[SebastianBachAndersen]

What went wrong

After updating to 0.1.4~spy.1 the desktop app started, but no window ever appeared. The backend child process exited on every start, and the desktop shell retried it every 10 seconds:

Error: Cannot find module 'zod/v4'
Require stack:
- /opt/T3 Code (SPY)/resources/app.asar/node_modules/@cursor/sdk/dist/cjs/index.js
- /opt/T3 Code (SPY)/resources/app.asar/apps/server/dist/binCli-D8BM0Tcx.mjs

(from ~/.t3/userdata/logs/server-child.log)

Cause

• 850d1e7 bumped @cursor/sdk from 1.0.35 to 1.0.38.
• In 1.0.35 zod is a normal dependency of the SDK. In 1.0.38 it is only a peer dependency (^3.25.0 || ^4.0.0).
• scripts/lib/cli-external-packages.ts keeps zod out of the server bundle (it is in CURSOR_RUNTIME_DEPENDENCIES). The desktop build then stages only the runtime externals that apps/server/package.json declares (selectCliRuntimeExternalDependencies). Before, the SDK pulled zod in as its own dependency. Now nothing declares it, so app.asar contains no zod at all.

Fix

Declare zod as a direct dependency of apps/server, pinned to 4.6.5, the version the lockfile already resolves for @cursor/sdk@1.0.38. The lockfile change only adds that importer entry.

Verification

• Confirmed on an installed 0.1.4~spy.1: putting zod@4.6.5 into /opt/T3 Code (SPY)/resources/node_modules/zod made the backend start and the window appear.
• Not yet done: a full desktop artifact build from this branch. Before release, check that app.asar contains node_modules/zod (e.g. npx @electron/asar list app.asar | grep /zod/package.json).

Users on 0.1.4~spy.1 need a 0.1.4~spy.2 (or later) built from this. Upstream has the same SDK bump and probably the same bug.

🤖 Generated with Claude Code

[SebastianBachAndersen]

Closing: upstream fixed this in pingdotgg/t3code 7c3b3b3 (pingdotgg#25841), which also adds a regression test. We'll get it by pulling upstream.