v0.1.58

Highlights

• 🔒 NATS stays on this computer. The message bus between the API and the agents now listens on 127.0.0.1 only. It used to bind every network interface with no authentication, so on a machine without a firewall anyone on the local network could reach it. Desktop app and pnpm serve alike.
• 🌐 Server mode says the right thing on its first start. With HYDRA_HOST=0.0.0.0 and no token yet, the API generates HYDRA_AUTH_TOKEN and saves it in the .env; pnpm serve now reads it back and prints the network URLs (http://192.168.x.x:3000) instead of warning that the API stayed on loopback while it had in fact opened the port. The API's listening on line shows the real address.
• 🛡️ Media harvesting, hardened. An image, video or 3D file a connection's tool names in its answer is fetched only from that connection's own server (the address in its settings), never following redirects, with a streamed size cap (300 MB) and a cap on attempts and time per result; duplicates are told apart by content, not by name and size.
• 📊 Each model step's size travels with the result. The task's result keeps, per round, the provider's token counts and how many characters went to instructions, history, tool results and tool definitions — the data needed to see what weighs in a call. The same file produced twice in one task is registered once.
• 📖 Docs: a fresh install starts with no agents (the installation page said it seeded an example one).

What's Changed

• tasks: each model step's size is kept with the result, and the same file is registered once per task by @TraX22 in #155
• tools: harvesting a connection's media fetches only that connection's server, without redirects, with a streamed size cap and a cap on attempts by @TraX22 in #156
• server mode: NATS stays on loopback, pnpm serve prints the right network URLs on its first start, and the docs say a fresh install has no agents by @TraX22 in #157

Full Changelog: v0.1.57...v0.1.58