@tanstack/ai-code-mode 0.3.3 → 0.3.5

package/dist/esm/create-code-mode-tool.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { toolDefinition } from "@tanstack/ai";
 import { toolsToBindings, createEventAwareBindings } from "./bindings/tool-to-binding.js";
 import { stripTypeScript } from "./strip-typescript.js";
+import { warnIfBindingsExposeSecrets } from "./validate-bindings.js";
 const executeTypescriptInputSchema = z.object({
   typescriptCode: z.string().describe(
     "TypeScript code to execute in the sandbox. Use external_* functions to call available APIs. Return a value to pass results back."
@@ -24,12 +25,18 @@ function createCodeModeTool(config) {
     timeout = 3e4,
     memoryLimit = 128,
     getSkillBindings,
+    onSecretParameter,
     transpile = stripTypeScript
   } = config;
   if (tools.length === 0) {
     throw new Error("At least one tool must be provided to createCodeModeTool");
   }
   const staticBindings = toolsToBindings(tools, "external_");
+  const secretDedupCache = /* @__PURE__ */ new Set();
+  warnIfBindingsExposeSecrets(Object.values(staticBindings), {
+    handler: onSecretParameter,
+    dedupCache: secretDedupCache
+  });
   const definition = toolDefinition({
     name: "execute_typescript",
     description: buildToolDescription(tools),
@@ -69,6 +76,13 @@ function createCodeModeTool(config) {
           };
         }
         const skillBindings = getSkillBindings ? await getSkillBindings() : {};
+        const skillBindingValues = Object.values(skillBindings);
+        if (skillBindingValues.length > 0) {
+          warnIfBindingsExposeSecrets(skillBindingValues, {
+            handler: onSecretParameter,
+            dedupCache: secretDedupCache
+          });
+        }
         const allBindings = { ...staticBindings, ...skillBindings };
         const eventAwareBindings = createEventAwareBindings(
           allBindings,

package/dist/esm/create-code-mode-tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-code-mode-tool.js","sources":["../../src/create-code-mode-tool.ts"],"sourcesContent":["import { z } from 'zod'\nimport { toolDefinition } from '@tanstack/ai'\nimport {\n  createEventAwareBindings,\n  toolsToBindings,\n} from './bindings/tool-to-binding'\nimport { stripTypeScript } from './strip-typescript'\nimport type { ServerTool, ToolExecutionContext } from '@tanstack/ai'\nimport type {\n  CodeModeTool,\n  CodeModeToolConfig,\n  CodeModeToolResult,\n  IsolateContext,\n} from './types'\n\n/**\n * Schema for the execute_typescript tool input\n */\nconst executeTypescriptInputSchema = z.object({\n  typescriptCode: z\n    .string()\n    .describe(\n      'TypeScript code to execute in the sandbox. ' +\n        'Use external_* functions to call available APIs. ' +\n        'Return a value to pass results back.',\n    ),\n})\n\n/**\n * Schema for the execute_typescript tool output\n */\nconst executeTypescriptOutputSchema = z.object({\n  success: z.boolean().describe('Whether execution completed without errors'),\n  result: z\n    .unknown()\n    .optional()\n    .describe('Return value from the executed code'),\n  logs: z\n    .array(z.string())\n    .optional()\n    .describe('Console output captured during execution'),\n  error: z\n    .object({\n      message: z.string(),\n      name: z.string().optional(),\n      line: z.number().optional(),\n    })\n    .optional()\n    .describe('Error details if execution failed'),\n})\n\nexport type ExecuteTypescriptInput = z.infer<\n  typeof executeTypescriptInputSchema\n>\nexport type ExecuteTypescriptOutput = z.infer<\n  typeof executeTypescriptOutputSchema\n>\n\n/**\n * Create an execute_typescript tool that can be used alongside other agent tools.\n *\n * This tool allows an LLM to execute TypeScript code in a secure sandbox.\n * Tools passed in the config become `external_*` functions available inside the sandbox.\n *\n * @example\n * ```typescript\n * import { createCodeMode } from '@tanstack/ai-code-mode'\n * import { createNodeIsolateDriver } from '@tanstack/ai-isolate-node'\n *\n * const { tool, systemPrompt } = createCodeMode({\n *   driver: createNodeIsolateDriver(),\n *   tools: [weatherTool, dbTool],  // Become external_fetchWeather, external_dbQuery\n *   timeout: 30000,\n * })\n *\n * chat({\n *   systemPrompts: [myPrompt, systemPrompt],\n *   tools: [tool, searchTool, emailTool],\n *   messages,\n * })\n * ```\n */\nexport function createCodeModeTool(\n  config: CodeModeToolConfig,\n): ServerTool<\n  typeof executeTypescriptInputSchema,\n  typeof executeTypescriptOutputSchema,\n  'execute_typescript'\n> {\n  const {\n    driver,\n    tools,\n    timeout = 30000,\n    memoryLimit = 128,\n    getSkillBindings,\n    transpile = stripTypeScript,\n  } = config\n\n  // Validate tools\n  if (tools.length === 0) {\n    throw new Error('At least one tool must be provided to createCodeModeTool')\n  }\n\n  // Transform tools to bindings with external_ prefix (static bindings)\n  const staticBindings = toolsToBindings(tools, 'external_')\n\n  // Create the tool definition\n  const definition = toolDefinition({\n    name: 'execute_typescript' as const,\n    description: buildToolDescription(tools),\n    inputSchema: executeTypescriptInputSchema,\n    outputSchema: executeTypescriptOutputSchema,\n  })\n\n  // Return server tool with execute function that accepts context\n  return definition.server(\n    async (\n      input,\n      toolContext?: ToolExecutionContext,\n    ): Promise<CodeModeToolResult> => {\n      const { typescriptCode } = input\n\n      // Get emitCustomEvent from context or use no-op\n      const emitCustomEvent = toolContext?.emitCustomEvent || (() => {})\n\n      if (!typescriptCode || typeof typescriptCode !== 'string') {\n        return {\n          success: false,\n          error: {\n            message: 'typescriptCode must be a non-empty string',\n            name: 'ValidationError',\n          },\n        }\n      }\n\n      // Create a fresh sandbox context for this execution\n      let isolateContext: IsolateContext | null = null\n\n      // Emit execution started event immediately\n      emitCustomEvent('code_mode:execution_started', {\n        timestamp: Date.now(),\n        codeLength: typescriptCode.length,\n      })\n\n      try {\n        // Step 1: Strip TypeScript (also serves as syntax validation via the\n        // transpiler — sucrase by default, or a user-supplied `transpile`)\n        let strippedCode: string\n        try {\n          strippedCode = await transpile(typescriptCode)\n        } catch (error) {\n          // Type/syntax error from the transpiler\n          return {\n            success: false,\n            error: {\n              message: error instanceof Error ? error.message : String(error),\n              name: 'TypeScriptError',\n            },\n          }\n        }\n\n        // Step 2: Get dynamic skill bindings if available\n        const skillBindings = getSkillBindings ? await getSkillBindings() : {}\n\n        // Step 3: Merge static and dynamic bindings, then wrap with event awareness\n        const allBindings = { ...staticBindings, ...skillBindings }\n        const eventAwareBindings = createEventAwareBindings(\n          allBindings,\n          emitCustomEvent,\n        )\n\n        // Step 4: Create sandbox context with event-aware bindings\n        isolateContext = await driver.createContext({\n          bindings: eventAwareBindings,\n          timeout,\n          memoryLimit,\n        })\n\n        // Step 5: Execute the code in the sandbox\n        const executionResult = await isolateContext.execute(strippedCode)\n\n        // Emit console logs as custom events\n        if (executionResult.logs && executionResult.logs.length > 0) {\n          for (const log of executionResult.logs) {\n            // Parse log level from prefix (added by sandbox console implementation)\n            let level: 'log' | 'warn' | 'error' | 'info' = 'log'\n            let message = log\n\n            if (log.startsWith('ERROR: ')) {\n              level = 'error'\n              message = log.slice(7)\n            } else if (log.startsWith('WARN: ')) {\n              level = 'warn'\n              message = log.slice(6)\n            } else if (log.startsWith('INFO: ')) {\n              level = 'info'\n              message = log.slice(6)\n            }\n\n            emitCustomEvent('code_mode:console', {\n              level,\n              message,\n              timestamp: Date.now(),\n            })\n          }\n        }\n\n        if (executionResult.success) {\n          return {\n            success: true,\n            result: executionResult.value,\n            logs: executionResult.logs,\n          }\n        } else {\n          return {\n            success: false,\n            error: executionResult.error\n              ? {\n                  message: executionResult.error.message,\n                  name: executionResult.error.name,\n                }\n              : { message: 'Unknown execution error' },\n            logs: executionResult.logs,\n          }\n        }\n      } catch (error) {\n        return {\n          success: false,\n          error: {\n            message: error instanceof Error ? error.message : String(error),\n            name: error instanceof Error ? error.name : 'Error',\n          },\n        }\n      } finally {\n        // Always clean up the sandbox context\n        if (isolateContext) {\n          await isolateContext.dispose()\n        }\n      }\n    },\n  )\n}\n\n/**\n * Build the tool description including available external functions\n */\nfunction buildToolDescription(tools: Array<CodeModeTool>): string {\n  const eager = tools.filter((t) => !t.lazy)\n  const hasLazy = tools.some((t) => t.lazy)\n  const externalFunctions = eager.map((t) => `external_${t.name}`).join(', ')\n\n  const discoverable = hasLazy\n    ? ` Additional functions can be discovered via the discover_tools tool.`\n    : ''\n\n  return (\n    `Execute TypeScript code in a secure sandbox environment. ` +\n    `The code can use these external API functions: ${externalFunctions}.${discoverable} ` +\n    `All external_* calls are async and must be awaited. ` +\n    `Return a value to pass results back. Use console.log() for debugging.`\n  )\n}\n"],"names":[],"mappings":";;;;AAkBA,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,gBAAgB,EACb,OAAA,EACA;AAAA,IACC;AAAA,EAAA;AAIN,CAAC;AAKD,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,SAAS,EAAE,UAAU,SAAS,4CAA4C;AAAA,EAC1E,QAAQ,EACL,QAAA,EACA,SAAA,EACA,SAAS,qCAAqC;AAAA,EACjD,MAAM,EACH,MAAM,EAAE,OAAA,CAAQ,EAChB,SAAA,EACA,SAAS,0CAA0C;AAAA,EACtD,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAA;AAAA,IACX,MAAM,EAAE,OAAA,EAAS,SAAA;AAAA,IACjB,MAAM,EAAE,OAAA,EAAS,SAAA;AAAA,EAAS,CAC3B,EACA,WACA,SAAS,mCAAmC;AACjD,CAAC;AAiCM,SAAS,mBACd,QAKA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV,cAAc;AAAA,IACd;AAAA,IACA,YAAY;AAAA,EAAA,IACV;AAGJ,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,QAAM,iBAAiB,gBAAgB,OAAO,WAAW;AAGzD,QAAM,aAAa,eAAe;AAAA,IAChC,MAAM;AAAA,IACN,aAAa,qBAAqB,KAAK;AAAA,IACvC,aAAa;AAAA,IACb,cAAc;AAAA,EAAA,CACf;AAGD,SAAO,WAAW;AAAA,IAChB,OACE,OACA,gBACgC;AAChC,YAAM,EAAE,mBAAmB;AAG3B,YAAM,kBAAkB,aAAa,oBAAoB,MAAM;AAAA,MAAC;AAEhE,UAAI,CAAC,kBAAkB,OAAO,mBAAmB,UAAU;AACzD,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,YACL,SAAS;AAAA,YACT,MAAM;AAAA,UAAA;AAAA,QACR;AAAA,MAEJ;AAGA,UAAI,iBAAwC;AAG5C,sBAAgB,+BAA+B;AAAA,QAC7C,WAAW,KAAK,IAAA;AAAA,QAChB,YAAY,eAAe;AAAA,MAAA,CAC5B;AAED,UAAI;AAGF,YAAI;AACJ,YAAI;AACF,yBAAe,MAAM,UAAU,cAAc;AAAA,QAC/C,SAAS,OAAO;AAEd,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,OAAO;AAAA,cACL,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,cAC9D,MAAM;AAAA,YAAA;AAAA,UACR;AAAA,QAEJ;AAGA,cAAM,gBAAgB,mBAAmB,MAAM,iBAAA,IAAqB,CAAA;AAGpE,cAAM,cAAc,EAAE,GAAG,gBAAgB,GAAG,cAAA;AAC5C,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA;AAAA,QAAA;AAIF,yBAAiB,MAAM,OAAO,cAAc;AAAA,UAC1C,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QAAA,CACD;AAGD,cAAM,kBAAkB,MAAM,eAAe,QAAQ,YAAY;AAGjE,YAAI,gBAAgB,QAAQ,gBAAgB,KAAK,SAAS,GAAG;AAC3D,qBAAW,OAAO,gBAAgB,MAAM;AAEtC,gBAAI,QAA2C;AAC/C,gBAAI,UAAU;AAEd,gBAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,sBAAQ;AACR,wBAAU,IAAI,MAAM,CAAC;AAAA,YACvB,WAAW,IAAI,WAAW,QAAQ,GAAG;AACnC,sBAAQ;AACR,wBAAU,IAAI,MAAM,CAAC;AAAA,YACvB,WAAW,IAAI,WAAW,QAAQ,GAAG;AACnC,sBAAQ;AACR,wBAAU,IAAI,MAAM,CAAC;AAAA,YACvB;AAEA,4BAAgB,qBAAqB;AAAA,cACnC;AAAA,cACA;AAAA,cACA,WAAW,KAAK,IAAA;AAAA,YAAI,CACrB;AAAA,UACH;AAAA,QACF;AAEA,YAAI,gBAAgB,SAAS;AAC3B,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,QAAQ,gBAAgB;AAAA,YACxB,MAAM,gBAAgB;AAAA,UAAA;AAAA,QAE1B,OAAO;AACL,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,OAAO,gBAAgB,QACnB;AAAA,cACE,SAAS,gBAAgB,MAAM;AAAA,cAC/B,MAAM,gBAAgB,MAAM;AAAA,YAAA,IAE9B,EAAE,SAAS,0BAAA;AAAA,YACf,MAAM,gBAAgB;AAAA,UAAA;AAAA,QAE1B;AAAA,MACF,SAAS,OAAO;AACd,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,YACL,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,YAC9D,MAAM,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UAAA;AAAA,QAC9C;AAAA,MAEJ,UAAA;AAEE,YAAI,gBAAgB;AAClB,gBAAM,eAAe,QAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,EAAA;AAEJ;AAKA,SAAS,qBAAqB,OAAoC;AAChE,QAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI;AACzC,QAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI;AACxC,QAAM,oBAAoB,MAAM,IAAI,CAAC,MAAM,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI;AAE1E,QAAM,eAAe,UACjB,yEACA;AAEJ,SACE,2GACkD,iBAAiB,IAAI,YAAY;AAIvF;"}
+{"version":3,"file":"create-code-mode-tool.js","sources":["../../src/create-code-mode-tool.ts"],"sourcesContent":["import { z } from 'zod'\nimport { toolDefinition } from '@tanstack/ai'\nimport {\n  createEventAwareBindings,\n  toolsToBindings,\n} from './bindings/tool-to-binding'\nimport { stripTypeScript } from './strip-typescript'\nimport { warnIfBindingsExposeSecrets } from './validate-bindings'\nimport type { ServerTool, ToolExecutionContext } from '@tanstack/ai'\nimport type {\n  CodeModeTool,\n  CodeModeToolConfig,\n  CodeModeToolResult,\n  IsolateContext,\n} from './types'\n\n/**\n * Schema for the execute_typescript tool input\n */\nconst executeTypescriptInputSchema = z.object({\n  typescriptCode: z\n    .string()\n    .describe(\n      'TypeScript code to execute in the sandbox. ' +\n        'Use external_* functions to call available APIs. ' +\n        'Return a value to pass results back.',\n    ),\n})\n\n/**\n * Schema for the execute_typescript tool output\n */\nconst executeTypescriptOutputSchema = z.object({\n  success: z.boolean().describe('Whether execution completed without errors'),\n  result: z\n    .unknown()\n    .optional()\n    .describe('Return value from the executed code'),\n  logs: z\n    .array(z.string())\n    .optional()\n    .describe('Console output captured during execution'),\n  error: z\n    .object({\n      message: z.string(),\n      name: z.string().optional(),\n      line: z.number().optional(),\n    })\n    .optional()\n    .describe('Error details if execution failed'),\n})\n\nexport type ExecuteTypescriptInput = z.infer<\n  typeof executeTypescriptInputSchema\n>\nexport type ExecuteTypescriptOutput = z.infer<\n  typeof executeTypescriptOutputSchema\n>\n\n/**\n * Create an execute_typescript tool that can be used alongside other agent tools.\n *\n * This tool allows an LLM to execute TypeScript code in a secure sandbox.\n * Tools passed in the config become `external_*` functions available inside the sandbox.\n *\n * @example\n * ```typescript\n * import { createCodeMode } from '@tanstack/ai-code-mode'\n * import { createNodeIsolateDriver } from '@tanstack/ai-isolate-node'\n *\n * const { tool, systemPrompt } = createCodeMode({\n *   driver: createNodeIsolateDriver(),\n *   tools: [weatherTool, dbTool],  // Become external_fetchWeather, external_dbQuery\n *   timeout: 30000,\n * })\n *\n * chat({\n *   systemPrompts: [myPrompt, systemPrompt],\n *   tools: [tool, searchTool, emailTool],\n *   messages,\n * })\n * ```\n */\nexport function createCodeModeTool(\n  config: CodeModeToolConfig,\n): ServerTool<\n  typeof executeTypescriptInputSchema,\n  typeof executeTypescriptOutputSchema,\n  'execute_typescript'\n> {\n  const {\n    driver,\n    tools,\n    timeout = 30000,\n    memoryLimit = 128,\n    getSkillBindings,\n    onSecretParameter,\n    transpile = stripTypeScript,\n  } = config\n\n  // Validate tools\n  if (tools.length === 0) {\n    throw new Error('At least one tool must be provided to createCodeModeTool')\n  }\n\n  // Transform tools to bindings with external_ prefix (static bindings)\n  const staticBindings = toolsToBindings(tools, 'external_')\n\n  // Shared across static + dynamic (skill) binding scans so a given\n  // (toolName, paramPath) pair surfaces at most once per code-mode instance.\n  const secretDedupCache = new Set<string>()\n\n  warnIfBindingsExposeSecrets(Object.values(staticBindings), {\n    handler: onSecretParameter,\n    dedupCache: secretDedupCache,\n  })\n\n  // Create the tool definition\n  const definition = toolDefinition({\n    name: 'execute_typescript' as const,\n    description: buildToolDescription(tools),\n    inputSchema: executeTypescriptInputSchema,\n    outputSchema: executeTypescriptOutputSchema,\n  })\n\n  // Return server tool with execute function that accepts context\n  return definition.server(\n    async (\n      input,\n      toolContext?: ToolExecutionContext,\n    ): Promise<CodeModeToolResult> => {\n      const { typescriptCode } = input\n\n      // Get emitCustomEvent from context or use no-op\n      const emitCustomEvent = toolContext?.emitCustomEvent || (() => {})\n\n      if (!typescriptCode || typeof typescriptCode !== 'string') {\n        return {\n          success: false,\n          error: {\n            message: 'typescriptCode must be a non-empty string',\n            name: 'ValidationError',\n          },\n        }\n      }\n\n      // Create a fresh sandbox context for this execution\n      let isolateContext: IsolateContext | null = null\n\n      // Emit execution started event immediately\n      emitCustomEvent('code_mode:execution_started', {\n        timestamp: Date.now(),\n        codeLength: typescriptCode.length,\n      })\n\n      try {\n        // Step 1: Strip TypeScript (also serves as syntax validation via the\n        // transpiler — sucrase by default, or a user-supplied `transpile`)\n        let strippedCode: string\n        try {\n          strippedCode = await transpile(typescriptCode)\n        } catch (error) {\n          // Type/syntax error from the transpiler\n          return {\n            success: false,\n            error: {\n              message: error instanceof Error ? error.message : String(error),\n              name: 'TypeScriptError',\n            },\n          }\n        }\n\n        // Step 2: Get dynamic skill bindings if available\n        const skillBindings = getSkillBindings ? await getSkillBindings() : {}\n\n        // Scan dynamic bindings too — their schemas are equally in-scope for\n        // the same exfiltration threat. Dedup cache prevents repeat warnings\n        // when the same binding reappears across executions.\n        const skillBindingValues = Object.values(skillBindings)\n        if (skillBindingValues.length > 0) {\n          warnIfBindingsExposeSecrets(skillBindingValues, {\n            handler: onSecretParameter,\n            dedupCache: secretDedupCache,\n          })\n        }\n\n        // Step 3: Merge static and dynamic bindings, then wrap with event awareness\n        const allBindings = { ...staticBindings, ...skillBindings }\n        const eventAwareBindings = createEventAwareBindings(\n          allBindings,\n          emitCustomEvent,\n        )\n\n        // Step 4: Create sandbox context with event-aware bindings\n        isolateContext = await driver.createContext({\n          bindings: eventAwareBindings,\n          timeout,\n          memoryLimit,\n        })\n\n        // Step 5: Execute the code in the sandbox\n        const executionResult = await isolateContext.execute(strippedCode)\n\n        // Emit console logs as custom events\n        if (executionResult.logs && executionResult.logs.length > 0) {\n          for (const log of executionResult.logs) {\n            // Parse log level from prefix (added by sandbox console implementation)\n            let level: 'log' | 'warn' | 'error' | 'info' = 'log'\n            let message = log\n\n            if (log.startsWith('ERROR: ')) {\n              level = 'error'\n              message = log.slice(7)\n            } else if (log.startsWith('WARN: ')) {\n              level = 'warn'\n              message = log.slice(6)\n            } else if (log.startsWith('INFO: ')) {\n              level = 'info'\n              message = log.slice(6)\n            }\n\n            emitCustomEvent('code_mode:console', {\n              level,\n              message,\n              timestamp: Date.now(),\n            })\n          }\n        }\n\n        if (executionResult.success) {\n          return {\n            success: true,\n            result: executionResult.value,\n            logs: executionResult.logs,\n          }\n        } else {\n          return {\n            success: false,\n            error: executionResult.error\n              ? {\n                  message: executionResult.error.message,\n                  name: executionResult.error.name,\n                }\n              : { message: 'Unknown execution error' },\n            logs: executionResult.logs,\n          }\n        }\n      } catch (error) {\n        return {\n          success: false,\n          error: {\n            message: error instanceof Error ? error.message : String(error),\n            name: error instanceof Error ? error.name : 'Error',\n          },\n        }\n      } finally {\n        // Always clean up the sandbox context\n        if (isolateContext) {\n          await isolateContext.dispose()\n        }\n      }\n    },\n  )\n}\n\n/**\n * Build the tool description including available external functions\n */\nfunction buildToolDescription(tools: Array<CodeModeTool>): string {\n  const eager = tools.filter((t) => !t.lazy)\n  const hasLazy = tools.some((t) => t.lazy)\n  const externalFunctions = eager.map((t) => `external_${t.name}`).join(', ')\n\n  const discoverable = hasLazy\n    ? ` Additional functions can be discovered via the discover_tools tool.`\n    : ''\n\n  return (\n    `Execute TypeScript code in a secure sandbox environment. ` +\n    `The code can use these external API functions: ${externalFunctions}.${discoverable} ` +\n    `All external_* calls are async and must be awaited. ` +\n    `Return a value to pass results back. Use console.log() for debugging.`\n  )\n}\n"],"names":[],"mappings":";;;;;AAmBA,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,gBAAgB,EACb,OAAA,EACA;AAAA,IACC;AAAA,EAAA;AAIN,CAAC;AAKD,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,SAAS,EAAE,UAAU,SAAS,4CAA4C;AAAA,EAC1E,QAAQ,EACL,QAAA,EACA,SAAA,EACA,SAAS,qCAAqC;AAAA,EACjD,MAAM,EACH,MAAM,EAAE,OAAA,CAAQ,EAChB,SAAA,EACA,SAAS,0CAA0C;AAAA,EACtD,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAA;AAAA,IACX,MAAM,EAAE,OAAA,EAAS,SAAA;AAAA,IACjB,MAAM,EAAE,OAAA,EAAS,SAAA;AAAA,EAAS,CAC3B,EACA,WACA,SAAS,mCAAmC;AACjD,CAAC;AAiCM,SAAS,mBACd,QAKA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV,cAAc;AAAA,IACd;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EAAA,IACV;AAGJ,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,QAAM,iBAAiB,gBAAgB,OAAO,WAAW;AAIzD,QAAM,uCAAuB,IAAA;AAE7B,8BAA4B,OAAO,OAAO,cAAc,GAAG;AAAA,IACzD,SAAS;AAAA,IACT,YAAY;AAAA,EAAA,CACb;AAGD,QAAM,aAAa,eAAe;AAAA,IAChC,MAAM;AAAA,IACN,aAAa,qBAAqB,KAAK;AAAA,IACvC,aAAa;AAAA,IACb,cAAc;AAAA,EAAA,CACf;AAGD,SAAO,WAAW;AAAA,IAChB,OACE,OACA,gBACgC;AAChC,YAAM,EAAE,mBAAmB;AAG3B,YAAM,kBAAkB,aAAa,oBAAoB,MAAM;AAAA,MAAC;AAEhE,UAAI,CAAC,kBAAkB,OAAO,mBAAmB,UAAU;AACzD,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,YACL,SAAS;AAAA,YACT,MAAM;AAAA,UAAA;AAAA,QACR;AAAA,MAEJ;AAGA,UAAI,iBAAwC;AAG5C,sBAAgB,+BAA+B;AAAA,QAC7C,WAAW,KAAK,IAAA;AAAA,QAChB,YAAY,eAAe;AAAA,MAAA,CAC5B;AAED,UAAI;AAGF,YAAI;AACJ,YAAI;AACF,yBAAe,MAAM,UAAU,cAAc;AAAA,QAC/C,SAAS,OAAO;AAEd,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,OAAO;AAAA,cACL,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,cAC9D,MAAM;AAAA,YAAA;AAAA,UACR;AAAA,QAEJ;AAGA,cAAM,gBAAgB,mBAAmB,MAAM,iBAAA,IAAqB,CAAA;AAKpE,cAAM,qBAAqB,OAAO,OAAO,aAAa;AACtD,YAAI,mBAAmB,SAAS,GAAG;AACjC,sCAA4B,oBAAoB;AAAA,YAC9C,SAAS;AAAA,YACT,YAAY;AAAA,UAAA,CACb;AAAA,QACH;AAGA,cAAM,cAAc,EAAE,GAAG,gBAAgB,GAAG,cAAA;AAC5C,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA;AAAA,QAAA;AAIF,yBAAiB,MAAM,OAAO,cAAc;AAAA,UAC1C,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QAAA,CACD;AAGD,cAAM,kBAAkB,MAAM,eAAe,QAAQ,YAAY;AAGjE,YAAI,gBAAgB,QAAQ,gBAAgB,KAAK,SAAS,GAAG;AAC3D,qBAAW,OAAO,gBAAgB,MAAM;AAEtC,gBAAI,QAA2C;AAC/C,gBAAI,UAAU;AAEd,gBAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,sBAAQ;AACR,wBAAU,IAAI,MAAM,CAAC;AAAA,YACvB,WAAW,IAAI,WAAW,QAAQ,GAAG;AACnC,sBAAQ;AACR,wBAAU,IAAI,MAAM,CAAC;AAAA,YACvB,WAAW,IAAI,WAAW,QAAQ,GAAG;AACnC,sBAAQ;AACR,wBAAU,IAAI,MAAM,CAAC;AAAA,YACvB;AAEA,4BAAgB,qBAAqB;AAAA,cACnC;AAAA,cACA;AAAA,cACA,WAAW,KAAK,IAAA;AAAA,YAAI,CACrB;AAAA,UACH;AAAA,QACF;AAEA,YAAI,gBAAgB,SAAS;AAC3B,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,QAAQ,gBAAgB;AAAA,YACxB,MAAM,gBAAgB;AAAA,UAAA;AAAA,QAE1B,OAAO;AACL,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,OAAO,gBAAgB,QACnB;AAAA,cACE,SAAS,gBAAgB,MAAM;AAAA,cAC/B,MAAM,gBAAgB,MAAM;AAAA,YAAA,IAE9B,EAAE,SAAS,0BAAA;AAAA,YACf,MAAM,gBAAgB;AAAA,UAAA;AAAA,QAE1B;AAAA,MACF,SAAS,OAAO;AACd,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,YACL,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,YAC9D,MAAM,iBAAiB,QAAQ,MAAM,OAAO;AAAA,UAAA;AAAA,QAC9C;AAAA,MAEJ,UAAA;AAEE,YAAI,gBAAgB;AAClB,gBAAM,eAAe,QAAA;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAAA,EAAA;AAEJ;AAKA,SAAS,qBAAqB,OAAoC;AAChE,QAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI;AACzC,QAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI;AACxC,QAAM,oBAAoB,MAAM,IAAI,CAAC,MAAM,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI;AAE1E,QAAM,eAAe,UACjB,yEACA;AAEJ,SACE,2GACkD,iBAAiB,IAAI,YAAY;AAIvF;"}

package/dist/esm/index.d.ts

@@ -9,3 +9,4 @@ export { generateTypeStubs, jsonSchemaToTypeScript, type TypeGeneratorOptions, }
 export { stripTypeScript } from './strip-typescript.js';
 export { wrapCode } from './code-wrapper.js';
 export type { CodeModeToolConfig, CreateCodeModeResult, CodeModeToolResult, IsolateDriver, IsolateConfig, IsolateContext, ExecutionResult, NormalizedError, ToolBinding, CodeModeTool, ToolExecutionContext, } from './types.js';
+export type { SecretParameterHandler, SecretParameterInfo, } from './validate-bindings.js';

package/dist/esm/types.d.ts

@@ -1,4 +1,5 @@
 import { LazyToolsConfig, SchemaInput, ServerTool, ToolExecutionContext } from '@tanstack/ai';
+import { SecretParameterHandler } from './validate-bindings.js';
 /**
  * Interface for isolate/sandbox drivers
  * Each runtime environment implements this to provide sandboxed code execution
@@ -152,6 +153,19 @@ export interface CodeModeToolConfig {
      * ```
      */
     getSkillBindings?: () => Promise<Record<string, ToolBinding>>;
+    /**
+     * How to surface tool parameters whose names look like secrets.
+     * Defaults to `'warn'` (logs via `console.warn`).
+     *
+     * - `'warn'`: log a warning for each match.
+     * - `'throw'`: throw an Error on the first match — useful in tests/CI.
+     * - `'ignore'`: suppress the check entirely.
+     * - `(info) => void`: receive each match and decide how to react.
+     *
+     * Matches are deduplicated per `(toolName, paramPath)` across the lifetime
+     * of a single `createCodeModeTool` instance.
+     */
+    onSecretParameter?: SecretParameterHandler;
     /**
      * Optional lazy-tool discovery config. Tools marked `lazy: true` are kept out
      * of the system prompt's full documentation and listed in a Discoverable APIs

package/dist/esm/validate-bindings.d.ts

@@ -0,0 +1,25 @@
+export interface SecretParameterInfo {
+    toolName: string;
+    paramName: string;
+    paramPath: Array<string>;
+}
+export type SecretParameterHandler = 'warn' | 'throw' | 'ignore' | ((info: SecretParameterInfo) => void);
+interface ToolLike {
+    name: string;
+    inputSchema?: Record<string, unknown>;
+}
+/**
+ * Scan tool input schemas for parameter names that look like secrets.
+ * Emits a warning (or invokes the configured handler) for each match.
+ *
+ * Recurses into nested object properties, array items, union branches
+ * (anyOf/oneOf/allOf), additionalProperties, and `$ref` targets that
+ * resolve within the same schema's `$defs`/`definitions`.
+ *
+ * Best-effort heuristic, not a security boundary.
+ */
+export declare function warnIfBindingsExposeSecrets(tools: Array<ToolLike>, options?: {
+    handler?: SecretParameterHandler;
+    dedupCache?: Set<string>;
+}): void;
+export {};

package/dist/esm/validate-bindings.js

@@ -0,0 +1,105 @@
+const DANGEROUS_WORDS = /* @__PURE__ */ new Set([
+  "password",
+  "passwd",
+  "pwd",
+  "passcode",
+  "secret",
+  "token",
+  "credential",
+  "credentials",
+  "authorization",
+  "jwt",
+  "bearer"
+]);
+const COMPOUND_PATTERNS = [
+  "apikey",
+  "accesskey",
+  "authkey",
+  "privatekey",
+  "clientsecret",
+  "webhooksecret"
+];
+function splitIntoWords(name) {
+  return name.replace(/[_\-\s]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/\s+/).filter(Boolean);
+}
+function looksLikeSecret(name) {
+  const words = splitIntoWords(name);
+  if (words.some((w) => DANGEROUS_WORDS.has(w))) return true;
+  const normalized = name.replace(/[_\-\s]/g, "").toLowerCase();
+  return COMPOUND_PATTERNS.some((p) => normalized.includes(p));
+}
+function resolveRef(ref, root) {
+  const match = ref.match(/^#\/(\$defs|definitions)\/(.+)$/);
+  if (!match) return void 0;
+  const bucket = match[1];
+  const key = match[2];
+  return key === void 0 ? void 0 : root[bucket]?.[key];
+}
+function findSecretParams(schema, root, seen, path, found) {
+  if (!schema || typeof schema !== "object" || seen.has(schema)) return;
+  seen.add(schema);
+  if (schema.properties && typeof schema.properties === "object") {
+    for (const [paramName, sub] of Object.entries(schema.properties)) {
+      if (looksLikeSecret(paramName)) {
+        found.push({ path: [...path, paramName], name: paramName });
+      }
+      findSecretParams(sub, root, seen, [...path, paramName], found);
+    }
+  }
+  if (Array.isArray(schema.items)) {
+    schema.items.forEach(
+      (s, i) => findSecretParams(s, root, seen, [...path, `[${i}]`], found)
+    );
+  } else if (schema.items && typeof schema.items === "object") {
+    findSecretParams(schema.items, root, seen, [...path, "[]"], found);
+  }
+  if (schema.additionalProperties && typeof schema.additionalProperties === "object") {
+    findSecretParams(schema.additionalProperties, root, seen, path, found);
+  }
+  for (const key of ["anyOf", "oneOf", "allOf"]) {
+    const arr = schema[key];
+    if (Array.isArray(arr)) {
+      arr.forEach((s) => findSecretParams(s, root, seen, path, found));
+    }
+  }
+  if (typeof schema.$ref === "string") {
+    const target = resolveRef(schema.$ref, root);
+    if (target) findSecretParams(target, root, seen, path, found);
+  }
+}
+function buildMessage(toolName, paramPath) {
+  return `[TanStack AI Code Mode] Tool "${toolName}" has parameter "${paramPath.join(".")}" that looks like a secret. Code Mode executes LLM-generated code — any value passed through this parameter is accessible to generated code and could be exfiltrated. Keep secrets in your server-side tool implementation instead of passing them as tool parameters.`;
+}
+function warnIfBindingsExposeSecrets(tools, options = {}) {
+  const { handler = "warn", dedupCache } = options;
+  if (handler === "ignore") return;
+  for (const tool of tools) {
+    const schema = tool.inputSchema;
+    if (!schema) continue;
+    const found = [];
+    findSecretParams(schema, schema, /* @__PURE__ */ new Set(), [], found);
+    for (const entry of found) {
+      const dedupKey = `${tool.name}::${entry.path.join(".")}`;
+      if (dedupCache) {
+        if (dedupCache.has(dedupKey)) continue;
+        dedupCache.add(dedupKey);
+      }
+      const info = {
+        toolName: tool.name,
+        paramName: entry.name,
+        paramPath: entry.path
+      };
+      if (typeof handler === "function") {
+        handler(info);
+      } else if (handler === "throw") {
+        throw new Error(buildMessage(tool.name, entry.path));
+      } else {
+        console.warn(buildMessage(tool.name, entry.path));
+      }
+    }
+  }
+}
+export {
+  warnIfBindingsExposeSecrets
+};
+//# sourceMappingURL=validate-bindings.js.map

package/dist/esm/validate-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-bindings.js","sources":["../../src/validate-bindings.ts"],"sourcesContent":["/**\n * Single words that on their own signal \"this is a credential\".\n * Matched after splitting a parameter name into camelCase/snake/kebab words.\n * So `accessToken` → `['access', 'token']` → matches `token`,\n * but `tokenizer` → `['tokenizer']` → does NOT match `token`.\n */\nconst DANGEROUS_WORDS = new Set<string>([\n  'password',\n  'passwd',\n  'pwd',\n  'passcode',\n  'secret',\n  'token',\n  'credential',\n  'credentials',\n  'authorization',\n  'jwt',\n  'bearer',\n])\n\n/**\n * Compound patterns matched as substrings of the normalized (lowercased,\n * separator-stripped) parameter name. Catches forms like `openai_api_key`,\n * `x-api-key`, and `webhookSecret`.\n */\nconst COMPOUND_PATTERNS = [\n  'apikey',\n  'accesskey',\n  'authkey',\n  'privatekey',\n  'clientsecret',\n  'webhooksecret',\n] as const\n\nexport interface SecretParameterInfo {\n  toolName: string\n  paramName: string\n  paramPath: Array<string>\n}\n\nexport type SecretParameterHandler =\n  | 'warn'\n  | 'throw'\n  | 'ignore'\n  | ((info: SecretParameterInfo) => void)\n\ninterface ToolLike {\n  name: string\n  inputSchema?: Record<string, unknown>\n}\n\ninterface JsonSchemaLike {\n  type?: string\n  properties?: Record<string, JsonSchemaLike>\n  items?: JsonSchemaLike | Array<JsonSchemaLike>\n  anyOf?: Array<JsonSchemaLike>\n  oneOf?: Array<JsonSchemaLike>\n  allOf?: Array<JsonSchemaLike>\n  additionalProperties?: boolean | JsonSchemaLike\n  $ref?: string\n  $defs?: Record<string, JsonSchemaLike>\n  definitions?: Record<string, JsonSchemaLike>\n}\n\nfunction splitIntoWords(name: string): Array<string> {\n  return name\n    .replace(/[_\\-\\s]+/g, ' ')\n    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n    .toLowerCase()\n    .split(/\\s+/)\n    .filter(Boolean)\n}\n\nfunction looksLikeSecret(name: string): boolean {\n  const words = splitIntoWords(name)\n  if (words.some((w) => DANGEROUS_WORDS.has(w))) return true\n  const normalized = name.replace(/[_\\-\\s]/g, '').toLowerCase()\n  return COMPOUND_PATTERNS.some((p) => normalized.includes(p))\n}\n\nfunction resolveRef(\n  ref: string,\n  root: JsonSchemaLike,\n): JsonSchemaLike | undefined {\n  const match = ref.match(/^#\\/(\\$defs|definitions)\\/(.+)$/)\n  if (!match) return undefined\n  const bucket = match[1] as '$defs' | 'definitions'\n  const key = match[2]\n  return key === undefined ? undefined : root[bucket]?.[key]\n}\n\nfunction findSecretParams(\n  schema: JsonSchemaLike | undefined,\n  root: JsonSchemaLike,\n  seen: Set<object>,\n  path: Array<string>,\n  found: Array<{ path: Array<string>; name: string }>,\n): void {\n  if (!schema || typeof schema !== 'object' || seen.has(schema)) return\n  seen.add(schema)\n\n  if (schema.properties && typeof schema.properties === 'object') {\n    for (const [paramName, sub] of Object.entries(schema.properties)) {\n      if (looksLikeSecret(paramName)) {\n        found.push({ path: [...path, paramName], name: paramName })\n      }\n      findSecretParams(sub, root, seen, [...path, paramName], found)\n    }\n  }\n\n  if (Array.isArray(schema.items)) {\n    schema.items.forEach((s, i) =>\n      findSecretParams(s, root, seen, [...path, `[${i}]`], found),\n    )\n  } else if (schema.items && typeof schema.items === 'object') {\n    findSecretParams(schema.items, root, seen, [...path, '[]'], found)\n  }\n\n  if (\n    schema.additionalProperties &&\n    typeof schema.additionalProperties === 'object'\n  ) {\n    findSecretParams(schema.additionalProperties, root, seen, path, found)\n  }\n\n  for (const key of ['anyOf', 'oneOf', 'allOf'] as const) {\n    const arr = schema[key]\n    if (Array.isArray(arr)) {\n      arr.forEach((s) => findSecretParams(s, root, seen, path, found))\n    }\n  }\n\n  if (typeof schema.$ref === 'string') {\n    const target = resolveRef(schema.$ref, root)\n    if (target) findSecretParams(target, root, seen, path, found)\n  }\n}\n\nfunction buildMessage(toolName: string, paramPath: Array<string>): string {\n  return (\n    `[TanStack AI Code Mode] Tool \"${toolName}\" has parameter \"${paramPath.join('.')}\" ` +\n    `that looks like a secret. Code Mode executes LLM-generated code — any ` +\n    `value passed through this parameter is accessible to generated code and ` +\n    `could be exfiltrated. Keep secrets in your server-side tool implementation ` +\n    `instead of passing them as tool parameters.`\n  )\n}\n\n/**\n * Scan tool input schemas for parameter names that look like secrets.\n * Emits a warning (or invokes the configured handler) for each match.\n *\n * Recurses into nested object properties, array items, union branches\n * (anyOf/oneOf/allOf), additionalProperties, and `$ref` targets that\n * resolve within the same schema's `$defs`/`definitions`.\n *\n * Best-effort heuristic, not a security boundary.\n */\nexport function warnIfBindingsExposeSecrets(\n  tools: Array<ToolLike>,\n  options: {\n    handler?: SecretParameterHandler\n    dedupCache?: Set<string>\n  } = {},\n): void {\n  const { handler = 'warn', dedupCache } = options\n  if (handler === 'ignore') return\n\n  for (const tool of tools) {\n    const schema = tool.inputSchema as JsonSchemaLike | undefined\n    if (!schema) continue\n\n    const found: Array<{ path: Array<string>; name: string }> = []\n    findSecretParams(schema, schema, new Set(), [], found)\n\n    for (const entry of found) {\n      const dedupKey = `${tool.name}::${entry.path.join('.')}`\n      if (dedupCache) {\n        if (dedupCache.has(dedupKey)) continue\n        dedupCache.add(dedupKey)\n      }\n\n      const info: SecretParameterInfo = {\n        toolName: tool.name,\n        paramName: entry.name,\n        paramPath: entry.path,\n      }\n\n      if (typeof handler === 'function') {\n        handler(info)\n      } else if (handler === 'throw') {\n        throw new Error(buildMessage(tool.name, entry.path))\n      } else {\n        console.warn(buildMessage(tool.name, entry.path))\n      }\n    }\n  }\n}\n"],"names":[],"mappings":"AAMA,MAAM,sCAAsB,IAAY;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,MAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgCA,SAAS,eAAe,MAA6B;AACnD,SAAO,KACJ,QAAQ,aAAa,GAAG,EACxB,QAAQ,sBAAsB,OAAO,EACrC,cACA,MAAM,KAAK,EACX,OAAO,OAAO;AACnB;AAEA,SAAS,gBAAgB,MAAuB;AAC9C,QAAM,QAAQ,eAAe,IAAI;AACjC,MAAI,MAAM,KAAK,CAAC,MAAM,gBAAgB,IAAI,CAAC,CAAC,EAAG,QAAO;AACtD,QAAM,aAAa,KAAK,QAAQ,YAAY,EAAE,EAAE,YAAA;AAChD,SAAO,kBAAkB,KAAK,CAAC,MAAM,WAAW,SAAS,CAAC,CAAC;AAC7D;AAEA,SAAS,WACP,KACA,MAC4B;AAC5B,QAAM,QAAQ,IAAI,MAAM,iCAAiC;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,MAAM,CAAC;AACtB,QAAM,MAAM,MAAM,CAAC;AACnB,SAAO,QAAQ,SAAY,SAAY,KAAK,MAAM,IAAI,GAAG;AAC3D;AAEA,SAAS,iBACP,QACA,MACA,MACA,MACA,OACM;AACN,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,KAAK,IAAI,MAAM,EAAG;AAC/D,OAAK,IAAI,MAAM;AAEf,MAAI,OAAO,cAAc,OAAO,OAAO,eAAe,UAAU;AAC9D,eAAW,CAAC,WAAW,GAAG,KAAK,OAAO,QAAQ,OAAO,UAAU,GAAG;AAChE,UAAI,gBAAgB,SAAS,GAAG;AAC9B,cAAM,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,SAAS,GAAG,MAAM,WAAW;AAAA,MAC5D;AACA,uBAAiB,KAAK,MAAM,MAAM,CAAC,GAAG,MAAM,SAAS,GAAG,KAAK;AAAA,IAC/D;AAAA,EACF;AAEA,MAAI,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC/B,WAAO,MAAM;AAAA,MAAQ,CAAC,GAAG,MACvB,iBAAiB,GAAG,MAAM,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,KAAK;AAAA,IAAA;AAAA,EAE9D,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,UAAU;AAC3D,qBAAiB,OAAO,OAAO,MAAM,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,KAAK;AAAA,EACnE;AAEA,MACE,OAAO,wBACP,OAAO,OAAO,yBAAyB,UACvC;AACA,qBAAiB,OAAO,sBAAsB,MAAM,MAAM,MAAM,KAAK;AAAA,EACvE;AAEA,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,GAAY;AACtD,UAAM,MAAM,OAAO,GAAG;AACtB,QAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,UAAI,QAAQ,CAAC,MAAM,iBAAiB,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,OAAO,OAAO,SAAS,UAAU;AACnC,UAAM,SAAS,WAAW,OAAO,MAAM,IAAI;AAC3C,QAAI,OAAQ,kBAAiB,QAAQ,MAAM,MAAM,MAAM,KAAK;AAAA,EAC9D;AACF;AAEA,SAAS,aAAa,UAAkB,WAAkC;AACxE,SACE,iCAAiC,QAAQ,oBAAoB,UAAU,KAAK,GAAG,CAAC;AAMpF;AAYO,SAAS,4BACd,OACA,UAGI,IACE;AACN,QAAM,EAAE,UAAU,QAAQ,WAAA,IAAe;AACzC,MAAI,YAAY,SAAU;AAE1B,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,KAAK;AACpB,QAAI,CAAC,OAAQ;AAEb,UAAM,QAAsD,CAAA;AAC5D,qBAAiB,QAAQ,QAAQ,oBAAI,OAAO,CAAA,GAAI,KAAK;AAErD,eAAW,SAAS,OAAO;AACzB,YAAM,WAAW,GAAG,KAAK,IAAI,KAAK,MAAM,KAAK,KAAK,GAAG,CAAC;AACtD,UAAI,YAAY;AACd,YAAI,WAAW,IAAI,QAAQ,EAAG;AAC9B,mBAAW,IAAI,QAAQ;AAAA,MACzB;AAEA,YAAM,OAA4B;AAAA,QAChC,UAAU,KAAK;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA;AAGnB,UAAI,OAAO,YAAY,YAAY;AACjC,gBAAQ,IAAI;AAAA,MACd,WAAW,YAAY,SAAS;AAC9B,cAAM,IAAI,MAAM,aAAa,KAAK,MAAM,MAAM,IAAI,CAAC;AAAA,MACrD,OAAO;AACL,gBAAQ,KAAK,aAAa,KAAK,MAAM,MAAM,IAAI,CAAC;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACF;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanstack/ai-code-mode",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Secure TypeScript Code Mode for TanStack AI agents to execute sandboxed tool orchestration programs.",
   "author": "Tanner Linsley",
   "license": "MIT",
@@ -54,12 +54,12 @@
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0",
-    "@tanstack/ai": "0.39.0"
+    "@tanstack/ai": "0.39.1"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "4.0.14",
     "zod": "^4.2.0",
-    "@tanstack/ai": "0.39.0"
+    "@tanstack/ai": "0.39.1"
   },
   "scripts": {
     "build": "vite build",

package/src/create-code-mode-tool.ts

@@ -5,6 +5,7 @@ import {
   toolsToBindings,
 } from './bindings/tool-to-binding'
 import { stripTypeScript } from './strip-typescript'
+import { warnIfBindingsExposeSecrets } from './validate-bindings'
 import type { ServerTool, ToolExecutionContext } from '@tanstack/ai'
 import type {
   CodeModeTool,
@@ -93,6 +94,7 @@ export function createCodeModeTool(
     timeout = 30000,
     memoryLimit = 128,
     getSkillBindings,
+    onSecretParameter,
     transpile = stripTypeScript,
   } = config
 
@@ -104,6 +106,15 @@ export function createCodeModeTool(
   // Transform tools to bindings with external_ prefix (static bindings)
   const staticBindings = toolsToBindings(tools, 'external_')
 
+  // Shared across static + dynamic (skill) binding scans so a given
+  // (toolName, paramPath) pair surfaces at most once per code-mode instance.
+  const secretDedupCache = new Set<string>()
+
+  warnIfBindingsExposeSecrets(Object.values(staticBindings), {
+    handler: onSecretParameter,
+    dedupCache: secretDedupCache,
+  })
+
   // Create the tool definition
   const definition = toolDefinition({
     name: 'execute_typescript' as const,
@@ -162,6 +173,17 @@ export function createCodeModeTool(
         // Step 2: Get dynamic skill bindings if available
         const skillBindings = getSkillBindings ? await getSkillBindings() : {}
 
+        // Scan dynamic bindings too — their schemas are equally in-scope for
+        // the same exfiltration threat. Dedup cache prevents repeat warnings
+        // when the same binding reappears across executions.
+        const skillBindingValues = Object.values(skillBindings)
+        if (skillBindingValues.length > 0) {
+          warnIfBindingsExposeSecrets(skillBindingValues, {
+            handler: onSecretParameter,
+            dedupCache: secretDedupCache,
+          })
+        }
+
         // Step 3: Merge static and dynamic bindings, then wrap with event awareness
         const allBindings = { ...staticBindings, ...skillBindings }
         const eventAwareBindings = createEventAwareBindings(

package/src/index.ts

@@ -55,3 +55,9 @@ export type {
   // Re-exported from @tanstack/ai
   ToolExecutionContext,
 } from './types'
+
+// Secret-parameter warning configuration
+export type {
+  SecretParameterHandler,
+  SecretParameterInfo,
+} from './validate-bindings'

package/src/types.ts

@@ -4,6 +4,7 @@ import type {
   ServerTool,
   ToolExecutionContext,
 } from '@tanstack/ai'
+import type { SecretParameterHandler } from './validate-bindings'
 
 // ============================================================================
 // Isolate Driver Interfaces
@@ -197,6 +198,20 @@ export interface CodeModeToolConfig {
    */
   getSkillBindings?: () => Promise<Record<string, ToolBinding>>
 
+  /**
+   * How to surface tool parameters whose names look like secrets.
+   * Defaults to `'warn'` (logs via `console.warn`).
+   *
+   * - `'warn'`: log a warning for each match.
+   * - `'throw'`: throw an Error on the first match — useful in tests/CI.
+   * - `'ignore'`: suppress the check entirely.
+   * - `(info) => void`: receive each match and decide how to react.
+   *
+   * Matches are deduplicated per `(toolName, paramPath)` across the lifetime
+   * of a single `createCodeModeTool` instance.
+   */
+  onSecretParameter?: SecretParameterHandler
+
   /**
    * Optional lazy-tool discovery config. Tools marked `lazy: true` are kept out
    * of the system prompt's full documentation and listed in a Discoverable APIs

package/src/validate-bindings.ts

@@ -0,0 +1,198 @@
+/**
+ * Single words that on their own signal "this is a credential".
+ * Matched after splitting a parameter name into camelCase/snake/kebab words.
+ * So `accessToken` → `['access', 'token']` → matches `token`,
+ * but `tokenizer` → `['tokenizer']` → does NOT match `token`.
+ */
+const DANGEROUS_WORDS = new Set<string>([
+  'password',
+  'passwd',
+  'pwd',
+  'passcode',
+  'secret',
+  'token',
+  'credential',
+  'credentials',
+  'authorization',
+  'jwt',
+  'bearer',
+])
+
+/**
+ * Compound patterns matched as substrings of the normalized (lowercased,
+ * separator-stripped) parameter name. Catches forms like `openai_api_key`,
+ * `x-api-key`, and `webhookSecret`.
+ */
+const COMPOUND_PATTERNS = [
+  'apikey',
+  'accesskey',
+  'authkey',
+  'privatekey',
+  'clientsecret',
+  'webhooksecret',
+] as const
+
+export interface SecretParameterInfo {
+  toolName: string
+  paramName: string
+  paramPath: Array<string>
+}
+
+export type SecretParameterHandler =
+  | 'warn'
+  | 'throw'
+  | 'ignore'
+  | ((info: SecretParameterInfo) => void)
+
+interface ToolLike {
+  name: string
+  inputSchema?: Record<string, unknown>
+}
+
+interface JsonSchemaLike {
+  type?: string
+  properties?: Record<string, JsonSchemaLike>
+  items?: JsonSchemaLike | Array<JsonSchemaLike>
+  anyOf?: Array<JsonSchemaLike>
+  oneOf?: Array<JsonSchemaLike>
+  allOf?: Array<JsonSchemaLike>
+  additionalProperties?: boolean | JsonSchemaLike
+  $ref?: string
+  $defs?: Record<string, JsonSchemaLike>
+  definitions?: Record<string, JsonSchemaLike>
+}
+
+function splitIntoWords(name: string): Array<string> {
+  return name
+    .replace(/[_\-\s]+/g, ' ')
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .toLowerCase()
+    .split(/\s+/)
+    .filter(Boolean)
+}
+
+function looksLikeSecret(name: string): boolean {
+  const words = splitIntoWords(name)
+  if (words.some((w) => DANGEROUS_WORDS.has(w))) return true
+  const normalized = name.replace(/[_\-\s]/g, '').toLowerCase()
+  return COMPOUND_PATTERNS.some((p) => normalized.includes(p))
+}
+
+function resolveRef(
+  ref: string,
+  root: JsonSchemaLike,
+): JsonSchemaLike | undefined {
+  const match = ref.match(/^#\/(\$defs|definitions)\/(.+)$/)
+  if (!match) return undefined
+  const bucket = match[1] as '$defs' | 'definitions'
+  const key = match[2]
+  return key === undefined ? undefined : root[bucket]?.[key]
+}
+
+function findSecretParams(
+  schema: JsonSchemaLike | undefined,
+  root: JsonSchemaLike,
+  seen: Set<object>,
+  path: Array<string>,
+  found: Array<{ path: Array<string>; name: string }>,
+): void {
+  if (!schema || typeof schema !== 'object' || seen.has(schema)) return
+  seen.add(schema)
+
+  if (schema.properties && typeof schema.properties === 'object') {
+    for (const [paramName, sub] of Object.entries(schema.properties)) {
+      if (looksLikeSecret(paramName)) {
+        found.push({ path: [...path, paramName], name: paramName })
+      }
+      findSecretParams(sub, root, seen, [...path, paramName], found)
+    }
+  }
+
+  if (Array.isArray(schema.items)) {
+    schema.items.forEach((s, i) =>
+      findSecretParams(s, root, seen, [...path, `[${i}]`], found),
+    )
+  } else if (schema.items && typeof schema.items === 'object') {
+    findSecretParams(schema.items, root, seen, [...path, '[]'], found)
+  }
+
+  if (
+    schema.additionalProperties &&
+    typeof schema.additionalProperties === 'object'
+  ) {
+    findSecretParams(schema.additionalProperties, root, seen, path, found)
+  }
+
+  for (const key of ['anyOf', 'oneOf', 'allOf'] as const) {
+    const arr = schema[key]
+    if (Array.isArray(arr)) {
+      arr.forEach((s) => findSecretParams(s, root, seen, path, found))
+    }
+  }
+
+  if (typeof schema.$ref === 'string') {
+    const target = resolveRef(schema.$ref, root)
+    if (target) findSecretParams(target, root, seen, path, found)
+  }
+}
+
+function buildMessage(toolName: string, paramPath: Array<string>): string {
+  return (
+    `[TanStack AI Code Mode] Tool "${toolName}" has parameter "${paramPath.join('.')}" ` +
+    `that looks like a secret. Code Mode executes LLM-generated code — any ` +
+    `value passed through this parameter is accessible to generated code and ` +
+    `could be exfiltrated. Keep secrets in your server-side tool implementation ` +
+    `instead of passing them as tool parameters.`
+  )
+}
+
+/**
+ * Scan tool input schemas for parameter names that look like secrets.
+ * Emits a warning (or invokes the configured handler) for each match.
+ *
+ * Recurses into nested object properties, array items, union branches
+ * (anyOf/oneOf/allOf), additionalProperties, and `$ref` targets that
+ * resolve within the same schema's `$defs`/`definitions`.
+ *
+ * Best-effort heuristic, not a security boundary.
+ */
+export function warnIfBindingsExposeSecrets(
+  tools: Array<ToolLike>,
+  options: {
+    handler?: SecretParameterHandler
+    dedupCache?: Set<string>
+  } = {},
+): void {
+  const { handler = 'warn', dedupCache } = options
+  if (handler === 'ignore') return
+
+  for (const tool of tools) {
+    const schema = tool.inputSchema as JsonSchemaLike | undefined
+    if (!schema) continue
+
+    const found: Array<{ path: Array<string>; name: string }> = []
+    findSecretParams(schema, schema, new Set(), [], found)
+
+    for (const entry of found) {
+      const dedupKey = `${tool.name}::${entry.path.join('.')}`
+      if (dedupCache) {
+        if (dedupCache.has(dedupKey)) continue
+        dedupCache.add(dedupKey)
+      }
+
+      const info: SecretParameterInfo = {
+        toolName: tool.name,
+        paramName: entry.name,
+        paramPath: entry.path,
+      }
+
+      if (typeof handler === 'function') {
+        handler(info)
+      } else if (handler === 'throw') {
+        throw new Error(buildMessage(tool.name, entry.path))
+      } else {
+        console.warn(buildMessage(tool.name, entry.path))
+      }
+    }
+  }
+}