[t3dotgg]

Nightly 0.1.4-nightly.20261027.3766 does not open on macOS. The backend crashes on every start with Cannot find module 'zod/v4', required from app.asar/node_modules/@cursor/sdk. Reported in #25840.

@cursor/sdk 1.0.38 moved zod to peerDependencies. The desktop stage only installs runtime externals that apps/server/package.json lists, and apps/server did not list zod. So app.asar shipped without it.

Fix: add zod (^4.6.5, the version already in the lockfile) to apps/server dependencies. zod is already in the runtime external list, so it is now staged next to @cursor/sdk.

Same fix as #25841 by @jason5545, which also adds a regression test. This PR is only the dependency change, from a branch in this repo so CI runs now.

Fixes #25840

Made by Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at b7ac308

Macroscope's review found this PR approvable — This is a minimal dependency-manifest and lockfile fix for packaged desktop startup, confined to ignored metadata paths. It introduces no new capability, product-default change, schema change, or static-analysis suppression.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	+29 B (+0.6%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.3 KiB	+29 B (+2.3%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	+41 B (+0.2%)	24.4 KiB	✅
Claude	Live turn messages	1	2	+1 (+100.0%)	8	✅

Baseline: a452c2d · PR result: b7ac308 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: fix/server-ships-zod
• File: .coderabbit.config.ts
• Commit: b7ac308
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: f98a1647-ea5d-4070-9f80-0480c48267ec

Commits

Reviewing files that changed from the base of the PR and between a452c2d and b7ac308.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• apps/server/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

Walkthrough

The server package manifest now declares zod version ^4.6.5 as a dependency.

Changes: Server dependency

Layer / File(s)	Summary
Declare zod dependency apps/server/package.json	The server package adds zod version ^4.6.5 to its dependencies.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix · Severity of issue fixed: Medium

Possibly related issues

• pingdotgg/t3code#25840 — The issue describes the missing zod dependency that this change adds to the server package.

Possibly related PRs

• pingdotgg/t3code#25841 — Adds a regression test for staging required peer dependencies, including @cursor/sdk's zod dependency.

Suggested reviewers: gcrft123, juliusmarminge

Merge Risk: Minimal · up to b7ac3

This dependency change is ready to merge; no current merge-blocking risk is evident.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the desktop startup fix and the dependency cause. It is concise and uses conventional commit syntax.
Description check		The description explains the macOS startup failure, identifies the missing runtime dependency, describes the fix, references issue #25840, and states the scope. It does not report verification steps o…
Linked Issues check		The only directly linked issue, #25840, is closed. Under the assessment rules, it supplies background only. No active directly linked targets remain, so no linked-issue coding requirements apply. The …
Out of Scope Changes check		The whole-PR change set, per the raw summary, is one dependency addition in apps/server/package.json (+2/-1): "zod" at "^4.6.5". The current PR description states this change is the entire fix. It mak…

Full details: Description check

Explanation

The description explains the macOS startup failure, identifies the missing runtime dependency, describes the fix, references issue #25840, and states the scope. It does not report verification steps or observed results.

Full details: Linked Issues check

Explanation

The only directly linked issue, #25840, is closed. Under the assessment rules, it supplies background only. No active directly linked targets remain, so no linked-issue coding requirements apply. The issue text describes the root cause and a workaround (add "zod": "^4.6.5" to apps/server dependencies). This PR applies that workaround, but the verdict does not depend on it.

Full details: Out of Scope Changes check

Explanation

The whole-PR change set, per the raw summary, is one dependency addition in apps/server/package.json (+2/-1): "zod" at "^4.6.5". The current PR description states this change is the entire fix. It makes zod a listed dependency of apps/server. The desktop staging step then includes zod, because zod is already in the runtime external list. This ties the change directly to the stated purpose. The lockfile is an ignored file and was not inspected. Its absence does not affect this verdict. No unrelated changes are reported.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[t3dotgg]

Superseded by #25841, which landed the same fix plus a regression test.