chore(deps): bump zod to ^4.2.0 across all workspaces

[chelojimenez]

Summary

Below zod 4.2.0, the MCP SDK's ~standard.jsonSchema self-conversion path silently drops .describe() annotations on tool/prompt input schemas whenever MCPJam is acting as an MCP server (mcp/, cli/ MCP-server surfaces). This bumps zod to ^4.2.0 across every workspace so served tool/prompt descriptions stop disappearing on the wire.

• Bumped zod dependency and overrides entries (both matter — npm keeps resolving the old range if only one is bumped) in:
  • sdk/package.json (dependencies + overrides)
  • cli/package.json
  • mcp/package.json
  • mcpjam-inspector/package.json (dependency + overrides)
• Regenerated the root package-lock.json via a clean npm install. npm ls zod --all now resolves zod@4.3.6 everywhere in scope (satisfies ^4.2.0); the only other zod version present is zod@3.25.76, pulled in transitively by the harness-claude-code/harness-codex canary AI SDK dependency chain — unrelated to this bump and out of scope.
• examples/** were intentionally left untouched (not npm workspaces).
• Added a regression test (sdk/tests/zod-describe-preservation.test.ts) that registers a tool with a z.string().describe("SOME_DESCRIPTION") input on an in-test McpServer, round-trips it through a real createMcpHandler + Client/StreamableHTTPClientTransport connection, and asserts the description survives onto the wire tools/list inputSchema.
• Smoke-checked the three known z.toJSONSchema call sites (mcpjam-tool-helpers.ts, model-request-payload.ts, mcp-http-bridge.ts) — these call z.toJSONSchema directly rather than going through the SDK's internal ~standard.jsonSchema path, so no code changes were needed there; they compile and behave identically.

Decisions to review

1. Reverted an auto-regenerated mcp/src/generated/McpAppsHtml.bundled.ts diff. Running npm run typecheck regenerates this bundled-HTML artifact as a side effect, and it came out with a large unrelated diff (build-hash/minification drift, not a functional change — this bundle doesn't consume zod). I checked it back out to keep this PR scoped to the zod bump; if the repo wants this regenerated, that should be its own PR.
2. Left the transitive zod@3.25.76 tree alone. It's pulled in by @ai-sdk/harness-claude-code/@ai-sdk/harness-codex canary dependencies (their own ai@7.0.0-canary.176 / @ai-sdk/provider-utils@5.0.0-canary.48 pin zod v3), which is a separate major version and outside this PR's "bump the v4 line to 4.2.0" scope.
3. Verification hit shared-machine disk exhaustion (ENOSPC) mid-run, not caused by this change — npm cache clean --force freed space and a clean re-run of the full test suite passed (877 files / 9540 tests, 0 failures). Flagging in case the same transient [vitest-worker]: Timeout calling "fetch" symptom shows up in CI on a loaded runner.

Test plan

• npm run typecheck (root) — exit 0, no new errors (only the pre-existing gitignored HarnessPageBundle.generated.ts / unrelated deprecation warnings, no resourceMetadataUrl errors surfaced in this run)
• npm run test (root) — exit 0 on a clean run: sdk 140/140 test files (2461 passed, 1 skipped, includes the new regression test), inspector 877/879 test files (9540 passed, 6 skipped), cli/mcp/design/chatui/widget all green
• npm run build:inspector — exit 0

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only bump with a targeted regression test; no auth or runtime logic changes beyond restored tool schema descriptions on the wire.

Overview
Raises zod to ^4.2.0 (lockfile resolves to 4.3.x) in sdk, cli, mcp, and mcpjam-inspector, including matching overrides where the repo pins the v4 line. Root package-lock.json is regenerated; a changeset marks patch releases for @mcpjam/sdk, @mcpjam/cli, and @mcpjam/inspector.

The bump fixes MCP server tool listing where, below 4.2.0, Zod .describe() text on tool inputSchema fields could be dropped when the MCP SDK converts schemas for tools/list. No application code changes—only dependency alignment plus coverage.

Adds sdk/tests/zod-describe-preservation.test.ts, which registers a tool with a described field, round-trips through createMcpHandler and a real client, and asserts the description appears on the wire inputSchema.

^{Reviewed by Cursor Bugbot for commit a0dc6fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Bumps zod to ^4.2.0 across all workspaces to stop .describe() annotations from being dropped during JSON Schema conversion in MCP server paths. Restores tool/prompt descriptions on the wire.

• Bug Fixes

  • Added sdk/tests/zod-describe-preservation.test.ts to verify a described input field retains its description through a real server/client round-trip.
  • Updated the test to call client.connect(...) inside try so client.close() always runs if the handshake fails.

• Dependencies

  • Updated zod dependency and overrides to ^4.2.0 in sdk, cli, mcp, and mcpjam-inspector.
  • Regenerated the root package-lock.json; added .changeset/zod-4-2-bump.md for patch releases in @mcpjam/sdk, @mcpjam/cli, and @mcpjam/inspector.
  • Left examples/** unchanged; unrelated transitive zod@3.x from @ai-sdk/* remains.

^{Written for commit a0dc6fa. Summary will update on new commits.}

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

MCP worker preview

Preview worker mcpjam-mcp-pr-3399 deleted — the preview URL no longer resolves.
Merged changes are live on mcpjam-mcp-staging via deploy-mcp-staging.yml.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 584e8513-8284-46d9-b915-036d8bad22ba

📥 Commits

Reviewing files that changed from the base of the PR and between 4fdbef0 and a0dc6fa.

📒 Files selected for processing (1)

• .changeset/zod-4-2-bump.md

---

Walkthrough

Updated Zod dependency and override versions to ^4.2.0 across the CLI, MCP, inspector, and SDK packages. Added a Vitest regression test that registers a described Zod tool schema, retrieves it through an MCP server/client HTTP round trip, and verifies the field description remains present.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@sdk/tests/zod-describe-preservation.test.ts`:
- Around line 56-68: Move client.connect(transport) inside the existing
try/finally block in the test, keeping the listTools assertions unchanged.
Ensure any connection or handshake failure still reaches the finally block and
invokes client.close().

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 733191d1-a2de-4cf7-92f5-a997c77f0c61

📥 Commits

Reviewing files that changed from the base of the PR and between 6a046c4 and 4be0797.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• cli/package.json
• mcp/package.json
• mcpjam-inspector/package.json
• sdk/package.json
• sdk/tests/zod-describe-preservation.test.ts

[github-actions]

Internal preview

Preview URL: https://mcp-inspector-pr-3399.up.railway.app
Deployed commit: f5f7cb4
PR head commit: a0dc6fa
Backend target: staging fallback.
Health: ✅ Convex reachable
Access is employee-only in non-production environments.

[cubic-dev-ai]

No issues found across 6 files

_{Re-trigger cubic}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4fdbef0887

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add a changeset for the releaseable dependency bump

This updates releaseable packages (@mcpjam/sdk, @mcpjam/cli, and @mcpjam/inspector) but does not add a .changeset entry, even though .changeset/README.md:3-5 says Changesets are used for npm package publication. With this commit as-is, the release workflow's npx changeset status preflight fails with Some packages have been changed but no changesets were found, blocking publication of the bumped manifests from main; add a changeset for these package changes, or an empty one only if this is intentionally unreleased.

Useful? React with 👍 / 👎.

[chelojimenez]

Fixed in a0dc6fa — added .changeset/zod-4-2-bump.md (patch for @mcpjam/sdk, @mcpjam/cli, @mcpjam/inspector) so the dependency bump releases through the normal changesets flow.