From 142561e60c8682facb603d488bdc92d30b4d2542 Mon Sep 17 00:00:00 2001
From: Marcelo Ceccon <32395187+marceloceccon@users.noreply.github.com>
Date: Mon, 26 Oct 2026 16:20:10 +0000
Subject: [PATCH 1/2] security: bump zod to 4.6.7

---
 package.json                        |  2 +-
 pnpm-lock.yaml                      | 10 +++++-----
 src/core/clash-engine/tool-vault.ts |  5 +++--
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/package.json b/package.json
index 791f21e..331ad5a 100644
--- a/package.json
+++ b/package.json
@@ -84,7 +84,7 @@
   "dependencies": {
     "marked": "^15.0.0",
     "marked-terminal": "^7.3.0",
-    "zod": "^3.25.76"
+    "zod": "^4.6.7"
   },
   "optionalDependencies": {
     "@superhq/shuru": "^0.1.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2831ed1..8bb1528 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,8 +25,8 @@ importers:
         specifier: ^7.3.0
         version: 7.3.0(marked@15.0.12)
       zod:
-        specifier: ^3.25.76
-        version: 3.25.76
+        specifier: ^4.6.7
+        version: 4.6.7
     optionalDependencies:
       '@superhq/shuru':
         specifier: ^0.1.0
@@ -2180,8 +2180,8 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
-  zod@3.25.76:
-    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+  zod@4.6.7:
+    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}
 
 snapshots:
 
@@ -4190,4 +4190,4 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
-  zod@3.25.76: {}
+  zod@4.6.7: {}
diff --git a/src/core/clash-engine/tool-vault.ts b/src/core/clash-engine/tool-vault.ts
index 180300a..965d884 100644
--- a/src/core/clash-engine/tool-vault.ts
+++ b/src/core/clash-engine/tool-vault.ts
@@ -20,7 +20,7 @@ export function zodToJsonSchema(schema: z.ZodType): Record<string, unknown> {
     const required: string[] = []
     for (const [key, val] of Object.entries(shape)) {
       if (val instanceof z.ZodOptional) {
-        properties[key] = zodToJsonSchema(val.unwrap())
+        properties[key] = zodToJsonSchema(val.unwrap() as z.ZodType)
       } else {
         properties[key] = zodToJsonSchema(val)
         required.push(key)
@@ -31,7 +31,8 @@ export function zodToJsonSchema(schema: z.ZodType): Record<string, unknown> {
   if (schema instanceof z.ZodString) return { type: 'string' }
   if (schema instanceof z.ZodNumber) return { type: 'number' }
   if (schema instanceof z.ZodBoolean) return { type: 'boolean' }
-  if (schema instanceof z.ZodArray) return { type: 'array', items: zodToJsonSchema(schema.element) }
+  if (schema instanceof z.ZodArray)
+    return { type: 'array', items: zodToJsonSchema(schema.element as z.ZodType) }
   return { type: 'string' }
 }
 

From 628b8e280eababe408491a833fb2e82b20ee2529 Mon Sep 17 00:00:00 2001
From: Marcelo Ceccon <32395187+marceloceccon@users.noreply.github.com>
Date: Mon, 26 Oct 2026 17:00:15 +0000
Subject: [PATCH 2/2] =?UTF-8?q?chore(release):=20clashcode=202.0.0=20?=
 =?UTF-8?q?=E2=80=94=20require=20zod=204?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md | 13 +++++++++++++
 package.json |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 558a179..298b834 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.0.0
+
+### Major Changes
+
+- Require zod 4 (security: resolves GHSA alerts for zod < 4.6.6).
+
+  `defineTool()` and `zodToJsonSchema()` now expect zod 4 schemas. zod is a regular dependency at `^4.6.7`.
+
+  Migration:
+  - Build tool schemas with zod 4 (`import { z } from 'zod'` with `zod@^4.6.7` installed).
+  - Schemas created with zod 3 are not recognized: they fail type-checking, and at runtime they are converted to `{ type: 'string' }`.
+  - zod 4 API changes that commonly affect tool schemas: `z.record()` needs an explicit key type (`z.record(z.string(), valueSchema)`), and error messages/codes changed (see the zod 4 migration guide).
+
 ## 1.3.0
 
 ### Breaking Changes
diff --git a/package.json b/package.json
index 331ad5a..43c7e8e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "clashcode",
-  "version": "1.3.1",
+  "version": "2.0.0",
   "description": "Model-agnostic multi-agent coding assistant. Where AI agents clash to build better code.",
   "type": "module",
   "bin": {