[roomote-roomote]

​Created by Roomote. View the session or mention @roomote-roomote for follow-up asks.

Related issue

Addresses the remaining Zod, MSAL and fast-uri alerts from the original 29-alert runtime bundle: 20 Zod alerts (#279, #280, #282–#291, #293–#300), two MSAL alerts (#281, #309), and four fast-uri alerts (#302–#305). The three undici alerts originally included here are already covered by merged #3615.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Complete the runtime security upgrade and Zod compatibility migration. The readiness request authorized preparation only. After current-head CI passed, mrubens merged this PR at November 1, 2026, 00:44:52 UTC, during evidence closeout. This readiness run did not perform the PR merge or any deployment.

What changed

Dependency	Current develop → proposed resolution	Alert context
Zod	3.25.76 / 4.3.6 / 4.6.7 → 4.6.7 everywhere	Zod alert #279 and 19 related alerts
@azure/msal-node	5.2.3 / 5.5.0 → 7.1.0	MSAL alert #281, alert #309
fast-uri	3.1.8 → 3.1.9	fast-uri alert #302–#305

• Align direct Zod declarations, all transitive resolutions and packaged API runtime dependencies. Zod 4.6.7 preserves the newer patched version already used by develop's authentication stack; it was published October 12 and satisfies the seven-day release-age policy.
• Migrate record keys, partial enum records, error APIs, generics, descriptions and JSON Schema conversion. Retain Zod 3's UUID-shaped input acceptance using GUID validation. Preserve MCP nullable-optionals handling, nested checks, discriminated unions, transport coercion and per-parse default factories, with focused regressions.
• Regenerate both lockfiles with pnpm. pnpm-workspace.yaml, minimumReleaseAge: 10080 and every exclusion remain byte-for-byte unchanged from both the original PR and current develop.

Current develop integration and overlap

Merged develop 66bdd0a into this branch and resolved the three manifest/lock conflicts by combining security intent:

• Retain body-parser 2.4.0 from merged PR #3628, including its required parser dependencies. This PR adds no body-parser delta against develop and no longer describes that patch as age-blocked.
• Retain undici 7.30.1 and qs 6.16.1 from merged PR #3615; do not duplicate or reverse those updates.
• Retain Better Auth/core/adapter 1.7.12 and the OAuth/account-linking compatibility work from merged PR #3636. Regenerate the combined graph with Zod 4.6.7 rather than restoring older auth packages.
• Bring in both Kimi catalog expectation repairs from merged PR #3603. No Kimi test is excluded or accepted as a baseline exception.

There is no intended user-visible behavior change. The benefit is removal of the remaining vulnerable Zod/MSAL/URI resolutions while preserving normal validation, authentication and runtime behavior. The migration necessarily spans shared schema consumers; no new product options or unrelated refactors were added. GitHub alert closure still depends on default-branch integration and dependency rescanning; no alerts were dismissed.

How it was tested

Current evidence applies to fd9fe5b, superseding the October 27 evidence and its Kimi exception.

• Workspace regeneration/frozen install and packaged API production frozen install passed. The graph audit confirms all 19 installed Zod workspaces use 4.6.7, both lockfiles contain only patched targeted resolutions, merged parser/auth fixes remain present, and all newly selected releases exceed seven days. Replayable graph/age check.
• Forced broad typechecking: 27 tasks passed, zero cache hits. Normal unmodified pre-commit/pre-push gates passed lint, typechecking and Knip.
• Full worker suite: 189 files / 2,226 passed. Full cloud-agents suite: 159 files / 2,632 passed, one existing skipped. The actual agent-home 117 cases and OpenCode runtime 46 cases also passed directly. Both formerly failing Kimi expectations pass without exclusions.
• Shared types: 1,089 passed; auth: 47 passed; real upgraded Better Auth OAuth/session plus setup/input regression selection: 76 passed; API MCP and automation lifecycle selection: 52 files / 1,025 passed. These retain the actual application/protocol/database paths where applicable; external identity providers use controlled fixtures.
• Both workspace and packaged Azure identity clients completed the actual MSAL 7 client-credential flow over a controlled HTTP transport, and undici fetch/Agent completed a real local HTTP round trip. Replay script. No live external account or exploit reproduction was used.
• Hosted CI on this head: Test, lint, typecheck, Knip, app/worker Docker builds, upgrade compatibility, deployment artifacts and backup/restore all passed. Docs, CodeQL and automated review also passed; Mintlify Deployment was skipped. The Judgement status is successful with no violations reported, but its description explicitly notes incomplete coverage.
• The current-head automated review reports zero findings, with zero unresolved review threads. Before the human merge, the branch was conflict-free and zero commits behind develop. GitHub now confirms merged by mrubens at 00:44:52 UTC on November 1, 2026. This readiness run submitted no approval, bypass, PR merge or deployment.
• Refreshed real local browser evidence: development login and home rendering; empty-name YAML rejection; correction through the actual textbox and successful valid preview without reload. No environment or task was created. All final screenshots were opened and inspected; the pushed diff matches the capture snapshot.

Screenshots

Authenticated home on the updated dependency graph:

The real YAML form rejects an empty name:

After correcting the input, the same form renders a valid preview:

These screenshots prove the rendered local compatibility states, not external-provider OAuth, persisted environment creation, task execution, or hosted-runtime parity.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

One cohesive security bundle with broad but mechanical Zod compatibility changes. Normal local fast lint/type gates and hosted full static checks were used; formatting-inclusive local aliases were not run. No changeset was added.

[roomote-community]

No new code issues found. See session

Reviewed the merge from develop, including dependency conflict resolutions, both lockfiles, Zod 4.6.7 alignment, and compatibility with the updated Better Auth dependency graph. The merged body-parser 2.4.0 and undici 7.30.1 fixes are preserved. The fast-agent automation change is inherited unchanged from the base branch.

Current-head CI lint, type checking, Knip, upgrade compatibility, deployment artifacts, docs validation, and fresh-host backup restore passed. Tests, app/worker Docker builds, and JavaScript/TypeScript CodeQL analysis were still running at review closeout. Repository validation suites were left to CI. No approval submitted.

_{Reviewed fd9fe5b}

[mrubens]

@roomote-roomote get this ready

[roomote-roomote]

@roomote-roomote get this ready

I’ll bring #3600 up to date, fix the failing CI checks, and revalidate the dependency upgrades and Zod migration. I’ll also check overlap with #3628 and refresh the PR’s validation evidence. I won’t merge it.

_{Reply anytime · Open in Roomote}

[roomote-roomote]

Prepared and pushed fd9fe5bea37610735fa04b2612353d3a2fbadf9c, bringing in all 13 develop commits and resolving the three dependency conflicts. Before merge the branch was conflict-free and zero commits behind develop.

• Kimi CI blocker fixed: incorporated merged [Chore] Align runtime configuration tests with shipped Kimi routes #3603; the actual worker agent-home 117 cases and OpenCode runtime 46 cases pass without exclusions. Full worker suite: 2,226 passed; full cloud-agents suite: 2,632 passed, one existing skip.
• Dependency scope preserved: all 19 Zod workspaces and both locks align to 4.6.7; MSAL 7.1.0 and fast-uri 3.1.9 remain patched. Retained body-parser 2.4.0 from merged [Chore] Patch body-parser runtime denial of service #3628, undici/qs from [Chore] Patch undici and qs security advisories #3615, and Better Auth 1.7.12 plus OAuth compatibility from [Chore] Patch Better Auth while preserving sign-in and account linking #3636. No duplicated body-parser change or release-age policy/exclusion change.
• Current-head checks green: Test, lint, typecheck, Knip, both Docker builds, upgrade compatibility, deployment artifacts and backup/restore passed; docs, CodeQL and automated review also passed. Mintlify Deployment skipped. Judgement reports success/no violations but incomplete coverage. Automated review has zero findings and there are zero unresolved threads.
• Renewed local evidence: 27 forced typecheck tasks with zero cache hits; shared types 1,089, auth 47, upgraded OAuth/session/setup/input 76 and API MCP/automation 1,025 tests passed. Frozen installs, graph/age audit, actual Azure identity→MSAL flow over controlled HTTP, undici HTTP round trip, and genuine browser validation/recovery passed. PR description and screenshots now reflect this head rather than the old baseline exception.

Final state: mrubens merged this PR at 2026-11-01 00:44:52 UTC while evidence closeout was underway. The resulting develop commit is 249d87b97c34eb3c7450855b56be1e6940c84fe0; its tree matches the tested head. No remaining code/CI blocker was observed. I did not approve, bypass protection, merge the PR or deploy anything. No new PR was opened.