$ show openclaw/clickclack
ClickClack is a production-grade, self-hostable team chat platform built for people, bots, and agents. The backend is a single Go binary serving a REST API with WebSocket real-time events, supporting both SQLite and PostgreSQL as interchangeable storage backends. The frontend is a Svelte 5 single-page application embedded into the Go binary, with an optional Electron desktop client and a TypeScript SDK for bot development. The system provides workspaces, channels, threads, direct messages, file uploads, full-text search, reactions, pinned messages, slash commands, event subscriptions, and push notifications (Web Push and Pushover). Authentication supports magic links, passwords (Argon2id), GitHub OAuth, and Cloudflare Access JWT. The architecture emphasizes security with SSRF-safe callback dialers, strict cookie namespacing, rate limiting, and bot scope enforcement. The codebase is notable for its dual-database store pattern with shared contract tests, a real-time event hub with cursor-based recovery, and a comprehensive test suite including unit, integration, and Playwright end-to-end tests. It is not a data research project; it is a fully featured application designed for self-hosting or cloud deployment.
The LLM identified 4 files worth highlighting for reuse:
Implements RFC 8291 Web Push message encryption (aes128gcm) with 16-byte salt, content encryption key derivation, and authentication tag. Self-contained, uses only standard library crypto packages, and can be extracted for any project needing push notification encryption.
Provides a custom HTTP dialer that prevents Server-Side Request Forgery (SSRF) by restricting connections to public TCP addresses only. It resolves hostnames, validates IPs against a curated blocklist of special-purpose ranges (e.g., 0.0.0.0/8, 100.64.0.0/10, Azure metadata), and enforces a 3-second timeout. The dialer is injectable for testing and can be reused in any Go service that makes outbound HTTP callbacks.
Implements password hashing and verification using Argon2id with configurable parameters (memory 64 MiB, iterations 3, parallelism 2). Includes a 'decoy' verification path that runs Argon2 for unknown accounts to prevent timing attacks. The package is self-contained, uses only standard library and golang.org/x/crypto, and can be extracted for any Go authentication system.
Manages theme customization for embedded chat widgets via cross-origin messaging (postMessage). Listens for theme change events from the host page, applies CSS custom properties, and persists the theme across page navigations. Self-contained, framework-agnostic, and can be reused in any web embedding scenario requiring dynamic theming.