Resolves #14385 Resolves #14387

Zod v4 compatibility is restored for the AI MCP schema path. ToolService now emits MCP tools/list schemas through Zod v4's native JSON Schema emitter instead of the stale external bridge, with a small compatibility normalization for passthrough object output. AI-side js-yaml imports are also switched to namespace imports so the updated js-yaml@5.2.0 ESM shape loads cleanly. The same dependency update also broke buildScripts still importing commander/esm.mjs; those now use the Commander package root supported by Commander 15.

Evidence: L2 (direct dependency/runtime probes + targeted AI/build unit/tool-list smoke tests) -> L2 required (schema emission and import compatibility ACs). No residuals for #14385 or #14387.

Deltas from ticket

The touched openApiValidator.mjs comments also had stale ticket-number references removed because the pre-commit archaeology hook blocks durable comment refs when the file is staged. No runtime behavior changed for that cleanup.

Current-head CI on the first PR head proved a second dependency-compatibility failure: Commander 15 no longer exports commander/esm.mjs, and the unit job imports several buildScripts during the full suite. I filed #14387 after V-B-A and folded that narrow buildScripts import fix into this PR so the dependency-update compatibility branch can go green end-to-end.

Test Evidence

• Direct probe: zod@4.4.3; old zod-to-json-schema bridge emitted {} for z.object({a:z.string()}); toOpenApiJsonSchema(...) emitted a strict object schema with properties, required, and additionalProperties:false.
• Direct probe: import yaml from 'js-yaml' fails under js-yaml@5.2.0 with SyntaxError: The requested module 'js-yaml' does not provide an export named 'default'.
• Source sweep passed: no remaining import yaml from 'js-yaml', import yaml from "js-yaml", zod-to-json-schema, or zodToJsonSchema matches in ai or test/playwright/unit/ai.
• Syntax checks passed for the changed runtime/demo AI modules with node --check.
• npm run test-unit -- test/playwright/unit/ai/mcp/validation/OpenApiValidatorCompliance.spec.mjs -> 40 passed.
• npm run test-unit -- test/playwright/unit/ai/mcp/server/McpServerListToolsSmoke.spec.mjs -> 29 passed.
• npm run test-unit -- test/playwright/unit/ai/mcp/validation/GuideToolParity.spec.mjs -> 1 passed.
• npm run test-unit -- test/playwright/unit/ai/mcp/server/github-workflow/ToolRegistration.spec.mjs -> 4 passed.
• npm run test-unit -- test/playwright/unit/ai/mcp/server/memory-core/McpServerToolLimits.spec.mjs -> 7 passed after accepting Zod v4's direct nullable:true object schema shape for the REM perSession output contract.
• npm run test-unit -- test/playwright/unit/ai/scripts/diagnostics/mcpHealthcheck.spec.mjs -> 13 passed.
• npm run test-unit -- test/playwright/unit/ai/services/github-workflow/PullRequestService.spec.mjs -> 56 passed.
• git diff --check passed.
• Pre-commit hook passed: whitespace, shorthand, AiConfig test mutation, JSDoc types, ticket archaeology, and staged block alignment.
• npm run agent-preflight -- --no-fix <AI changed files> passed after the buildScripts Commander fix.
• npm run agent-preflight -- --no-fix <buildScripts changed files> passed: 21 files scanned, 0 ticket-archaeology violations.
• Direct import probe passed for the previously failing modules: buildScripts/docs/index/discussions.mjs, tickets.mjs, release.mjs, docs/seo/generate.mjs, and util/agent-preflight.mjs.
• Source sweep passed: no commander/esm.mjs matches remain in buildScripts.

Note: after syncing dependencies with npm install --ignore-scripts, the first broader MCP smoke run exposed a missing better-sqlite3 native binding. npm rebuild better-sqlite3 restored the local native module, and the smoke suite then passed.

Post-Merge Validation

• Confirm GitHub Actions run the AI MCP validation and PR body lint against the updated dependency set.

Commits

• 38882e980c - fix(ai): restore Zod v4 MCP schema emission (#14385)
• ebc66d958d - fix(build): support Commander 15 imports (#14387)
• 7c3d5ee9a1 - test(ai): accept Zod v4 nullable schema shape (#14385)

Authored by Euclid (GPT-5, Codex Desktop). Session 019f18b1-1b14-7900-a06f-8ffdc43790b1.