feat: 迁移到 zod 4（dependabot #34）

package.json

@@ -124,7 +124,7 @@
     "pino-pretty": "^13.1.3",
     "uuid": "^13.0.0",
     "yaml": "^2.9.0",
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

packages/plugin-sdk/package.json

@@ -29,7 +29,7 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "zod": "^3.0.0"
+    "zod": "^3.0.0 || ^4.0.0"
   },
   "dependencies": {
     "@rikune/shared": "1.1.0"

packages/plugin-sdk/src/index.ts

@@ -2277,8 +2277,8 @@ export const PluginSystemDepSchema = z
     dockerFeature: z.string().optional(),
     aptPackages: z.array(z.string()).optional(),
     dockerValidation: z.array(z.string()).optional(),
-    extraEnv: z.record(z.string()).optional(),
-    buildArgs: z.record(z.string()).optional(),
+    extraEnv: z.record(z.string(), z.string()).optional(),
+    buildArgs: z.record(z.string(), z.string()).optional(),
     directories: z.array(z.object({ path: z.string(), chown: z.string().optional() })).optional(),
     volumes: z
       .array(
@@ -2309,7 +2309,7 @@ export const SurfaceRulesSchema = z
       })
       .optional(),
     category: z.string().optional(),
-    signalMap: z.record(z.union([z.string(), z.array(z.string())])).optional(),
+    signalMap: z.record(z.string(), z.union([z.string(), z.array(z.string())])).optional(),
   })
   .passthrough()
 
@@ -2376,7 +2376,7 @@ export const BackendWorkerContractSchema = z
     defaultMode: z.string().optional().default('builtin'),
     inputArtifactTypes: z.array(z.string()).optional().default([]),
     outputArtifactTypes: z.array(z.string()).optional().default([]),
-    policy: BackendWorkerPolicySchema.optional().default({}),
+    policy: BackendWorkerPolicySchema.optional().prefault({}),
     readiness: z
       .object({
         doesNotStartBackend: z.boolean().optional().default(true),
@@ -2385,7 +2385,7 @@ export const BackendWorkerContractSchema = z
       })
       .passthrough()
       .optional()
-      .default({}),
+      .prefault({}),
     packaging: z
       .object({
         installRoute: z
@@ -2592,7 +2592,7 @@ export const ArtifactRefSchema = z
     path: z.string(),
     sha256: z.string(),
     mime: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
+    metadata: z.record(z.string(), z.any()).optional(),
   })
   .passthrough()
 
@@ -2612,7 +2612,7 @@ export const EvidenceRefSchema = z
     sampleId: z.string().optional(),
     artifactRefs: z.array(ArtifactRefSchema).optional(),
     confidence: z.number().min(0).max(1).optional(),
-    metadata: z.record(z.any()).optional(),
+    metadata: z.record(z.string(), z.any()).optional(),
   })
   .passthrough()
 
@@ -2628,7 +2628,7 @@ export const EvidenceTimelineEntrySchema = z
     target: z.string().optional(),
     confidence: z.number().min(0).max(1).optional(),
     artifactRefs: z.array(ArtifactRefSchema).optional(),
-    metadata: z.record(z.any()).optional(),
+    metadata: z.record(z.string(), z.any()).optional(),
   })
   .passthrough()
 

packages/runtime-node/package.json

@@ -21,7 +21,7 @@
     "@rikune/shared": "1.1.0",
     "pino": "^10.3.1",
     "uuid": "^13.0.0",
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.3.5",

packages/runtime-node/src/config.ts

@@ -10,7 +10,7 @@ export const ConfigSchema = z.object({
       port: z.number().int().min(1).max(65535).default(18081),
       host: z.string().default('127.0.0.1'),
     })
-    .default({}),
+    .prefault({}),
   runtime: z
     .object({
       mode: z.enum(['sandbox', 'manual', 'disabled']).default('sandbox'),
@@ -23,12 +23,12 @@ export const ConfigSchema = z.object({
       maxRssBytes: z.number().default(2 * 1024 * 1024 * 1024),
       minDiskSpaceBytes: z.number().default(5 * 1024 * 1024 * 1024),
     })
-    .default({}),
+    .prefault({}),
   logging: z
     .object({
       level: z.enum(['trace', 'debug', 'info', 'warn', 'error', 'fatal']).default('info'),
     })
-    .default({}),
+    .prefault({}),
 })
 
 export type Config = z.infer<typeof ConfigSchema>

packages/shared/package.json

@@ -24,6 +24,6 @@
   },
   "license": "MIT",
   "dependencies": {
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   }
 }

packages/shared/src/runtime-contract.ts

@@ -400,5 +400,5 @@ export const RuntimeDelegationFailureResultSchema = z.object({
   artifacts: z.array(z.any()).optional(),
   setup_actions: z.array(z.any()).optional(),
   required_user_inputs: z.array(z.any()).optional(),
-  metrics: z.record(z.any()).optional(),
+  metrics: z.record(z.string(), z.any()).optional(),
 })

packages/shared/src/runtime-control-plane.ts

@@ -6,7 +6,7 @@ export const RuntimeTaskStatusSchema = z.enum([
   'completed',
   'failed',
   'cancelled',
-])
+] as const)
 export type RuntimeTaskStatus = z.infer<typeof RuntimeTaskStatusSchema>
 
 export const RuntimeTaskLifecycleEventTypeSchema = z.enum([
@@ -141,7 +141,7 @@ export const RuntimeDynamicArtifactFamilySchema = z.enum([
   'sandbox_trace',
   'runtime_debug',
   'runtime_analysis',
-])
+] as const)
 export type RuntimeDynamicArtifactFamily = z.infer<typeof RuntimeDynamicArtifactFamilySchema>
 export const RUNTIME_DYNAMIC_TRACE_ARTIFACT_TYPES = [
   PRIMARY_RUNTIME_DYNAMIC_TRACE_ARTIFACT_TYPE,

packages/windows-host-agent/package.json

@@ -20,7 +20,7 @@
   "dependencies": {
     "@rikune/shared": "1.1.0",
     "pino": "^10.3.1",
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.3.5",

src/analysis/analysis-evidence.ts

@@ -51,8 +51,8 @@ export const AnalysisEvidenceRecordSchema = z.object({
   freshness_marker: z.string().nullable(),
   created_at: z.string(),
   updated_at: z.string(),
-  provenance: z.record(z.any()).optional(),
-  metadata: z.record(z.any()).optional(),
+  provenance: z.record(z.string(), z.any()).optional(),
+  metadata: z.record(z.string(), z.any()).optional(),
   artifact_refs: z.array(z.any()),
   result: z.any(),
 })

src/analysis/analysis-run-state.ts

@@ -112,7 +112,7 @@ export const AnalysisRunStageViewSchema = z.object({
   finished_at: z.string().nullable().optional(),
   artifact_refs: z.array(z.any()),
   result: z.any().optional(),
-  metadata: z.record(z.any()).optional(),
+  metadata: z.record(z.string(), z.any()).optional(),
 })
 
 export const RecoverableStageSchema = z.object({

src/artifacts/crypto-breakpoint-analysis.ts

@@ -67,7 +67,7 @@ export const ArtifactRefSchema = z.object({
   path: z.string(),
   sha256: z.string(),
   mime: z.string().optional(),
-  metadata: z.record(z.any()).optional(),
+  metadata: z.record(z.string(), z.any()).optional(),
 })
 
 export const CryptoEvidenceSchema = z.object({

src/artifacts/explanation-graphs.ts

@@ -38,7 +38,7 @@ export const ExplanationArtifactRefSchema = z.object({
   path: z.string(),
   sha256: z.string(),
   mime: z.string().optional(),
-  metadata: z.record(z.any()).optional(),
+  metadata: z.record(z.string(), z.any()).optional(),
 })
 
 export const ExplanationGraphProvenanceSchema = z.object({

src/artifacts/summary-digests.ts

@@ -22,7 +22,7 @@ export const SummaryArtifactRefSchema = z.object({
   path: z.string(),
   sha256: z.string(),
   mime: z.string().optional(),
-  metadata: z.record(z.any()).optional(),
+  metadata: z.record(z.string(), z.any()).optional(),
 })
 
 export const DigestBudgetSchema = z.object({
@@ -33,7 +33,7 @@ export const DigestBudgetSchema = z.object({
   omitted: z.number().int().nonnegative(),
 })
 
-export const DigestTruncationSchema = z.record(DigestBudgetSchema)
+export const DigestTruncationSchema = z.record(z.string(), DigestBudgetSchema)
 
 const DetailLevelSchema = z.enum(['compact', 'full'])
 

src/config/index.ts

@@ -62,7 +62,7 @@ export const ConfigSchema = z
         port: z.number().int().min(1).max(65535).default(3000),
         host: z.string().default('localhost'),
       })
-      .default({}),
+      .prefault({}),
     database: z
       .object({
         type: z.enum(['sqlite', 'postgresql']).default('sqlite'),
@@ -73,7 +73,7 @@ export const ConfigSchema = z
         user: z.string().optional(),
         password: z.string().optional(),
       })
-      .default({}),
+      .prefault({}),
     workspace: z
       .object({
         root: z.string().default(getDefaultWorkspaceRoot()),
@@ -83,7 +83,7 @@ export const ConfigSchema = z
           .min(1)
           .default(500 * 1024 * 1024), // 500MB
       })
-      .default({}),
+      .prefault({}),
     workers: z
       .object({
         ghidra: z
@@ -98,7 +98,7 @@ export const ConfigSchema = z
             maxConcurrent: z.number().int().min(1).max(16).default(4),
             timeout: z.number().int().min(1).default(300),
           })
-          .default({}),
+          .prefault({}),
         static: z
           .object({
             enabled: z.boolean().default(true),
@@ -115,14 +115,14 @@ export const ConfigSchema = z
             dieTimeout: z.number().int().min(1).default(30),
             timeout: z.number().int().min(1).default(60),
           })
-          .default({}),
+          .prefault({}),
         dotnet: z
           .object({
             enabled: z.boolean().default(true),
             ilspyPath: z.string().optional(),
             timeout: z.number().int().min(1).default(60),
           })
-          .default({}),
+          .prefault({}),
         sandbox: z
           .object({
             enabled: z.boolean().default(true),
@@ -134,17 +134,17 @@ export const ConfigSchema = z
             pandaPythonPath: z.string().optional(),
             timeout: z.number().int().min(1).default(120),
           })
-          .default({}),
+          .prefault({}),
         frida: z
           .object({
             enabled: z.boolean().default(true),
             path: z.string().optional(),
             scriptRoot: z.string().optional(),
             timeout: z.number().int().min(1).default(30),
           })
-          .default({}),
+          .prefault({}),
       })
-      .default({}),
+      .prefault({}),
     cache: z
       .object({
         enabled: z.boolean().default(true),
@@ -155,14 +155,14 @@ export const ConfigSchema = z
           .min(0)
           .default(30 * 24 * 60 * 60), // 30 days
       })
-      .default({}),
+      .prefault({}),
     logging: z
       .object({
         level: z.enum(['trace', 'debug', 'info', 'warn', 'error', 'fatal']).default('info'),
         pretty: z.boolean().default(false),
         auditPath: z.string().default(getDefaultAuditLogPath()),
       })
-      .default({}),
+      .prefault({}),
     api: z
       .object({
         enabled: z.boolean().default(true), // Default: enabled
@@ -190,7 +190,7 @@ export const ConfigSchema = z
       .object({
         role: z.enum(['analyzer', 'runtime', 'hybrid']).default('analyzer'),
       })
-      .default({}),
+      .prefault({}),
     runtime: z
       .object({
         mode: z.enum(['auto-sandbox', 'remote-sandbox', 'manual', 'disabled']).default('disabled'),
@@ -202,7 +202,7 @@ export const ConfigSchema = z
         heartbeatIntervalMs: z.number().int().min(1000).default(30000),
         healthCheckTimeoutMs: z.number().int().min(1000).default(60000),
       })
-      .default({}),
+      .prefault({}),
   })
   .superRefine((data, ctx) => {
     // Cross-field validations

src/core/tool-executor.ts

@@ -186,7 +186,7 @@ export class ToolExecutor {
     } catch (error) {
       if (error instanceof z.ZodError) {
         // Build detailed validation error message
-        const errorDetails = error.errors.map((e) => {
+        const errorDetails = error.issues.map((e) => {
           const path = e.path.length > 0 ? e.path.join('.') : 'root'
           return `  - ${path}: ${e.message}`
         })