security!: require zod 4 (clashcode 2.0.0)

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.0.0
+
+### Major Changes
+
+- Require zod 4 (security: resolves GHSA alerts for zod < 4.6.6).
+
+  `defineTool()` and `zodToJsonSchema()` now expect zod 4 schemas. zod is a regular dependency at `^4.6.7`.
+
+  Migration:
+  - Build tool schemas with zod 4 (`import { z } from 'zod'` with `zod@^4.6.7` installed).
+  - Schemas created with zod 3 are not recognized: they fail type-checking, and at runtime they are converted to `{ type: 'string' }`.
+  - zod 4 API changes that commonly affect tool schemas: `z.record()` needs an explicit key type (`z.record(z.string(), valueSchema)`), and error messages/codes changed (see the zod 4 migration guide).
+
 ## 1.3.0
 
 ### Breaking Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "clashcode",
-  "version": "1.3.1",
+  "version": "2.0.0",
   "description": "Model-agnostic multi-agent coding assistant. Where AI agents clash to build better code.",
   "type": "module",
   "bin": {
@@ -84,7 +84,7 @@
   "dependencies": {
     "marked": "^15.0.0",
     "marked-terminal": "^7.3.0",
-    "zod": "^3.25.76"
+    "zod": "^4.6.7"
   },
   "optionalDependencies": {
     "@superhq/shuru": "^0.1.0",

src/core/clash-engine/tool-vault.ts

@@ -20,7 +20,7 @@ export function zodToJsonSchema(schema: z.ZodType): Record<string, unknown> {
     const required: string[] = []
     for (const [key, val] of Object.entries(shape)) {
       if (val instanceof z.ZodOptional) {
-        properties[key] = zodToJsonSchema(val.unwrap())
+        properties[key] = zodToJsonSchema(val.unwrap() as z.ZodType)
       } else {
         properties[key] = zodToJsonSchema(val)
         required.push(key)
@@ -31,7 +31,8 @@ export function zodToJsonSchema(schema: z.ZodType): Record<string, unknown> {
   if (schema instanceof z.ZodString) return { type: 'string' }
   if (schema instanceof z.ZodNumber) return { type: 'number' }
   if (schema instanceof z.ZodBoolean) return { type: 'boolean' }
-  if (schema instanceof z.ZodArray) return { type: 'array', items: zodToJsonSchema(schema.element) }
+  if (schema instanceof z.ZodArray)
+    return { type: 'array', items: zodToJsonSchema(schema.element as z.ZodType) }
   return { type: 'string' }
 }