[Juliusolsson05]

Bumps five package pointers to the merges of their grouped Dependabot PRs:

Package	Pointer	Merged PR	What it carries
opencode-headless	973ad4e → f566ab9	#17	postcss 8.5.28 (security), @vitest/coverage-v8
agent-transcript-parser	4ad8d9c → 68dbfff	#39	fast-uri 3.1.8 (security), coverage, tsx
claude-code-headless	64fd0ea → 728cb49	#65	postcss 8.5.28 (security), coverage, tsx, react 19.3 (dev: tests/examples)
codex-headless	d42cc1d → b225d45	#61	postcss 8.5.28 (security), coverage, tsx, undici-types
workflow-mcp	b4b98f8 → ef995af	#64, then #67	runtime: @openai/codex-sdk 0.144.6 → 0.154.0, @modelcontextprotocol/sdk 1.30.0, zod 4.6.5, acorn 8.18.0; ip-address 10.7.2 (security); dev and GitHub Actions bumps; one test and generated build metadata

For the four headless and parser packages, each package's main is exactly its grouped merge on top of the pointer main pinned. workflow-mcp's range holds two merges:

1. feat(command-palette): add command descriptions panel #64 (80363d7): standalone/docker/Dockerfile pins libexpat 2.8.4-r0 → 2.8.5-r0, the container image's own OS package. It is not in the desktop app or the root lockfile.
2. fix(dictation): force the built-in Mac microphone #67 (ef995af): the grouped Dependabot bump. The four headless and parser bumps are dev-only. workflow-mcp carries runtime dependency changes. Each grouped PR had three MERGE-READY reviews and green package CI; workflow-mcp#67 also had a verification pass.

Lockfile

Resynced with npm install --package-lock-only, because the file: package deps embed their trees. It is stable after the merge of origin/main.

Dedupes:

• packages/agent-transcript-parser/node_modules/{vitest,@vitest/*} is gone: the parser's old ^4.1.10 range did not match the root's hoisted vitest, and the bumped ^4.1.11 does.
• tsx 4.23.15 at the root now satisfies the packages' ^4.23.13.
• 31 nested packages/workflow-mcp/node_modules/* entries (rolldown wasm helpers) drop out, matching workflow-mcp's own lockfile change.

⚠ Two app runtime versions move. The app itself declares @modelcontextprotocol/sdk: ^1.29.0 and zod: ^4.4.3. Their hoisted copies, shared with workflow-mcp, now resolve to 1.30.0 and 4.6.5. That is within the app's ranges, but it changes what the app's MCP servers and schemas run on (src/main/userMcp, src/main/externalControlMcp, the workflow host). workflow-mcp#67's reviews found only additive or hardening changes on the MCP SDK and zod surfaces workflow-mcp imports. The app's own imports get their own review here.

No other package or lockfile changes. The complete pointer ranges were checked by review (all five gitlinks equal the named merge commits).

App source fix: required keys lost under zod 4.6 (steering q84)

The first exact-head CI run failed src/main/externalControlMcp/tools.test.ts. The built-in McpServer advertised ac_probe_echo with required: [], while the external Server advertised required: ['payload'].

• Cause. Under the newly hoisted zod 4.6.5, z.fromJSONSchema turns a recursive $ref property (every z.json() payload) into a lazy schema whose input optionality reports optional. Call validation still rejected {}. Only the re-exported tools/list schema lost required. zod 4.4.3 did not do this.
• Fix. withDeclaredRequiredKeys in src/main/externalControlMcp/tools.ts re-imposes the descriptor's own required lists on every plain object it describes after conversion. It is a no-op on 4.4.3 and a repair on 4.6.x.
• Wrappers (steering q92, verification b). The first repair only walked bare objects. z.fromJSONSchema wraps nested objects: an optional one in ZodOptional, a defaulted one in ZodDefault, a nullable one in ZodUnion[object, null] (paired with anyOf), and an array of objects in ZodArray. Their nested required was still lost on the built-in side.
  • c6896e43 and 6c60c8da walk through all four, cloning each with the repaired inner schema so its own checks (an array's min/max) survive.
  • A new test compares both real projections for every shape, and checks that a missing nested payload is still rejected.
  • It is red at d563b05a. Removing the Default, Union or Array branch each turns it red again.
• Test. Reproduced red at 5f9bf305 with an isolated install of the PR's exact versions: the shared checkout's older zod is why the first local gate passed. It is green after the fix, and the equality assertion is unchanged. z.fromJSONSchema has no other call site in src/.

Gate

CI on this PR, plus locally:

• npx tsc -b, against an isolated install of the PR's exact lockfile;
• the workflow-mcp build;
• the workflow, user-MCP, external-control, provider, conversation and transcript suites.

🤖 Generated with Claude Code

[Juliusolsson05]

Disposition for verification review b (head 33ebfba)

• Record values lose required keys: fixed in 33ebfba.
  • withDeclaredRequiredKeys now repairs a record's value schema: the ZodPipe out object and its catchall, projected as additionalProperties.
  • The nested-schema test gains a byKey record of strict objects. It asserts that required: ['payload'] appears under additionalProperties in BOTH real MCP projections.
  • The test was red before the fix. Removing the pipe or catchall branch fails it.

[Juliusolsson05]

READY (W1). Head 33ebfba9. Exact-head CI is green. Every reviewer's latest verdict is MERGE-READY:

• a: verify2-report-a, covering the q92 and record-value commits;
• b: verify3-report-b, confirming CI after its code verification in verify2-report-b;
• c: report-c.

Dispositions for q84, q92 and b's record finding are posted above. merge-gate.sh --member: GATE PASS. The PR is mergeable and clean, so main was not merged in.

Note for the batch: this PR moves the packages/codex-headless gitlink. The app half of #1336, bumping to codex-headless#70, waits for this PR to merge.