ta
TanStack
OSS
ta
Pipelines
Nx runs
Insights
Compare tasks
Analytics
Sign in
Toggle Sidebar
ai
ai
Pipelines
fix(ai-code-mode): reject tools that require approval A tool marked `needsApproval: true` expects a human approval interrupt before it runs. Code Mode invokes tools from inside the sandbox, where the model only ever sees the outer `execute_typescript` call, so the per-tool interrupt is never raised and the tool would run unattended. The `CodeModeTool` type already pins `needsApproval` to `false`, so typed callers were blocked at compile time. This adds the matching runtime guard for callers that bypass the types (JavaScript, `as` casts, dynamically built tools): - `createCodeModeTool` / `createCodeMode` throw synchronously when any supplied tool has `needsApproval: true`, naming every offending tool. - `toolToBinding` / `toolsToBindings` enforce the same rule as a lower-level backstop, so every binding path is covered. Approving only the outer `execute_typescript` call would not preserve per-tool/per-argument approval semantics, so these tools are rejected rather than silently approved. Addresses GHSA-wmh6-35qp-cc2x. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
nx run-many --targets=build --exclude=examples/**,testing/**
⌘K
fix(ai-code-mode): reject tools that require approval
Succeeded
in
6s
Started
Linux
4 CPU cores
read-write
access token used
Copy command
nx run-many --targets=build --exclude=examples/**,testing/**
1949
99445ef
GitHub
Open on GitHub
Tasks
Resource Usage
ta
TanStack
OSS