Skip to content

[Bug]: create-function and update-function accept empty code files without validation #41

@AbdulWasih05

Description

@AbdulWasih05

What's the bug?

In local mode, the create-function and update-function MCP tools read a code file via fs.readFile() but never validate that the content is non-empty. An empty or whitespace-only file is silently sent to the API, which either fails with a confusing backend error or creates a broken function.

create-function (src/shared/tools/functions.ts, line 78-86):

  • Reads args.codeFile successfully
  • Sends the content directly to the API without checking if it's empty
  • uploadFunctionRequestSchema defines code: z.string().min(1), but the tool omits the code field and defines its own without the min(1) constraint

update-function (src/shared/tools/functions.ts, line 210-218):

  • Same issue -- reads file, no empty check
  • updateFunctionRequestSchema defines code as an optional plain string with no min(1), so even the schema would not catch an empty string here

How to reproduce

  1. Create an empty file: touch empty.ts
  2. Call create-function with codeFile: "empty.ts"
  3. The tool sends an empty string as the function code

Proposed fix

Add empty file validation after the successful fs.readFile() call in both local mode handlers:

code = await fs.readFile(args.codeFile, 'utf-8');
if (!code.trim()) {
  throw new Error(`Code file '${args.codeFile}' is empty`);
}

I'd like to work on this fix and have a PR ready.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions