Skip to content

[Bug]: create-function and update-function accept empty code files without validation #41

@AbdulWasih05

Description

@AbdulWasih05

What's the bug?

In local mode, the create-function and update-function MCP tools read a code file via fs.readFile() but never validate that the content is non-empty. An empty or whitespace-only file is silently sent to the API, which either fails with a confusing backend error or creates a broken function.

create-function (src/shared/tools/functions.ts, line 78-86):

  • Reads args.codeFile successfully
  • Sends the content directly to the API without checking if it's empty
  • uploadFunctionRequestSchema defines code: z.string().min(1), but the tool omits the code field and defines its own without the min(1) constraint

update-function (src/shared/tools/functions.ts, line 210-218):

  • Same issue -- reads file, no empty check
  • updateFunctionRequestSchema defines code as an optional plain string with no min(1), so even the schema would not catch an empty string here

How to reproduce

  1. Create an empty file: touch empty.ts
  2. Call create-function with codeFile: "empty.ts"
  3. The tool sends an empty string as the function code

Proposed fix

Add empty file validation after the successful fs.readFile() call in both local mode handlers:

code = await fs.readFile(args.codeFile, 'utf-8');
if (!code.trim()) {
  throw new Error(`Code file '${args.codeFile}' is empty`);
}

I'd like to work on this fix and have a PR ready.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions