build(deps): bump zod catalog to 4.6.7 by iscekic · Pull Request #8207 · Kilo-Org/cloud

iscekic · 2026-10-20T00:39:11Z

Change

Moves the shared pnpm-workspace.yaml catalog entry for zod from 4.4.3 to 4.6.7.

4.6.7 is the newest release that clears minimumReleaseAge: 6842 (published 2026-10-12, about 7 days before this branch). No gate change, no exemption.
55 workspace packages consume zod through catalog:, so the bump moves all of them in one step; pnpm-lock.yaml was regenerated with pnpm install.
services/cloud-agent-next/wrapper pins its own zod outside the catalog (it builds from its own dependency set). It moves to 4.6.7 as well so it does not drift from the workspace.
services/kilo-mcp/catalog.json regenerated because zod 4.6.7 renders JSON Schema differently from 4.4.3: nullable fields become type: ["x", "null"] instead of an anyOf pair, and the date-time pattern requires seconds. Without the regeneration the drift check in the kilocode-mcp-catalog workflow fails (src/scripts/mcp-catalog/catalog.test.ts).
.github/workflows/kilo-mcp-catalog.yml: both catalog jobs now install cloud-agent-next next to web. The dump enumerates apps/web's router graph, and apps/web/src/routers/cloud-agent-next-schemas.ts imports its schemas from services/cloud-agent-next by relative path — a project that is not in web's dependency closure. pnpm install --filter web... therefore left it uninstalled, its bare zod import fell through to pnpm's hoisted copy (4.4.3 in the filtered install, since knip still pulls that version), and the dump wrote JSON Schema in 4.4.3's shape while jest — which installs every project — wrote 4.6.7's. Two required checks then disagreed about the committed file, so either version failed one of them. With cloud-agent-next installed, services/cloud-agent-next/node_modules/zod is the workspace 4.6.7 and the dump is byte-identical to jest's output.

Third-party packages that declare zod themselves keep their own copy; no override was added for them.

Verification

Run on the branch checkout on a work VM.

Install: pnpm install --no-frozen-lockfile — lockfile catalog entry resolves zod to 4.6.7, and every one of the 55 importers that declared zod: catalog: now resolves 4.6.7.
Types: pnpm typecheck (full, since scripts/typecheck-all.sh forces full typecheck when pnpm-workspace.yaml changes) — all workspaces pass, including the wrapper's own tsgo --noEmit.
Lint: pnpm lint — 0 warnings, 0 errors.
Tests:
- apps/web jest (which also runs packages/web-shared and packages/db): 1204 suites, 20410 passed, 3 skipped, 0 failed.
- pnpm --filter kilo-app run test (mobile): 1194 files, 17898 passed.
- pnpm --filter kilo-extension run test: 100 files, 1613 passed.
- packages/cloud-agent-sdk jest: 1714 passed. packages/db jest: 41 passed.
- services/cloud-agent-next/wrapper bun test src: 1262 tests, 0 fail.
- auto-routing-contracts 191, usage-contracts 24, notifications 126, app-shared 493, cloud-agent-profile 160, event-service 86, container-usage 53, ai-gateway-secure-proxy-contracts 5 — all pass.
- pnpm run test:scripts — passes except dev/local/tmux.test.ts ("decoy session must have an attached client"), which also fails on the pre-bump tree in this VM's tmux environment. Verified by stashing the change and re-running that file.
Runtime, web: started the local stack (Next.js on :3000, Postgres, Redis), signed in through the dev fake-login flow with an owned throwaway account seeded in the local database, then exercised a zod-validated tRPC mutation against the running server:
- POST /api/trpc/user.submitCustomerSource with {"source": ""} → 400 with the schema error Too small: expected string to have >=1 characters (proves zod input validation runs at runtime on 4.6.7).
- Same call with a valid value → 200 {"result":{"data":{"success":true}}}, and the value is present in the local database afterwards.
Runtime, tool-call diagnostics (the one call site affected by 4.6's fromJSONSchema change: packages/web-shared/src/lib/ai-gateway/api-request-log-errors.ts): a throwaway script drove detectToolCallArgumentErrors with an SSE response whose tool arguments violate uniqueItems and minProperties. 4.6.7 now reports the mismatch (schema_mismatch with Array items must be unique and Too small: expected object to have >=1 properties), valid arguments return null, and an unknown tool still reports unknown_tool. Nothing throws; the stricter keywords only add diagnostic entries.
Catalog determinism: reproduced both sides in a scratch worktree. With only --filter web... installed, services/cloud-agent-next/node_modules is absent, tsx resolves zod to the hoisted 4.4.3 copy, and the dump writes the two cloudAgentNext.getSandboxStatus entries without format; with --filter web... --filter cloud-agent-next, that project resolves zod 4.6.7 and the dump reproduces the committed file byte-for-byte (verified with diff against the committed catalog). node --test scripts/kilo-mcp-catalog.test.mjs passes (38 tests), and apps/web jest src/scripts/mcp-catalog/catalog.test.ts passes (51 tests) against the committed catalog.
services/session-ingest/src/types/user-connection-protocol.test.ts: zod 4.6 measures min/max/length on strings in Unicode code points instead of UTF-16 units (the check counts code points only when the unit count would otherwise overflow). The gitBranch: z.string().max(24) bound therefore counts code points, so 24 astral characters (48 UTF-16 units) are within the bound. The test asserted the old unit-based boundary; its surrogate-pair row and title now state the code-point boundary the schema enforces, and the other rows are unchanged because they are the same in both measures. Live behaviour change: an inbound heartbeat with a branch longer than 24 units but no more than 24 code points is now accepted. The instance-metadata byte headroom in UserConnectionDO.test.ts is unaffected — the number of bounded characters per field did not change.

No visual surface changed (dependency bump plus a regenerated JSON artifact), so there is no screenshot.

Proxy answers

The owner's proxy gave these answers in the owner's place.

Question: Scope: The zod catalog bump moves 20 workspace consumers. Two zod pins bypass the catalog: services/cloud-agent-next/wrapper (4.4.3) and one pin owned by an excluded feature (4.3.5). Does this PR touch the cloud-agent-next wrapper pin?
Answer: Also bump wrapper to 4.6.7
Confidence: 0.50 · Precedent: Fix the root cause and the class of the issue: owner wrote "fix class of issue preventing progress" (7f3470e0ba6f). Also "if you saw a gap, fix it" (89824a222897). The wrapper pin matches the old catalog version, so letting it drift is a gap. Leave the excluded feature's pin alone (its PRs are closed).
Question: If a consumer breaks: If typecheck or a test fails because 4.6.7 tightened behavior (e.g. fromJSONSchema now enforces previously ignored keywords), which way do you want it resolved?
Answer: Fix the consumer (Recommended)
Confidence: 0.90 · Precedent: Respect the release-age rule and use the newest release: owner chose "Wait for 24.14.0" over pinning an older version (3eb5d90dfa84).
Question: Verification depth: Verification budget: this VM has no node_modules yet, so a full pnpm install is needed regardless. How far do I go?
Answer: Full typecheck + all zod-workspace tests + web smoke (Recommended)
Confidence: 0.65 · Precedent: Require valid end-to-end proof on every PR: owner wrote "logs and/or screenshots are mandatory proof" (55c9c80332a7). Keep local tests targeted and let CI run the rest (30e048f42118).

The shared catalog pinned zod 4.4.3. 4.6.7 is the newest release that clears minimumReleaseAge (published 2026-10-12, gate is 6842 minutes). The catalog entry moves every catalog consumer at once; the standalone cloud-agent-next wrapper pins its own copy and moves with it so both stay on one zod version. pnpm-lock.yaml regenerated with pnpm install.

zod 4.6.7 emits JSON Schema differently from 4.4.3: nullable fields become type arrays instead of anyOf pairs, and the date-time pattern requires seconds. Regenerate the committed catalog so the drift check in the mcp-catalog workflow passes.

socket-security · 2026-10-20T00:40:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/zod@4.6.7

View full report

kilo-code-bot · 2026-10-20T00:50:57Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental range since df8d194 contains only merges of main plus an empty review-request commit; the merged services/kilo-mcp/catalog.json keeps the zod 4.6.7 JSON-Schema shapes while picking up main's tool changes, and the workflow's new --filter cloud-agent-next target matches a real workspace package.

Files Reviewed (6 files)

.github/workflows/kilo-mcp-catalog.yml
pnpm-lock.yaml
pnpm-workspace.yaml
services/cloud-agent-next/wrapper/package.json
services/kilo-mcp/catalog.json
services/session-ingest/src/types/user-connection-protocol.test.ts

Verification performed during review (read-only, no execution):

The incremental diff (df8d194..HEAD) touches no author-authored lines in the PR's own files; it consists of the two origin/main merges and 222d3299 ("request review"), so no new author change needed re-analysis.
The catalog merge did not revert the zod 4.6.7 rendering: the incremental diff contains no type: [...] → anyOf reversals, and the only entry-level changes are main's removal of cliSessions.shareForWebhookTrigger / cliSessionsV2.shareForWebhookTrigger (PR Simplify webhook request actions and session cleanup #8176) plus the kiloSessionId additions from feat(cloud-agent-next): rebuild chat state from local and server-prefetched data #8145, whose committed shape (type: string + ^ses_... pattern) matches clientKiloSessionIdSchema = z.string().regex(...).
--filter cloud-agent-next matches services/cloud-agent-next/package.json "name": "cloud-agent-next" (the same filter form is used in ci.yml and the e2e workflow), and apps/web/src/routers/cloud-agent-next-schemas.ts is the only router-graph file importing outside web's dependency closure.
pnpm-workspace.yaml pins zod: 4.6.7 and services/cloud-agent-next/wrapper/package.json pins 4.6.7; the only other non-catalog pin (services/gastown/container/plugin, 4.3.5) is intentionally left alone, and no 4.4.3 references remain in manifests.
The lockfile diff is confined to zod version resolutions plus one pnpm peer-suffix normalization on an @expo snapshot; no other dependency versions move.

Gap: the catalog determinism check and the zod 4.6 code-point test were not executed in this read-only sandbox, so byte-identical regeneration is taken from the author's reproduced dump plus the CI gate rather than re-run here.

Previous Review Summaries (4 snapshots, latest commit df8d194)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `df8d194`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit updates the CLI outbound schema test to zod 4.6's code-point string-bound semantics (24/25 astral characters instead of 12 surrogate pairs), and the fixture, assertion path, and comment are internally consistent with gitBranch: z.string().max(24), so no correctness or security findings arise.

Files Reviewed (1 file)

services/session-ingest/src/types/user-connection-protocol.test.ts

Verification performed during review (read-only, no execution):

The changed rows sit in the it.each table that feeds CLIOutboundMessageSchema.parse / safeParse through a JSON roundtrip (JSON.parse(JSON.stringify(...))), so the valid row genuinely exercises the schema bound rather than the helper alone.
gitBranch is declared z.string().max(24).optional() in services/session-ingest/src/types/user-connection-protocol.ts, so 24 code points is exactly at the bound and 25 is one over; the other rows (ASCII, escaped \", CJK) still cover the UTF-16-unit-equal boundaries, so unit-based coverage is preserved.
The JSON-byte headroom guard in services/session-ingest/src/dos/UserConnectionDO.test.ts still holds under code-point counting: worst-case JSON bytes per bounded character remain 6 (\u0000 escaping), and astral characters serialize as 4 UTF-8 bytes per code point rather than 12, so the 1280-byte instance guard is not weakened. Oversized attachments are separately handled by the serializeAttachment catch-and-retry path in UserConnectionDO.ts.
The behaviour change (branches with more than 24 UTF-16 units but no more than 24 code points are now accepted) only widens an optional display field; no downstream consumer applies a unit-based length assumption to it.

Gap: the zod 4.6.7 code-point behaviour was confirmed from the schema plus updated test expectations, not by executing the suite in this read-only sandbox; a wrong premise would surface as a failing test in CI rather than as a silent regression.

Previous review (commit `2c6aaab`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change (200817798 → 2c6aaab4) adds --filter cloud-agent-next to both catalog installs and the two missing format: "starts_with" entries, and the install scope now matches the catalog's only out-of-closure import path, so the dump renders deterministically at 4.6.7 with no correctness or security findings.

Files Reviewed (2 files)

.github/workflows/kilo-mcp-catalog.yml
services/kilo-mcp/catalog.json

Verification performed during review:

.github/workflows/kilo-mcp-catalog.yml: the added filter names the workspace project that owns the schemas (services/cloud-agent-next/package.json declares zod: catalog:), and apps/web/src/routers/cloud-agent-next-schemas.ts is the only apps/web/src router import that reaches outside web's closure (services/cloud-agent-next/src/shared/sandbox-status.ts, preview-port.ts; only the former imports zod). Both the PR and merge jobs use the same scope, and the change-detection gate still matches ^\.github/workflows/kilo-mcp-catalog\.yml$, so the jobs run for this PR. scripts/kilo-mcp-catalog.test.mjs only asserts the dump/skill command strings, so the wider install does not break the wiring check.
services/kilo-mcp/catalog.json: the two added format: "starts_with" entries sit on cloudAgentNext.getSandboxStatus and organizations.cloudAgentNext.getSandboxStatus, matching SandboxStatusSessionIdSchema's .startsWith('workspace_', ...) and the rendering already present on the other seven startsWith schemas from the previous regeneration; the surrounding allOf patterns, types, required, kind, summaries, and tags are unchanged. No procedures were added or removed, so no new MCP write surface appears.

Previous review (commit `2008177`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental range since the previous review (aeda6d831 → 200817798) is empty — 200817798 is a tree-identical empty commit — so the reviewed zod 4.6.7 catalog bump, wrapper pin, lockfile, and regenerated MCP catalog are unchanged and carry no open findings.

Files Reviewed (4 files)

pnpm-lock.yaml
pnpm-workspace.yaml
services/cloud-agent-next/wrapper/package.json
services/kilo-mcp/catalog.json

Previous review (commit `aeda6d8`)

Status: No Issues Found | Recommendation: Merge

The zod catalog bump to 4.6.7, the wrapper pin, the regenerated lockfile, and the regenerated MCP catalog are consistent and contain no correctness or security defects on the changed lines.

Verification performed during review:

pnpm-lock.yaml: the catalog resolves 4.6.7, all 55 catalog consumers and the services/cloud-agent-next/wrapper importer move with it, and remaining zod@4.4.3 resolutions are third-party copies (e.g. the openclaw tree) that intentionally keep their own pin. Non-zod lockfile churn is limited to a peer-suffix recomputation (metro-config, @sentry/react-native) whose variants already existed at the base commit.
services/kilo-mcp/catalog.json: row keys are identical to the base commit (838 rows, no added/removed procedures, so no new MCP mutation surface). After normalizing the documented rendering differences (anyOf nullable pairs to type arrays, the date-time seconds requirement, and the email pattern), the only residual differences are semantically equivalent: cloudAgentNext.prepareSession / organizations.cloudAgentNext.prepareSession flatten a top-level allOf intersection into the union branches with identical property and required values, and organizations.modes.create / organizations.modes.update now render the existing z.tuple([literal('edit'), config]) as a correct 2-tuple (prefixItems + minItems/maxItems/items: false). Summaries, tags, searchBlob, kind, and admin/debug flags are unchanged, so author-edited summaries were not clobbered.
$schema remains draft 2020-12 for every row, so @cfworker/json-schema validation in services/kilo-mcp/src/call.ts keeps using the same draft, and the OpenAPI document is 3.1.0, which accepts the new type arrays.

Files Reviewed (4 files)

pnpm-lock.yaml
pnpm-workspace.yaml
services/cloud-agent-next/wrapper/package.json
services/kilo-mcp/catalog.json

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 64.8K · Output: 10.1K · Cached: 1M}

_{Review guidance: REVIEW.md from base branch main}

The dump enumerates `apps/web`'s router graph, and `apps/web/src/routers/cloud-agent-next-schemas.ts` imports its schemas from `services/cloud-agent-next` by relative path. `cloud-agent-next` is not in `web`'s dependency closure, so `pnpm install --filter web...` left it uninstalled and its bare `zod` import resolved through pnpm's hoisted copy, a different version from the one the jest suite loads. The dump then wrote JSON Schema in that version's shape and the two required checks disagreed on the committed catalog. Install `cloud-agent-next` in both catalog jobs so the dump and the tests resolve one zod, and keep the catalog entries that render `starts_with`.

zod 4.6 measures string min/max/length in Unicode code points rather than UTF-16 units, so the `gitBranch: z.string().max(24)` bound accepts 24 astral characters where 4.4.3 accepted 12. The surrogate-pair row and the test title now describe the boundary the schema enforces; the ASCII, escaped-character, and CJK rows are identical under both measures.

iscekic · 2026-10-20T11:49:38Z

bot: Merged current main in 9c89a35 and resolved the generated catalog conflict by regenerating it from the merged router graph with Zod 4.6.7. The generated skill remains unchanged. The catalog preserves all 838 procedures, summaries, and procedure kinds from main.

Verification on the merged tree:

Frozen workspace install passed.
Web typecheck and tRPC declaration build passed.
Catalog regeneration and skill drift checks passed.
Catalog Jest suite: 51 passed, after starting and migrating the isolated local PostgreSQL test database.
Catalog workflow suite: 38 passed.
Web, cloud agent, and wrapper each resolve Zod 4.6.7.

No visual changes or new proxy decisions.

iscekic · 2026-10-20T11:56:08Z

bot: Main advanced during the first sync. Merged the newer main in ea56b1a, regenerated the catalog again, and pushed head 222d329 with a non-merge review trigger.

The latest catalog preserves all 836 current-main procedures, summaries, and procedure kinds. Frozen install, web typecheck, tRPC declaration build, catalog regeneration/drift checks, skill drift check, and all 51 catalog Jest tests pass on this merged tree. No source changes beyond the generated conflict resolution.

iscekic added 2 commits October 20, 2026 00:38

iscekic added drain Work item from the findings drain janitor:dependencies Findings drain: dependency update work item labels Oct 20, 2026

chore(kilo-mcp): refresh catalog.json and SKILL.md from CI

aeda6d8

iscekic added 3 commits October 20, 2026 00:53

chore(mcp): run CI on the refreshed tool catalog

2008177

iscekic added the merge:human A human reviews and merges this pull request. label Oct 20, 2026

Merge origin/main into drain/zod-catalog-4-6-7

9c89a35

iscekic added 2 commits October 20, 2026 11:51

Merge origin/main into drain/zod-catalog-4-6-7

ea56b1a

chore(deps): request review after Zod catalog sync

222d329

Navigation Menu

Repository navigation

build(deps): bump zod catalog to 4.6.7 - #8207

build(deps): bump zod catalog to 4.6.7#8207
iscekic wants to merge 9 commits into
mainfrom
drain/zod-catalog-4-6-7

iscekic commented Oct 20, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

kilo-code-bot Bot commented Oct 20, 2026 •

edited

Loading

Previous review (commit `df8d194`)

Executive Summary

Previous review (commit `2c6aaab`)

Executive Summary

Previous review (commit `2008177`)

Executive Summary

Previous review (commit `aeda6d8`)

Uh oh!

iscekic commented Oct 20, 2026

Uh oh!

iscekic commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

iscekic commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change

Verification

Proxy answers

Uh oh!

socket-security Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kilo-code-bot Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit df8d194)

Executive Summary

Previous review (commit 2c6aaab)

Executive Summary

Previous review (commit 2008177)

Executive Summary

Previous review (commit aeda6d8)

Uh oh!

iscekic commented Oct 20, 2026

Uh oh!

iscekic commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

iscekic commented Oct 20, 2026 •

edited

Loading

socket-security Bot commented Oct 20, 2026 •

edited

Loading

kilo-code-bot Bot commented Oct 20, 2026 •

edited

Loading

Previous review (commit `df8d194`)

Previous review (commit `2c6aaab`)

Previous review (commit `2008177`)

Previous review (commit `aeda6d8`)