@tractorscorch/clank 1.5.3 → 1.5.5

package/CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ---
 
+## [1.5.5] — 2026-03-23
+
+### Fixed
+- **Local models refuse to use tools** — models claimed "I can't access your files" despite having `read_file`, `write_file`, etc. available. Strengthened the system prompt to explicitly tell the model it runs locally on the user's machine with direct file system access and must never refuse file operations
+
+---
+
+## [1.5.4] — 2026-03-23
+
+### Fixed
+- **Streaming dies mid-answer with local models** — added per-chunk idle timeout (60s) that detects when the model hangs between chunks (GPU OOM, Ollama crash). Previously the only timeout was the 5-minute overall timer, which couldn't detect mid-stream stalls
+- **Incomplete responses treated as complete** — when a stream ends without the `[DONE]` marker (connection drop, model crash), the response is no longer silently accepted. The provider now throws an error so the agent retries instead of showing a half-finished answer
+- **Agent retry on stream failure** — the retry loop now resets partial state on retry and recognizes stream drops/empty responses as retryable errors, automatically attempting once more before giving up
+- **XSS in web dashboard** — 3 places where server data (`role`, `a.status`, `j.lastStatus`) was rendered as raw HTML without escaping (CodeQL CWE-79)
+- **Incomplete glob sanitization in search-files** — `.replace("*", "")` only stripped the first `*`; changed to `.replaceAll()` (CodeQL CWE-116)
+
+---
+
 ## [1.5.3] — 2026-03-23
 
 ### Fixed

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ItsTrag1c/Clank/releases/latest"><img src="https://img.shields.io/badge/version-1.5.3-blue.svg" alt="Version" /></a>
+  <a href="https://github.com/ItsTrag1c/Clank/releases/latest"><img src="https://img.shields.io/badge/version-1.5.5-blue.svg" alt="Version" /></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License" /></a>
   <a href="https://www.npmjs.com/package/@tractorscorch/clank"><img src="https://img.shields.io/npm/v/@tractorscorch/clank.svg" alt="npm" /></a>
   <a href="https://github.com/ItsTrag1c/Clank/stargazers"><img src="https://img.shields.io/github/stars/ItsTrag1c/Clank.svg" alt="Stars" /></a>
@@ -75,7 +75,7 @@ That's it. Setup auto-detects your local models, configures the gateway, and get
 | Platform | Download |
 |----------|----------|
 | **npm** (all platforms) | `npm install -g @tractorscorch/clank` |
-| **macOS** (Apple Silicon) | [Clank_1.5.3_macos](https://github.com/ItsTrag1c/Clank/releases/latest/download/Clank_1.5.3_macos) |
+| **macOS** (Apple Silicon) | [Clank_1.5.5_macos](https://github.com/ItsTrag1c/Clank/releases/latest/download/Clank_1.5.5_macos) |
 
 ## Features
 

package/dist/index.js

@@ -579,10 +579,20 @@ var init_ollama = __esm({
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = "";
+        let receivedDone = false;
+        let lastFinishReason = null;
+        let hasContent = false;
         const toolCalls = /* @__PURE__ */ new Map();
+        const CHUNK_IDLE_TIMEOUT = 6e4;
         try {
           while (true) {
-            const { done, value } = await reader.read();
+            const idleTimeout = new Promise(
+              (_, reject) => setTimeout(() => reject(new Error("Model stopped responding (no data for 60s)")), CHUNK_IDLE_TIMEOUT)
+            );
+            const { done, value } = await Promise.race([
+              reader.read(),
+              idleTimeout
+            ]);
             if (done) break;
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split("\n");
@@ -592,6 +602,7 @@ var init_ollama = __esm({
               if (!trimmed || !trimmed.startsWith("data: ")) continue;
               const data = trimmed.slice(6);
               if (data === "[DONE]") {
+                receivedDone = true;
                 for (const tc of toolCalls.values()) {
                   let parsedArgs = {};
                   try {
@@ -608,10 +619,15 @@ var init_ollama = __esm({
                 const chunk = JSON.parse(data);
                 const choice = chunk.choices?.[0];
                 if (!choice) continue;
+                if (choice.finish_reason) {
+                  lastFinishReason = choice.finish_reason;
+                }
                 if (choice.delta?.content) {
+                  hasContent = true;
                   yield { type: "text", content: choice.delta.content };
                 }
                 if (choice.delta?.tool_calls) {
+                  hasContent = true;
                   for (const tc of choice.delta.tool_calls) {
                     const existing = toolCalls.get(tc.index);
                     if (existing) {
@@ -641,14 +657,22 @@ var init_ollama = __esm({
         } finally {
           reader.releaseLock();
         }
-        for (const tc of toolCalls.values()) {
-          let parsedArgs = {};
-          try {
-            parsedArgs = JSON.parse(tc.arguments);
-          } catch {
-            parsedArgs = {};
+        if (!receivedDone && hasContent) {
+          for (const tc of toolCalls.values()) {
+            let parsedArgs = {};
+            try {
+              parsedArgs = JSON.parse(tc.arguments);
+            } catch {
+              parsedArgs = {};
+            }
+            yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
           }
-          yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
+          throw new Error(
+            lastFinishReason === "length" ? "Model response truncated (hit token limit)" : "Model stream ended unexpectedly (connection dropped)"
+          );
+        }
+        if (!receivedDone) {
+          throw new Error("Model returned empty response");
         }
         yield { type: "done" };
       }
@@ -914,6 +938,12 @@ var init_agent = __esm({
             let streamSuccess = false;
             this.emit("response-start");
             for (let attempt = 0; attempt < 2; attempt++) {
+              if (attempt > 0) {
+                iterationText = "";
+                toolCalls.length = 0;
+                promptTokens = 0;
+                outputTokens = 0;
+              }
               try {
                 const streamIterator = activeProvider.stream(
                   this.contextEngine.getMessages(),
@@ -948,10 +978,12 @@ var init_agent = __esm({
                 streamSuccess = true;
                 break;
               } catch (streamErr) {
-                const isTimeout = streamErr instanceof Error && (streamErr.name === "TimeoutError" || streamErr.name === "AbortError" || streamErr.message.includes("timed out"));
-                if (attempt === 0 && !signal.aborted && !isTimeout) {
+                const errMsg = streamErr instanceof Error ? streamErr.message : "unknown";
+                const isTimeout = streamErr instanceof Error && (streamErr.name === "TimeoutError" || streamErr.name === "AbortError" || errMsg.includes("timed out"));
+                const isRetryable = !isTimeout && !signal.aborted && (errMsg.includes("connection dropped") || errMsg.includes("stopped responding") || errMsg.includes("empty response") || errMsg.includes("fetch failed") || errMsg.includes("ECONNREFUSED") || errMsg.includes("ECONNRESET"));
+                if (attempt === 0 && (isRetryable || !signal.aborted && !isTimeout)) {
                   this.emit("error", {
-                    message: `Model connection failed, retrying... (${streamErr instanceof Error ? streamErr.message : "unknown"})`,
+                    message: `Model stream failed, retrying... (${errMsg})`,
                     recoverable: true
                   });
                   await new Promise((r) => setTimeout(r, 2e3));
@@ -1129,10 +1161,11 @@ async function buildSystemPrompt(opts) {
   }
   parts.push("");
   if (compact) {
-    parts.push("You are a helpful AI assistant with tools. Be concise. Use tools proactively. Read files before editing.");
+    parts.push("You are a local AI agent running on the user's machine with DIRECT file system access via tools. Be concise. Use tools proactively. Read files before editing. NEVER say you cannot access files \u2014 you CAN and MUST use your tools.");
   } else {
     parts.push("## Instructions");
-    parts.push("You are a helpful AI assistant with access to tools for reading/writing files, running commands, and more.");
+    parts.push("You are a local AI agent running directly on the user's machine. You have DIRECT access to the local file system, shell, and web.");
+    parts.push("You MUST use your tools (read_file, write_file, edit_file, list_directory, bash, etc.) to accomplish tasks. NEVER claim you cannot access, read, or modify files \u2014 you absolutely can through your tools.");
     parts.push("Be concise and direct. Use tools proactively to accomplish tasks.");
     parts.push("When you need to make changes, read the relevant files first to understand the context.");
     parts.push("You can configure yourself \u2014 use the config, channel, agent, and model management tools to modify your own setup.");
@@ -1700,7 +1733,7 @@ var init_search_files = __esm({
               await searchDir(full);
             } else if (s.isFile() && s.size < 1024 * 1024) {
               if (globFilter) {
-                const ext = globFilter.replace("*", "");
+                const ext = globFilter.replaceAll("*", "");
                 if (!entry.endsWith(ext)) continue;
               }
               try {
@@ -3021,10 +3054,20 @@ var init_openai = __esm({
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = "";
+        let receivedDone = false;
+        let lastFinishReason = null;
+        let hasContent = false;
         const toolCalls = /* @__PURE__ */ new Map();
+        const CHUNK_IDLE_TIMEOUT = this.isLocal ? 6e4 : 3e4;
         try {
           while (true) {
-            const { done, value } = await reader.read();
+            const idleTimeout = new Promise(
+              (_, reject) => setTimeout(() => reject(new Error("Model stopped responding (no data received)")), CHUNK_IDLE_TIMEOUT)
+            );
+            const { done, value } = await Promise.race([
+              reader.read(),
+              idleTimeout
+            ]);
             if (done) break;
             buffer += decoder.decode(value, { stream: true });
             const lines = buffer.split("\n");
@@ -3034,6 +3077,7 @@ var init_openai = __esm({
               if (!trimmed.startsWith("data: ")) continue;
               const data = trimmed.slice(6);
               if (data === "[DONE]") {
+                receivedDone = true;
                 for (const tc of toolCalls.values()) {
                   let parsedArgs = {};
                   try {
@@ -3049,7 +3093,11 @@ var init_openai = __esm({
               try {
                 const chunk = JSON.parse(data);
                 const choice = chunk.choices?.[0];
+                if (choice?.finish_reason) {
+                  lastFinishReason = choice.finish_reason;
+                }
                 if (choice?.delta?.reasoning_content) {
+                  hasContent = true;
                   if (this.isLocal) {
                     yield { type: "text", content: choice.delta.reasoning_content };
                   } else {
@@ -3057,9 +3105,11 @@ var init_openai = __esm({
                   }
                 }
                 if (choice?.delta?.content) {
+                  hasContent = true;
                   yield { type: "text", content: choice.delta.content };
                 }
                 if (choice?.delta?.tool_calls) {
+                  hasContent = true;
                   for (const tc of choice.delta.tool_calls) {
                     const existing = toolCalls.get(tc.index);
                     if (existing) {
@@ -3087,14 +3137,22 @@ var init_openai = __esm({
         } finally {
           reader.releaseLock();
         }
-        for (const tc of toolCalls.values()) {
-          let parsedArgs = {};
-          try {
-            parsedArgs = JSON.parse(tc.arguments);
-          } catch {
-            parsedArgs = {};
+        if (!receivedDone && hasContent) {
+          for (const tc of toolCalls.values()) {
+            let parsedArgs = {};
+            try {
+              parsedArgs = JSON.parse(tc.arguments);
+            } catch {
+              parsedArgs = {};
+            }
+            yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
           }
-          yield { type: "tool_call", id: tc.id, name: tc.name, arguments: parsedArgs };
+          throw new Error(
+            lastFinishReason === "length" ? "Model response truncated (hit token limit)" : "Model stream ended unexpectedly (connection dropped)"
+          );
+        }
+        if (!receivedDone) {
+          throw new Error("Model returned empty response");
         }
         yield { type: "done" };
       }
@@ -6170,7 +6228,7 @@ var init_server = __esm({
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             status: "ok",
-            version: "1.5.3",
+            version: "1.5.5",
             uptime: process.uptime(),
             clients: this.clients.size,
             agents: this.engines.size
@@ -6282,7 +6340,7 @@ var init_server = __esm({
         const hello = {
           type: "hello",
           protocol: PROTOCOL_VERSION,
-          version: "1.5.3",
+          version: "1.5.5",
           agents: this.config.agents.list.map((a) => ({
             id: a.id,
             name: a.name || a.id,
@@ -7677,7 +7735,7 @@ async function runTui(opts) {
   ws.on("open", () => {
     ws.send(JSON.stringify({
       type: "connect",
-      params: { auth: { token }, mode: "tui", version: "1.5.3" }
+      params: { auth: { token }, mode: "tui", version: "1.5.5" }
     }));
   });
   ws.on("message", (data) => {
@@ -8106,7 +8164,7 @@ import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname5, join as join19 } from "path";
 var __filename3 = fileURLToPath5(import.meta.url);
 var __dirname3 = dirname5(__filename3);
-var version = "1.5.3";
+var version = "1.5.5";
 try {
   const pkg = JSON.parse(readFileSync(join19(__dirname3, "..", "package.json"), "utf-8"));
   version = pkg.version;