Merge latest main to resolve review feedback dependencies

Author: mouse-value-add

.changeset/agents-config-schema.md

@@ -0,0 +1,5 @@
+---
+'@nanocollective/nanocoder': minor
+---
+
+Publish a JSON Schema for `agents.config.json` as `schemas/agents.config.schema.json`. It is generated deterministically from the on-disk `DiskConfig` type (`pnpm run generate:schema`), ships with an Ajv validation suite plus a CI drift check, and enables editor autocompletion — either by dropping the `$schema` key into your config or by wiring up the schema via `jsonValidation` / a JSON Schema mapping in your editor.

.changeset/big-states-wink.md

@@ -0,0 +1,6 @@
+---
+"@nanocollective/nanocoder": patch
+---
+
+Fix fetch_url truncation warning to display the content limit in characters.
+  

.changeset/changeset-status-gate.md

@@ -1,3 +1,2 @@
 ---
 ---
-

.changeset/fetch-url-localhost-subdomains.md

@@ -0,0 +1,5 @@
+---
+'@nanocollective/nanocoder': patch
+---
+
+fetch_url now blocks the whole `.localhost` zone, not just the bare `localhost` label. RFC 6761 reserves it for loopback and systemd-resolved resolves every label under it to 127.0.0.1, so `http://foo.localhost` reached a local service on Linux. Real hosts that merely contain the string (`localhost.example.com`) are unaffected.

.changeset/fetch-url-private-hosts.md

@@ -0,0 +1,5 @@
+---
+'@nanocollective/nanocoder': patch
+---
+
+fetch_url now rejects the request URL inside execute, not only the validator. readOnly tools skip confirmation, so yolo/headless/subagents never ran the old hostname list. Blocks loopback CIDR, RFC1918, and GCP metadata names (`metadata`, `metadata.goog`, `metadata.google.internal`). HTTP redirects and DNS rebinding are not covered (#1089).

.changeset/fix-checkpoint-binary-snapshots.md

@@ -0,0 +1,7 @@
+---
+"@nanocollective/nanocoder": patch
+---
+
+Fixed checkpoints irrecoverably corrupting binary files. Every layer of the pipeline read and wrote contents as UTF-8, so each byte of an image, `.vsix` bundle or database came back as U+FFFD — and because the damage was done at save time, the checkpoint itself held nothing left to recover. Snapshots are now carried as `Buffer` and written with no encoding argument; text still round-trips byte-identically.
+
+A checkpoint that came out incomplete also restored in silence. Files that could not be read at capture, and files dropped by the `MAX_CHECKPOINT_FILES` cap, are now recorded on the checkpoint's metadata and named when it is restored. Old checkpoints still load, though binaries captured before this fix stay corrupt. Closes #962.

.changeset/fix-compactToolDisplay-preferences.md

@@ -3,4 +3,3 @@
 ---
 
 Fix Expand Tool Results label inverted and compactToolDisplay preference never read at startup
-  

.changeset/mcp-development-mode-policy.md

@@ -0,0 +1,5 @@
+---
+"@nanocollective/nanocoder": patch
+---
+
+Fixed MCP tools bypassing the development-mode policy that governs every other tool. MCP built its own approval predicate rather than routing through the central mode system, which failed in two directions: a tool on a server's `alwaysAllow` list collapsed to "never needs approval" in *every* mode, so plan mode executed mutating MCP tools with no prompt despite being the mode you switch into specifically to inspect an untrusted model's intentions without side effects; and every other MCP tool required approval in headless, where no approval handler exists, so daemon-triggered skill runs failed with "Tool execution was denied by the user" when no user was ever asked. MCP tools now take the same posture as built-in tools — headless runs them unattended like `execute_bash` and the file tools, and plan mode gates them on the server's `readOnlyHint` annotation, treating an unannotated tool as a possible mutation and hiding it. A server's `alwaysAllow` list now applies in normal mode only, as its documentation already stated, and can no longer override plan mode. `readOnlyHint` decides plan-mode availability only: because it is supplied by the same server being gated, it never skips a confirmation prompt in normal mode — the user's own `alwaysAllow` list remains the only way to do that.

.changeset/mcp-readonly-hint-scope.md

@@ -0,0 +1,5 @@
+---
+"@nanocollective/nanocoder": patch
+---
+
+Confined the MCP `readOnlyHint` annotation to plan-mode availability, and made `"enabled": false` actually disable an MCP server. The `readOnlyHint` a server reports was being copied onto its registered tool entries, where `ToolManager.isReadOnly()` also decides whether ACP captures a checkpoint before the call and whether the tool joins a parallel execution batch — so a server annotating itself read-only could talk its way out of a restore point. The hint now lives on the MCP tool mapping, which only plan-mode filtering reads, exactly as the documentation describes. Separately, `enabled` was loaded from config and then ignored: every configured server connected regardless, including in headless runs where MCP tools execute unattended and `"enabled": false` is the only documented opt-out. Disabled servers are now skipped before any connection is attempted.

.changeset/olive-moons-judge.md

@@ -0,0 +1,5 @@
+---
+"@nanocollective/nanocoder": patch
+---
+
+Fixed a slash command with leading whitespace being sent to the model as a chat message instead of running. `parseInput` trims before testing for the `/` prefix but the routing in `handleMessageSubmission` did not, so `  /help` reached the LLM. With lifecycle hooks configured it also fired `user-prompt-submit` and consumed buffered `session-start` context for an input that never reaches the model. Both the routing and the hook's local-action check now trim, matching the `!` bash passthrough. Also added `nanocoder.hooks` to the `agents.config.json` JSON Schema — hooks landed alongside the schema and were missing from it, so every documented hooks example was flagged as an unknown key in editors.