[bartsdev]

Summary

Replaces #80. That PR conflicted with main and broke the build and tools/list. This one is rebased onto main with two fixes.

 devDependencies
-  @clack/prompts               ^1.5.1        →  ^1.8.1
-  @gleanwork/mcp-server-tester 1.0.0-beta.6  →  1.1.1
-  @playwright/test             ^1.58.2       →  ^1.64.1
-  esbuild                      ^0.28.0       →  ^0.28.2
-  jest                         ^30.1.3       →  ^30.5.2
-  posthog-node                 5.0.0         →  5.57.2
-  prettier                     ^3.6.2        →  ^3.9.10
-  ts-jest                      ^29.4.1       →  ^29.4.15
   zod                          4.3.6            (held, was 4.6.7 in #80)

clack 1.8 cancel type. Prompts now return T | typeof CANCEL_SYMBOL instead of T | symbol. With the old signature, the unwrap helpers inferred the unique symbol into T, which caused the TS2322 and TS2339 errors in init.ts and remove.ts.

-ensureAnswer<T>(value: T | symbol, …): T
+ensureAnswer<T>(value: T | typeof p.CANCEL_SYMBOL, …): T

zod held at 4.3.6. xmcp 0.6.13 inlines its own zod (4.4.3) into its runtime and uses it to convert every tool schema to JSON Schema. Our tool schemas are built with the app's zod. Schemas from zod 4.6.7 make that converter throw:

tools/list
  xmcp runtime (stdio.js, zod 4.4.3) toJSONSchema
    tool chunk (104.js, zod 4.6.7) _zod.processJSONSchema
      TypeError: Cannot read properties of undefined (reading 'push')

Deduping zod in the lockfile doesn't help, because the 4.4.3 copy is compiled into xmcp's dist. .github/dependabot.yml now skips zod minor updates, with a comment saying to lift the rule once xmcp ships a matching zod.

Evidence

• Before (Bump the npm-minor-patch group across 1 directory with 9 updates #80 CI): tsc fails with 7 errors in src/cli. tools/list returns -32603 Cannot read properties of undefined (reading 'push'), so 2 MCP direct tests fail.
• After (local): tsc passes, jest passes 395/395 and yarn build succeeds. Raw tools/list over stdio returns all tools. Playwright direct and azure-offline tests pass 10/11; the remaining test is docs, which needs LOCALSTACK_AUTH_TOKEN and runs in CI.
• Bisect: zod 4.6.7 with everything else bumped fails tools/list. Swapping in zod 4.3.6 makes it pass.

Merge Danger

Door: two-way

Dev dependencies, a type-only change, and a Dependabot config rule. Revert to undo.

Blast Radius: small

posthog-node 5.0 → 5.57 is the largest jump; it's bundled into the CLI for telemetry. The zod ignore rule means Dependabot won't propose zod 4.4+ until someone removes it. Zod patch updates and security updates still come through.

🤖 Generated with Claude Code