[Chore] Patch remaining Zod, MSAL and fast-uri security alerts

.docker/app/runtime-deps/api/package.json

@@ -7,11 +7,12 @@
     "dompurify": "3.4.17",
     "jsdom": "26.1.0",
     "snowflake-sdk": "3.3.0",
-    "zod": "3.25.76"
+    "zod": "4.6.7"
   },
   "pnpm": {
     "overrides": {
       "axios": "1.20.0",
+      "@azure/msal-node": "7.1.0",
       "follow-redirects": "1.16.1",
       "moment": "2.31.0",
       "toml": "5.0.1"

apps/api/package.json

@@ -50,7 +50,7 @@
     "snowflake-sdk": "3.3.0",
     "svix": "^1.99.1",
     "undici": "^7.30.1",
-    "zod": "^3.25.76"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@ai-sdk/azure": "3.0.93",

apps/api/src/handlers/ado/types.ts

@@ -167,7 +167,7 @@ const adoWorkItemResourceSchema = z
     // work-item-update shape with per-field old/new values.
     revision: z
       .object({
-        fields: z.record(adoWorkItemRevisionFieldSchema).optional(),
+        fields: z.record(z.string(), adoWorkItemRevisionFieldSchema).optional(),
         revisedBy: adoIdentitySchema.optional(),
       })
       .passthrough()

apps/api/src/handlers/custom-automations/index.ts

@@ -63,7 +63,7 @@ const modelSchema = z
   .regex(/^[^/\s]+\/.+$/u, 'Model must use provider/model format.');
 
 const environmentTargetSchema = z.union([
-  z.string().uuid(),
+  z.guid(),
   z.literal(ALL_REPOSITORIES),
   z.literal(FAST_EXECUTION),
 ]);

apps/api/src/handlers/inference/jevgrep.ts

@@ -9,6 +9,7 @@ const requestSchema = z.object({
   state: z.unknown(),
   questions: z
     .record(
+      z.string(),
       z.object({
         type: z.literal('noul'),
         instructions: z.string().min(1).max(32_768),

apps/api/src/handlers/mcp/bitbucket.ts

@@ -109,11 +109,12 @@ function createServer(auth: Variables['authContext']) {
       connected?: Awaited<ReturnType<typeof authorize>>,
     ) => Promise<unknown>,
   ) {
-    server.registerTool(
+    const inputSchema = z.object(shape).strict();
+    server.registerTool<z.ZodRawShape, typeof inputSchema>(
       name,
       {
         description,
-        inputSchema: z.object(shape).strict(),
+        inputSchema,
         annotations: {
           readOnlyHint: readOnly,
           destructiveHint: !readOnly,
@@ -122,7 +123,9 @@ function createServer(auth: Variables['authContext']) {
       },
       async (input) => {
         try {
-          const fullName = repository.parse(input.repositoryFullName);
+          const fullName = repository.parse(
+            (input as Record<string, unknown>).repositoryFullName,
+          );
           const connected = await authorize(auth, fullName);
           // Resolve through the existing refresh coordinator on every call, never at discovery.
           const token = await resolveBitbucketOAuthAccessToken();

apps/api/src/handlers/mcp/http-integrations/broker.ts

@@ -257,7 +257,7 @@ export async function integrationRequest(
       : undefined;
   const secretRef = z
     .string()
-    .uuid()
+    .check(z.guid())
     .safeParse(
       typeof rawId === 'string' && rawId.startsWith('session:')
         ? rawId.slice(8)

apps/api/src/handlers/mcp/task-outputs.ts

@@ -83,7 +83,7 @@ const commandCursorSchema = z
       .max(100)
       .refine((value) => Number.isFinite(Date.parse(value))),
     ts: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-    id: z.string().uuid(),
+    id: z.guid(),
   })
   .strict();
 
@@ -238,7 +238,7 @@ export async function downloadMemberTaskArtifact(
     const input = z
       .object({
         taskId: z.string().regex(/^[0-9a-z]{13}$/),
-        artifactId: z.string().uuid(),
+        artifactId: z.guid(),
       })
       .strict()
       .safeParse(c.req.query());

apps/api/src/handlers/tasks/automation-work-items/schema.ts

@@ -12,7 +12,7 @@ const automationWorkItemBaseSchema = z.object({
   actionKind: z.string().trim().min(1).max(120),
   investigationContext: z.string().trim().max(4000).optional(),
   fingerprint: z.string().trim().max(255).optional(),
-  targetEnvironmentId: z.string().uuid().optional(),
+  targetEnvironmentId: z.guid().optional(),
   workspaceReadiness: workspaceReadinessSchema.optional(),
   readinessMessage: z.string().trim().min(1).max(500).optional(),
 });
@@ -28,16 +28,20 @@ export const automationWorkItemSchema = z
       disposition: z.literal('act'),
       executionPrompt: z
         .string({
-          required_error:
-            'Act automation work items must include executionPrompt.',
+          error: (issue) =>
+            issue.input === undefined
+              ? 'Act automation work items must include executionPrompt.'
+              : undefined,
         })
         .trim()
         .min(1, 'Act automation work items must include executionPrompt.')
         .max(6000),
       targetRepositoryFullName: z
         .string({
-          required_error:
-            'Act automation work items must include targetRepositoryFullName.',
+          error: (issue) =>
+            issue.input === undefined
+              ? 'Act automation work items must include targetRepositoryFullName.'
+              : undefined,
         })
         .trim()
         .min(

apps/api/src/handlers/tasks/fastSessionCommunication.ts

@@ -21,7 +21,7 @@ import {
 } from '@roomote/types';
 import { z } from 'zod';
 
-const canonicalFastSessionIdSchema = z.string().uuid();
+const canonicalFastSessionIdSchema = z.guid();
 
 export async function getFastSessionMessagesForUser(params: {
   sessionId: string;

apps/api/src/handlers/tasks/getTaskMessages.ts

@@ -85,7 +85,7 @@ export async function getTaskMessages(
 
     if (!task) {
       const userId = c.get('mcpAuth').userId;
-      if (userId && z.string().uuid().safeParse(taskId).success) {
+      if (userId && z.guid().safeParse(taskId).success) {
         const [conversation] = await db
           .select({ id: fastAgentConversations.id })
           .from(fastAgentConversations)

apps/api/src/handlers/tasks/saveTaskMemory.ts

@@ -26,7 +26,7 @@ function describeTaskMemoryIssues(
         const value = issue.path.reduce<unknown>(
           (acc, key) =>
             acc && typeof acc === 'object'
-              ? (acc as Record<string | number, unknown>)[key]
+              ? (acc as Record<PropertyKey, unknown>)[key]
               : undefined,
           input,
         );
@@ -36,7 +36,7 @@ function describeTaskMemoryIssues(
             : Array.isArray(value)
               ? `${value.length} entries`
               : undefined;
-        return `${path}: at most ${issue.maximum} ${issue.type === 'array' ? 'entries' : 'characters'}${actual ? ` (got ${actual})` : ''}`;
+        return `${path}: at most ${issue.maximum} ${issue.origin === 'array' ? 'entries' : 'characters'}${actual ? ` (got ${actual})` : ''}`;
       }
       return `${path}: ${issue.message}`;
     })

apps/api/src/handlers/tasks/submitTaskSuggestions.ts

@@ -103,7 +103,7 @@ const taskSuggestionSchema = z.object({
   priority: z.enum(['P0', 'P1', 'P2', 'P3']).optional(),
   investigationContext: z.string().trim().max(4000).optional(),
   targetRepositoryFullName: z.string().trim().min(1).optional(),
-  targetEnvironmentId: z.string().uuid().optional(),
+  targetEnvironmentId: z.guid().optional(),
   workspaceReadiness: workspaceReadinessSchema.optional(),
   readinessMessage: z.string().trim().min(1).max(500).optional(),
 });

apps/bullmq/package.json

@@ -39,7 +39,7 @@
     "hono": "4.13.11",
     "ioredis": "^5.10.1",
     "jsdom": "26.1.0",
-    "zod": "^3.25.76"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@roomote/config-typescript": "workspace:^",

apps/bullmq/src/jobs/snapshot.ts

@@ -92,7 +92,7 @@ const snapshotFailureMetadataSchema = z
   .object({
     name: z.string().min(1).nullish(),
     responseHeaders: z
-      .record(z.unknown())
+      .record(z.string(), z.unknown())
       .nullish()
       .transform((headers) =>
         Object.fromEntries(

apps/preview-proxy/package.json

@@ -30,7 +30,7 @@
     "http-proxy": "^1.18.1",
     "pino": "^9.7.0",
     "pino-pretty": "^13.1.3",
-    "zod": "^3.25.76"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@roomote/config-typescript": "workspace:^",

apps/web/package.json

@@ -133,7 +133,7 @@
     "usehooks-ts": "^3.1.1",
     "vaul": "^1.1.2",
     "yaml": "^2.9.0",
-    "zod": "^3.25.76",
+    "zod": "^4.6.6",
     "zustand": "^5.0.10"
   },
   "devDependencies": {

apps/web/src/app/(authenticated)/platform-issues/[reportId]/submit/page.tsx

@@ -6,7 +6,7 @@ import { getPlatformIssueReportCommand } from '@/trpc/commands/platform-issue-re
 
 import { PlatformIssueSubmission } from './PlatformIssueSubmission';
 
-const reportIdSchema = z.string().uuid();
+const reportIdSchema = z.guid();
 
 export default async function Page({
   params,

apps/web/src/app/(sandbox)/sessions/[sessionId]/page.tsx

@@ -46,7 +46,7 @@ const getSessionPageData = cache(async (sessionId: string) => {
   }
   // Both lookup columns are uuid; a garbage route param would otherwise throw
   // 22P02 in Postgres instead of 404ing.
-  if (!z.string().uuid().safeParse(sessionId).success) {
+  if (!z.guid().safeParse(sessionId).success) {
     notFound();
   }
 

apps/web/src/app/api/mcp-remote-oauth/authorize/route.ts

@@ -18,7 +18,7 @@ export const dynamic = 'force-dynamic';
 
 const authorizeSchema = z.object({
   response_type: z.literal('code'),
-  client_id: z.string().uuid(),
+  client_id: z.guid(),
   redirect_uri: z.string().url(),
   state: z.string().min(1),
   code_challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),

apps/web/src/app/api/mcp-remote-oauth/revoke/route.ts

@@ -7,7 +7,7 @@ export const runtime = 'nodejs';
 
 const revocationSchema = z.object({
   token: z.string().min(1),
-  client_id: z.string().uuid(),
+  client_id: z.guid(),
 });
 
 export async function POST(request: NextRequest) {

apps/web/src/app/api/mcp-remote-oauth/token/route.ts

@@ -27,15 +27,15 @@ const tokenSchema = z.discriminatedUnion('grant_type', [
   z.object({
     grant_type: z.literal('authorization_code'),
     code: z.string().min(1),
-    client_id: z.string().uuid(),
+    client_id: z.guid(),
     redirect_uri: z.string().url(),
     code_verifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
     resource: z.string().url().optional(),
   }),
   z.object({
     grant_type: z.literal('refresh_token'),
     refresh_token: z.string().min(1),
-    client_id: z.string().uuid(),
+    client_id: z.guid(),
     resource: z.string().url().optional(),
     scope: z.string().optional(),
   }),

apps/web/src/app/api/sessions/[sessionId]/attention/route.ts

@@ -9,10 +9,10 @@ import { findAccessibleSession } from '@/lib/server/sessions';
 
 export const runtime = 'nodejs';
 
-const paramsSchema = z.object({ sessionId: z.string().uuid() });
+const paramsSchema = z.object({ sessionId: z.guid() });
 const bodySchema = z.object({
-  notificationId: z.string().uuid(),
-  clientId: z.string().uuid(),
+  notificationId: z.guid(),
+  clientId: z.guid(),
   action: z.enum(['accepted', 'failed', 'opened']),
 });
 

apps/web/src/app/api/sessions/[sessionId]/attention/stream/route.ts

@@ -16,9 +16,9 @@ import { findAccessibleSession } from '@/lib/server/sessions';
 
 export const runtime = 'nodejs';
 
-const paramsSchema = z.object({ sessionId: z.string().uuid() });
+const paramsSchema = z.object({ sessionId: z.guid() });
 const querySchema = z.object({
-  clientId: z.string().uuid(),
+  clientId: z.guid(),
   permission: z.enum(['granted', 'default', 'denied', 'unsupported']),
 });
 const POLL_INTERVAL_MS = 1_000;

apps/web/src/app/api/sessions/[sessionId]/integration-tool-approvals/route.ts

@@ -30,7 +30,7 @@ async function handle(request: Request, props: Props, method: 'GET' | 'POST') {
     const auth = await authorize();
     if (!auth.success || !auth.userId) return error(401);
     const params = z
-      .object({ sessionId: z.string().uuid() })
+      .object({ sessionId: z.guid() })
       .safeParse(await props.params);
     if (!params.success) return error(400);
     const context = { sessionId: params.data.sessionId, userId: auth.userId };

apps/web/src/app/api/sessions/[sessionId]/presence/route.ts

@@ -18,9 +18,9 @@ import { getUsersById } from '@/lib/server/users';
 
 export const runtime = 'nodejs';
 
-const paramsSchema = z.object({ sessionId: z.string().uuid() });
+const paramsSchema = z.object({ sessionId: z.guid() });
 const bodySchema = z.object({
-  clientId: z.string().uuid(),
+  clientId: z.guid(),
   channel: z.enum(['view', 'voice']).default('view'),
   generation: z.number().int().nonnegative().optional(),
 });