Nanocoder v1.22.4 Release Notes — What's New

Security: Tool validators now run inside the AI SDK's auto-execution loop. Previously, tools with needsApproval: false (like read_file) were auto-executed by the AI SDK's generateText without any path validation, allowing the model to read or write files outside the project directory using absolute or ~ paths. Validators are now wrapped into each tool's execute function at registration time, ensuring validation runs in all code paths.
Security: Reject home directory shorthand (~) in file path validation. Paths starting with ~ are not expanded by Node.js and could bypass project boundary checks.
Fix: Tab characters in code blocks within assistant messages now render at 2-space width instead of the terminal default of 8 spaces. This prevents long lines from wrapping prematurely and eliminates the blocky visual effect on messages containing indented code.
Fix: normalizeIndentation no longer short-circuits when the minimum indent is 0. Previously, if any line in the context window had zero indentation, raw tab characters passed through to the terminal unchanged, rendering at 8-space width in string_replace diff previews.

npm install -g @nanocollective/nanocoder

nanocoder

Full Changelog: https://github.com/Nano-Collective/nanocoder/compare/v1.22.3...v1.22.4