openclacky 1.5.12 → 1.5.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 858730306a6e6647d79a5ebb35160c52fba7ed26c62ec97043373e7f052332e2
-  data.tar.gz: b412bc405daae81f1b6d71dd4dd2dffc197a00ac97540ecfd4916f7daf58843d
+  metadata.gz: ca259b2f17df9695e21c4d4c4f18ee83affec0fc41d67db829d903e1c3bb008d
+  data.tar.gz: b0bfd31378c6b452a7aef246d3d316242a91fa6366f543c45edcff8c3f44ac6c
 SHA512:
-  metadata.gz: 685d67556e68efd81a8bc446edd473a57939f0404b754e4432c7d29e073d2c47adc0c939fc5da3ea32144f3c6026aa17d73ff4766420399515089a3a8a4bc98d
-  data.tar.gz: dc85168d4b103185d20087635cfc5972c4e3e23b8dee95cb2ba28017d276dda425d8d92d23159dad463bd6cdcc29b8e02404d50dd4a79e5e6345193e8b4167c8
+  metadata.gz: cfcb5b28264aeb2acb6b121b89c395e4e9241b3a3135c2e9fb7d565365ed263c701f939448a2c01cb229359cca11402b36b081d4edff6231ce8e46e72d253498
+  data.tar.gz: 95cca310ebd8e0a23b1f1e5aed241b6e5fbc19aa206fdb16301dfd3b90f07e33424a44686c10b2d6cf4d3344c75eab2c033d7b3e4e7ef6c9a40b7879dd07a88b

data/CHANGELOG.md

@@ -4,6 +4,54 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
+## [1.5.13] - 2026-09-03
+
+### Added
+- Add Gemini 3.8 Flash model and set it as the trial default
+- Add or-stt-gemini-3-8-flash speech-to-text model; default STT and video understanding to 3.8
+- Add OpenAI Responses API as a fourth API format (#490 - @kylezhang)
+- Add access-key API and config-reload API
+- Add Claude Fable 5.1, GLM-5.3-Flash and qwen3.8-max models with pricing
+- Default the Web UI to the OS/browser language on first visit
+- Make the workspace file tree resizable
+- Expose mounted drives in the directory picker
+- Personalize the new-session page title and empty-chat greeting with the AI's name
+- Localise built-in setup session titles
+
+### Improved
+- Replace native selects with shared CustomSelect dropdowns across settings
+- Overhaul the git & time-machine panel
+- Improve the directory picker (#521)
+
+### Fixed
+- Merge OpenClacky billing across all configured API keys
+- Preserve custom provider and API format when editing a model
+- Reclaim PTY file descriptors when a session shell dies
+- Wrap ANSI-coloured CJK text without IndexError
+- Prevent history edits while a session is running (#520)
+- Preserve attachment badges after compression (#516)
+- Flag hidden agents instead of dropping them
+- Install upgrades next to the running gem's base directory
+- Skip extension auto-sync for administrators (#515)
+- Support the mention menu with Windows IME (#513)
+- Validate extension version input (#514)
+- Keep mention chips anchored and on one line while typing
+- Fall back to uncolored markdown for CJK tables
+- Stabilise billing toolbar layout (#517)
+- Light the group unread dot for backend-created sessions (#518)
+- Translate maximum reasoning effort (#522)
+- Harden WSL Windows profile detection in the directory picker
+- Wrap download errors so the CDN fallback fires
+- Surface the git tab badge eagerly
+- Show the meeting panel only in general sessions
+- Whitelist the config top-level key in the extension verifier
+
+### More
+- Extract shared ModelPicker model dropdown component
+- Refine dropdown chevrons and submenu selection
+- Adjust sidebar panel order and labels
+- Update trial model copy to Gemini 3.7 Flash
+
 ## [1.5.12] - 2026-08-27
 
 ### Added

data/lib/clacky/access_key.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "securerandom"
+
+module Clacky
+  # Access key for server-mode authentication.
+  #
+  # Two sources, in priority order:
+  #   1. ~/.clacky/access_key — a file holding the raw key, writable from
+  #      outside the process (e.g. a sandbox host pushing a key into a
+  #      pre-started container). This is what makes rotation possible:
+  #      ENV is a boot-time snapshot the running process can never change.
+  #   2. CLACKY_ACCESS_KEY env var — the original bootstrap mechanism.
+  module AccessKey
+    ENV_VAR = "CLACKY_ACCESS_KEY"
+
+    def self.resolve
+      from_file || from_env
+    end
+
+    def self.from_file
+      return nil unless File.exist?(key_file)
+
+      key = File.read(key_file).strip
+      key.empty? ? nil : key
+    rescue StandardError
+      nil
+    end
+
+    def self.from_env
+      key = ENV.fetch(ENV_VAR, "").strip
+      key.empty? ? nil : key
+    end
+
+    def self.write(key)
+      key = key.to_s.strip
+      raise ArgumentError, "access key must not be blank" if key.empty?
+
+      FileUtils.mkdir_p(File.dirname(key_file))
+      File.write(key_file, "#{key}\n")
+      FileUtils.chmod(0o600, key_file)
+      key
+    end
+
+    def self.generate
+      SecureRandom.hex(32)
+    end
+
+    def self.configured?
+      !resolve.nil?
+    end
+
+    # Resolved lazily so specs that stub Dir.home in a before-hook still work.
+    def self.key_file
+      File.join(Dir.home, ".clacky", "access_key")
+    end
+  end
+end

data/lib/clacky/agent/message_compressor_helper.rb

@@ -624,10 +624,12 @@ module Clacky
 
           case role
           when "user"
+            display_files = display_files_for_archive(msg)
             lines << (msg[:task_id] ? "## User [Task #{msg[:task_id]}]" : "## User")
             lines << ""
-            lines << format_message_content(content)
+            lines << format_archived_user_content(content, display_files)
             lines << ""
+            append_display_files_line(lines, display_files)
             append_ext_events_line(lines, msg)
           when "assistant"
             # If this message is itself a compressed summary, annotate the header
@@ -676,6 +678,55 @@ module Clacky
         lines
       end
 
+      # Serialize only the lightweight UI metadata needed to reconstruct file
+      # badges after compression. File paths, previews, sizes, MIME types, and
+      # contents deliberately stay out of the chunk archive.
+      def display_files_for_archive(msg)
+        files = Array(msg[:display_files]).dup
+        Array(msg[:content]).each do |block|
+          next unless block.is_a?(Hash)
+          next unless %w[image image_url].include?((block[:type] || block["type"]).to_s)
+
+          name = block[:image_name] || block["image_name"]
+          if name.nil? || name.to_s.strip.empty?
+            path = block[:image_path] || block["image_path"]
+            name = File.basename(path.to_s).sub(/\A[0-9a-f]{16}_/, "") unless path.to_s.empty?
+          end
+          name = "image" if name.nil? || name.to_s.strip.empty?
+          files << { name: name, type: "image" }
+        end
+
+        files.filter_map do |file|
+          next unless file.is_a?(Hash)
+
+          name = file[:name] || file["name"]
+          next if name.nil? || name.to_s.strip.empty?
+
+          type = file[:type] || file["type"] || "file"
+          type = "file" if type.to_s.strip.empty?
+          { name: name.to_s, type: type.to_s }
+        end.uniq { |file| [file[:name], file[:type]] }
+      end
+
+      # Once an image has a badge in the archive, omit the generic [image_url]
+      # placeholder from the visible replay text. Text blocks remain unchanged.
+      def format_archived_user_content(content, display_files)
+        return format_message_content(content) unless content.is_a?(Array)
+        return format_message_content(content) unless display_files.any? { |file| file[:type] == "image" }
+
+        visible_blocks = content.reject do |block|
+          block.is_a?(Hash) && %w[image image_url].include?((block[:type] || block["type"]).to_s)
+        end
+        format_message_content(visible_blocks)
+      end
+
+      def append_display_files_line(lines, files)
+        return if files.empty?
+
+        lines << "_Display files: #{files.to_json}_"
+        lines << ""
+      end
+
       # Serialize persisted extension events into the chunk MD so they survive
       # compression and can be replayed in place. Mirrors the "_Tool calls:"
       # convention; parse_chunk_md_to_rounds reads it back.

data/lib/clacky/agent/session_serializer.rb

@@ -534,6 +534,7 @@ module Clacky
         sections.each do |sec|
           text = sec[:lines].join.strip
           text, sec_ext_events = extract_ext_events_from_text(text)
+          text, sec_display_files = extract_display_files_from_text(text)
 
           # Nested chunk: expand it recursively, prepend before current rounds
           if sec[:nested_chunk]
@@ -546,7 +547,7 @@ module Clacky
             next
           end
 
-          next if text.empty? && sec_ext_events.empty?
+          next if text.empty? && sec_ext_events.empty? && sec_display_files.empty?
 
           if sec[:role] == "user"
             round_index += 1
@@ -560,6 +561,7 @@ module Clacky
               _from_chunk: true
             }
             user_msg[:task_id] = sec[:task_id] if sec[:task_id]
+            user_msg[:display_files] = sec_display_files unless sec_display_files.empty?
             current_round = {
               user_msg: user_msg,
               events: [],
@@ -618,6 +620,35 @@ module Clacky
       end
 
 
+      # Pull lightweight attachment badge metadata out of a chunk section.
+      # The marker is internal archive data and must not appear in replayed text.
+      # Only name + type are accepted; paths and file contents are never restored.
+      def extract_display_files_from_text(text)
+        return [text, []] unless text.include?("_Display files:")
+
+        files = []
+        kept = text.each_line.reject do |line|
+          match = line.strip.match(/\A_Display files:\s*(\[.*\])_?\z/i)
+          next false unless match
+
+          parsed = JSON.parse(match[1]) rescue []
+          Array(parsed).each do |file|
+            next unless file.is_a?(Hash)
+
+            name = file["name"] || file[:name]
+            next if name.nil? || name.to_s.strip.empty?
+
+            type = file["type"] || file[:type] || "file"
+            type = "file" if type.to_s.strip.empty?
+            files << { name: name.to_s, type: type.to_s }
+          end
+          true
+        end
+
+        [kept.join.strip, files]
+      end
+
+
       # Pull the "_Ext events: type | {json}; ..._" line out of a chunk section,
       # returning the remaining text plus the parsed events. Counterpart to
       # MessageCompressorHelper#append_ext_events_line.
@@ -948,7 +979,9 @@ module Clacky
 
           mime_type = (url || "")[/\Adata:([^;]+);/, 1] || "image/jpeg"
           ext       = mime_type.split("/").last
-          { name: "image_#{idx + 1}.#{ext}", mime_type: mime_type, data_url: url, path: path }
+          name      = block[:image_name] || block["image_name"]
+          name      = "image_#{idx + 1}.#{ext}" if name.nil? || name.to_s.strip.empty?
+          { name: name, mime_type: mime_type, data_url: url, path: path }
         end
       end
 

data/lib/clacky/agent/time_machine.rb

@@ -529,7 +529,15 @@ module Clacky
       private def looks_binary?(path)
         return false if path.nil? || !File.exist?(path)
         sample = File.binread(path, 8000)
-        sample.include?("\x00") || !sample.dup.force_encoding("UTF-8").valid_encoding?
+        return true if sample.include?("\x00")
+        sample.force_encoding("UTF-8")
+        # The 8000-byte window can cut a multibyte char in half; drop up to
+        # three dangling tail bytes before judging the encoding.
+        3.times do
+          break if sample.valid_encoding?
+          sample = sample.byteslice(0, sample.bytesize - 1)
+        end
+        !sample.valid_encoding?
       rescue StandardError
         true
       end

data/lib/clacky/agent.rb

@@ -568,9 +568,12 @@ module Clacky
       all_disk_files = disk_files + downgraded
 
       # Format user message — text + inline vision images
-      # Store the tmp path alongside the data_url so the history replay can
-      # reconstruct the image if the base64 was stripped (e.g. after compression).
-      user_content = format_user_content(user_input, vision_images.map { |v| { url: v[:url], path: v[:path] } })
+      # Store the tmp path and original name alongside the data_url: the path supports
+      # normal replay, while the name becomes the lightweight badge after compression.
+      user_content = format_user_content(
+        user_input,
+        vision_images.map { |v| { url: v[:url], path: v[:path], name: v[:name] } }
+      )
 
       # Parse disk files — agent's responsibility, not the upload layer.
       # process_path runs the parser script and returns a FileRef with preview_path or parse_error.
@@ -2351,10 +2354,10 @@ module Clacky
 
     # Build user message content for LLM.
     # Returns plain String when no vision images; Array of content parts otherwise.
-    # Build user message content for LLM.
-    # vision_images: Array of String (plain url) OR Hash { url:, path: }
-    # path is stored in the block so history replay can reconstruct the image
-    # from the tmp file when the base64 data_url is no longer available.
+    # vision_images: Array of String (plain url) OR Hash { url:, path:, name: }
+    # path is stored so normal history replay can reconstruct the image; name is
+    # lightweight metadata used for an archived badge after compression. Both
+    # fields are stripped by MessageHistory before the content reaches the API.
     private def format_user_content(text, vision_images)
       vision_images ||= []
 
@@ -2366,6 +2369,7 @@ module Clacky
         if img.is_a?(Hash)
           block = { type: "image_url", image_url: { url: img[:url] } }
           block[:image_path] = img[:path] if img[:path]
+          block[:image_name] = img[:name] if img[:name]
           content << block
         else
           content << { type: "image_url", image_url: { url: img } }

data/lib/clacky/agent_config.rb

@@ -402,6 +402,46 @@ module Clacky
       Clacky::ProxyConfig.reset_cache! if defined?(Clacky::ProxyConfig)
     end
 
+    # Re-read config.yml from disk and apply it to this instance in place.
+    #
+    # Two invariants make this safe for a running server:
+    #   1. @models is mutated with #replace, never reassigned — every session
+    #      built via #deep_copy shares that array by design (see #deep_copy).
+    #   2. Model ids are regenerated on every load and are not persisted, so
+    #      fresh entries inherit the id of the matching old entry (same model
+    #      name + base_url). Otherwise every session's @current_model_id
+    #      would dangle after a reload.
+    #
+    # Returns true when applied, false when the file could not be parsed —
+    # in-memory config is left untouched rather than wiped.
+    def reload!(config_file = CONFIG_FILE)
+      fresh = self.class.load(config_file)
+
+      fresh.models.each do |m|
+        previous = find_model_by_name_and_url(m["model"], m["base_url"])
+        m["id"] = previous["id"] if previous
+      end
+
+      @models.replace(fresh.models)
+
+      CONFIG_SETTINGS_KEYS.each do |key|
+        send("#{key}=", fresh.send(key))
+      end
+
+      # A session may have been pinned to a model the user just deleted.
+      unless @models.any? { |m| m["id"] == @current_model_id }
+        fallback = find_model_by_type("default") || @models.first
+        @current_model_id    = fallback && fallback["id"]
+        @current_model_index = fallback ? @models.index(fallback).to_i : 0
+      end
+
+      Clacky::ProxyConfig.reset_cache! if defined?(Clacky::ProxyConfig)
+      true
+    rescue StandardError => e
+      Clacky::Logger.warn("[AgentConfig] reload! failed: #{e.class}: #{e.message}") if defined?(Clacky::Logger)
+      false
+    end
+
     # Convert to YAML format (top-level array)
     # Auto-injected lite models (auto_injected: true) are excluded from persistence —
     # they are regenerated at load time from the provider preset.

data/lib/clacky/agent_profile.rb

@@ -88,11 +88,11 @@ module Clacky
     # @param recency [Hash<String, Integer>] agent id => epoch of last use,
     #   used to order third-party extension agents by most-recently-used
     #   instead of their static `order` field.
-    # @return [Array<Hash>] each: { id:, title:, title_zh:, description:, description_zh:, source:, order:, layer:, author:, avatar: }
+    # @return [Array<Hash>] each: { id:, title:, title_zh:, description:, description_zh:, source:, order:, layer:, author:, avatar:, hidden: }
     def self.all(recency: {})
       out = {}
 
-      add = lambda do |id, title, title_zh, description, description_zh, source, order, layer, author, avatar|
+      add = lambda do |id, title, title_zh, description, description_zh, source, order, layer, author, avatar, hidden|
         next if id.nil? || id.empty?
         out[id] = {
           id: id,
@@ -105,13 +105,13 @@ module Clacky
           layer: layer,
           author: author,
           avatar: avatar,
+          hidden: hidden,
         }
       end
 
       ext_result = ExtensionLoader.last_result || ExtensionLoader.load_all
       ext_result&.agents&.each do |unit|
         spec = unit.spec || {}
-        next if spec["hidden"]
         title = spec["title"].to_s
         title = unit.id if title.empty?
         avatar = spec["avatar_abs"].to_s.empty? ? nil : "/agent_avatar/#{unit.id}"
@@ -119,7 +119,7 @@ module Clacky
           unit.id, title, spec["title_zh"].to_s,
           spec["description"].to_s, spec["description_zh"].to_s,
           "extension", spec["order"], unit.layer.to_s,
-          spec["author"].to_s, avatar
+          spec["author"].to_s, avatar, !!spec["hidden"]
         )
       end
 
@@ -134,7 +134,7 @@ module Clacky
           id, meta["title"] || meta["name"] || id, meta["title_zh"].to_s,
           meta["description"].to_s, meta["description_zh"].to_s,
           "user", meta["order"], "user",
-          meta["author"].to_s.empty? ? "You" : meta["author"].to_s, user_avatar
+          meta["author"].to_s.empty? ? "You" : meta["author"].to_s, user_avatar, false
         )
       end
 

data/lib/clacky/billing/platform_billing.rb

@@ -21,6 +21,7 @@ module Clacky
         "dsk-deepseek-v4-flash"            => "deepseek-v4-flash",
         "dsk-deepseek-v4-flash-vision-exp" => "deepseek-v4-flash-vision-exp",
         # claude via bedrock (abs-)
+        "abs-claude-fable-5-1"  => "global.anthropic.claude-fable-5-1",
         "abs-claude-fable-5"    => "global.anthropic.claude-fable-5",
         "abs-claude-opus-5"     => "global.anthropic.claude-opus-5",
         "abs-claude-opus-4-8"   => "global.anthropic.claude-opus-4-8",
@@ -31,7 +32,8 @@ module Clacky
         "abs-claude-sonnet-4-5" => "global.anthropic.claude-sonnet-4-5",
         "abs-claude-haiku-4-5"  => "global.anthropic.claude-haiku-4-5",
         # gemini chat (or-)
-        "or-gemini-3-1-pro"  => "gemini-3.1-pro-preview",
+        "or-gemini-3-1-pro"   => "gemini-3.1-pro-preview",
+        "or-gemini-3-8-flash" => "gemini-3.8-flash",
         "or-gemini-3-7-flash" => "gemini-3.7-flash",
         "or-gemini-3-6-flash" => "gemini-3.6-flash",
         "or-gemini-3-5-flash" => "gemini-3.5-flash",
@@ -48,6 +50,7 @@ module Clacky
         "or-tts-gemini-2-5-flash" => "gemini-2.5-flash-tts",
         "or-tts-gemini-2-5-pro"   => "gemini-2.5-pro-tts",
         # speech-to-text (or-)
+        "or-stt-gemini-3-8-flash" => "gemini-3.8-flash",
         "or-stt-gemini-3-7-flash" => "gemini-3.7-flash",
         "or-stt-gemini-3-6-flash" => "gemini-3.6-flash",
         "or-stt-gemini-3-5-flash" => "gemini-3.5-flash",
@@ -62,6 +65,7 @@ module Clacky
         "google/gemini-3-pro-image-preview"  => "or-gemini-3-pro-image",
         # STT aliases reuse the chat real id; Hash#invert keeps the later STT
         # key, so pin these back to the chat alias for display.
+        "gemini-3.8-flash" => "or-gemini-3-8-flash",
         "gemini-3.7-flash" => "or-gemini-3-7-flash",
         "gemini-3.6-flash" => "or-gemini-3-6-flash",
         "gemini-3.5-flash" => "or-gemini-3-5-flash"
@@ -80,6 +84,26 @@ module Clacky
           ALIAS_TO_REAL[alias_name]
         end
 
+        # Fetch and merge usage summaries across multiple openclacky keys
+        # (e.g. several accounts). The platform bills per key, so summing
+        # per-key results yields the combined total. Failing keys
+        # (invalid/revoked) are skipped; returns nil only when every key fails.
+        def fetch_summary_merged(api_keys, period:, model: nil)
+          summaries = Array(api_keys).uniq.map { |key| fetch_summary(key, period: period, model: model) }.compact
+          return nil if summaries.empty?
+
+          summaries.reduce { |acc, summary| merge_summaries(acc, summary) }
+        end
+
+        # Fetch and merge daily breakdowns across multiple openclacky keys.
+        # Same skip-on-failure semantics as fetch_summary_merged.
+        def fetch_daily_merged(api_keys, days:, model: nil)
+          dailies = Array(api_keys).uniq.map { |key| fetch_daily(key, days: days, model: model) }.compact
+          return nil if dailies.empty?
+
+          { days: merge_daily_entries(dailies.flat_map { |daily| daily[:days] }) }
+        end
+
         # Fetch authoritative usage summary for the platform (openclacky).
         # Returns a hash shaped like BillingStore#summary, or nil on failure.
         def fetch_summary(api_key, period:, model: nil)
@@ -116,6 +140,65 @@ module Clacky
           nil
         end
 
+        private def merge_summaries(a, b)
+          merged = {}
+          (a.keys | b.keys).each do |key|
+            merged[key] =
+              case key
+              when :by_model then merge_by_model(a[:by_model], b[:by_model])
+              when :by_day   then merge_by_day(a[:by_day], b[:by_day])
+              else merge_value(a[key], b[key])
+              end
+          end
+          merged
+        end
+
+        private def merge_by_model(a, b)
+          merged = {}
+          (a || {}).each { |model, entry| merged[model] = entry }
+          (b || {}).each do |model, entry|
+            merged[model] = merged.key?(model) ? merge_entries(merged[model], entry) : entry
+          end
+          merged
+        end
+
+        private def merge_by_day(a, b)
+          merged = {}
+          (a || {}).each { |date, cost| merged[date] = cost.to_f }
+          (b || {}).each { |date, cost| merged[date] = (merged[date] || 0.0) + cost.to_f }
+          merged
+        end
+
+        private def merge_daily_entries(entries)
+          by_date = {}
+          entries.each do |entry|
+            next unless entry.is_a?(Hash)
+
+            date = entry[:date] || entry["date"]
+            next if date.nil?
+
+            by_date[date] = by_date.key?(date) ? merge_entries(by_date[date], entry) : entry
+          end
+          by_date.values.sort_by { |entry| entry[:date].to_s }
+        end
+
+        private def merge_entries(a, b)
+          merged = {}
+          (a.keys | b.keys).each { |key| merged[key] = merge_value(a[key], b[key]) }
+          merged
+        end
+
+        # Sum numeric leaf fields. Non-numeric fields (period, from/to,
+        # source) are identical across keys — they come from the same query
+        # shape — so the first value wins.
+        private def merge_value(a, b)
+          return b if a.nil?
+          return a if b.nil?
+          return a + b if a.is_a?(Numeric) && b.is_a?(Numeric)
+
+          a
+        end
+
         # Normalise the platform summary (string keys) to the same shape as
         # BillingStore#summary (symbol keys, symbol-keyed by_model entries).
         private def normalize_summary(data)

data/lib/clacky/brand_config.rb

@@ -912,14 +912,15 @@ module Clacky
       { success: false, error: e.message }
     end
 
-    # Synchronise brand extensions in the background for activated installs.
+    # Synchronise brand extensions in the background for activated consumer
+    # installs. Brand administrators manage extensions through ext-studio and
+    # must not auto-install the extensions they publish for consumers.
     # Mirrors sync_brand_skills_async! but installs into the extension layer.
-    # Unlike brand skills, new extensions are auto-installed because a bundled
-    # extension is chosen by the brand administrator, not the end user.
     #
     # @return [Thread, nil]
     def sync_brand_extensions_async!(on_complete: nil)
       return nil unless activated?
+      return nil if user_licensed?
       return nil if ENV["CLACKY_TEST"] == "1"
 
       Clacky::ThreadRegistry.spawn(name: "brand-fetch-extensions") do

data/lib/clacky/cli.rb

@@ -1349,8 +1349,8 @@ module Clacky
 
       # ── Security gate ──────────────────────────────────────────────────────
       # Binding to 0.0.0.0 exposes the server to the public network.
-      # Refuse to start unless CLACKY_ACCESS_KEY env var is set.
-      if options[:host] == "0.0.0.0" && !ENV.key?("CLACKY_ACCESS_KEY")
+      # Refuse to start unless an access key is available.
+      if options[:host] == "0.0.0.0" && !ENV.key?("CLACKY_ACCESS_KEY") && Clacky::AccessKey.from_file.nil?
         puts <<~MSG
           ╔══════════════════════════════════════════════════════════════╗
           ║  ⚠️  Security Warning: Refusing to start                      ║
@@ -1365,6 +1365,8 @@ module Clacky
           ║  Then export it:                                             ║
           ║    export CLACKY_ACCESS_KEY=<your-generated-key>             ║
           ║                                                              ║
+          ║  Or write it to ~/.clacky/access_key                         ║
+          ║                                                              ║
           ╚══════════════════════════════════════════════════════════════╝
         MSG
         exit(1)