openclacky 1.5.4 → 1.5.6

data/lib/clacky/extension/api_extension.rb

@@ -258,14 +258,31 @@ module Clacky
       @http_server&.instance_variable_get(:@registry)
     end
 
+    def project_manager
+      @http_server&.instance_variable_get(:@project_manager)
+    end
+
     # Create a brand-new session and optionally kick off its first task.
     # Returns the new session_id. When a prompt is given, the task is
     # submitted immediately (the session starts running); display_message
     # controls the user-facing bubble shown in place of the raw prompt.
+    # When `project_id` is given, the project's working_dir is inherited
+    # (unless an explicit working_dir overrides it) and the session is
+    # associated with the project.
     def create_session(name: nil, prompt: nil, working_dir: nil, profile: "general",
-                       source: :manual, display_message: nil, hidden: false)
+                       source: :manual, display_message: nil, hidden: false, project_id: nil)
       error!("server not ready", status: 503) unless @http_server
 
+      if project_id
+        project_id = project_id.to_s.strip
+        project_id = nil if project_id.empty?
+      end
+
+      project = project_id ? project_manager&.find(project_id) : nil
+      error!("Project not found", status: 404) if project_id && project.nil?
+
+      working_dir = File.expand_path(project[:working_dir]) if working_dir.nil? && project && project[:working_dir].to_s.strip != ""
+
       session_id = @http_server.send(
         :build_session,
         name: name,
@@ -275,8 +292,19 @@ module Clacky
         hidden: hidden
       )
 
+      if project_id
+        agent = nil
+        registry.with_session(session_id) { |s| agent = s[:agent] }
+        if agent
+          agent.project_id = project_id
+          session_manager&.save(agent.to_session_data)
+        end
+      end
+
       submit_task(session_id, prompt, display_message: display_message) if prompt && !prompt.strip.empty?
 
+      @http_server.send(:broadcast_session_update, session_id)
+
       session_id
     end
 

data/lib/clacky/extension/loader.rb

@@ -422,6 +422,7 @@ module Clacky
                    "description"    => spec["description"].to_s,
                    "description_zh" => spec["description_zh"].to_s,
                    "order"          => spec["order"],
+                   "hidden"         => !!spec["hidden"],
                    "author"         => container[:author],
                    "homepage"       => container[:homepage],
                    "license"        => container[:license],

data/lib/clacky/extension/packager.rb

@@ -18,9 +18,20 @@ module Clacky
     MANIFEST     = "ext.yml"
     MAX_ZIP_SIZE = 50 * 1024 * 1024
 
+    # Network timeouts for the download step. `read_timeout` is an *idle*
+    # timeout (resets on every chunk received), so a stalled connection with
+    # no new bytes flowing for this long is treated as dead — not a "download
+    # still going, just slow" situation, which large files on a slow link
+    # would otherwise trigger.
+    OPEN_TIMEOUT = 15   # seconds to establish the connection
+    READ_TIMEOUT = 60   # seconds of silence before giving up mid-download
+
     # Platform metadata that leaks in from the developer's OS; never ship it.
     SYSTEM_METADATA = [".DS_Store", "__MACOSX", "Thumbs.db", "desktop.ini"].freeze
 
+    # VCS and IDE metadata that must never ship in a pack, even without a .gitignore.
+    NEVER_PACK_DIRS = [".git", ".svn", ".hg", ".idea", ".vscode"].freeze
+
     Result = Struct.new(:ext_id, :path, :units, keyword_init: true)
 
     class Error < StandardError; end
@@ -48,6 +59,7 @@ module Clacky
         File.delete(zip_path) if File.exist?(zip_path)
 
         write_zip(container_dir, zip_path)
+        enforce_zip_size!(zip_path)
 
         Result.new(ext_id: slug, path: zip_path, units: nil)
       end
@@ -56,12 +68,19 @@ module Clacky
       # local zip path or an http(s) URL. Validates the archive (single top
       # container with an ext.yml, no path traversal), extracts it, then runs
       # verify on the resolved installed layer.
-      def install(source, installed_dir: Clacky::ExtensionLoader::INSTALLED_DIR, force: false)
+      # on_progress is an optional callable that receives a stage hash, e.g.:
+      #   { stage: "downloading", progress: 45 }
+      #   { stage: "extracting" }
+      #   { stage: "verifying" }
+      # Caller can use this for progress reporting without coupling to internals.
+      def install(source, installed_dir: Clacky::ExtensionLoader::INSTALLED_DIR, force: false, on_progress: nil)
         Dir.mktmpdir("clacky-ext-install") do |tmp|
-          zip_path = local_zip_for(source, tmp)
+          on_progress&.call({ stage: "downloading", progress: 0 })
+          zip_path = local_zip_for(source, tmp, on_progress: on_progress)
+
+          on_progress&.call({ stage: "extracting" })
           extract_root = File.join(tmp, "unpacked")
           FileUtils.mkdir_p(extract_root)
-
           extract_zip(zip_path, extract_root)
 
           ext_id, container_src = locate_container(extract_root)
@@ -74,6 +93,7 @@ module Clacky
           FileUtils.mkdir_p(target)
           FileUtils.cp_r(Dir.glob("#{container_src}/*"), target)
 
+          on_progress&.call({ stage: "verifying" })
           Clacky::ExtensionLoader.invalidate_cache!
           units = verify_installed(ext_id, installed_dir)
 
@@ -124,12 +144,9 @@ module Clacky
       end
 
       private def write_zip(container_dir, zip_path)
+        gitignore = load_container_gitignore(container_dir)
         Zip::File.open(zip_path, create: true) do |zip|
-          files = Dir.glob(File.join(container_dir, "**", "*"), File::FNM_DOTMATCH)
-          files.each do |abs|
-            base = File.basename(abs)
-            next if base == "." || base == ".."
-
+          each_packable(container_dir, gitignore) do |abs|
             rel = relative(container_dir, abs)
             next if system_metadata?(rel)
 
@@ -143,17 +160,65 @@ module Clacky
         end
       end
 
+      # Same budget the installer enforces on download/extract - without it a
+      # creator could publish something no one (themselves included) can install.
+      private def enforce_zip_size!(zip_path)
+        size = File.size(zip_path)
+        return if size <= MAX_ZIP_SIZE
+
+        raise Error, "packed zip is #{size} bytes, exceeds #{MAX_ZIP_SIZE} bytes (#{MAX_ZIP_SIZE / 1024 / 1024}MB) limit"
+      end
+
+      private def load_container_gitignore(container_dir)
+        path = File.join(container_dir, ".gitignore")
+        Clacky::GitignoreParser.new(path) if File.exist?(path)
+      end
+
+      # Walk the container yielding every path that should ship. Honors .gitignore
+      # strictly: ignored files are excluded even when they are config files
+      # (.env, secrets) - packing must never leak gitignored content, unlike the
+      # search tools which surface config files. Nested .gitignore files are
+      # honored per-subtree without leaking rules into sibling directories.
+      private def each_packable(dir, gitignore, root: dir)
+        Dir.children(dir).sort.each do |name|
+          full = File.join(dir, name)
+          rel = relative(root, full)
+
+          if File.directory?(full)
+            next if File.symlink?(full)
+            next if NEVER_PACK_DIRS.include?(name)
+            next if gitignore&.ignored?("#{rel}/")
+
+            yield full
+            each_packable(full, gitignore_for_subdir(full, rel, gitignore), root: root) { |p| yield p }
+          else
+            next if gitignore&.ignored?(rel)
+
+            yield full
+          end
+        end
+      end
+
+      private def gitignore_for_subdir(dir, rel, parent)
+        nested = File.join(dir, ".gitignore")
+        return parent unless File.exist?(nested)
+
+        merged = parent ? parent.dup : Clacky::GitignoreParser.new(nil)
+        merged.merge!(nested, prefix: rel)
+        merged
+      end
+
       # True if any path segment is a platform metadata file/dir (e.g. a nested
       # agents/.DS_Store or a whole __MACOSX/ tree).
       private def system_metadata?(rel)
         rel.split(File::SEPARATOR).any? { |seg| SYSTEM_METADATA.include?(seg) }
       end
 
-      private def local_zip_for(source, tmp)
+      private def local_zip_for(source, tmp, on_progress: nil)
         src = source.to_s
         if src.match?(%r{\Ahttps?://})
           dest = File.join(tmp, "download.zip")
-          download(src, dest)
+          download(src, dest, on_progress: on_progress)
           dest
         else
           path = File.expand_path(src)
@@ -162,19 +227,48 @@ module Clacky
         end
       end
 
-      private def download(url, dest)
-        total = 0
-        URI.open(url, "rb") do |io| # rubocop:disable Security/Open
-          File.open(dest, "wb") do |out|
-            while (chunk = io.read(64 * 1024))
-              total += chunk.bytesize
-              raise Error, "download exceeds #{MAX_ZIP_SIZE} bytes" if total > MAX_ZIP_SIZE
-              out.write(chunk)
-            end
-          end
+      # Download url → dest file.
+      # IMPORTANT: OpenURI's block form (`URI.open(url) { |io| ... }`) buffers
+      # the *entire* response into a StringIO/Tempfile via Net::HTTP's
+      # read_body before ever yielding `io` — so reading `io` in chunks after
+      # the fact reports progress only after the download has already
+      # finished. To get progress callbacks that fire while bytes are still
+      # arriving on the socket, we hook OpenURI's own `progress_proc` /
+      # `content_length_proc`, which run inside read_body as each chunk lands.
+      # Respects whatever proxy env vars the user has configured (some CDN
+      # domains are only reachable at usable speed through a proxy).
+      private def download(url, dest, on_progress: nil)
+        content_length = nil
+
+        content_length_proc = lambda do |len|
+          content_length = len if len&.positive?
+        end
+
+        progress_proc = lambda do |size|
+          raise Error, "download exceeds #{MAX_ZIP_SIZE} bytes" if size > MAX_ZIP_SIZE
+          next unless on_progress
+
+          pct = if content_length&.positive?
+                  [(size * 100 / content_length).floor, 99].min
+                else
+                  (90 - 90 * Math.exp(-size.to_f / (1024 * 1024))).floor
+                end
+          on_progress.call({ stage: "downloading", progress: pct })
+        end
+
+        URI.open(
+          url, "rb",
+          open_timeout: OPEN_TIMEOUT,
+          read_timeout: READ_TIMEOUT,
+          content_length_proc: content_length_proc,
+          progress_proc: progress_proc
+        ) do |io| # rubocop:disable Security/Open
+          File.open(dest, "wb") { |out| out.write(io.read) }
         end
       rescue OpenURI::HTTPError, SocketError => e
         raise Error, "failed to download #{url}: #{e.message}"
+      rescue Net::OpenTimeout, Net::ReadTimeout => e
+        raise Error, "download timed out: #{e.message}"
       end
 
       private def extract_zip(zip_path, dest_root)

data/lib/clacky/extension/verifier.rb

@@ -22,7 +22,7 @@ module Clacky
     PANEL_KEYS   = %w[id title title_zh description description_zh view order attach entry_points].freeze
     API_KEYS     = %w[id handler].freeze
     SKILL_KEYS   = %w[id dir protected].freeze
-    AGENT_KEYS   = %w[id title title_zh description description_zh order prompt panels skills avatar].freeze
+    AGENT_KEYS   = %w[id title title_zh description description_zh order prompt panels skills avatar hidden].freeze
     CHANNEL_KEYS = %w[id platform adapter].freeze
     PATCH_KEYS   = %w[target file fingerprint on_mismatch].freeze
     HOOK_KEYS    = %w[event file].freeze

data/lib/clacky/idle_compression_timer.rb

@@ -121,9 +121,7 @@ module Clacky
       success = @agent.trigger_idle_compression
 
       if success && @session_manager
-        existing = @session_manager.load(@agent.session_id)
-        original_updated_at = existing&.dig(:updated_at) ? Time.parse(existing[:updated_at].to_s) : nil
-        @session_manager.save(@agent.to_session_data(status: :success, updated_at: original_updated_at))
+        @session_manager.save(@agent.to_session_data(status: :success))
       end
 
       @on_compress&.call(success)

data/lib/clacky/message_format/anthropic.rb

@@ -114,7 +114,7 @@ module Clacky
       private_class_method def self.normalized_effort(effort)
         return nil if effort.nil? || effort.to_s.empty?
         s = effort.to_s
-        %w[low medium high].include?(s) ? s : nil
+        %w[low medium high xhigh max].include?(s) ? s : nil
       end
 
       # Merge consecutive tool_result user messages into a single user message.

data/lib/clacky/message_format/bedrock.rb

@@ -91,7 +91,7 @@ module Clacky
 
       private_class_method def self.additional_fields_for_effort(effort)
         return nil if effort.nil? || effort.to_s.empty?
-        return nil unless %w[low medium high].include?(effort.to_s)
+        return nil unless %w[low medium high xhigh max].include?(effort.to_s)
         {
           thinking: { type: "adaptive" },
           output_config: { effort: effort.to_s }

data/lib/clacky/message_format/open_ai.rb

@@ -279,6 +279,14 @@ module Clacky
           elsif !effort_str.empty?
             body[:thinking] = { type: "adaptive" }
           end
+        elsif model.to_s.match?(/deepseek/i)
+          # DeepSeek V4 reasoning_effort only accepts low/high/max.
+          # xhigh is not recognized — map it to max.
+          effort = case effort_str
+                   when "xhigh" then "max"
+                   else effort_str
+                   end
+          body[:reasoning_effort] = effort unless effort.empty?
         elsif reasoning_effort && !effort_str.empty?
           body[:reasoning_effort] = effort_str
         end

data/lib/clacky/providers.rb

@@ -427,13 +427,11 @@ module Clacky
         "name_key" => "provider.name.volcengine_ark",
         "base_url" => "https://ark.cn-beijing.volces.com/api/v3",
         "api" => "openai-completions",
-        "default_model" => "doubao-seed-2.0-pro",
+        "default_model" => "doubao-seed-2.1-pro",
         "models" => [
           "doubao-seed-evolving",
           "doubao-seed-2.1-pro",
           "doubao-seed-2.1-turbo",
-          "doubao-seed-2.0-code",
-          "doubao-seed-2.0-pro",
           "doubao-seed-2.0-lite",
           "minimax-m3",
           "minimax-m2.7",
@@ -460,9 +458,7 @@ module Clacky
             "deepseek-v4-flash"  => "deepseek-v4-flash-260425",
             "doubao-seed-2.1-pro"   => "doubao-seed-2-1-pro-260628",
             "doubao-seed-2.1-turbo" => "doubao-seed-2-1-turbo-260628",
-            "doubao-seed-2.0-pro"   => "doubao-seed-2-0-pro-260215",
-            "doubao-seed-2.0-lite"  => "doubao-seed-2-0-lite-260428",
-            "doubao-seed-2.0-code"  => "doubao-seed-2-0-code-preview-260215"
+            "doubao-seed-2.0-lite"  => "doubao-seed-2-0-lite-260428"
           }.freeze
         }.freeze,
         # Most Doubao/multimodal models accept image input; GLM-5.2 and
@@ -477,6 +473,67 @@ module Clacky
         "website_url" => "https://console.volcengine.com/ark/region:cn-beijing/overview"
       }.freeze,
 
+      "ollama" => {
+        "name" => "Ollama (Cloud)",
+        # Ollama Cloud API — OpenAI-compatible endpoint serving both local and
+        # cloud models. Cloud models are available immediately without pulling.
+        # Authentication: API key via Authorization: Bearer <key> header.
+        # Create API keys at: https://ollama.com/settings/keys
+        "base_url" => "https://ollama.com",
+        "api" => "openai-completions",
+        "default_model" => "deepseek-v4-flash",
+        # Curated list of cloud-enabled models from the Ollama library.
+        # Users can type any Ollama model name manually; this list seeds the picker.
+        "models" => [
+          "glm-5.2",
+          "kimi-k3",
+          "gemma4",
+          "qwen3.5",
+          "glm-5.1",
+          "minimax-m2.7",
+          "nemotron-3-super",
+          "minimax-m3",
+          "kimi-k2.7-code",
+          "kimi-k2.6",
+          "deepseek-v4-flash",
+          "deepseek-v4-pro",
+          "nemotron-3-ultra",
+          "gemini-3-flash-preview",
+          "nemotron-3-nano",
+          "mistral-large-3",
+          "gpt-oss"
+        ],
+        # Provider-level default: many Ollama cloud models are vision-capable.
+        "capabilities" => { "vision" => true }.freeze,
+        # Model-level overrides: text-only models that don't accept image input.
+        "model_capabilities" => {
+          "glm-5.2"             => { "vision" => false }.freeze,
+          "glm-5.1"             => { "vision" => false }.freeze,
+          "minimax-m2.7"        => { "vision" => false }.freeze,
+          "deepseek-v4-pro"     => { "vision" => false }.freeze,
+          "deepseek-v4-flash"   => { "vision" => false }.freeze,
+          "nemotron-3-super"    => { "vision" => false }.freeze,
+          "nemotron-3-ultra"    => { "vision" => false }.freeze,
+          "nemotron-3-nano"     => { "vision" => false }.freeze,
+          "gpt-oss"             => { "vision" => false }.freeze
+        }.freeze,
+        # Per-primary lite pairing: subagents use smaller models for cheap/fast work.
+        "lite_models" => {
+          "glm-5.2"                => "glm-5.1",
+          "kimi-k3"                => "kimi-k2.6",
+          "gemma4"                 => "nemotron-3-nano",
+          "qwen3.5"                => "gemini-3-flash-preview",
+          "minimax-m3"             => "minimax-m2.7",
+          "kimi-k2.7-code"         => "kimi-k2.6",
+          "deepseek-v4-pro"        => "deepseek-v4-flash",
+          "mistral-large-3"        => "nemotron-3-nano",
+          "gpt-oss"                => "nemotron-3-nano",
+          "gemini-3-flash-preview"  => "nemotron-3-nano"
+        },
+        "default_ocr_model" => "kimi-k2.7-code",
+        "website_url" => "https://ollama.com/settings/keys"
+      }.freeze,
+
       "openai" => {
         "name" => "OpenAI (GPT)",
         "base_url" => "https://api.openai.com/v1",
@@ -930,8 +987,8 @@ module Clacky
       # Translate a display model name into the real model id the target
       # endpoint expects. Some providers expose the same model under different
       # ids per billing endpoint (e.g. Volcengine Ark's pay-as-you-go API needs
-      # versioned ids like "doubao-seed-2-0-pro-260215" while the Coding/Agent
-      # Plan endpoints accept the short "doubao-seed-2.0-pro"). Users always see
+      # versioned ids like "doubao-seed-2-1-pro-260628" while the Coding/Agent
+      # Plan endpoints accept the short "doubao-seed-2.1-pro"). Users always see
       # and pick the short name; this swaps it just before the request goes out.
       #
       # Returns the original model unchanged when no alias applies (unknown

data/lib/clacky/search_config.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "yaml"
+require "fileutils"
+
+module Clacky
+  # Search provider selection, backed by ~/.clacky/search.yml.
+  #
+  # The built-in DuckDuckGo/Bing scrapers need no configuration and stay the
+  # default. Pointing `provider` at a script in ~/.clacky/searchers/ routes
+  # web_search through an API-backed engine instead, which is what users who
+  # want higher-quality results (or China-reachable ones) reach for.
+  #
+  # search.yml schema:
+  #   provider: tavily     — basename of a script in ~/.clacky/searchers/;
+  #                          blank or missing means built-in engines only
+  #   key: tvly-xxx        — credential handed to that script via env
+  #
+  # The directory is the registry: dropping my_engine.rb into
+  # ~/.clacky/searchers/ and setting `provider: my_engine` is all it takes,
+  # mirroring how ~/.clacky/skills/ and ~/.clacky/parsers/ work.
+  module SearchConfig
+    CONFIG_PATH = File.expand_path("~/.clacky/search.yml").freeze
+
+    class << self
+      # @return [Hash] { "provider" => String, "key" => String }
+      def load
+        raw = File.exist?(CONFIG_PATH) ? YAML.load_file(CONFIG_PATH) : nil
+        return { "provider" => "", "key" => "" } unless raw.is_a?(Hash)
+
+        { "provider" => raw["provider"].to_s.strip, "key" => raw["key"].to_s.strip }
+      rescue StandardError
+        { "provider" => "", "key" => "" }
+      end
+
+      def save(provider:, key:)
+        FileUtils.mkdir_p(File.dirname(CONFIG_PATH))
+        File.write(CONFIG_PATH, { "provider" => provider.to_s.strip, "key" => key.to_s.strip }.to_yaml)
+        File.chmod(0o600, CONFIG_PATH)
+      end
+
+      # Absolute path of the configured searcher, or nil when unset/missing.
+      # A provider naming a script that isn't installed is treated as unset so
+      # web_search silently falls back instead of erroring on every search.
+      def script_path
+        name = load["provider"]
+        return nil if name.empty?
+
+        Clacky::Utils::SearcherManager.path_for(name)
+      end
+
+      def key
+        load["key"]
+      end
+    end
+  end
+end