Function validateArtifactCode

packages/hosts/mcp/src/create-artifact.ts:345–407

(code: string)

/** `null` when the code may be rendered, otherwise the reason to hand back. */
export const validateArtifactCode = (code: string): string | null => {
  // Checked first: a five-segment address is the mistake a model that only read
  // the `execute` skill will make, and every other rejection below would be a
  // confusing thing to hear about code whose real problem is its addressing.
  const oldStyleAddress = oldStyleAddressRejection(code);
  if (oldStyleAddress) return oldStyleAddress;

  if (REMOVED_RUN_CALL.test(code) && !LOCAL_RUN_DECLARATION.test(code)) {
    return [
      "`run(code)` no longer exists — artifact code is purely declarative `tools.*`.",
      "Read data with useQuery(tools.<ns>.<tool>.queryOptions(args)),",
      "page through a cursor with useInfiniteQuery(tools.<ns>.<tool>.infiniteQueryOptions(args, { getNextPageParam })),",
      "and write with useMutation(tools.<ns>.<tool>.mutationOptions({ onSuccess })).",
    ].join(" ");
  }

  const loopedHook = hookCalledInLoop(code);
  if (loopedHook) {
    return [
      `\`${loopedHook}\` is called inside a loop body.`,
      "React hooks must run unconditionally at the top level of the component, in the same order every render.",
      PAGINATION_HOOKS.has(loopedHook)
        ? "To read every page of a cursor, use one useInfiniteQuery(tools.<ns>.<tool>.infiniteQueryOptions(args, { cursorKey, getNextPageParam })) and render data.pages — never a loop of useQuery calls, one per page."
        : "Move the hook out of the loop, and derive per-item values from its result instead.",
    ].join(" ");
  }

  const missingProvider = providerPairingRejection(code);
  if (missingProvider) return missingProvider;

  if (REACT_DESTRUCTURING_DECLARATION.test(code)) {
    return [
      "Do not destructure React in create-artifact.",
      "Hooks such as useState are already in scope; use useState(...) directly or React.useState(...).",
    ].join(" ");
  }

  for (const match of code.matchAll(OBJECT_DESTRUCTURING_DECLARATION)) {
    const names = match[1]?.split(",").flatMap((part) => {
      const name = localDestructuredName(part);
      return name ? [name] : [];
    });
    const providedName = names?.find((name) => PROVIDED_GLOBAL_NAMES.has(name));
    if (providedName) {
      return [
        `Provided global "${providedName}" is already in scope and cannot be redeclared.`,
        "Remove the destructuring declaration and use the provided global directly.",
      ].join(" ");
    }
  }

  for (const match of code.matchAll(PROVIDED_GLOBAL_DECLARATION)) {
    const name = firstDefined(match[1], match[2], match[3]);
    if (name && PROVIDED_GLOBAL_NAMES.has(name)) {
      return [
        `Provided global "${name}" is already in scope and cannot be redeclared.`,
        "Remove the local declaration and use the provided global directly.",
      ].join(" ");