@tractorscorch/clank 1.5.8 → 1.5.10

package/CHANGELOG.md

@@ -6,6 +6,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ---
 
+## [1.5.10] — 2026-03-23
+
+### Fixed
+- **Telegram/Discord hangs forever when agent uses tools** — medium/high safety tools (bash, write_file, edit_file) require user confirmation, but the adapter streaming path had no confirmation handler. The engine would emit `confirm-needed`, nobody would respond, and the agent hung indefinitely with Telegram stuck on "typing". Now auto-approves all tool confirmations for non-interactive channels
+
+---
+
+## [1.5.9] — 2026-03-23
+
+### Changed
+- **Workspace defaults to current directory** — the agent's workspace is now the directory you run `clank` from, not a hidden `%APPDATA%/Clank/workspace` folder. This means the agent works with your actual project files out of the box
+- **Full file system access** — the path guard no longer blocks reads/writes outside the workspace. Clank is a dev tool and needs to access the full system. Added security notice to README recommending dedicated hardware
+
+### Fixed
+- **Telegram `/new` and `/reset` were no-ops** — these commands returned a "session started" message but never actually reset the session. The model kept its full conversation history. Now properly clears session store, context engine, and destroys the old engine instance
+- **Security notice added to README** — recommends running Clank on dedicated hardware since it gives agents full system access
+
+---
+
 ## [1.5.8] — 2026-03-23
 
 ### Added

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ItsTrag1c/Clank/releases/latest"><img src="https://img.shields.io/badge/version-1.5.8-blue.svg" alt="Version" /></a>
+  <a href="https://github.com/ItsTrag1c/Clank/releases/latest"><img src="https://img.shields.io/badge/version-1.5.10-blue.svg" alt="Version" /></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License" /></a>
   <a href="https://www.npmjs.com/package/@tractorscorch/clank"><img src="https://img.shields.io/npm/v/@tractorscorch/clank.svg" alt="npm" /></a>
   <a href="https://github.com/ItsTrag1c/Clank/stargazers"><img src="https://img.shields.io/github/stars/ItsTrag1c/Clank.svg" alt="Stars" /></a>
@@ -75,7 +75,13 @@ That's it. Setup auto-detects your local models, configures the gateway, and get
 | Platform | Download |
 |----------|----------|
 | **npm** (all platforms) | `npm install -g @tractorscorch/clank` |
-| **macOS** (Apple Silicon) | [Clank_1.5.8_macos](https://github.com/ItsTrag1c/Clank/releases/latest/download/Clank_1.5.8_macos) |
+| **macOS** (Apple Silicon) | [Clank_1.5.10_macos](https://github.com/ItsTrag1c/Clank/releases/latest/download/Clank_1.5.10_macos) |
+
+## Security Notice
+
+Clank is a **developer tool** that gives AI agents full access to your file system, shell, and connected services. The agent can read, write, and execute on your behalf.
+
+**We strongly recommend running Clank on dedicated hardware** (a dev machine, VM, or container) rather than on a system with sensitive personal files, credentials, or accounts you don't want the agent to access. Treat it like giving someone SSH access to your box.
 
 ## Features
 

package/dist/index.js

@@ -1044,6 +1044,7 @@ var init_agent = __esm({
               this.emit("tool-start", { id: tc.id, name: tc.name, arguments: tc.arguments });
               const toolCtx = {
                 projectRoot: this.identity.workspace,
+                allowExternal: true,
                 autoApprove: this.autoApprove,
                 agentId: this.identity.id,
                 signal
@@ -2099,7 +2100,7 @@ function defaultConfig() {
     agents: {
       defaults: {
         model: { primary: "ollama/qwen3.5" },
-        workspace: join6(getConfigDir(), "workspace"),
+        workspace: process.cwd(),
         toolTier: "auto",
         temperature: 0.7
       },
@@ -5697,9 +5698,15 @@ You can read this file with the read_file tool.`
             return "Use /new to start a fresh session, or /reset to clear the current one.";
           }
           case "new":
-            return "New session started. Send a message to begin.";
           case "reset":
-            return "Session reset. History cleared.";
+            if (this.gateway) {
+              await this.gateway.resetSession({
+                channel: "telegram",
+                peerId: chatId,
+                peerKind: isGroup ? "group" : "dm"
+              });
+            }
+            return command === "new" ? "New session started. Send a message to begin." : "Session reset. History cleared.";
           case "model": {
             const model = this.config?.agents?.defaults?.model?.primary || "unknown";
             return `Current model: \`${model}\``;
@@ -6134,6 +6141,20 @@ var init_server = __esm({
           }
         }
       }
+      /**
+       * Reset a session — clear its history and context.
+       * Used by channel adapters (Telegram /new, /reset commands).
+       */
+      async resetSession(context) {
+        const sessionKey = deriveSessionKey(context);
+        await this.sessionStore.reset(sessionKey);
+        const engine = this.engines.get(sessionKey);
+        if (engine) {
+          engine.getContextEngine().clear();
+          engine.destroy();
+          this.engines.delete(sessionKey);
+        }
+      }
       /**
        * Handle an inbound message from any channel adapter.
        * This is the main entry point for all non-WebSocket messages.
@@ -6198,6 +6219,12 @@ var init_server = __esm({
           engine.on("error", fn);
           listeners.push(["error", fn]);
         }
+        const confirmFn = (data) => {
+          const { resolve: resolve4 } = data;
+          resolve4("always");
+        };
+        engine.on("confirm-needed", confirmFn);
+        listeners.push(["confirm-needed", confirmFn]);
         try {
           console.log(`  Streaming: sending message to engine (session: ${sessionKey})`);
           const result = await engine.sendMessage(text);
@@ -6245,7 +6272,7 @@ var init_server = __esm({
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             status: "ok",
-            version: "1.5.8",
+            version: "1.5.10",
             uptime: process.uptime(),
             clients: this.clients.size,
             agents: this.engines.size
@@ -6357,7 +6384,7 @@ var init_server = __esm({
         const hello = {
           type: "hello",
           protocol: PROTOCOL_VERSION,
-          version: "1.5.8",
+          version: "1.5.10",
           agents: this.config.agents.list.map((a) => ({
             id: a.id,
             name: a.name || a.id,
@@ -7753,7 +7780,7 @@ async function runTui(opts) {
   ws.on("open", () => {
     ws.send(JSON.stringify({
       type: "connect",
-      params: { auth: { token }, mode: "tui", version: "1.5.8" }
+      params: { auth: { token }, mode: "tui", version: "1.5.10" }
     }));
   });
   ws.on("message", (data) => {
@@ -8182,7 +8209,7 @@ import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname5, join as join19 } from "path";
 var __filename3 = fileURLToPath5(import.meta.url);
 var __dirname3 = dirname5(__filename3);
-var version = "1.5.8";
+var version = "1.5.10";
 try {
   const pkg = JSON.parse(readFileSync(join19(__dirname3, "..", "package.json"), "utf-8"));
   version = pkg.version;