fix(opencode): ship audited runtime dependencies

.opencode/package-lock.json

@@ -8,6 +8,9 @@
       "name": "ecc-universal",
       "version": "2.2.3",
       "license": "MIT",
+      "dependencies": {
+        "zod": "4.6.7"
+      },
       "devDependencies": {
         "@opencode-ai/plugin": "^1.4.3",
         "@types/node": "^20.0.0",
@@ -156,10 +159,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.8.tgz",
-      "integrity": "sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==",
-      "dev": true,
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

.opencode/package.json

@@ -56,6 +56,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "zod": "4.6.7"
+  },
   "peerDependencies": {
     "@opencode-ai/plugin": ">=1.0.0"
   },
@@ -66,5 +69,8 @@
   },
   "engines": {
     "node": ">=18.0.0"
+  },
+  "overrides": {
+    "zod": "4.6.7"
   }
 }

.opencode/tools/changed-files.ts

@@ -1,4 +1,4 @@
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import type { ChangeType, TreeNode } from "../plugins/lib/changed-files-store.ts"
 
 const INDICATORS: Record<ChangeType, string> = {

.opencode/tools/check-coverage.ts

@@ -5,7 +5,7 @@
  * Supports common coverage report formats.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import * as path from "path"
 import * as fs from "fs"
 

.opencode/tools/dependency-analyzer.ts

@@ -5,7 +5,7 @@
  * and unused dependencies. Supports multiple package managers.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import * as path from "path"
 import * as fs from "fs"
 

.opencode/tools/format-code.ts

@@ -6,7 +6,7 @@
  * Supports cross-platform command generation.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import * as path from "path"
 import * as fs from "fs"
 

.opencode/tools/git-summary.ts

@@ -4,7 +4,7 @@
  * Returns branch/status/log/diff details for the active repository.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import { execFileSync } from "child_process"
 
 // Conservative subset of git's allowed ref-name characters. Rejects shell

.opencode/tools/lint-check.ts

@@ -5,7 +5,7 @@
  * Supports cross-platform command generation and error handling.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import * as path from "path"
 import * as fs from "fs"
 

.opencode/tools/run-tests.ts

@@ -5,7 +5,7 @@
  * Automatically detects the package manager and test framework.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import * as path from "path"
 import * as fs from "fs"
 

.opencode/tools/security-audit.ts

@@ -8,7 +8,7 @@
  * The regex patterns below are used to DETECT potential issues in user code.
  */
 
-import { tool, type ToolDefinition } from "@opencode-ai/plugin/tool"
+import { tool, type ToolDefinition } from "./tool.ts"
 import * as path from "path"
 import * as fs from "fs"
 

.opencode/tools/tool.ts

@@ -0,0 +1,10 @@
+import { z } from "zod"
+import type { tool as OpenCodeTool } from "@opencode-ai/plugin/tool"
+
+export type { ToolDefinition } from "@opencode-ai/plugin/tool"
+
+// OpenCode's tool helper returns the definition unchanged and exposes Zod as schema.
+// Keep the runtime import local so packed installs use the audited Zod version.
+export const tool = Object.assign(<T>(definition: T): T => definition, {
+  schema: z,
+}) as typeof OpenCodeTool

package-lock.json

@@ -10,10 +10,10 @@
       "license": "MIT",
       "dependencies": {
         "@iarna/toml": "2.2.5",
-        "@opencode-ai/plugin": "1.4.3",
         "ajv": "8.20.0",
         "js-yaml": "4.3.2",
-        "sql.js": "1.14.2"
+        "sql.js": "1.14.2",
+        "zod": "4.6.7"
       },
       "bin": {
         "ecc": "scripts/ecc.js",
@@ -25,6 +25,7 @@
       },
       "devDependencies": {
         "@eslint/js": "9.39.2",
+        "@opencode-ai/plugin": "1.4.3",
         "@types/node": "26.6.4",
         "c8": "11.0.0",
         "eslint": "10.11.0",
@@ -328,6 +329,7 @@
       "version": "1.4.3",
       "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.4.3.tgz",
       "integrity": "sha512-Ob/3tVSIeuMRJBr2O23RtrnC5djRe01Lglx+TwGEmjrH9yDBJ2tftegYLnNEjRoMuzITgq9LD8168p4pzv+U/A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/sdk": "1.4.3",
@@ -350,6 +352,7 @@
       "version": "1.4.3",
       "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.4.3.tgz",
       "integrity": "sha512-X0CAVbwoGAjTY2iecpWkx2B+GAa2jSaQKYpJ+xILopeF/OGKZUN15mjqci+L7cEuwLHV5wk3x2TStUOVCa5p0A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "cross-spawn": "7.0.6"
@@ -714,6 +717,7 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -1039,9 +1043,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "funding": [
         {
           "type": "github",
@@ -1354,6 +1358,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
@@ -2325,6 +2330,7 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -2461,6 +2467,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -2473,6 +2480,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -2671,6 +2679,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -2783,9 +2792,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.8.tgz",
-      "integrity": "sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

package.json

@@ -543,10 +543,10 @@
   },
   "dependencies": {
     "@iarna/toml": "2.2.5",
-    "@opencode-ai/plugin": "1.4.3",
     "ajv": "8.20.0",
     "js-yaml": "4.3.2",
-    "sql.js": "1.14.2"
+    "sql.js": "1.14.2",
+    "zod": "4.6.7"
   },
   "pi": {
     "extensions": [
@@ -561,6 +561,7 @@
   },
   "devDependencies": {
     "@eslint/js": "9.39.2",
+    "@opencode-ai/plugin": "1.4.3",
     "@types/node": "26.6.4",
     "c8": "11.0.0",
     "eslint": "10.11.0",
@@ -572,22 +573,24 @@
     "node": ">=18"
   },
   "overrides": {
-    "fast-uri": "3.1.8",
+    "fast-uri": "3.1.9",
     "markdown-it": "14.3.1",
     "js-yaml": "4.3.2",
     "@humanfs/node": "0.16.8",
     "brace-expansion": "5.0.12",
     "katex": "0.18.2",
-    "smol-toml": "1.9.1"
+    "smol-toml": "1.9.1",
+    "zod": "4.6.7"
   },
   "resolutions": {
-    "fast-uri": "3.1.8",
+    "fast-uri": "3.1.9",
     "markdown-it": "14.3.1",
     "js-yaml": "4.3.2",
     "@humanfs/node": "0.16.8",
     "brace-expansion": "5.0.12",
     "katex": "0.18.2",
-    "smol-toml": "1.9.1"
+    "smol-toml": "1.9.1",
+    "zod": "4.6.7"
   },
   "packageManager": "yarn@4.9.2+sha512.1fc009bc09d13cfd0e19efa44cbfc2b9cf6ca61482725eb35bbc5e257e093ebf4130db6dfe15d604ff4b79efd8e1e8e99b25fa7d0a6197c9f9826358d4d65c3c"
 }

yarn.lock

@@ -571,6 +571,7 @@ __metadata:
     markdownlint-cli: "npm:0.49.1"
     sql.js: "npm:1.14.2"
     typescript: "npm:6.0.3"
+    zod: "npm:4.6.7"
   bin:
     ecc: scripts/ecc.js
     ecc-control-pane: scripts/control-pane.js
@@ -744,10 +745,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-uri@npm:3.1.8":
-  version: 3.1.8
-  resolution: "fast-uri@npm:3.1.8"
-  checksum: 10c0/c9c47860a7f9110176d94bb30a02942182f0bfc8d6780e9702f320336dc2dadb83b1d9879cceaf8d4b439642d1ec6d78c317cb808ab155455551bd5d9d7c22d8
+"fast-uri@npm:3.1.9":
+  version: 3.1.9
+  resolution: "fast-uri@npm:3.1.9"
+  checksum: 10c0/052757540d8c0bbc16bb124a45b8f5cb5d0932f9b89f019221ee41cdb3cafc1db44b2e809d6b888b87922af3e5560a863124454e9d9193e1fc955887357b5add
   languageName: node
   linkType: hard
 
@@ -1904,9 +1905,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod@npm:4.1.8":
-  version: 4.1.8
-  resolution: "zod@npm:4.1.8"
-  checksum: 10c0/5eae39da09d7bd0564a30dfd2348811e4e2e7dd15955d8f3444f8e196f35e5422b1482eda234b722fafb0738f4a8b718adb042b860936bfdd2cc19cdbdac8a9a
+"zod@npm:4.6.7":
+  version: 4.6.7
+  resolution: "zod@npm:4.6.7"
+  checksum: 10c0/4ce2eb14034317b7254e347ca37b5ad591cf8333147030cf05b9b5d31692d45073f7f2747aa50cf8c6b29012194d2b22978cecc89969cf34a0d18e89d0ee7d7b
   languageName: node
   linkType: hard