@tractorscorch/clank 1.5.3 → 1.5.4

package/CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ---
 
+## [1.5.4] — 2026-03-23
+
+### Fixed
+- **Streaming dies mid-answer with local models** — added per-chunk idle timeout (60s) that detects when the model hangs between chunks (GPU OOM, Ollama crash). Previously the only timeout was the 5-minute overall timer, which couldn't detect mid-stream stalls
+- **Incomplete responses treated as complete** — when a stream ends without the `[DONE]` marker (connection drop, model crash), the response is no longer silently accepted. The provider now throws an error so the agent retries instead of showing a half-finished answer
+- **Agent retry on stream failure** — the retry loop now resets partial state on retry and recognizes stream drops/empty responses as retryable errors, automatically attempting once more before giving up
+- **XSS in web dashboard** — 3 places where server data (`role`, `a.status`, `j.lastStatus`) was rendered as raw HTML without escaping (CodeQL CWE-79)
+- **Incomplete glob sanitization in search-files** — `.replace("*", "")` only stripped the first `*`; changed to `.replaceAll()` (CodeQL CWE-116)
+
+---
+
 ## [1.5.3] — 2026-03-23
 
 ### Fixed

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ItsTrag1c/Clank/releases/latest"><img src="https://img.shields.io/badge/version-1.5.3-blue.svg" alt="Version" /></a>
+  <a href="https://github.com/ItsTrag1c/Clank/releases/latest"><img src="https://img.shields.io/badge/version-1.5.4-blue.svg" alt="Version" /></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License" /></a>
   <a href="https://www.npmjs.com/package/@tractorscorch/clank"><img src="https://img.shields.io/npm/v/@tractorscorch/clank.svg" alt="npm" /></a>
   <a href="https://github.com/ItsTrag1c/Clank/stargazers"><img src="https://img.shields.io/github/stars/ItsTrag1c/Clank.svg" alt="Stars" /></a>
@@ -75,7 +75,7 @@ That's it. Setup auto-detects your local models, configures the gateway, and get
 | Platform | Download |
 |----------|----------|
 | **npm** (all platforms) | `npm install -g @tractorscorch/clank` |
-| **macOS** (Apple Silicon) | [Clank_1.5.3_macos](https://github.com/ItsTrag1c/Clank/releases/latest/download/Clank_1.5.3_macos) |
+| **macOS** (Apple Silicon) | [Clank_1.5.4_macos](https://github.com/ItsTrag1c/Clank/releases/latest/download/Clank_1.5.4_macos) |
 
 ## Features
 

package/dist/index.js

@@ -579,10 +579,20 @@ var init_ollama = __esm({
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = "";
+        let receivedDone = false;
+        let lastFinishReason = null;
+        let hasContent = false;
         const toolCalls = /* @__PURE__ */ new Map();
+        const CHUNK_IDLE_TIMEOUT = 6e4;
         try {
           while (true) {
-            const { done, value } = await reader.read();
+            const idleTimeout = new Promise(
+              (_, reject) => setTimeout(() => reject(new Error("Model stopped responding (no data for 60s)")), CHUNK_IDLE_TIMEOUT)
+            );
+            const { done, value } = await Promise.race([
+              reader.read(),
+              idleTimeout
+            ]);
             if (done) break;
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split("\n");
@@ -592,6 +602,7 @@ var init_ollama = __esm({
               if (!trimmed || !trimmed.startsWith("data: ")) continue;
               const data = trimmed.slice(6);
               if (data === "[DONE]") {
+                receivedDone = true;
                 for (const tc of toolCalls.values()) {
                   let parsedArgs = {};
                   try {
@@ -608,10 +619,15 @@ var init_ollama = __esm({
                 const chunk = JSON.parse(data);
                 const choice = chunk.choices?.[0];
                 if (!choice) continue;
+                if (choice.finish_reason) {
+                  lastFinishReason = choice.finish_reason;
+                }
                 if (choice.delta?.content) {
+                  hasContent = true;
                   yield { type: "text", content: choice.delta.content };
                 }
                 if (choice.delta?.tool_calls) {
+                  hasContent = true;
                   for (const tc of choice.delta.tool_calls) {
                     const existing = toolCalls.get(tc.index);
                     if (existing) {
@@ -641,14 +657,22 @@ var init_ollama = __esm({
         } finally {
           reader.releaseLock();
         }
-        for (const tc of toolCalls.values()) {
-          let parsedArgs = {};
-          try {
-            parsedArgs = JSON.parse(tc.arguments);
-          } catch {
-            parsedArgs = {};
+        if (!receivedDone && hasContent) {
+          for (const tc of toolCalls.values()) {
+            let parsedArgs = {};
+            try {
+              parsedArgs = JSON.parse(tc.arguments);
+            } catch {
+              parsedArgs = {};
+            }
+            yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
           }
-          yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
+          throw new Error(
+            lastFinishReason === "length" ? "Model response truncated (hit token limit)" : "Model stream ended unexpectedly (connection dropped)"
+          );
+        }
+        if (!receivedDone) {
+          throw new Error("Model returned empty response");
         }
         yield { type: "done" };
       }
@@ -914,6 +938,12 @@ var init_agent = __esm({
             let streamSuccess = false;
             this.emit("response-start");
             for (let attempt = 0; attempt < 2; attempt++) {
+              if (attempt > 0) {
+                iterationText = "";
+                toolCalls.length = 0;
+                promptTokens = 0;
+                outputTokens = 0;
+              }
               try {
                 const streamIterator = activeProvider.stream(
                   this.contextEngine.getMessages(),
@@ -948,10 +978,12 @@ var init_agent = __esm({
                 streamSuccess = true;
                 break;
               } catch (streamErr) {
-                const isTimeout = streamErr instanceof Error && (streamErr.name === "TimeoutError" || streamErr.name === "AbortError" || streamErr.message.includes("timed out"));
-                if (attempt === 0 && !signal.aborted && !isTimeout) {
+                const errMsg = streamErr instanceof Error ? streamErr.message : "unknown";
+                const isTimeout = streamErr instanceof Error && (streamErr.name === "TimeoutError" || streamErr.name === "AbortError" || errMsg.includes("timed out"));
+                const isRetryable = !isTimeout && !signal.aborted && (errMsg.includes("connection dropped") || errMsg.includes("stopped responding") || errMsg.includes("empty response") || errMsg.includes("fetch failed") || errMsg.includes("ECONNREFUSED") || errMsg.includes("ECONNRESET"));
+                if (attempt === 0 && (isRetryable || !signal.aborted && !isTimeout)) {
                   this.emit("error", {
-                    message: `Model connection failed, retrying... (${streamErr instanceof Error ? streamErr.message : "unknown"})`,
+                    message: `Model stream failed, retrying... (${errMsg})`,
                     recoverable: true
                   });
                   await new Promise((r) => setTimeout(r, 2e3));
@@ -1700,7 +1732,7 @@ var init_search_files = __esm({
               await searchDir(full);
             } else if (s.isFile() && s.size < 1024 * 1024) {
               if (globFilter) {
-                const ext = globFilter.replace("*", "");
+                const ext = globFilter.replaceAll("*", "");
                 if (!entry.endsWith(ext)) continue;
               }
               try {
@@ -3021,10 +3053,20 @@ var init_openai = __esm({
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = "";
+        let receivedDone = false;
+        let lastFinishReason = null;
+        let hasContent = false;
         const toolCalls = /* @__PURE__ */ new Map();
+        const CHUNK_IDLE_TIMEOUT = this.isLocal ? 6e4 : 3e4;
         try {
           while (true) {
-            const { done, value } = await reader.read();
+            const idleTimeout = new Promise(
+              (_, reject) => setTimeout(() => reject(new Error("Model stopped responding (no data received)")), CHUNK_IDLE_TIMEOUT)
+            );
+            const { done, value } = await Promise.race([
+              reader.read(),
+              idleTimeout
+            ]);
             if (done) break;
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split("\n");
@@ -3034,6 +3076,7 @@ var init_openai = __esm({
               if (!trimmed.startsWith("data: ")) continue;
               const data = trimmed.slice(6);
               if (data === "[DONE]") {
+                receivedDone = true;
                 for (const tc of toolCalls.values()) {
                   let parsedArgs = {};
                   try {
@@ -3049,7 +3092,11 @@ var init_openai = __esm({
               try {
                 const chunk = JSON.parse(data);
                 const choice = chunk.choices?.[0];
+                if (choice?.finish_reason) {
+                  lastFinishReason = choice.finish_reason;
+                }
                 if (choice?.delta?.reasoning_content) {
+                  hasContent = true;
                   if (this.isLocal) {
                     yield { type: "text", content: choice.delta.reasoning_content };
                   } else {
@@ -3057,9 +3104,11 @@ var init_openai = __esm({
                   }
                 }
                 if (choice?.delta?.content) {
+                  hasContent = true;
                   yield { type: "text", content: choice.delta.content };
                 }
                 if (choice?.delta?.tool_calls) {
+                  hasContent = true;
                   for (const tc of choice.delta.tool_calls) {
                     const existing = toolCalls.get(tc.index);
                     if (existing) {
@@ -3087,14 +3136,22 @@ var init_openai = __esm({
         } finally {
           reader.releaseLock();
         }
-        for (const tc of toolCalls.values()) {
-          let parsedArgs = {};
-          try {
-            parsedArgs = JSON.parse(tc.arguments);
-          } catch {
-            parsedArgs = {};
+        if (!receivedDone && hasContent) {
+          for (const tc of toolCalls.values()) {
+            let parsedArgs = {};
+            try {
+              parsedArgs = JSON.parse(tc.arguments);
+            } catch {
+              parsedArgs = {};
+            }
+            yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
           }
-          yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
+          throw new Error(
+            lastFinishReason === "length" ? "Model response truncated (hit token limit)" : "Model stream ended unexpectedly (connection dropped)"
+          );
+        }
+        if (!receivedDone) {
+          throw new Error("Model returned empty response");
         }
         yield { type: "done" };
       }
@@ -6170,7 +6227,7 @@ var init_server = __esm({
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             status: "ok",
-            version: "1.5.3",
+            version: "1.5.4",
             uptime: process.uptime(),
             clients: this.clients.size,
             agents: this.engines.size
@@ -6282,7 +6339,7 @@ var init_server = __esm({
         const hello = {
           type: "hello",
           protocol: PROTOCOL_VERSION,
-          version: "1.5.3",
+          version: "1.5.4",
           agents: this.config.agents.list.map((a) => ({
             id: a.id,
             name: a.name || a.id,
@@ -7677,7 +7734,7 @@ async function runTui(opts) {
   ws.on("open", () => {
     ws.send(JSON.stringify({
       type: "connect",
-      params: { auth: { token }, mode: "tui", version: "1.5.3" }
+      params: { auth: { token }, mode: "tui", version: "1.5.4" }
     }));
   });
   ws.on("message", (data) => {
@@ -8106,7 +8163,7 @@ import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname5, join as join19 } from "path";
 var __filename3 = fileURLToPath5(import.meta.url);
 var __dirname3 = dirname5(__filename3);
-var version = "1.5.3";
+var version = "1.5.4";
 try {
   const pkg = JSON.parse(readFileSync(join19(__dirname3, "..", "package.json"), "utf-8"));
   version = pkg.version;