     const notFound = el("div", { class: "preview-notfound" },
@@ -412,10 +574,13 @@
       empty: empty, notFound: notFound, unreachable: unreachable,
       address: address,
       backBtn: backBtn, forwardBtn: forwardBtn,
+      moreBtn: moreBtn, menu: menu,
+      zoomValue: zoomValue, zoomOutBtn: zoomOutBtn, zoomInBtn: zoomInBtn, zoomResetBtn: zoomResetBtn,
     };
     activeSessionId = ctx.sessionId;
     syncAddress(currentRel);
     updateNavButtons();
+    applyZoom();
 
     if (pending && pending.sid === ctx.sessionId) {
       const rel = pending.rel;

data/lib/clacky/providers.rb

@@ -36,7 +36,7 @@ module Clacky
         "default_model" => "auto",
         "models" => [
           "auto",
-          "dsk-deepseek-flash",
+          "dsk-deepseek-v4.1-flash",
           "dsk-deepseek-v4-pro",
           "oc-glm-5.3",
           "oc-kimi-k3",
@@ -148,9 +148,11 @@ module Clacky
         # vision=true; oc-gpt-6.1-sol, oc-gpt-6-astra, oc-gpt-6-sol and
         # oc-gpt-6-luna do too.
         "model_capabilities" => {
-          "dsk-deepseek-flash"  => { "vision" => true }.freeze,
-          "dsk-deepseek-v4-pro" => { "vision" => false }.freeze,
-          "oc-glm-5.3"          => { "vision" => false }.freeze
+          "dsk-deepseek-v4.1-flash" => { "vision" => true }.freeze,
+          # Legacy alias still sent by sessions created before the rename.
+          "dsk-deepseek-flash"      => { "vision" => true }.freeze,
+          "dsk-deepseek-v4-pro"     => { "vision" => false }.freeze,
+          "oc-glm-5.3"              => { "vision" => false }.freeze
         }.freeze,
         # Bedrock GPT models (abs-gpt-*) are served through the OpenAI
         # Responses API — their Chat Completions endpoint rejects function
@@ -166,7 +168,7 @@ module Clacky
         # themselves, so they're intentionally not listed here as keys —
         # no injection happens when the default model is already lite-class.
         "lite_models" => {
-          "auto"                 => "dsk-deepseek-flash",
+          "auto"                 => "dsk-deepseek-v4.1-flash",
           "abs-claude-fable-5-1"  => "abs-claude-haiku-5-5",
           "abs-claude-fable-5"    => "abs-claude-haiku-5-5",
           "abs-claude-opus-5-5"   => "abs-claude-haiku-5-5",
@@ -180,7 +182,7 @@ module Clacky
           "abs-gpt-6-sol"         => "abs-gpt-6-luna",
           "abs-gpt-5.6-sol"       => "abs-gpt-5.6-luna",
           "abs-gpt-5.6-terra"     => "abs-gpt-5.6-luna",
-          "dsk-deepseek-v4-pro"   => "dsk-deepseek-flash",
+          "dsk-deepseek-v4-pro"   => "dsk-deepseek-v4.1-flash",
           "or-gemini-3-1-pro"     => "or-gemini-3-8-flash"
         },
         # Fallback chain: if a model is unavailable, try the next one in order.
@@ -213,7 +215,7 @@ module Clacky
         "base_url" => "https://api.deepseek.com",
         "api" => "openai-completions",
         "default_model" => "deepseek-v4-pro",
-        "lite_model" => "deepseek-flash",
+        "lite_model" => "deepseek-v4.1-flash",
         # Note: deepseek-chat and deepseek-reasoner are legacy aliases being
         # deprecated on 2026-07-24; they map to V4.1 Flash's non-thinking and
         # thinking modes respectively.
@@ -221,14 +223,21 @@ module Clacky
         # longer offered upstream, so they are out of this list: only their
         # pricing entries remain, to let already-billed history resolve.
         "models" => [
-          "deepseek-flash",
+          "deepseek-v4.1-flash",
           "deepseek-v4-pro",
         ],
         # DeepSeek V4 API is text-only across all models, except V4.1 Flash
-        # (deepseek-flash), which is natively multimodal.
+        # (deepseek-v4.1-flash), which is natively multimodal.
         "capabilities" => { "vision" => false }.freeze,
         "model_capabilities" => {
-          "deepseek-flash" => { "vision" => true }.freeze
+          "deepseek-v4.1-flash" => { "vision" => true }.freeze,
+          # Legacy id kept for configs saved before the rename.
+          "deepseek-flash"     => { "vision" => true }.freeze
+        }.freeze,
+        # The upstream API still exposes V4.1 Flash as "deepseek-flash"; the
+        # picker shows the generation name.
+        "api_model_aliases" => {
+          "deepseek-v4.1-flash" => "deepseek-flash"
         }.freeze,
         "deepseek_web_tools" => true,
         "website_url" => "https://platform.deepseek.com/api_keys"
@@ -271,8 +280,8 @@ module Clacky
         "name" => "Kimi (Moonshot)",
         "base_url" => "https://api.moonshot.cn/v1",
         "api" => "openai-completions",
-        "default_model" => "kimi-k3",
-        "models" => ["kimi-k3", "kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6"],
+        "default_model" => "kimi-k3.1-pro",
+        "models" => ["kimi-k3.1-pro", "kimi-k3.1-pro-highspeed", "kimi-k3", "kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6"],
         # Moonshot operates two regional endpoints with identical APIs & model
         # lineup — mainland China (.cn) and international (.ai). These are the
         # pay-as-you-go Open Platform endpoints; the subscription-billed
@@ -288,7 +297,7 @@ module Clacky
           { "label" => "Mainland China", "label_key" => "settings.models.baseurl.variant.mainland_cn",   "base_url" => "https://api.moonshot.cn/v1", "region" => "cn"   }.freeze,
           { "label" => "International",  "label_key" => "settings.models.baseurl.variant.international", "base_url" => "https://api.moonshot.ai/v1", "region" => "intl" }.freeze
         ].freeze,
-        # k3 / k2.7-code / k2.6 are multimodal; legacy k2 text-only models need model_capabilities override if added.
+        # k3.1-pro / k3 / k2.7-code / k2.6 are multimodal; legacy k2 text-only models need model_capabilities override if added.
         "capabilities" => { "vision" => true }.freeze,
         "default_ocr_model" => "kimi-k3",
         "website_url" => "https://platform.moonshot.cn/console/api-keys"
@@ -574,17 +583,20 @@ module Clacky
           "doubao-seed-evolving",
           "doubao-seed-2.1-pro",
           "doubao-seed-2.1-turbo",
+          "doubao-seed-2.1-lite",
           "doubao-seed-2.0-mini",
-          "doubao-seed-2.0-lite",
           "minimax-m3",
-          "kimi-k2.7-code",
+          "kimi-k3.1-pro",
           "kimi-k3",
+          "kimi-k2.7-code",
           # GLM-5.2 is delisted from Ark on 2026-08-31, so new setups only
           # offer GLM-5.3. It is available on the Coding/Agent Plan endpoints;
           # the pay-as-you-go endpoint does not carry it yet (no versioned id),
           # so no payg alias is registered for it.
           "glm-5.3",
           "glm-5.3-flash",
+          "deepseek-v4.1-flash",
+          "deepseek-v4.1-flash-economy",
           "deepseek-v4-pro",
           "deepseek-v4-flash"
         ],
@@ -605,14 +617,21 @@ module Clacky
             "glm-5.2"            => "glm-5-2-260617",
             "deepseek-v4-pro"    => "deepseek-v4-pro-260425",
             "deepseek-v4-flash"  => "deepseek-v4-flash-260425",
+            "deepseek-v4.1-flash"         => "deepseek-v4-1-flash-261017",
+            "deepseek-v4.1-flash-economy" => "deepseek-v4-1-flash-economy-261017",
+            "kimi-k3.1-pro"         => "kimi-k3-1-pro-261024",
             "doubao-seed-2.1-pro"   => "doubao-seed-2-1-pro-260628",
             "doubao-seed-2.1-turbo" => "doubao-seed-2-1-turbo-260628",
+            "doubao-seed-2.1-lite"  => "doubao-seed-2-1-lite-260915",
             "doubao-seed-2.0-mini"  => "doubao-seed-2-0-mini-260428",
+            # doubao-seed-2.0-lite is delisted in favor of 2.1-lite; the alias
+            # stays so existing configs keep working.
             "doubao-seed-2.0-lite"  => "doubao-seed-2-0-lite-260428"
           }.freeze
         }.freeze,
         # Most Doubao/multimodal models accept image input; GLM-5.2/5.3 and
-        # DeepSeek-V4 on Ark are text-only. GLM-5.3-Flash inherits vision=true.
+        # DeepSeek-V4 on Ark are text-only. GLM-5.3-Flash and DeepSeek-V4.1
+        # (incl. economy) inherit vision=true.
         "capabilities" => { "vision" => true }.freeze,
         "model_capabilities" => {
           "glm-5.3"           => { "vision" => false }.freeze,
@@ -621,7 +640,7 @@ module Clacky
           "deepseek-v4-flash" => { "vision" => false }.freeze,
           "minimax-m2.7"      => { "vision" => false }.freeze
         }.freeze,
-        "default_ocr_model" => "doubao-seed-2.0-lite",
+        "default_ocr_model" => "doubao-seed-2.1-lite",
         "website_url" => "https://console.volcengine.com/ark/region:cn-beijing/overview"
       }.freeze,
 
@@ -1083,6 +1102,10 @@ module Clacky
       # Plan endpoints accept the short "doubao-seed-2.1-pro"). Users always see
       # and pick the short name; this swaps it just before the request goes out.
       #
+      # The map comes in two shapes:
+      #   - grouped by endpoint variant: { "payg" => { short => real } }
+      #   - flat, endpoint-independent:  { short => real }   (e.g. DeepSeek)
+      #
       # Returns the original model unchanged when no alias applies (unknown
       # provider, endpoint without an alias group, or model not in the map).
       #
@@ -1100,6 +1123,9 @@ module Clacky
         aliases = preset && preset["api_model_aliases"]
         return model unless aliases.is_a?(Hash)
 
+        flat = aliases[model.to_s]
+        return flat if flat.is_a?(String)
+
         group = alias_group_for_base_url(preset, base_url)
         return model unless group
 

data/lib/clacky/search_config.rb

@@ -16,8 +16,9 @@ module Clacky
   #   provider: tavily     — "deepseek_web" for DeepSeek's hosted
   #                          search/fetch, blank for built-in engines only,
   #                          otherwise the basename of a script in ~/.clacky/searchers/
-  #   key: tvly-xxx        — credential for the selected provider (optional for
-  #                          deepseek_web, which can reuse a configured model key)
+  #   keys:                — credentials per provider, so switching providers never
+  #     tavily: tvly-xxx       hands one provider's key to another (optional for
+  #                            deepseek_web, which can reuse a configured model key)
   #
   # A missing file, or one without a `provider` key, means "never chosen" and
   # resolves to the free chain.
@@ -33,27 +34,43 @@ module Clacky
     DEEPSEEK_WEB = "deepseek_web"
 
     class << self
-      # @return [Hash] { "provider" => String, "key" => String }
+      # @return [Hash] { "provider" => String, "keys" => { provider => String } }
       def load
         raw = File.exist?(CONFIG_PATH) ? YAML.load_file(CONFIG_PATH) : nil
         return default_config unless raw.is_a?(Hash)
 
-        {
-          "provider" => raw["provider"].to_s.strip,
-          "key" => raw["key"].to_s.strip
-        }
+        provider = raw["provider"].to_s.strip
+        keys = {}
+        (raw["keys"].is_a?(Hash) ? raw["keys"] : {}).each do |name, value|
+          value = value.to_s.strip
+          keys[name.to_s] = value unless value.empty?
+        end
+        # Files written before keys were split hold one key for the provider then selected.
+        legacy = raw["key"].to_s.strip
+        keys[provider] ||= legacy unless provider.empty? || legacy.empty?
+
+        { "provider" => provider, "keys" => keys }
       rescue StandardError
         default_config
       end
 
+      # The key is stored under the resulting provider; a blank key removes it.
       def save(provider: nil, key: nil)
         current = load
         new_provider = provider.nil? ? current["provider"] : provider.to_s.strip
-        new_key = key.nil? ? current["key"] : key.to_s.strip
+        keys = current["keys"]
+        unless key.nil? || new_provider.empty?
+          key = key.to_s.strip
+          if key.empty?
+            keys.delete(new_provider)
+          else
+            keys[new_provider] = key
+          end
+        end
 
         payload = {
           "provider" => new_provider,
-          "key" => new_key
+          "keys" => keys
         }
 
         FileUtils.mkdir_p(File.dirname(CONFIG_PATH))
@@ -70,7 +87,7 @@ module Clacky
       end
 
       private def default_config
-        { "provider" => "", "key" => "" }
+        { "provider" => "", "keys" => {} }
       end
 
       # Absolute path of the configured searcher, or nil when unset/missing.
@@ -84,7 +101,12 @@ module Clacky
       end
 
       def key
-        load["key"]
+        config = load
+        config["keys"][config["provider"]].to_s
+      end
+
+      def key_for(provider)
+        load["keys"][provider.to_s].to_s
       end
     end
   end