openclacky 1.5.6 → 1.5.8

data/lib/clacky/fanout.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+module Clacky
+  # Runs a batch of blocking jobs on a bounded thread pool and collects their
+  # results in the order the jobs were given, regardless of completion order.
+  #
+  # Built for subagent fan-out: each job blocks inside Agent#run, so the pool is
+  # sized for concurrency rather than CPU count. A job that raises is captured
+  # as a failed slot instead of tearing down its siblings.
+  class Fanout
+    Result = Struct.new(:index, :value, :error, :duration, keyword_init: true) do
+      def ok?
+        error.nil?
+      end
+    end
+
+    DEFAULT_MAX_CONCURRENCY = 4
+
+    # @param max_concurrency [Integer] jobs allowed to run at once
+    # @param timeout [Numeric, nil] wall-clock budget for the whole batch
+    def initialize(max_concurrency: DEFAULT_MAX_CONCURRENCY, timeout: nil)
+      raise ArgumentError, "max_concurrency must be positive" unless max_concurrency.to_i.positive?
+
+      @max_concurrency = max_concurrency.to_i
+      @timeout = timeout
+    end
+
+    # @param jobs [Array<#call>] each job is invoked with no arguments
+    # @return [Array<Result>] one entry per job, aligned to the input order
+    def run(jobs)
+      return [] if jobs.empty?
+
+      pending = build_queue(jobs)
+      results = Array.new(jobs.size)
+      deadline = @timeout && (monotonic_now + @timeout)
+
+      workers = Array.new([@max_concurrency, jobs.size].min) do
+        Thread.new { drain(pending, results, deadline) }
+      end
+      join_all(workers, deadline)
+
+      fill_unfinished(results)
+    end
+
+    private def build_queue(jobs)
+      queue = Queue.new
+      jobs.each_with_index { |job, index| queue << [index, job] }
+      queue
+    end
+
+    private def drain(pending, results, deadline)
+      # pop(true) raises ThreadError when the queue is drained, which is the
+      # only exit condition — workers outlive individual jobs.
+      loop do
+        index, job = pending.pop(true)
+        break if deadline && monotonic_now >= deadline
+
+        results[index] = invoke(index, job)
+      end
+    rescue ThreadError
+      nil
+    end
+
+    private def invoke(index, job)
+      started = monotonic_now
+      value = job.call
+      Result.new(index: index, value: value, error: nil, duration: monotonic_now - started)
+    rescue StandardError, ScriptError => e
+      Result.new(index: index, value: nil, error: e, duration: monotonic_now - started)
+    end
+
+    private def join_all(workers, deadline)
+      workers.each do |worker|
+        if deadline
+          remaining = deadline - monotonic_now
+          worker.join(remaining.positive? ? remaining : 0) or worker.kill
+        else
+          worker.join
+        end
+      end
+    end
+
+    private def fill_unfinished(results)
+      results.each_with_index do |result, index|
+        next if result
+
+        results[index] = Result.new(
+          index: index,
+          value: nil,
+          error: FanoutTimeoutError.new("fan-out job #{index} did not finish within #{@timeout}s"),
+          duration: @timeout
+        )
+      end
+    end
+
+    private def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/clacky/locales/en.rb

@@ -3,6 +3,8 @@
 module Clacky
   module Locales
     EN = {
+      "phase.skill_evolution"           => "Reflecting on this task",
+      "phase.skipped"                   => "skipped",
       "llm.error.insufficient_credit"   => "Insufficient credit, please top up your account to continue",
       "llm.error.rate_limit_400"        => "Rate limit or service issue, retrying...",
       "llm.error.invalid_api_key"       => "API key is invalid or expired, please update it in Settings",

data/lib/clacky/locales/zh.rb

@@ -3,6 +3,8 @@
 module Clacky
   module Locales
     ZH = {
+      "phase.skill_evolution"           => "正在复盘本次任务",
+      "phase.skipped"                   => "已跳过",
       "llm.error.insufficient_credit"   => "账户余额不足，请前往控制台充值后继续使用",
       "llm.error.rate_limit_400"        => "请求频率过高或服务暂时不可用，正在重试...",
       "llm.error.invalid_api_key"       => "API Key 无效或已过期，请到设置中重新配置",

data/lib/clacky/mcp/cli_commands.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "thor"
+require "json"
+require_relative "connection_manager"
+
+module Clacky
+  module Mcp
+    class CliCommands < Thor
+      desc "capabilities", "Report MCP client capabilities"
+      option :json, type: :boolean, default: false
+      def capabilities
+        result = { "remote_oauth" => true }
+        emit(result, "Remote MCP OAuth: supported")
+      end
+
+      desc "login SERVER", "Authorize an OAuth-protected remote MCP server"
+      option :json, type: :boolean, default: false
+      def login(server)
+        result = manager(server).login
+        emit(result, "Connected MCP server '#{server}'.")
+      rescue ConnectionManager::Error => e
+        fail_with(e.message)
+      end
+
+      desc "status SERVER", "Show remote MCP authorization status"
+      option :json, type: :boolean, default: false
+      def status(server)
+        result = manager(server).status
+        label = result["connected"] ? "connected" : "disconnected"
+        emit(result, "MCP server '#{server}' is #{label}.")
+      rescue ConnectionManager::Error => e
+        fail_with(e.message)
+      end
+
+      desc "logout SERVER", "Delete credentials for a remote MCP server"
+      option :json, type: :boolean, default: false
+      def logout(server)
+        result = manager(server).logout
+        emit(result, "Disconnected MCP server '#{server}'.")
+      rescue ConnectionManager::Error => e
+        fail_with(e.message)
+      end
+
+      no_commands do
+        private def manager(server)
+          ConnectionManager.new(server_name: server)
+        end
+
+        private def emit(result, text)
+          puts(options[:json] ? JSON.generate(result) : text)
+        end
+
+        private def fail_with(message)
+          warn message
+          raise Thor::Error, message
+        end
+      end
+    end
+  end
+end

data/lib/clacky/mcp/client.rb

@@ -6,6 +6,10 @@ require "monitor"
 require_relative "transport"
 require_relative "stdio_transport"
 require_relative "http_transport"
+require_relative "oauth/config"
+require_relative "oauth/credential_store"
+require_relative "oauth/authorization_manager"
+require_relative "oauth/session"
 
 module Clacky
   module Mcp
@@ -29,7 +33,7 @@ module Clacky
       # Build a Client from an mcp.json spec hash.
       # Recognized fields:
       #   stdio: command (required), args, env, cwd
-      #   http:  type: "http", url (required), headers
+      #   http:  type: "http", url (required), headers, auth
       def self.from_spec(name, spec)
         type = (spec["type"] || (spec["url"] ? "http" : "stdio")).to_s
         case type
@@ -45,12 +49,24 @@ module Clacky
             )
           )
         when "http", "streamable-http"
+          oauth_config = OAuth::Config.from_server_spec(spec)
+          authorization = nil
+          if oauth_config.enabled?
+            store = OAuth::CredentialStore.new(server_name: name)
+            manager = OAuth::AuthorizationManager.new(
+              server_name: name,
+              config: oauth_config,
+              store: store
+            )
+            authorization = OAuth::Session.new(store: store, manager: manager)
+          end
           new(
             name:    name,
             transport: HttpTransport.new(
               name:    name,
               url:     spec["url"],
-              headers: spec["headers"] || {}
+              headers: spec["headers"] || {},
+              authorization: authorization
             )
           )
         else

data/lib/clacky/mcp/connection_manager.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "oauth/config"
+require_relative "oauth/credential_store"
+require_relative "oauth/authorization_manager"
+require_relative "oauth/session"
+
+module Clacky
+  module Mcp
+    class ConnectionManager
+      class Error < StandardError; end
+
+      def initialize(server_name:, home: Dir.home, working_dir: Dir.pwd, session_factory: nil)
+        @server_name = server_name.to_s
+        @home = File.expand_path(home)
+        @working_dir = working_dir && File.expand_path(working_dir)
+        @session_factory = session_factory || lambda do |_config, store, manager|
+          OAuth::Session.new(store: store, manager: manager)
+        end
+      end
+
+      def login
+        session.login
+        safe_status
+      rescue OAuth::AuthorizationManager::Error, OAuth::Session::Error, OAuth::CredentialStore::Error => e
+        raise Error, e.message
+      end
+
+      def status
+        safe_status
+      rescue OAuth::CredentialStore::Error => e
+        raise Error, e.message
+      end
+
+      def logout
+        session.logout
+        { "server" => @server_name, "connected" => false }
+      rescue OAuth::Session::Error, OAuth::CredentialStore::Error => e
+        raise Error, e.message
+      end
+
+      private def safe_status
+        session.status.merge("server" => @server_name)
+      end
+
+      private def session
+        return @session if @session
+
+        spec = server_spec
+        raise Error, "MCP server '#{@server_name}' is not configured" unless spec
+        config = OAuth::Config.from_server_spec(spec)
+        raise Error, "MCP server '#{@server_name}' is not configured for OAuth" unless config.enabled?
+        store = OAuth::CredentialStore.new(server_name: @server_name, home: @home)
+        manager = OAuth::AuthorizationManager.new(
+          server_name: @server_name,
+          config: config,
+          store: store
+        )
+        @session = @session_factory.call(config, store, manager)
+      rescue OAuth::Config::Error => e
+        raise Error, e.message
+      end
+
+      private def server_spec
+        servers = {}
+        config_paths.each do |path|
+          next unless File.file?(path)
+          document = JSON.parse(File.read(path))
+          source = document["mcpServers"] || document["servers"] || {}
+          source.each { |name, spec| servers[name.to_s] = spec if spec.is_a?(Hash) }
+        rescue JSON::ParserError
+          raise Error, "invalid MCP configuration in #{path}"
+        end
+        servers[@server_name]
+      end
+
+      private def config_paths
+        paths = [File.join(@home, ".clacky", "mcp.json")]
+        paths << File.join(@working_dir, ".clacky", "mcp.json") if @working_dir
+        paths
+      end
+    end
+  end
+end

data/lib/clacky/mcp/http_transport.rb

@@ -23,12 +23,15 @@ module Clacky
       DEFAULT_OPEN_TIMEOUT = 10
       DEFAULT_READ_TIMEOUT = 120
 
-      def initialize(name:, url:, headers: {}, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT)
+      def initialize(name:, url:, headers: {}, authorization: nil, requester: nil,
+                     open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT)
         @name = name
         @uri  = URI.parse(url)
         raise TransportError, "MCP server '#{name}' url is not http(s): #{url}" unless %w[http https].include?(@uri.scheme)
 
         @extra_headers = (headers || {}).transform_keys(&:to_s).transform_values(&:to_s)
+        @authorization = authorization
+        @requester = requester
         @open_timeout  = open_timeout
         @read_timeout  = read_timeout
 
@@ -79,21 +82,17 @@ module Clacky
         @last_error ? "last error: #{@last_error.class}: #{@last_error.message}" : ""
       end
 
-      private def dispatch_post(body, is_request:)
-        http = Net::HTTP.new(@uri.host, @uri.port)
-        http.use_ssl = (@uri.scheme == "https")
-        http.open_timeout = @open_timeout
-        http.read_timeout = @read_timeout
-
+      private def dispatch_post(body, is_request:, retried: false)
         req = Net::HTTP::Post.new(@uri.request_uri)
         req["Content-Type"] = "application/json"
         req["Accept"]       = "application/json, text/event-stream"
         req["MCP-Protocol-Version"] = Client::PROTOCOL_VERSION if defined?(Client::PROTOCOL_VERSION)
         @lock.synchronize { req["Mcp-Session-Id"] = @session_id if @session_id }
         @extra_headers.each { |k, v| req[k] = v }
+        @authorization&.authorization_headers&.each { |k, v| req[k] = v }
         req.body = body
 
-        http.request(req) do |res|
+        perform_request(req) do |res|
           if (sid = res["Mcp-Session-Id"])
             @lock.synchronize { @session_id = sid }
           end
@@ -102,9 +101,16 @@ module Clacky
           if status == 202
             return
           end
+          if status == 401 && @authorization && !retried
+            res.read_body.to_s
+            @authorization.invalidate!
+            return dispatch_post(body, is_request: is_request, retried: true)
+          end
           if status >= 400
             text = res.read_body.to_s
-            raise TransportError, "HTTP #{status} from MCP server '#{@name}': #{text[0, 500]}"
+            message = "HTTP #{status} from MCP server '#{@name}'"
+            message += ": #{text[0, 500]}" unless status == 401
+            raise TransportError, message
           end
 
           ctype = (res["Content-Type"] || "").downcase
@@ -123,6 +129,16 @@ module Clacky
         end
       end
 
+      private def perform_request(request, &block)
+        return @requester.call(request, &block) if @requester
+
+        http = Net::HTTP.new(@uri.host, @uri.port)
+        http.use_ssl = (@uri.scheme == "https")
+        http.open_timeout = @open_timeout
+        http.read_timeout = @read_timeout
+        http.request(request, &block)
+      end
+
       private def consume_sse(res)
         buffer = String.new
         res.read_body do |chunk|

data/lib/clacky/mcp/oauth/authorization_manager.rb

@@ -0,0 +1,257 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+require "net/http"
+require "securerandom"
+require "digest"
+require "base64"
+require "socket"
+require "timeout"
+
+module Clacky
+  module Mcp
+    module OAuth
+      class AuthorizationManager
+        Response = Struct.new(:status, :headers, :body)
+        MAX_RESPONSE_BYTES = 1_048_576
+
+        class Error < StandardError; end
+
+        def self.pkce_challenge(verifier)
+          Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
+        end
+
+        def initialize(server_name:, config:, store:, requester: nil, callback: nil, clock: nil)
+          @server_name = server_name
+          @config = config
+          @store = store
+          @requester = requester || method(:request)
+          @callback = callback
+          @clock = clock || -> { Time.now.to_i }
+        end
+
+        def login(resource_metadata_url: nil)
+          raise Error, "MCP server '#{@server_name}' is not configured for OAuth" unless @config.enabled?
+
+          receiver = @callback || CallbackReceiver.new
+          redirect_uri = receiver.respond_to?(:redirect_uri) ? receiver.redirect_uri : "http://127.0.0.1:52963/callback"
+          metadata = discover_metadata(resource_metadata_url)
+          client = register_client(metadata, redirect_uri)
+          verifier = SecureRandom.urlsafe_base64(48, false)
+          state = SecureRandom.urlsafe_base64(32, false)
+          authorization_url = build_authorization_url(metadata, client.fetch("client_id"), redirect_uri, verifier, state)
+          callback_result = receiver.call(authorization_url, state)
+          raise Error, "OAuth callback state mismatch" unless callback_result["state"].to_s == state
+          raise Error, "OAuth authorization returned no code" if callback_result["code"].to_s.empty?
+
+          token = token_request(metadata.fetch("token_endpoint"), {
+            "grant_type" => "authorization_code",
+            "code" => callback_result.fetch("code"),
+            "redirect_uri" => redirect_uri,
+            "client_id" => client.fetch("client_id"),
+            "code_verifier" => verifier
+          })
+          grant = normalize_token(token).merge(
+            "client_id" => client.fetch("client_id"),
+            "client_secret" => client["client_secret"],
+            "token_endpoint_auth_method" => client["token_endpoint_auth_method"] || "none",
+            "token_endpoint" => metadata.fetch("token_endpoint"),
+            "authorization_server" => metadata.fetch("issuer"),
+            "resource" => @config.resource
+          )
+          @store.save(grant)
+        ensure
+          receiver.close if defined?(receiver) && receiver.respond_to?(:close)
+        end
+
+        def refresh(grant)
+          refresh_token = grant["refresh_token"].to_s
+          raise Error, "OAuth refresh token is missing; log in again" if refresh_token.empty?
+
+          fields = {
+            "grant_type" => "refresh_token",
+            "refresh_token" => refresh_token,
+            "client_id" => grant.fetch("client_id")
+          }
+          token = token_request(grant.fetch("token_endpoint"), fields,
+                                client_secret: grant["client_secret"],
+                                auth_method: grant["token_endpoint_auth_method"])
+          updated = grant.merge(normalize_token(token))
+          updated["refresh_token"] = refresh_token if token["refresh_token"].to_s.empty?
+          updated
+        rescue KeyError
+          raise Error, "stored OAuth grant is incomplete; log in again"
+        end
+
+        private def discover_metadata(explicit_resource_metadata_url)
+          protected_url = explicit_resource_metadata_url || default_resource_metadata_url
+          protected = get_json(protected_url, "protected resource metadata")
+          if protected["resource"] && protected["resource"] != @config.resource
+            raise Error, "OAuth protected resource metadata does not match the configured MCP resource"
+          end
+
+          server = Array(protected["authorization_servers"]).first || protected["authorization_server"]
+          server = validate_https_url(server, "authorization server")
+          metadata_url = "#{server.sub(%r{/\z}, '')}/.well-known/oauth-authorization-server"
+          metadata = get_json(metadata_url, "authorization server metadata")
+          metadata["issuer"] ||= server
+          %w[issuer authorization_endpoint token_endpoint registration_endpoint].each do |key|
+            metadata[key] = validate_https_url(metadata[key], key.tr("_", " "))
+          end
+          raise Error, "authorization server metadata issuer does not match" unless metadata["issuer"] == server
+          unless Array(metadata["code_challenge_methods_supported"]).include?("S256")
+            raise Error, "authorization server does not support PKCE S256"
+          end
+          metadata
+        end
+
+        private def default_resource_metadata_url
+          resource = URI.parse(@config.resource)
+          origin = "#{resource.scheme}://#{resource.host}"
+          origin += ":#{resource.port}" unless resource.port == 443
+          "#{origin}/.well-known/oauth-protected-resource#{resource.path}"
+        end
+
+        private def register_client(metadata, redirect_uri)
+          response = @requester.call("POST", metadata.fetch("registration_endpoint"),
+                                     { "Content-Type" => "application/json" },
+                                     JSON.generate(
+                                       "client_name" => "openclacky",
+                                       "application_type" => "native",
+                                       "redirect_uris" => [redirect_uri],
+                                       "grant_types" => %w[authorization_code refresh_token],
+                                       "response_types" => ["code"],
+                                       "token_endpoint_auth_method" => "none",
+                                       "scope" => "openid profile email offline_access"
+                                     ))
+          client = parse_success_json(response, "OAuth client registration")
+          raise Error, "OAuth client registration returned no client_id" if client["client_id"].to_s.empty?
+          client
+        end
+
+        private def build_authorization_url(metadata, client_id, redirect_uri, verifier, state)
+          uri = URI.parse(metadata.fetch("authorization_endpoint"))
+          uri.query = URI.encode_www_form(
+            "response_type" => "code",
+            "client_id" => client_id,
+            "redirect_uri" => redirect_uri,
+            "scope" => "openid profile email offline_access",
+            "code_challenge" => self.class.pkce_challenge(verifier),
+            "code_challenge_method" => "S256",
+            "state" => state,
+            "resource" => @config.resource
+          )
+          uri.to_s
+        end
+
+        private def token_request(url, fields, client_secret: nil, auth_method: nil)
+          headers = { "Content-Type" => "application/x-www-form-urlencoded" }
+          if client_secret && auth_method == "client_secret_basic"
+            credentials = Base64.strict_encode64("#{fields['client_id']}:#{client_secret}")
+            headers["Authorization"] = "Basic #{credentials}"
+          elsif client_secret
+            fields = fields.merge("client_secret" => client_secret)
+          end
+          response = @requester.call("POST", validate_https_url(url, "token endpoint"), headers,
+                                     URI.encode_www_form(fields))
+          parse_success_json(response, "OAuth token exchange")
+        end
+
+        private def normalize_token(token)
+          access_token = token["access_token"].to_s
+          raise Error, "OAuth token response contained no access token" if access_token.empty?
+          {
+            "access_token" => access_token,
+            "refresh_token" => token["refresh_token"],
+            "token_type" => token["token_type"] || "Bearer",
+            "expires_at" => @clock.call + token.fetch("expires_in", 3600).to_i
+          }
+        end
+
+        private def get_json(url, label)
+          response = @requester.call("GET", validate_https_url(url, label), { "Accept" => "application/json" }, nil)
+          parse_success_json(response, label)
+        end
+
+        private def parse_success_json(response, label)
+          status = response.status.to_i
+          raise Error, "#{label} failed with HTTP #{status}" unless status >= 200 && status < 300
+          body = response.body.to_s
+          raise Error, "#{label} response was too large" if body.bytesize > MAX_RESPONSE_BYTES
+          value = JSON.parse(body)
+          raise JSON::ParserError unless value.is_a?(Hash)
+          value
+        rescue JSON::ParserError
+          raise Error, "#{label} returned invalid JSON"
+        end
+
+        private def validate_https_url(value, label)
+          uri = URI.parse(value.to_s)
+          unless uri.scheme == "https" && uri.host && !uri.host.empty? && !uri.user && !uri.password
+            raise Error, "#{label} must be an HTTPS URL without credentials"
+          end
+          uri.to_s
+        rescue URI::InvalidURIError
+          raise Error, "#{label} must be an HTTPS URL"
+        end
+
+        private def request(method, url, headers, body)
+          uri = URI.parse(url)
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = true
+          http.open_timeout = 10
+          http.read_timeout = 30
+          request_class = method == "GET" ? Net::HTTP::Get : Net::HTTP::Post
+          request = request_class.new(uri.request_uri)
+          headers.each { |key, value| request[key] = value }
+          request.body = body if body
+          response = http.request(request)
+          Response.new(response.code.to_i, response.each_header.to_h, response.body.to_s)
+        rescue StandardError => e
+          raise Error, "OAuth network request failed (#{e.class})"
+        end
+
+        class CallbackReceiver
+          attr_reader :redirect_uri
+
+          def initialize(timeout: 300)
+            @server = TCPServer.new("127.0.0.1", 0)
+            @timeout = timeout
+            @redirect_uri = "http://127.0.0.1:#{@server.addr[1]}/callback"
+          end
+
+          def call(authorization_url, _expected_state)
+            open_browser(authorization_url)
+            socket = Timeout.timeout(@timeout) { @server.accept }
+            request_line = socket.gets.to_s
+            path = request_line.split(" ")[1].to_s
+            query = URI.decode_www_form(URI.parse(path).query.to_s).to_h
+            socket.write("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nOpenClacky authorization complete. You may close this tab.\n")
+            query
+          rescue Timeout::Error
+            raise Error, "OAuth authorization timed out"
+          ensure
+            socket.close if defined?(socket) && socket
+          end
+
+          def close
+            @server.close unless @server.closed?
+          end
+
+          private def open_browser(url)
+            command = if RUBY_PLATFORM.include?("darwin")
+                        ["open", url]
+                      elsif RUBY_PLATFORM =~ /mswin|mingw|cygwin/
+                        ["cmd", "/c", "start", "", url]
+                      else
+                        ["xdg-open", url]
+                      end
+            opened = system(*command, out: File::NULL, err: File::NULL)
+            raise Error, "could not open a browser for OAuth authorization" unless opened
+          end
+        end
+      end
+    end
+  end
+end