Repository navigation
chore(deps): move to zod 4 and the zod-4 @agent-relay lines - #343
Conversation
- mcp-workforce: zod ^3.23.8 -> ^4.6.5, @modelcontextprotocol/sdk ^1.31.0; add an MCP-protocol test that the zod schemas list as JSON Schema and reject invalid input. - deploy/cli: @agent-relay/cloud ^10.1.0 -> ^12.2.2; local-surface: @agent-relay/fleet ^11.5.0 -> ^12.2.2; runtime: @agent-relay/events ^6.3.3 -> ^7.1.1. - runtime + root: agent-trajectories ^0.5.3 -> ^0.5.3 || ^0.6.0 || ^0.7.0 so consumers can dedupe on the zod-4 trajectories release. The 0.5.5-0.6.x type declarations omit CreateTrajectoryInput.workflowId (still honored at runtime), so the start options are built outside the call; a test now asserts the workflowId is stamped. - Lockfile: collapse the remaining zod 4.4.3 copy onto 4.6.5. Supports AgentWorkforce/cloud#4080. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pwJbZ21p1TB7MRHXdYjG3
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 16 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (10)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughDependency ranges change for MCP, Agent Relay, and agent-trajectories packages. Runtime trajectory start options now require ChangesDependency and MCP protocol checks
Trajectory recording
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~12 minutes Change: Other Suggested reviewers: Merge Risk: ⚪ Minimal · up to This PR updates dependency ranges and adds tests without changing runtime behavior, and no concrete merge-blocking issue was found. Normal CI should still confirm that the dependency upgrades install and build cleanly. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to This is primarily a dependency-compatibility change. The local refactor preserves existing behavior, and no introduced security bypass is established. Compatibility across all supported dependency versions and failure states remains only partially verified. Retained concerns Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the schemas at dawn, Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 11 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
- mcp-workforce: zod ^4.6.5 -> ^4.4.3 and resolve the whole lockfile to zod 4.4.3 so cloud can pin 4.4.3 (4.5+ roughly doubles zod/v4/core and pushes the cloud Worker over its size limit). Every zod-4 dependent in the tree accepts 4.4.3. - local-surface: the spawn:persona compatibility guard and README now require @agent-relay/fleet 12+, matching the ^12.2.2 dependency. The guard checks the installed Fleet major (falling back to the capability flag when the manifest is unreadable); tests cover both paths. Supports AgentWorkforce/cloud#4080. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pwJbZ21p1TB7MRHXdYjG3
There was a problem hiding this comment.
All reported issues were addressed across 6 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
- Root pnpm.overrides `zod@^4: 4.4.3` so lockfile regeneration in this repo cannot drift to zod 4.5+. The published mcp-workforce range stays ^4.4.3 so consumers are not forced into duplicate zod copies. - local-surface: the spawn:persona guard reads the installed Fleet version once per process (undefined results cached too) instead of doing sync fs I/O on every action; covered by a test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pwJbZ21p1TB7MRHXdYjG3
2 participants
Supports AgentWorkforce/cloud#4080: cloud wants to converge on a single zod version. Cloud pulls
@agentworkforce/deploy→@agentworkforce/runtime, and several deps in that chain still brought in zod 3.The zod floor is
^4.4.3, so cloud can pin zod 4.4.3. zod 4.5.0 and later roughly doublezod/v4/core(about +50 KB gzip). Cloud's Cloudflare Worker bundles zod about 5 times, so 4.5+ pushes it over the 10 MiB limit. The lockfile here resolves the whole tree to 4.4.3, so tests run against the version cloud will pin. Every zod-4 dependent in the tree accepts 4.4.3:@agent-relay/*12.x (^4.4.3),@relaycast/*(^4.3.6),@modelcontextprotocol/sdk(^3.25 || ^4.0) andai/@ai-sdk/*(^4.1.8).Dependency changes
zod^3.23.8^4.4.3(resolved 4.4.3)@modelcontextprotocol/sdk^1.21.0^1.31.0(peerzod ^3.25 || ^4.0)@agent-relay/cloud^10.1.0^12.2.2(@agent-relay/config12.x → zod 4)@agent-relay/fleet^11.5.0^12.2.2@agent-relay/events^6.3.3^7.1.1agent-trajectories^0.5.3^0.5.3 || ^0.6.0 || ^0.7.0The lockfile now resolves
@agent-relay/*to 12.4.1,agent-trajectoriesto 0.6.1 and zod 4 to 4.4.3 everywhere.Code changes
z.record(z.string(), …), noerrorMap,.errorsor_def), so no source change was needed. I added a test that connects over the in-memory MCP transport. It checks that tool input schemas are listed as JSON Schema (required,minLength,enum) and that a call with invalid input is rejected. It passes with zod 4.4.3 resolved.trajectory.ts: the type declarations inagent-trajectories0.5.5–0.6.x leaveworkflowIdout ofCreateTrajectoryInput. Every release still reads it at runtime, and trajectories main (0.7) declares it again. The start options are now built in a separate variable to get past the excess-property check. A new test checks thatworkflowIdends up on the raw trajectory.spawn:personacompatibility guard and README now require@agent-relay/fleet12 or newer, matching the new dependency. The guard reads the installed Fleet major version and falls back to theFLEET_DYNAMIC_SPAWN_DELEGATIONflag when the manifest can't be read. No Fleet export separates 12.x from 11.8+, so the guard reads the version directly. Tests cover both paths.@agent-relay/cloud,fleetorevents.Remaining zod 3 in the production tree
agent-trajectories0.6.1, which uses zod 3. This goes away once trajectories 0.7.0 (zod 4) is released, and the widened range already allows it.@agent-assistant/*devDependencies inturn-kitstill bring in older@agent-relay/sdk4.x/6.x and zod 3.Testing (Node 26.5.0, same as CI)
pnpm install --frozen-lockfile, build,pnpm run lint,pnpm run typecheck,scripts/*.test.mjsandtest:e2e:agent-cardall pass.pnpm -r test: everything passes exceptdeploy'sruntime-credentials-live.test. That test calls productionagentrelay.com, which the sandbox's egress proxy blocks, so it got 403 instead of 401. It is unrelated to this change.🤖 Generated with Claude Code
https://claude.ai/code/session_015pwJbZ21p1TB7MRHXdYjG3
Note
Medium Risk
Major bumps on @agent-relay/cloud, fleet, and events plus a breaking Fleet 12 floor for spawn:persona affect install graphs and local Relay deployments; trajectory typing is a compile-time workaround with runtime behavior unchanged.
Overview
This PR moves the monorepo onto zod 4.4.3 (root
pnpmoverridezod@^4→4.4.3) so consumers like cloud can dedupe without pulling zod 3, and bumps@agent-relay/*to zod-4 lines:@agent-relay/cloud^12.2.2 (cli/deploy),@agent-relay/fleet^12.2.2 (local-surface),@agent-relay/events^7.1.1 (runtime).@agentworkforce/mcp-workforceupgrades@modelcontextprotocol/sdkto ^1.31.0 andzodto ^4.4.3; a new integration test asserts MCP tool schemas are JSON Schema and invalid calls are rejected.@agentworkforce/runtimewidensagent-trajectoriesto^0.5.3 || ^0.6.0 || ^0.7.0and adjusts trajectory start options soworkflowIdis passed despite missing types in 0.6.x, with a test that the raw artifact carries it.spawn:personain local-surface now requires Fleet major 12+: README updated, and a runtime guard checksFLEET_DYNAMIC_SPAWN_DELEGATIONplus a memoized read of the installed@agent-relay/fleetversion (capability-only when the manifest is unreadable). Tests cover version rules and memoization.CHANGELOG documents the dependency and compatibility shifts; lockfile resolves relay 12.4.1, trajectories 0.6.1, and zod 4.4.3 across the tree.
Reviewed by Cursor Bugbot for commit e675ea7. Bugbot is set up for automated code reviews on this repo. Configure here.