view-network-request-details: includeBody coerces the string "false" to true #1538

view-network-request-details declares includeBody with z.coerce.boolean() (packages/tool-server/src/tools/network/network-request.ts:81), which is JS truthiness: the strings "false", "0" and "no" all parse to true. It is the only z.coerce.boolean() param left in packages/tool-server/src once #1385 fixes the screenshot-diff pair from #811.

Repro (zod 4.6.7, the same schema shape):

z.object({ b: z.coerce.boolean().default(true) })
"false" -> true
"0"     -> true
"no"    -> true
false   -> false

Trigger: an MCP or HTTP caller that sends "includeBody": "false" as a JSON string. The CLI is unaffected, since its flag parser maps false/0 itself.

Impact: the caller asked to leave the response body out, and gets it anyway (network-request.ts:202, :271, :280): up to 1000 more chars of body in the agent's context, plus a Network.getResponseBody CDP round trip on the Chromium path. Nothing says the value was ignored.