Function warnIfBindingsExposeSecrets

packages/ai-code-mode/src/validate-bindings.ts:159–198

(
  tools: Array<ToolLike>,
  options: {
    handler?: SecretParameterHandler
    dedupCache?: Set<string>
  } = {},
)

 * Best-effort heuristic, not a security boundary.
 */
export function warnIfBindingsExposeSecrets(
  tools: Array<ToolLike>,
  options: {
    handler?: SecretParameterHandler
    dedupCache?: Set<string>
  } = {},
): void {
  const { handler = 'warn', dedupCache } = options
  if (handler === 'ignore') return

  for (const tool of tools) {
    const schema = tool.inputSchema as JsonSchemaLike | undefined
    if (!schema) continue

    const found: Array<{ path: Array<string>; name: string }> = []
    findSecretParams(schema, schema, new Set(), [], found)

    for (const entry of found) {
      const dedupKey = `${tool.name}::${entry.path.join('.')}`
      if (dedupCache) {
        if (dedupCache.has(dedupKey)) continue
        dedupCache.add(dedupKey)
      }

      const info: SecretParameterInfo = {
        toolName: tool.name,
        paramName: entry.name,
        paramPath: entry.path,
      }

      if (typeof handler === 'function') {
        handler(info)
      } else if (handler === 'throw') {
        throw new Error(buildMessage(tool.name, entry.path))
      } else {
        console.warn(buildMessage(tool.name, entry.path))
      }
    }
  }
}