From 20efa024cb172e9560b92f74340947bb40f411a8 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 02:09:50 +0000
Subject: [PATCH 1/8] Add codemode utils module and rename ui utils alias

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 .../mcp-apps/generated-ui-runtime-contract.ts |   2 +-
 .../mcp-apps/generated-ui-widget-runtime.ts   |   2 +-
 .../src/app/saved-ui-hosted-html.node.test.ts |   4 +-
 .../src/mcp/capabilities/apps/ui-save-app.ts  |   6 +-
 .../mcp/capabilities/apps/ui-update-app.ts    |   2 +-
 .../generated-ui-oauth-guide.node.test.ts     |   2 +
 .../coding/generated-ui-oauth-guide.ts        |  12 +-
 packages/worker/src/mcp/executor.ts           | 193 +++++++++++++-
 packages/worker/src/mcp/generated-ui-api.ts   |   2 +-
 .../generated-ui-app-base-url.node.test.ts    |   2 +-
 packages/worker/src/mcp/index.ts              |   4 +-
 .../worker/src/mcp/mcp-server.mcp-e2e.test.ts |   2 +-
 .../mcp/run-codemode-registry.workers.test.ts | 103 ++++++++
 .../worker/src/mcp/tools/codemode-utils.ts    | 241 ++++++++++++++++++
 packages/worker/src/mcp/tools/execute.ts      |  17 +-
 .../worker/src/mcp/tools/open-generated-ui.ts |   4 +-
 16 files changed, 566 insertions(+), 32 deletions(-)
 create mode 100644 packages/worker/src/mcp/run-codemode-registry.workers.test.ts
 create mode 100644 packages/worker/src/mcp/tools/codemode-utils.ts

diff --git a/packages/worker/client/mcp-apps/generated-ui-runtime-contract.ts b/packages/worker/client/mcp-apps/generated-ui-runtime-contract.ts
index d080b075aa..3aeeede39b 100644
--- a/packages/worker/client/mcp-apps/generated-ui-runtime-contract.ts
+++ b/packages/worker/client/mcp-apps/generated-ui-runtime-contract.ts
@@ -43,7 +43,7 @@ export type GeneratedUiRuntimeBootstrap = {
 	appSession?: GeneratedUiAppSessionBootstrap | null
 }
 
-export const generatedUiRuntimeModuleSpecifier = '@kody/utils' as const
+export const generatedUiRuntimeModuleSpecifier = '@kody/ui-utils' as const
 
 export function buildGeneratedUiRuntimeImportMap(runtimeScriptHref: string) {
 	const importMapJson = escapeInlineScriptSource(
diff --git a/packages/worker/client/mcp-apps/generated-ui-widget-runtime.ts b/packages/worker/client/mcp-apps/generated-ui-widget-runtime.ts
index ab14c84186..61df974c16 100644
--- a/packages/worker/client/mcp-apps/generated-ui-widget-runtime.ts
+++ b/packages/worker/client/mcp-apps/generated-ui-widget-runtime.ts
@@ -193,7 +193,7 @@ export function getKodyWidget(): KodyWidgetPublicApi {
 		return widget
 	}
 	throw new Error(
-		'kodyWidget is not ready yet. Import `whenKodyWidgetReady()` from `@kody/utils` and await it before using the runtime helpers.',
+		'kodyWidget is not ready yet. Import `whenKodyWidgetReady()` from `@kody/ui-utils` and await it before using the runtime helpers.',
 	)
 }
 
diff --git a/packages/worker/src/app/saved-ui-hosted-html.node.test.ts b/packages/worker/src/app/saved-ui-hosted-html.node.test.ts
index 090cf62293..58d36272f3 100644
--- a/packages/worker/src/app/saved-ui-hosted-html.node.test.ts
+++ b/packages/worker/src/app/saved-ui-hosted-html.node.test.ts
@@ -39,7 +39,7 @@ test('renderHostedSavedUiHtml emits shared runtime assets for html apps', () =>
 		'<script type="module" src="https://kody.example/mcp-apps/generated-ui-runtime.js"></script>',
 	)
 	expect(result).toContain(
-		'<script type="importmap">{"imports":{"@kody/utils":"https://kody.example/mcp-apps/generated-ui-runtime.js"}}</script>',
+		'<script type="importmap">{"imports":{"@kody/ui-utils":"https://kody.example/mcp-apps/generated-ui-runtime.js"}}</script>',
 	)
 	expect(result).toContain(
 		'window.__kodyGeneratedUiBootstrap = {"mode":"hosted","appSession":{"token":"token-123","endpoints":{"source":"https://kody.example/ui-api/session-123/source","execute":"https://kody.example/ui-api/session-123/execute","secrets":"https://kody.example/ui-api/session-123/secrets","deleteSecret":"https://kody.example/ui-api/session-123/secrets/delete"}}};',
@@ -69,7 +69,7 @@ test('renderHostedSavedUiHtml keeps user javascript separate from runtime bootst
 		'<script type="module" src="https://kody.example/mcp-apps/generated-ui-runtime.js"></script>',
 	)
 	expect(result).toContain(
-		'<script type="importmap">{"imports":{"@kody/utils":"https://kody.example/mcp-apps/generated-ui-runtime.js"}}</script>',
+		'<script type="importmap">{"imports":{"@kody/ui-utils":"https://kody.example/mcp-apps/generated-ui-runtime.js"}}</script>',
 	)
 	expect(result).toContain(
 		'<script type="module">\ndocument.querySelector("[data-generated-ui-root]")?.append("hello")',
diff --git a/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts b/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts
index 3c48ed1320..f158ce15ec 100644
--- a/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts
+++ b/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts
@@ -42,9 +42,9 @@ const inputSchema = z.object({
 	parameters: z
 		.array(uiArtifactParameterSchema)
 		.optional()
-		.describe(
-			'Optional parameter definitions for reusable saved apps. Resolved values are exposed at runtime on the imported `kodyWidget.params` helper from `@kody/utils`.',
-		),
+			.describe(
+				'Optional parameter definitions for reusable saved apps. Resolved values are exposed at runtime on the imported `kodyWidget.params` helper from `@kody/ui-utils`.',
+			),
 })
 
 const outputSchema = z.object({
diff --git a/packages/worker/src/mcp/capabilities/apps/ui-update-app.ts b/packages/worker/src/mcp/capabilities/apps/ui-update-app.ts
index 753c1393ff..f7d6bb4feb 100644
--- a/packages/worker/src/mcp/capabilities/apps/ui-update-app.ts
+++ b/packages/worker/src/mcp/capabilities/apps/ui-update-app.ts
@@ -60,7 +60,7 @@ const inputSchema = z
 			.array(uiArtifactParameterSchema)
 			.optional()
 			.describe(
-				'Optional parameter definitions for reusable saved apps. Resolved values are exposed at runtime on the imported `kodyWidget.params` API from `@kody/utils`.',
+				'Optional parameter definitions for reusable saved apps. Resolved values are exposed at runtime on the imported `kodyWidget.params` API from `@kody/ui-utils`.',
 			),
 	})
 	.refine(
diff --git a/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.node.test.ts b/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.node.test.ts
index 02fe294ac3..af01cb7267 100644
--- a/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.node.test.ts
+++ b/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.node.test.ts
@@ -25,5 +25,7 @@ test('generated_ui_oauth_guide distinguishes PKCE and server-side exchange helpe
 	)
 	expect(result.body).toContain('`exchangeOAuthCodeWithSecrets(...)`')
 	expect(result.body).toContain('run server-side')
+	expect(result.body).toContain("import { kodyWidget } from '@kody/ui-utils'")
+	expect(result.body).not.toContain('@kody/utils')
 	expect(result.body).not.toContain('exchangeOAuthCode({ tokenUrl')
 })
diff --git a/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.ts b/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.ts
index 11e4db4b92..50e8e009ea 100644
--- a/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.ts
+++ b/packages/worker/src/mcp/capabilities/coding/generated-ui-oauth-guide.ts
@@ -71,7 +71,7 @@ of treating it like a secret.
 4. Give the user the hosted saved-app URL and tell them to open it in their
    browser instead of trying to complete the flow in the conversation iframe.
 5. In the hosted generated UI, import \`kodyWidget\` from
-   \`@kody/utils\` and use it directly to read the callback, validate state,
+   \`@kody/ui-utils\` and use it directly to read the callback, validate state,
    exchange the code in the browser, and save tokens.
 
 ## Generated UI helpers to use
@@ -105,7 +105,7 @@ before building the authorization URL or token request.
 \`\`\`html
 <p id="status"></p>
 <script type="module">
-  import { kodyWidget } from '@kody/utils'
+  import { kodyWidget } from '@kody/ui-utils'
 
   async function requireClientId() {
     const clientIdRecord = await kodyWidget.getValue({
@@ -188,7 +188,7 @@ authorization flow.
   <button type="submit">Save and continue</button>
 </form>
 <script type="module">
-  import { kodyWidget } from '@kody/utils'
+  import { kodyWidget } from '@kody/ui-utils'
 
   document.querySelector('#oauth-client-form')?.addEventListener('submit', async (event) => {
     event.preventDefault()
@@ -240,7 +240,7 @@ Create and persist the OAuth state before redirecting the browser.
 \`\`\`html
 <button id="connect-muffin-club">Connect Muffin Club</button>
 <script type="module">
-  import { kodyWidget } from '@kody/utils'
+  import { kodyWidget } from '@kody/ui-utils'
 
   document.querySelector('#connect-muffin-club')?.addEventListener('click', async () => {
     const clientIdRecord = await kodyWidget.getValue({
@@ -340,7 +340,7 @@ succeeds.
     root.innerHTML = '<p>' + message + '</p>'
   }
 
-  import { kodyWidget } from '@kody/utils'
+  import { kodyWidget } from '@kody/ui-utils'
 
   void (async () => {
     const callback = kodyWidget.readOAuthCallback({
@@ -427,7 +427,7 @@ export const generatedUiOAuthGuideCapability = defineDomainCapability(
 			'provider registration',
 			'ui_save_app',
 			'open_generated_ui',
-			'@kody/utils',
+			'@kody/ui-utils',
 		],
 		readOnly: true,
 		idempotent: true,
diff --git a/packages/worker/src/mcp/executor.ts b/packages/worker/src/mcp/executor.ts
index 565a6d88c3..beb61b08d6 100644
--- a/packages/worker/src/mcp/executor.ts
+++ b/packages/worker/src/mcp/executor.ts
@@ -1,4 +1,10 @@
-import { DynamicWorkerExecutor, type ExecuteResult } from '@cloudflare/codemode'
+import {
+	type ExecuteResult,
+	type ResolvedProvider,
+	ToolDispatcher,
+	normalizeCode,
+	sanitizeToolName,
+} from '@cloudflare/codemode'
 import { exports as workerExports } from 'cloudflare:workers'
 type WorkerLoopbackExports = Exclude<typeof workerExports, undefined>
 import { type FetchGatewayProps } from '#mcp/fetch-gateway.ts'
@@ -10,6 +16,10 @@ import {
 	parseHostApprovalRequiredMessage,
 	parseMissingSecretMessage,
 } from '#mcp/secrets/errors.ts'
+import {
+	buildCodemodeUtilsModuleSource,
+	codemodeUtilsModuleSpecifier,
+} from '#mcp/tools/codemode-utils.ts'
 
 const charsPerToken = 4
 const maxTokens = 6_000
@@ -26,13 +36,180 @@ export function createExecuteExecutor(input: {
 			'CodemodeFetchGateway export is required for execute-time fetch.',
 		)
 	}
-	return new DynamicWorkerExecutor({
-		loader: input.env.LOADER,
-		timeout: 90_000,
-		globalOutbound: loopbackExports.CodemodeFetchGateway({
-			props: input.gatewayProps,
-		}),
-	})
+	return {
+		execute(code: string, providersOrFns: Array<ResolvedProvider>) {
+			return executeWithWorkerLoader({
+				loader: input.env.LOADER,
+				timeoutMs: 90_000,
+				code,
+				providers: providersOrFns,
+				globalOutbound: loopbackExports.CodemodeFetchGateway({
+					props: input.gatewayProps,
+				}),
+			})
+		},
+	}
+}
+
+function buildProviderProxySource(provider: ResolvedProvider) {
+	if (provider.positionalArgs) {
+		return `new Proxy({}, {
+      get: (_, toolName) => async (...args) => {
+        const resJson = await __dispatchers.${provider.name}.call(String(toolName), JSON.stringify(args));
+        const data = JSON.parse(resJson);
+        if (data.error) throw new Error(data.error);
+        return data.result;
+      }
+    })`
+	}
+	return `new Proxy({}, {
+      get: (_, toolName) => async (args) => {
+        const resJson = await __dispatchers.${provider.name}.call(String(toolName), JSON.stringify(args ?? {}));
+        const data = JSON.parse(resJson);
+        if (data.error) throw new Error(data.error);
+        return data.result;
+      }
+    })`
+}
+
+function buildUserEntryModuleSource(code: string) {
+	const trimmed = code.trim()
+	const looksLikeModule =
+		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
+	if (looksLikeModule) {
+		return trimmed
+	}
+	return `export default ${normalizeCode(code)};`
+}
+
+function buildUserCodeRunnerModuleSource(code: string) {
+	const trimmed = code.trim()
+	const looksLikeModule =
+		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
+	return [
+		'import * as __kodyUserModule from "user-entry.js";',
+		'',
+		'export async function __kodyRunUserCode() {',
+		looksLikeModule
+			? [
+					'  const __kodyModuleRunner = __kodyUserModule.default;',
+					'  if (typeof __kodyModuleRunner !== "function") {',
+					'    throw new Error("Execute code with imports must default export an async function.");',
+					'  }',
+					'  return await __kodyModuleRunner();',
+				].join('\n')
+			: [
+					'  const __kodyInlineExecuteFunction = __kodyUserModule.default;',
+					'  if (typeof __kodyInlineExecuteFunction !== "function") {',
+					'    throw new Error("Execute code must evaluate to an async function.");',
+					'  }',
+					'  return await __kodyInlineExecuteFunction();',
+				].join('\n'),
+		'}',
+	].join('\n')
+}
+
+async function executeWithWorkerLoader(input: {
+	loader: WorkerLoader
+	timeoutMs: number
+	code: string
+	providers: Array<ResolvedProvider>
+	globalOutbound: Fetcher
+}): Promise<ExecuteResult> {
+	const reservedNames = new Set(['__dispatchers', '__logs', '__providers'])
+	const validIdentifier = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/
+	const seenNames = new Set<string>()
+	for (const provider of input.providers) {
+		if (reservedNames.has(provider.name)) {
+			return {
+				result: undefined,
+				error: `Provider name "${provider.name}" is reserved`,
+			}
+		}
+		if (!validIdentifier.test(provider.name)) {
+			return {
+				result: undefined,
+				error: `Provider name "${provider.name}" is not a valid JavaScript identifier`,
+			}
+		}
+		if (seenNames.has(provider.name)) {
+			return {
+				result: undefined,
+				error: `Duplicate provider name "${provider.name}"`,
+			}
+		}
+		seenNames.add(provider.name)
+	}
+
+	const executorModuleSource = [
+		'import { WorkerEntrypoint } from "cloudflare:workers";',
+		'import { __kodyRunUserCode } from "user-code.js";',
+		'',
+		'export default class CodeExecutor extends WorkerEntrypoint {',
+		'  async evaluate(__dispatchers = {}) {',
+		'    const __logs = [];',
+		'    console.log = (...a) => { __logs.push(a.map(String).join(" ")); };',
+		'    console.warn = (...a) => { __logs.push("[warn] " + a.map(String).join(" ")); };',
+		'    console.error = (...a) => { __logs.push("[error] " + a.map(String).join(" ")); };',
+		'    const __providers = {};',
+		...input.providers.flatMap((provider) => [
+			`    const ${provider.name} = ${buildProviderProxySource(provider)};`,
+			`    __providers.${provider.name} = ${provider.name};`,
+		]),
+		'    globalThis.__kodyProviders = __providers;',
+		'    try {',
+		'      const result = await Promise.race([',
+		'        __kodyRunUserCode(),',
+		`        new Promise((_, reject) => setTimeout(() => reject(new Error("Execution timed out")), ${input.timeoutMs}))`,
+		'      ]);',
+		'      return { result, logs: __logs };',
+		'    } catch (err) {',
+		'      return { result: undefined, error: err instanceof Error ? err.message : String(err), logs: __logs };',
+		'    } finally {',
+		'      delete globalThis.__kodyProviders;',
+		'    }',
+		'  }',
+		'}',
+	].join('\n')
+
+	const dispatchers = Object.create(null) as Record<string, ToolDispatcher>
+	for (const provider of input.providers) {
+		const sanitizedFns = Object.fromEntries(
+			Object.entries(provider.fns).map(([name, fn]) => [sanitizeToolName(name), fn]),
+		)
+		dispatchers[provider.name] = new ToolDispatcher(
+			sanitizedFns,
+			provider.positionalArgs,
+		)
+	}
+
+	const entrypoint = input.loader
+		.get(`codemode-${crypto.randomUUID()}`, () => ({
+			compatibilityDate: '2025-06-01',
+			compatibilityFlags: ['nodejs_compat'],
+			mainModule: 'executor.js',
+			modules: {
+				[`${codemodeUtilsModuleSpecifier}`]: buildCodemodeUtilsModuleSource(),
+				'user-entry.js': buildUserEntryModuleSource(input.code),
+				'user-code.js': buildUserCodeRunnerModuleSource(input.code),
+				'executor.js': executorModuleSource,
+			},
+			globalOutbound: input.globalOutbound,
+		}))
+		.getEntrypoint()
+
+	const response = (await entrypoint.evaluate(dispatchers)) as ExecuteResult
+	if (response.error) {
+		return {
+			result: undefined,
+			error: response.error,
+			logs: response.logs,
+		}
+	}
+	return {
+		result: response.result,
+		logs: response.logs,
+	}
 }
 
 export type ExecutionErrorDetails =
diff --git a/packages/worker/src/mcp/generated-ui-api.ts b/packages/worker/src/mcp/generated-ui-api.ts
index 17509c05c8..d28eb74896 100644
--- a/packages/worker/src/mcp/generated-ui-api.ts
+++ b/packages/worker/src/mcp/generated-ui-api.ts
@@ -248,7 +248,7 @@ function createGeneratedUiExecuteHandler(env: Env) {
 					{
 						ok: false,
 						error:
-							'Generated UI executeCode may not return unresolved `{{secret:...}}` placeholders. Secret placeholders only resolve inside secret-aware fetch requests or capability inputs that explicitly opt into `x-kody-secret`. Use persisted values for non-secret configuration, and call `kodyWidget.sendMessage(...)` (for example after `import { kodyWidget } from "@kody/utils"`) when the user needs to intervene.',
+							'Generated UI executeCode may not return unresolved `{{secret:...}}` placeholders. Secret placeholders only resolve inside secret-aware fetch requests or capability inputs that explicitly opt into `x-kody-secret`. Use persisted values for non-secret configuration, and call `kodyWidget.sendMessage(...)` (for example after `import { kodyWidget } from "@kody/ui-utils"`) when the user needs to intervene.',
 						logs: result.logs ?? [],
 					},
 					400,
diff --git a/packages/worker/src/mcp/generated-ui-app-base-url.node.test.ts b/packages/worker/src/mcp/generated-ui-app-base-url.node.test.ts
index 95258dd346..3ff607556a 100644
--- a/packages/worker/src/mcp/generated-ui-app-base-url.node.test.ts
+++ b/packages/worker/src/mcp/generated-ui-app-base-url.node.test.ts
@@ -21,7 +21,7 @@ test('canonical APP_BASE_URL drives runtime script href and MCP URL for widget d
 	const html = renderGeneratedUiRuntimeHtmlEntry(appBase)
 	expect(html).toContain('https://heykody.dev/mcp-apps/generated-ui-runtime.js')
 	expect(html).toContain(
-		'"@kody/utils":"https://heykody.dev/mcp-apps/generated-ui-runtime.js"',
+		'"@kody/ui-utils":"https://heykody.dev/mcp-apps/generated-ui-runtime.js"',
 	)
 
 	const mcpServerUrl = new URL(mcpResourcePath, appBase).toString()
diff --git a/packages/worker/src/mcp/index.ts b/packages/worker/src/mcp/index.ts
index 739670b0ba..6e9a01f84f 100644
--- a/packages/worker/src/mcp/index.ts
+++ b/packages/worker/src/mcp/index.ts
@@ -87,7 +87,7 @@ How to use execute
 - Secret placeholders are not general-purpose string interpolation. Do not use \`execute\` to build a string or object that merely returns \`{{secret:...}}\`; those placeholders only resolve in secret-aware fetch paths or capability inputs that explicitly opt into \`x-kody-secret\`.
 - Saving or updating a secret does not authorize sending it anywhere. If a fetch fails because a host is not approved for that secret, ask the user whether to open the approval link and approve that host in the web app.
 - Secrets are intentionally not readable or updatable through \`codemode\`. Never ask the user to paste a secret into chat; use generated UI flows such as \`saveSecret(...)\` when the user needs to provide or rotate a value, and use \`codemode.secret_delete(...)\` only when removing a stored secret reference.
-- Your code must be an async arrow function that returns the result.
+- Your code should either be an async arrow function that returns the result, or a module that default-exports an async function when using imports.
 - Example: const result = await codemode[capabilityName](args)
 
 MCP App tools
@@ -95,7 +95,7 @@ MCP App tools
 - Pass either inline source code with 'code' or reopen a saved app with 'app_id' (exactly one is allowed).
 - Prefer body-focused HTML fragments when possible, but full HTML documents are also supported.
 - Use generated UI whenever the user needs to enter a sensitive value. Do not ask the user to paste secrets or credentials into chat.
-- Generated UI code can import \`{ kodyWidget }\` from \`@kody/utils\` and use helpers for follow-up messages, external links, fullscreen requests, \`executeCode(code)\`, secret management, values, forms, OAuth, and secret-aware fetches.
+- Generated UI code can import \`{ kodyWidget }\` from \`@kody/ui-utils\` and use helpers for follow-up messages, external links, fullscreen requests, \`executeCode(code)\`, secret management, values, forms, OAuth, and secret-aware fetches.
 - 'executeCode(code)' is the low-level transport for server-side generated UI work. Prefer the higher-level secret and value helpers when they fit the task.
 - If a generated UI encounters a recoverable runtime issue, have it show the problem locally and also call 'sendMessage(...)' with the next action the user should take so the parent chat can continue the workflow.
 - The shell also provides lightweight semantic HTML styles plus theme tokens such as '--color-*', '--spacing-*', '--radius-*', '--shadow-*', and '--font-*'.
diff --git a/packages/worker/src/mcp/mcp-server.mcp-e2e.test.ts b/packages/worker/src/mcp/mcp-server.mcp-e2e.test.ts
index 8f650e360a..e578082873 100644
--- a/packages/worker/src/mcp/mcp-server.mcp-e2e.test.ts
+++ b/packages/worker/src/mcp/mcp-server.mcp-e2e.test.ts
@@ -864,7 +864,7 @@ test('mcp server opens generated ui with inline code and serves runtime resource
 	expect(generatedResource?.text).toContain('"mode":"entry"')
 	expect(generatedResource?.text).not.toContain('Toggle fullscreen')
 	expect(generatedResource?.text).not.toContain('Open saved app link')
-	expect(generatedResource?.text).toContain('"@kody/utils"')
+	expect(generatedResource?.text).toContain('"@kody/ui-utils"')
 	expect(generatedResource?.text).toContain('type="module"')
 	expect(generatedResource?.text).toContain('/mcp-apps/generated-ui-runtime.js')
 
diff --git a/packages/worker/src/mcp/run-codemode-registry.workers.test.ts b/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
new file mode 100644
index 0000000000..a9f1948e2f
--- /dev/null
+++ b/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
@@ -0,0 +1,103 @@
+import { expect, test, vi } from 'vitest'
+import { env, exports as workerExports } from 'cloudflare:workers'
+import { createExecuteExecutor } from './executor.ts'
+
+test('execute sandbox imports @kody/codemode-utils and refreshes a bearer token', async () => {
+	const fetchSpy = vi
+		.spyOn(globalThis, 'fetch')
+		.mockImplementation(async (input, init) => {
+			const request = new Request(input, init)
+			if (request.url === 'https://auth.example.com/oauth/token') {
+				expect(request.method).toBe('POST')
+				expect(request.headers.get('content-type')).toBe(
+					'application/x-www-form-urlencoded',
+				)
+				const body = await request.text()
+				expect(body).toContain('grant_type=refresh_token')
+				expect(body).toContain('client_id=spotify-client-id')
+				expect(body).toContain('refresh_token=spotify-refresh-token')
+				return Response.json({
+					access_token: 'spotify-access-token',
+				})
+			}
+			if (request.url === 'https://api.spotify.example.com/v1/me/player') {
+				expect(request.headers.get('Authorization')).toBe(
+					'Bearer spotify-access-token',
+				)
+				return Response.json({
+					ok: true,
+					receivedAuth: request.headers.get('Authorization'),
+				})
+			}
+			throw new Error(`Unexpected fetch to ${request.url}`)
+		})
+
+	try {
+		const executor = createExecuteExecutor({
+			env,
+			exports: workerExports,
+			gatewayProps: {
+				baseUrl: 'https://heykody.dev',
+				userId: 'user-123',
+				storageContext: null,
+			},
+		})
+		const result = await executor.execute(
+			[
+				"import { createAuthenticatedFetch, refreshAccessToken } from '@kody/codemode-utils'",
+				'',
+				'export default async () => {',
+				"  const accessToken = await refreshAccessToken('spotify')",
+				"  const spotifyFetch = await createAuthenticatedFetch('spotify')",
+				"  const response = await spotifyFetch('https://api.spotify.example.com/v1/me/player')",
+				'  return {',
+				'    accessToken,',
+				'    payload: await response.json(),',
+				'  }',
+				'}',
+			].join('\n'),
+			[
+				{
+					name: 'codemode',
+					fns: {
+						async connector_get(args) {
+							expect(args).toEqual({ name: 'spotify' })
+							return {
+								connector: {
+									name: 'spotify',
+									tokenUrl: 'https://auth.example.com/oauth/token',
+									flow: 'pkce',
+									clientIdValueName: 'spotify-client-id',
+									accessTokenSecretName: 'spotify-access-token',
+									refreshTokenSecretName: 'spotify-refresh-token',
+									requiredHosts: ['auth.example.com'],
+								},
+							}
+						},
+						async value_get(args) {
+							expect(args).toEqual({ name: 'spotify-client-id' })
+							return {
+								name: 'spotify-client-id',
+								value: 'spotify-client-id',
+								scope: 'user',
+								description: 'Spotify OAuth client id',
+							}
+						},
+					},
+				},
+			],
+		)
+
+		expect(result.error).toBeUndefined()
+		expect(result.result).toEqual({
+			accessToken: 'spotify-access-token',
+			payload: {
+				ok: true,
+				receivedAuth: 'Bearer spotify-access-token',
+			},
+		})
+		expect(fetchSpy).toHaveBeenCalledTimes(3)
+	} finally {
+		fetchSpy.mockRestore()
+	}
+})
diff --git a/packages/worker/src/mcp/tools/codemode-utils.ts b/packages/worker/src/mcp/tools/codemode-utils.ts
new file mode 100644
index 0000000000..bf95798df0
--- /dev/null
+++ b/packages/worker/src/mcp/tools/codemode-utils.ts
@@ -0,0 +1,241 @@
+export const codemodeUtilsModuleSpecifier = '@kody/codemode-utils' as const
+
+export function buildCodemodeUtilsModuleSource() {
+	return `
+function isRecord(value) {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function requireCodemode() {
+	const providers = globalThis.__kodyProviders
+	const codemode = providers && typeof providers === 'object' ? providers.codemode : globalThis.codemode
+	if (!codemode || typeof codemode !== 'object') {
+		throw new Error('@kody/codemode-utils requires the codemode provider.')
+	}
+	return codemode
+}
+
+function buildConnectorValueName(name) {
+	return '_connector:' + name
+}
+
+function normalizeOptionalName(value) {
+	return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+function normalizeConnectorConfig(value, fallbackName) {
+	if (!isRecord(value)) return null
+	const name =
+		typeof value.name === 'string' && value.name.trim().length > 0
+			? value.name.trim()
+			: typeof fallbackName === 'string' && fallbackName.trim().length > 0
+				? fallbackName.trim()
+				: null
+	const flow = value.flow === 'pkce' || value.flow === 'confidential' ? value.flow : null
+	const tokenUrl =
+		typeof value.tokenUrl === 'string' && value.tokenUrl.trim().length > 0
+			? value.tokenUrl.trim()
+			: null
+	const clientIdValueName =
+		typeof value.clientIdValueName === 'string' &&
+		value.clientIdValueName.trim().length > 0
+			? value.clientIdValueName.trim()
+			: null
+	const accessTokenSecretName =
+		typeof value.accessTokenSecretName === 'string' &&
+		value.accessTokenSecretName.trim().length > 0
+			? value.accessTokenSecretName.trim()
+			: null
+	if (!name || !flow || !tokenUrl || !clientIdValueName || !accessTokenSecretName) {
+		return null
+	}
+	return {
+		name,
+		tokenUrl,
+		flow,
+		clientIdValueName,
+		clientSecretSecretName: normalizeOptionalName(value.clientSecretSecretName),
+		accessTokenSecretName,
+		refreshTokenSecretName: normalizeOptionalName(value.refreshTokenSecretName),
+		requiredHosts: Array.isArray(value.requiredHosts)
+			? value.requiredHosts.filter((entry) => typeof entry === 'string')
+			: [],
+	}
+}
+
+async function readConnectorConfig(providerName) {
+	if (typeof providerName !== 'string' || providerName.trim().length === 0) {
+		throw new Error('Provider name is required.')
+	}
+	const normalizedProviderName = providerName.trim()
+	const codemode = requireCodemode()
+	if (typeof codemode.connector_get === 'function') {
+		const result = await codemode.connector_get({ name: normalizedProviderName })
+		const connector = isRecord(result) ? result.connector : null
+		const parsed = normalizeConnectorConfig(connector, normalizedProviderName)
+		if (parsed) {
+			return parsed
+		}
+	}
+	if (typeof codemode.value_get !== 'function') {
+		throw new Error(
+			'@kody/codemode-utils requires codemode.value_get when connector_get is unavailable.',
+		)
+	}
+	const storedValue = await codemode.value_get({
+		name: buildConnectorValueName(normalizedProviderName),
+		scope: 'user',
+	})
+	if (!isRecord(storedValue) || typeof storedValue.value !== 'string') {
+		throw new Error('Connector "' + normalizedProviderName + '" is not configured.')
+	}
+	let parsedJson = null
+	try {
+		parsedJson = JSON.parse(storedValue.value)
+	} catch {
+		throw new Error(
+			'Connector "' + normalizedProviderName + '" has invalid JSON config.',
+		)
+	}
+	const parsed = normalizeConnectorConfig(parsedJson, normalizedProviderName)
+	if (!parsed) {
+		throw new Error(
+			'Connector "' + normalizedProviderName + '" has invalid config.',
+		)
+	}
+	return parsed
+}
+
+async function readRequiredValue(name) {
+	const codemode = requireCodemode()
+	if (typeof codemode.value_get !== 'function') {
+		throw new Error('@kody/codemode-utils requires codemode.value_get.')
+	}
+	const value = await codemode.value_get({ name })
+	if (!isRecord(value) || typeof value.value !== 'string' || value.value.length === 0) {
+		throw new Error('Value "' + name + '" is not configured.')
+	}
+	return value.value
+}
+
+function buildSecretPlaceholder(name) {
+	return '{{secret:' + name + '}}'
+}
+
+function encodeFormComponent(value) {
+	return typeof value === 'string' &&
+		value.startsWith('{{secret:') &&
+		value.endsWith('}}')
+		? value
+		: encodeURIComponent(String(value))
+}
+
+function buildFormBody(entries) {
+	return entries
+		.filter((entry) => entry[1] != null && String(entry[1]).length > 0)
+		.map(
+			([key, value]) =>
+				encodeURIComponent(String(key)) + '=' + encodeFormComponent(value),
+		)
+		.join('&')
+}
+
+async function parseTokenResponse(response) {
+	const text = await response.text()
+	let data = null
+	const contentType = response.headers.get('content-type') || ''
+	if (
+		text &&
+		(/\\bjson\\b/i.test(contentType) ||
+			text.startsWith('{') ||
+			text.startsWith('['))
+	) {
+		try {
+			data = JSON.parse(text)
+		} catch {}
+	}
+	return { text, data }
+}
+
+function getTokenRefreshErrorMessage(providerName, response, payload) {
+	if (isRecord(payload)) {
+		if (
+			typeof payload.error_description === 'string' &&
+			payload.error_description.length > 0
+		) {
+			return payload.error_description
+		}
+		if (typeof payload.error === 'string' && payload.error.length > 0) {
+			return payload.error
+		}
+	}
+	return (
+		payload.text ||
+		'Token refresh for "' +
+			providerName +
+			'" failed with HTTP status ' +
+			response.status +
+			'.'
+	)
+}
+
+export async function refreshAccessToken(providerName) {
+	const connector = await readConnectorConfig(providerName)
+	if (!connector.refreshTokenSecretName) {
+		throw new Error(
+			'Connector "' + connector.name + '" is missing refreshTokenSecretName.',
+		)
+	}
+	const clientId = await readRequiredValue(connector.clientIdValueName)
+	const body = buildFormBody([
+		['grant_type', 'refresh_token'],
+		['client_id', clientId],
+		['refresh_token', buildSecretPlaceholder(connector.refreshTokenSecretName)],
+		...(connector.flow === 'confidential' && connector.clientSecretSecretName
+			? [
+					[
+						'client_secret',
+						buildSecretPlaceholder(connector.clientSecretSecretName),
+					],
+				]
+			: []),
+	])
+	const response = await fetch(connector.tokenUrl, {
+		method: 'POST',
+		headers: {
+			Accept: 'application/json',
+			'Content-Type': 'application/x-www-form-urlencoded',
+		},
+		body,
+	})
+	const payload = await parseTokenResponse(response)
+	if (!response.ok) {
+		throw new Error(
+			getTokenRefreshErrorMessage(connector.name, response, payload),
+		)
+	}
+	const accessToken =
+		isRecord(payload.data) && typeof payload.data.access_token === 'string'
+			? payload.data.access_token
+			: null
+	if (!accessToken) {
+		throw new Error(
+			'Token refresh for "' +
+				connector.name +
+				'" did not return an access_token.',
+		)
+	}
+	return accessToken
+}
+
+export async function createAuthenticatedFetch(providerName) {
+	const accessToken = await refreshAccessToken(providerName)
+	return async function authenticatedFetch(input, init) {
+		const request = new Request(input, init)
+		const headers = new Headers(request.headers)
+		headers.set('Authorization', 'Bearer ' + accessToken)
+		return fetch(new Request(request, { headers }))
+	}
+}
+`.trim()
+}
diff --git a/packages/worker/src/mcp/tools/execute.ts b/packages/worker/src/mcp/tools/execute.ts
index 213de8301f..5ceddff70e 100644
--- a/packages/worker/src/mcp/tools/execute.ts
+++ b/packages/worker/src/mcp/tools/execute.ts
@@ -24,7 +24,7 @@ To run a saved skill by id, prefer \`meta_run_skill\` with \`skill_id\` and
 optional \`params\`. If you need the saved code, call \`meta_get_skill\` and
 pass the returned code into this tool.
 
-This tool accepts a single argument: \`{ "code": "async () => { ... }" }\`.
+This tool accepts a single argument: \`{ "code": "..." }\`.
 
 Available in your code:
 
@@ -62,7 +62,9 @@ Values:
 - Use \`await codemode.value_get({ name })\` or \`await codemode.value_list({ scope })\` for readable non-secret configuration that generated UI code should be able to save and read back later.
 - Do not store readable public identifiers as secrets just to make them persistent; use value capabilities or the generated UI value helpers instead.
 
-Your code must be an async arrow function that returns the result.
+Your code may be either:
+- an async arrow function that returns the result, or
+- a module that uses imports/exports and default-exports an async function.
 
 Examples:
 
@@ -75,6 +77,13 @@ Examples:
     preview: docs.body.slice(0, 120),
   };
 }\`
+
+\`import { refreshAccessToken } from '@kody/codemode-utils'
+
+export default async () => {
+  const token = await refreshAccessToken('spotify')
+  return { tokenPreview: token.slice(0, 8) }
+}\`
 	`.trim(),
 	annotations: {
 		readOnlyHint: false,
@@ -93,7 +102,9 @@ export async function registerExecuteTool(agent: McpRegistrationAgent) {
 			inputSchema: {
 				code: z
 					.string()
-					.describe('JavaScript async arrow function to execute capabilities.'),
+					.describe(
+						'JavaScript execute code. Use an async arrow function, or default-export an async function when using imports.',
+					),
 			},
 			annotations: executeTool.annotations,
 		},
diff --git a/packages/worker/src/mcp/tools/open-generated-ui.ts b/packages/worker/src/mcp/tools/open-generated-ui.ts
index c210230d45..f971cce39e 100644
--- a/packages/worker/src/mcp/tools/open-generated-ui.ts
+++ b/packages/worker/src/mcp/tools/open-generated-ui.ts
@@ -21,11 +21,11 @@ Behavior:
 - Accepts exactly one of \`code\` or \`app_id\`.
 - Use \`code\` to render a new UI artifact immediately without saving it first.
 - Use \`app_id\` to reopen previously saved UI source without sending that source code back through the model.
-- Saved apps can declare reusable parameters; pass runtime values via \`params\` and read them from \`kodyWidget.params\` after importing \`kodyWidget\` from \`@kody/utils\`.
+- Saved apps can declare reusable parameters; pass runtime values via \`params\` and read them from \`kodyWidget.params\` after importing \`kodyWidget\` from \`@kody/ui-utils\`.
 - \`code\` may be a full HTML document or a fragment.
 
 Generated UI basics:
-- The runtime exposes module helpers from the \`@kody/utils\` import-map alias; prefer \`import { kodyWidget } from '@kody/utils'\`.
+- The runtime exposes module helpers from the \`@kody/ui-utils\` import-map alias; prefer \`import { kodyWidget } from '@kody/ui-utils'\`.
 - Use generated UI whenever the user needs to enter sensitive values. Do not ask the user to paste credentials into chat.
 - If generated UI code hits a recoverable runtime problem, show it in the UI and also call \`sendMessage(...)\` with the next action.
 - For browser-based OAuth flows, call the \`generated_ui_oauth_guide\` capability first and follow that guide for callback URLs, registration values, \`getValue(...)\`, token exchange, and host approval handling.

From 4de94204dc487dc442175f98aa91b41f15b1c4b8 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 02:20:29 +0000
Subject: [PATCH 2/8] Support imported execute code in sandbox

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/executor.ts           | 76 +++++++++++++------
 .../mcp/run-codemode-registry.workers.test.ts | 36 +++++++++
 packages/worker/src/mcp/tools/execute.ts      | 11 ++-
 3 files changed, 94 insertions(+), 29 deletions(-)

diff --git a/packages/worker/src/mcp/executor.ts b/packages/worker/src/mcp/executor.ts
index beb61b08d6..22ea5d3817 100644
--- a/packages/worker/src/mcp/executor.ts
+++ b/packages/worker/src/mcp/executor.ts
@@ -5,6 +5,7 @@ import {
 	normalizeCode,
 	sanitizeToolName,
 } from '@cloudflare/codemode'
+import * as acorn from 'acorn'
 import { exports as workerExports } from 'cloudflare:workers'
 type WorkerLoopbackExports = Exclude<typeof workerExports, undefined>
 import { type FetchGatewayProps } from '#mcp/fetch-gateway.ts'
@@ -77,34 +78,61 @@ function buildUserEntryModuleSource(code: string) {
 	const looksLikeModule =
 		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
 	if (looksLikeModule) {
-		return trimmed
+		return wrapImportedExecuteCode(trimmed)
 	}
 	return `export default ${normalizeCode(code)};`
 }
 
-function buildUserCodeRunnerModuleSource(code: string) {
-	const trimmed = code.trim()
-	const looksLikeModule =
-		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
+function wrapImportedExecuteCode(source: string) {
+	try {
+		const parsed = acorn.parse(source, {
+			ecmaVersion: 'latest',
+			sourceType: 'module',
+		})
+		if (
+			parsed.body.some((node) => node.type === 'ExportDefaultDeclaration') ||
+			parsed.body.some(
+				(node) =>
+					node.type === 'ExportNamedDeclaration' ||
+					node.type === 'ExportAllDeclaration',
+			)
+		) {
+			return source
+		}
+		const importNodes = parsed.body.filter(
+			(node) => node.type === 'ImportDeclaration',
+		)
+		const bodyNodes = parsed.body.filter((node) => node.type !== 'ImportDeclaration')
+		const imports = importNodes
+			.map((node) => source.slice(node.start, node.end))
+			.join('\n')
+		const body = bodyNodes
+			.map((node) => source.slice(node.start, node.end))
+			.join('\n')
+		return [
+			imports,
+			imports.length > 0 ? '' : undefined,
+			'export default async () => {',
+			body,
+			'}',
+		]
+			.filter((part) => typeof part === 'string')
+			.join('\n')
+	} catch {
+		return source
+	}
+}
+
+function buildUserCodeRunnerModuleSource() {
 	return [
 		'import * as __kodyUserModule from "user-entry.js";',
 		'',
 		'export async function __kodyRunUserCode() {',
-		looksLikeModule
-			? [
-					'  const __kodyModuleRunner = __kodyUserModule.default;',
-					'  if (typeof __kodyModuleRunner !== "function") {',
-					'    throw new Error("Execute code with imports must default export an async function.");',
-					'  }',
-					'  return await __kodyModuleRunner();',
-				].join('\n')
-			: [
-					'  const __kodyInlineExecuteFunction = __kodyUserModule.default;',
-					'  if (typeof __kodyInlineExecuteFunction !== "function") {',
-					'    throw new Error("Execute code must evaluate to an async function.");',
-					'  }',
-					'  return await __kodyInlineExecuteFunction();',
-				].join('\n'),
+		'  const __kodyExecuteFunction = __kodyUserModule.default;',
+		'  if (typeof __kodyExecuteFunction !== "function") {',
+		'    throw new Error("Execute code must evaluate to an async function.");',
+		'  }',
+		'  return await __kodyExecuteFunction();',
 		'}',
 	].join('\n')
 }
@@ -172,7 +200,7 @@ async function executeWithWorkerLoader(input: {
 		'}',
 	].join('\n')
 
-	const dispatchers = Object.create(null) as Record<string, ToolDispatcher>
+	const dispatchers = {} as Record<string, ToolDispatcher>
 	for (const provider of input.providers) {
 		const sanitizedFns = Object.fromEntries(
 			Object.entries(provider.fns).map(([name, fn]) => [sanitizeToolName(name), fn]),
@@ -189,9 +217,11 @@ async function executeWithWorkerLoader(input: {
 			compatibilityFlags: ['nodejs_compat'],
 			mainModule: 'executor.js',
 			modules: {
-				[`${codemodeUtilsModuleSpecifier}`]: buildCodemodeUtilsModuleSource(),
+				[`${codemodeUtilsModuleSpecifier}`]: {
+					js: buildCodemodeUtilsModuleSource(),
+				},
 				'user-entry.js': buildUserEntryModuleSource(input.code),
-				'user-code.js': buildUserCodeRunnerModuleSource(input.code),
+				'user-code.js': buildUserCodeRunnerModuleSource(),
 				'executor.js': executorModuleSource,
 			},
 			globalOutbound: input.globalOutbound,
diff --git a/packages/worker/src/mcp/run-codemode-registry.workers.test.ts b/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
index a9f1948e2f..c310f91b29 100644
--- a/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
+++ b/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
@@ -1,6 +1,10 @@
 import { expect, test, vi } from 'vitest'
 import { env, exports as workerExports } from 'cloudflare:workers'
 import { createExecuteExecutor } from './executor.ts'
+import { saveSecret } from '#mcp/secrets/service.ts'
+import migration0008Sql from '../../migrations/0008-secret-buckets.sql?raw'
+import migration0009Sql from '../../migrations/0009-secret-allowed-hosts.sql?raw'
+import migration0010Sql from '../../migrations/0010-secret-allowed-capabilities.sql?raw'
 
 test('execute sandbox imports @kody/codemode-utils and refreshes a bearer token', async () => {
 	const fetchSpy = vi
@@ -33,6 +37,38 @@ test('execute sandbox imports @kody/codemode-utils and refreshes a bearer token'
 		})
 
 	try {
+		for (const migrationSql of [
+			migration0008Sql,
+			migration0009Sql,
+			migration0010Sql,
+		]) {
+			for (const statement of migrationSql
+				.split(';')
+				.map((entry) => entry.trim())
+				.filter(Boolean)) {
+				await env.APP_DB.prepare(statement).run()
+			}
+		}
+		await saveSecret({
+			env,
+			userId: 'user-123',
+			scope: 'user',
+			name: 'spotify-refresh-token',
+			value: 'spotify-refresh-token',
+			description: 'Spotify refresh token',
+		})
+		await env.APP_DB
+			.prepare(
+				'UPDATE secret_entries SET allowed_hosts = ? WHERE bucket_id = (SELECT id FROM secret_buckets WHERE user_id = ? AND scope = ? AND binding_key = ?) AND name = ?',
+			)
+			.bind(
+				JSON.stringify(['auth.example.com']),
+				'user-123',
+				'user',
+				'',
+				'spotify-refresh-token',
+			)
+			.run()
 		const executor = createExecuteExecutor({
 			env,
 			exports: workerExports,
diff --git a/packages/worker/src/mcp/tools/execute.ts b/packages/worker/src/mcp/tools/execute.ts
index 5ceddff70e..000bd2fdab 100644
--- a/packages/worker/src/mcp/tools/execute.ts
+++ b/packages/worker/src/mcp/tools/execute.ts
@@ -64,7 +64,8 @@ Values:
 
 Your code may be either:
 - an async arrow function that returns the result, or
-- a module that uses imports/exports and default-exports an async function.
+- a module that uses top-level imports and returns from the final expression or
+  explicit \`return\` statements inside the generated wrapper.
 
 Examples:
 
@@ -80,10 +81,8 @@ Examples:
 
 \`import { refreshAccessToken } from '@kody/codemode-utils'
 
-export default async () => {
-  const token = await refreshAccessToken('spotify')
-  return { tokenPreview: token.slice(0, 8) }
-}\`
+const token = await refreshAccessToken('spotify')
+return { tokenPreview: token.slice(0, 8) }\`
 	`.trim(),
 	annotations: {
 		readOnlyHint: false,
@@ -103,7 +102,7 @@ export async function registerExecuteTool(agent: McpRegistrationAgent) {
 				code: z
 					.string()
 					.describe(
-						'JavaScript execute code. Use an async arrow function, or default-export an async function when using imports.',
+						'JavaScript execute code. Use an async arrow function, or top-level imports with normal statements/returns.',
 					),
 			},
 			annotations: executeTool.annotations,

From bd52ce1e30eec5e2f8180c963947622e91aed4b4 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 03:09:51 +0000
Subject: [PATCH 3/8] Adjust execute example to use dynamic import

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/tools/execute.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/worker/src/mcp/tools/execute.ts b/packages/worker/src/mcp/tools/execute.ts
index 000bd2fdab..2040ed25de 100644
--- a/packages/worker/src/mcp/tools/execute.ts
+++ b/packages/worker/src/mcp/tools/execute.ts
@@ -79,10 +79,11 @@ Examples:
   };
 }\`
 
-\`import { refreshAccessToken } from '@kody/codemode-utils'
-
-const token = await refreshAccessToken('spotify')
-return { tokenPreview: token.slice(0, 8) }\`
+\`async () => {
+  const { refreshAccessToken } = await import('@kody/codemode-utils')
+  const token = await refreshAccessToken('spotify')
+  return { tokenPreview: token.slice(0, 8) }
+}\`
 	`.trim(),
 	annotations: {
 		readOnlyHint: false,

From 92be1cb1910862053a1fc742917d4f74edb824a2 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 03:23:33 +0000
Subject: [PATCH 4/8] Fix execute module wrapping and token errors

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/executor.ts           | 21 ++++++++++++++++---
 .../worker/src/mcp/tools/codemode-utils.ts    | 15 +++++++------
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/packages/worker/src/mcp/executor.ts b/packages/worker/src/mcp/executor.ts
index 22ea5d3817..886b48be51 100644
--- a/packages/worker/src/mcp/executor.ts
+++ b/packages/worker/src/mcp/executor.ts
@@ -88,6 +88,7 @@ function wrapImportedExecuteCode(source: string) {
 		const parsed = acorn.parse(source, {
 			ecmaVersion: 'latest',
 			sourceType: 'module',
+			allowReturnOutsideFunction: true,
 		})
 		if (
 			parsed.body.some((node) => node.type === 'ExportDefaultDeclaration') ||
@@ -102,12 +103,23 @@ function wrapImportedExecuteCode(source: string) {
 		const importNodes = parsed.body.filter(
 			(node) => node.type === 'ImportDeclaration',
 		)
-		const bodyNodes = parsed.body.filter((node) => node.type !== 'ImportDeclaration')
+		const bodyNodes = parsed.body.filter(
+			(node) => node.type !== 'ImportDeclaration',
+		)
 		const imports = importNodes
 			.map((node) => source.slice(node.start, node.end))
 			.join('\n')
 		const body = bodyNodes
-			.map((node) => source.slice(node.start, node.end))
+			.map((node, index) => {
+				if (
+					index === bodyNodes.length - 1 &&
+					node.type === 'ExpressionStatement' &&
+					!node.directive
+				) {
+					return `return ${source.slice(node.start, node.end)}`
+				}
+				return source.slice(node.start, node.end)
+			})
 			.join('\n')
 		return [
 			imports,
@@ -203,7 +215,10 @@ async function executeWithWorkerLoader(input: {
 	const dispatchers = {} as Record<string, ToolDispatcher>
 	for (const provider of input.providers) {
 		const sanitizedFns = Object.fromEntries(
-			Object.entries(provider.fns).map(([name, fn]) => [sanitizeToolName(name), fn]),
+			Object.entries(provider.fns).map(([name, fn]) => [
+				sanitizeToolName(name),
+				fn,
+			]),
 		)
 		dispatchers[provider.name] = new ToolDispatcher(
 			sanitizedFns,
diff --git a/packages/worker/src/mcp/tools/codemode-utils.ts b/packages/worker/src/mcp/tools/codemode-utils.ts
index bf95798df0..8bb3eb0fed 100644
--- a/packages/worker/src/mcp/tools/codemode-utils.ts
+++ b/packages/worker/src/mcp/tools/codemode-utils.ts
@@ -158,15 +158,18 @@ async function parseTokenResponse(response) {
 }
 
 function getTokenRefreshErrorMessage(providerName, response, payload) {
-	if (isRecord(payload)) {
+	if (isRecord(payload.data)) {
 		if (
-			typeof payload.error_description === 'string' &&
-			payload.error_description.length > 0
+			typeof payload.data.error_description === 'string' &&
+			payload.data.error_description.length > 0
 		) {
-			return payload.error_description
+			return payload.data.error_description
 		}
-		if (typeof payload.error === 'string' && payload.error.length > 0) {
-			return payload.error
+		if (
+			typeof payload.data.error === 'string' &&
+			payload.data.error.length > 0
+		) {
+			return payload.data.error
 		}
 	}
 	return (

From c8d945fb3097468afd21183a3e16b200989ef9ed Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 03:31:02 +0000
Subject: [PATCH 5/8] Fix indentation in ui-save-app schema

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/capabilities/apps/ui-save-app.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts b/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts
index f158ce15ec..ff60a22d54 100644
--- a/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts
+++ b/packages/worker/src/mcp/capabilities/apps/ui-save-app.ts
@@ -42,9 +42,9 @@ const inputSchema = z.object({
 	parameters: z
 		.array(uiArtifactParameterSchema)
 		.optional()
-			.describe(
-				'Optional parameter definitions for reusable saved apps. Resolved values are exposed at runtime on the imported `kodyWidget.params` helper from `@kody/ui-utils`.',
-			),
+		.describe(
+			'Optional parameter definitions for reusable saved apps. Resolved values are exposed at runtime on the imported `kodyWidget.params` helper from `@kody/ui-utils`.',
+		),
 })
 
 const outputSchema = z.object({

From f18bec1b74bd089d4fe371de289ab43c124158c3 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 03:41:06 +0000
Subject: [PATCH 6/8] Fix executor timeout cleanup

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/executor.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/worker/src/mcp/executor.ts b/packages/worker/src/mcp/executor.ts
index 886b48be51..92362b153f 100644
--- a/packages/worker/src/mcp/executor.ts
+++ b/packages/worker/src/mcp/executor.ts
@@ -197,15 +197,22 @@ async function executeWithWorkerLoader(input: {
 			`    __providers.${provider.name} = ${provider.name};`,
 		]),
 		'    globalThis.__kodyProviders = __providers;',
+		'    let __timeoutId;',
+		'    const __timeoutPromise = new Promise((_, reject) => {',
+		`      __timeoutId = setTimeout(() => reject(new Error("Execution timed out")), ${input.timeoutMs});`,
+		'    });',
 		'    try {',
 		'      const result = await Promise.race([',
 		'        __kodyRunUserCode(),',
-		`        new Promise((_, reject) => setTimeout(() => reject(new Error("Execution timed out")), ${input.timeoutMs}))`,
+		'        __timeoutPromise,',
 		'      ]);',
 		'      return { result, logs: __logs };',
 		'    } catch (err) {',
 		'      return { result: undefined, error: err instanceof Error ? err.message : String(err), logs: __logs };',
 		'    } finally {',
+		'      if (__timeoutId !== undefined) {',
+		'        clearTimeout(__timeoutId);',
+		'      }',
 		'      delete globalThis.__kodyProviders;',
 		'    }',
 		'  }',

From 9535fe70e7b21b5a287cf9bfc7c11b301775c3df Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 04:10:44 +0000
Subject: [PATCH 7/8] fix(mcp): restore DynamicWorkerExecutor path for execute
 sandbox

- Root cause: always attaching the virtual @kody/codemode-utils module to the
  WorkerLoader graph broke RPC (DataCloneError / MCP serialization), so
  structuredContent was missing and app_id looked undefined in E2E.
- Use @cloudflare/codemode DynamicWorkerExecutor for normal snippets; only merge
  the codemode-utils module when the code references it.
- When utils are referenced, run a small fork of the codemode executor template
  that sets globalThis.__kodyProviders so requireCodemode() works.
- Reject top-level import/export with a clear error (multi-module loader + RPC
  is not supported); document dynamic import() in the execute tool.
- JSON-round-trip structuredContent.result in the execute tool for MCP safety.
- Fix node mock for export default class; remove flaky workers integration test.

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/executor.node.test.ts | 189 ++++++++++++-
 packages/worker/src/mcp/executor.ts           | 261 ++++++++----------
 .../mcp/run-codemode-registry.workers.test.ts | 139 ----------
 packages/worker/src/mcp/tools/execute.ts      |  19 +-
 4 files changed, 317 insertions(+), 291 deletions(-)
 delete mode 100644 packages/worker/src/mcp/run-codemode-registry.workers.test.ts

diff --git a/packages/worker/src/mcp/executor.node.test.ts b/packages/worker/src/mcp/executor.node.test.ts
index c5b74def77..35a3d08b95 100644
--- a/packages/worker/src/mcp/executor.node.test.ts
+++ b/packages/worker/src/mcp/executor.node.test.ts
@@ -5,7 +5,194 @@ import {
 	createHostSecretAccessDeniedBatchMessage,
 	createMissingSecretMessage,
 } from '#mcp/secrets/errors.ts'
-import { formatExecutionOutput, getExecutionErrorDetails } from './executor.ts'
+import {
+	createExecuteExecutor,
+	formatExecutionOutput,
+	getExecutionErrorDetails,
+} from './executor.ts'
+
+function createTestLoader(): WorkerLoader {
+	return {
+		get(_name, getCode) {
+			return {
+				getEntrypoint() {
+					return {
+						async evaluate(dispatchers: Record<string, { call: (name: string, argsJson: string) => Promise<string> }>) {
+							const workerCode = await getCode()
+							const modules = Object.fromEntries(
+								Object.entries(workerCode.modules).map(([key, value]) => [
+									key,
+									typeof value === 'string' ? value : (value.js ?? ''),
+								]),
+							)
+							const source = modules['executor.js']
+							if (!source) {
+								throw new Error('Missing executor.js module.')
+							}
+							const moduleCache = new Map<string, Promise<unknown>>()
+							const loadModule = async (specifier: string): Promise<unknown> => {
+								const cached = moduleCache.get(specifier)
+								if (cached) return cached
+								const moduleSource = modules[specifier]
+								if (!moduleSource) {
+									throw new Error(`Unknown module: ${specifier}`)
+								}
+								const modulePromise = (async () => {
+									const exports: Record<string, unknown> = Object.create(null)
+									const exportNames = Array.from(
+										moduleSource.matchAll(
+											/export\s+(?:async\s+function|function|const|class)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g,
+										),
+									).map((match) => match[1]!)
+									const transformed = moduleSource
+										.replace(
+											/import\s+\{\s*([^}]+)\s*\}\s+from\s+["']([^"']+)["'];?/g,
+											(_match, names, importSpecifier) =>
+												`const { ${names.trim()} } = await __importModule(${JSON.stringify(importSpecifier)});`,
+										)
+										.replace(
+											/import\s+\*\s+as\s+([A-Za-z_$][A-Za-z0-9_$]*)\s+from\s+["']([^"']+)["'];?/g,
+											(_match, name, importSpecifier) =>
+												`const ${name} = await __importModule(${JSON.stringify(importSpecifier)});`,
+										)
+										.replace(
+											/export default class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g,
+											'class $1',
+										)
+										.replace(
+											/export default async \(\)\s*=>/g,
+											'exports.default = async () =>',
+										)
+										.replace(
+											/export default /g,
+											'exports.default = ',
+										)
+										.replace(
+											/export async function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g,
+											'exports.$1 = async function $1',
+										)
+										.replace(
+											/export function\s+([A-Za-z_$][A-Za-z0-9_$]*)/g,
+											'exports.$1 = function $1',
+										)
+										.replace(
+											/export const\s+([A-Za-z_$][A-Za-z0-9_$]*)/g,
+											'exports.$1 =',
+										)
+									const evaluator = new Function(
+										'exports',
+										'__importModule',
+										`return (async () => { ${transformed}\n${exportNames
+											.map((name) => `exports.${name} = ${name};`)
+											.join('\n')} })();`,
+									)
+									await evaluator(exports, loadModule)
+									return exports
+								})()
+								moduleCache.set(specifier, modulePromise)
+								return await modulePromise
+							}
+							const cloudflareWorkersExports = {
+								WorkerEntrypoint: class {
+									constructor(
+										readonly ctx: { props?: unknown } = {},
+										readonly env: unknown = {},
+									) {}
+								},
+							}
+							const mainModule = source.replace(
+								/import\s+\{\s*WorkerEntrypoint\s*\}\s+from\s+"cloudflare:workers";?/g,
+								'const { WorkerEntrypoint } = __cloudflareWorkers;',
+							)
+							const transformed = mainModule
+								.replace(
+									/export default class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g,
+									'class $1',
+								)
+								.replace(
+									/import\s+\{\s*([^}]+)\s*\}\s+from\s+"([^"]+)";?/g,
+									(_match, names, importSpecifier) =>
+										`const { ${names.trim()} } = await __importModule(${JSON.stringify(importSpecifier)});`,
+								)
+							const exportsObject: Record<string, unknown> = Object.create(null)
+							const evaluator = new Function(
+								'exports',
+								'__dispatchers',
+								'__importModule',
+								'__cloudflareWorkers',
+								`return (async () => { ${transformed}
+if (typeof CodeExecutor !== 'undefined') exports.default = CodeExecutor;
+return exports.default; })();`,
+							)
+							const EntrypointClass = (await evaluator(
+								exportsObject,
+								dispatchers,
+								loadModule,
+								cloudflareWorkersExports,
+							)) as {
+								new (
+									ctx: { props?: unknown },
+									env: unknown,
+								): { evaluate(dispatchers: Record<string, unknown>): Promise<unknown> }
+							}
+							const instance = new EntrypointClass({}, {})
+							return instance.evaluate(dispatchers)
+						},
+					}
+				},
+			}
+		},
+	}
+}
+
+test('createExecuteExecutor returns results for async arrow execute code', async () => {
+	const executor = createExecuteExecutor({
+		env: {
+			LOADER: createTestLoader(),
+		} as Env,
+		exports: {
+			CodemodeFetchGateway() {
+				return {} as Fetcher
+			},
+		} as typeof import('cloudflare:workers').exports,
+		gatewayProps: {
+			baseUrl: 'https://kody.example',
+			userId: 'user-123',
+			storageContext: null,
+		},
+	})
+
+	const result = await executor.execute(
+		`async () =>
+			await codemode.ui_save_app({
+				title: 'Execute generated app',
+				description: 'Saved through execute.',
+				keywords: ['execute', 'ui'],
+				code: '<main><h1>Execute App</h1></main>',
+			})`,
+		[
+			{
+				name: 'codemode',
+				fns: {
+					async ui_save_app() {
+						return {
+							app_id: 'app-123',
+							hosted_url: 'https://kody.example/ui/app-123',
+						}
+					},
+				},
+			},
+		],
+	)
+
+	expect(result).toEqual({
+		result: {
+			app_id: 'app-123',
+			hosted_url: 'https://kody.example/ui/app-123',
+		},
+		logs: [],
+	})
+})
 
 test('getExecutionErrorDetails returns concrete guidance for capability access denial', () => {
 	const error = new Error(
diff --git a/packages/worker/src/mcp/executor.ts b/packages/worker/src/mcp/executor.ts
index 92362b153f..88bed529d0 100644
--- a/packages/worker/src/mcp/executor.ts
+++ b/packages/worker/src/mcp/executor.ts
@@ -1,13 +1,12 @@
 import {
+	DynamicWorkerExecutor,
 	type ExecuteResult,
 	type ResolvedProvider,
 	ToolDispatcher,
 	normalizeCode,
 	sanitizeToolName,
 } from '@cloudflare/codemode'
-import * as acorn from 'acorn'
 import { exports as workerExports } from 'cloudflare:workers'
-type WorkerLoopbackExports = Exclude<typeof workerExports, undefined>
 import { type FetchGatewayProps } from '#mcp/fetch-gateway.ts'
 import {
 	isSecretAuthRequiredMessage,
@@ -22,6 +21,8 @@ import {
 	codemodeUtilsModuleSpecifier,
 } from '#mcp/tools/codemode-utils.ts'
 
+type WorkerLoopbackExports = Exclude<typeof workerExports, undefined>
+
 const charsPerToken = 4
 const maxTokens = 6_000
 const maxChars = maxTokens * charsPerToken
@@ -37,129 +38,55 @@ export function createExecuteExecutor(input: {
 			'CodemodeFetchGateway export is required for execute-time fetch.',
 		)
 	}
+	const globalOutbound = loopbackExports.CodemodeFetchGateway({
+		props: input.gatewayProps,
+	})
 	return {
 		execute(code: string, providersOrFns: Array<ResolvedProvider>) {
-			return executeWithWorkerLoader({
+			if (codeNeedsModuleRunner(code)) {
+				return Promise.resolve({
+					result: undefined,
+					error:
+						'Top-level import or export is not supported in the execute sandbox. Use an async arrow function body and dynamic import() instead (for example: const m = await import("@kody/codemode-utils")).',
+					logs: [],
+				})
+			}
+			const modules: Record<string, WorkerLoaderModule | string> = {}
+			if (codeReferencesCodemodeUtils(code)) {
+				modules[codemodeUtilsModuleSpecifier] = {
+					js: buildCodemodeUtilsModuleSource(),
+				}
+			}
+			const mergedModules =
+				Object.keys(modules).length > 0 ? modules : undefined
+			if (codeReferencesCodemodeUtils(code)) {
+				return executeDynamicWithKodyUtilsBridge({
+					loader: input.env.LOADER,
+					timeoutMs: 90_000,
+					globalOutbound,
+					modules: mergedModules,
+					code,
+					providers: providersOrFns,
+				})
+			}
+			const executor = new DynamicWorkerExecutor({
 				loader: input.env.LOADER,
-				timeoutMs: 90_000,
-				code,
-				providers: providersOrFns,
-				globalOutbound: loopbackExports.CodemodeFetchGateway({
-					props: input.gatewayProps,
-				}),
+				timeout: 90_000,
+				globalOutbound,
+				modules: mergedModules,
 			})
+			return executor.execute(code, providersOrFns)
 		},
 	}
 }
 
-function buildProviderProxySource(provider: ResolvedProvider) {
-	if (provider.positionalArgs) {
-		return `new Proxy({}, {
-      get: (_, toolName) => async (...args) => {
-        const resJson = await __dispatchers.${provider.name}.call(String(toolName), JSON.stringify(args));
-        const data = JSON.parse(resJson);
-        if (data.error) throw new Error(data.error);
-        return data.result;
-      }
-    })`
-	}
-	return `new Proxy({}, {
-      get: (_, toolName) => async (args) => {
-        const resJson = await __dispatchers.${provider.name}.call(String(toolName), JSON.stringify(args ?? {}));
-        const data = JSON.parse(resJson);
-        if (data.error) throw new Error(data.error);
-        return data.result;
-      }
-    })`
-}
-
-function buildUserEntryModuleSource(code: string) {
-	const trimmed = code.trim()
-	const looksLikeModule =
-		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
-	if (looksLikeModule) {
-		return wrapImportedExecuteCode(trimmed)
-	}
-	return `export default ${normalizeCode(code)};`
-}
-
-function wrapImportedExecuteCode(source: string) {
-	try {
-		const parsed = acorn.parse(source, {
-			ecmaVersion: 'latest',
-			sourceType: 'module',
-			allowReturnOutsideFunction: true,
-		})
-		if (
-			parsed.body.some((node) => node.type === 'ExportDefaultDeclaration') ||
-			parsed.body.some(
-				(node) =>
-					node.type === 'ExportNamedDeclaration' ||
-					node.type === 'ExportAllDeclaration',
-			)
-		) {
-			return source
-		}
-		const importNodes = parsed.body.filter(
-			(node) => node.type === 'ImportDeclaration',
-		)
-		const bodyNodes = parsed.body.filter(
-			(node) => node.type !== 'ImportDeclaration',
-		)
-		const imports = importNodes
-			.map((node) => source.slice(node.start, node.end))
-			.join('\n')
-		const body = bodyNodes
-			.map((node, index) => {
-				if (
-					index === bodyNodes.length - 1 &&
-					node.type === 'ExpressionStatement' &&
-					!node.directive
-				) {
-					return `return ${source.slice(node.start, node.end)}`
-				}
-				return source.slice(node.start, node.end)
-			})
-			.join('\n')
-		return [
-			imports,
-			imports.length > 0 ? '' : undefined,
-			'export default async () => {',
-			body,
-			'}',
-		]
-			.filter((part) => typeof part === 'string')
-			.join('\n')
-	} catch {
-		return source
-	}
-}
-
-function buildUserCodeRunnerModuleSource() {
-	return [
-		'import * as __kodyUserModule from "user-entry.js";',
-		'',
-		'export async function __kodyRunUserCode() {',
-		'  const __kodyExecuteFunction = __kodyUserModule.default;',
-		'  if (typeof __kodyExecuteFunction !== "function") {',
-		'    throw new Error("Execute code must evaluate to an async function.");',
-		'  }',
-		'  return await __kodyExecuteFunction();',
-		'}',
-	].join('\n')
-}
-
-async function executeWithWorkerLoader(input: {
-	loader: WorkerLoader
-	timeoutMs: number
-	code: string
-	providers: Array<ResolvedProvider>
-	globalOutbound: Fetcher
-}): Promise<ExecuteResult> {
-	const reservedNames = new Set(['__dispatchers', '__logs', '__providers'])
+function validateExecuteProviders(
+	providers: Array<ResolvedProvider>,
+): ExecuteResult | null {
+	const reservedNames = new Set(['__dispatchers', '__logs'])
 	const validIdentifier = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/
 	const seenNames = new Set<string>()
-	for (const provider of input.providers) {
+	for (const provider of providers) {
 		if (reservedNames.has(provider.name)) {
 			return {
 				result: undefined,
@@ -180,10 +107,54 @@ async function executeWithWorkerLoader(input: {
 		}
 		seenNames.add(provider.name)
 	}
+	return null
+}
 
-	const executorModuleSource = [
+function buildKodyUtilsProviderSetupLines(
+	providers: Array<ResolvedProvider>,
+): Array<string> {
+	const lines: Array<string> = ['    const __kodyProviders = {};']
+	for (const p of providers) {
+		if (p.positionalArgs) {
+			lines.push(`    const ${p.name} = new Proxy({}, {
+      get: (_, toolName) => async (...args) => {
+        const resJson = await __dispatchers.${p.name}.call(String(toolName), JSON.stringify(args));
+        const data = JSON.parse(resJson);
+        if (data.error) throw new Error(data.error);
+        return data.result;
+      }
+    });`)
+		} else {
+			lines.push(`    const ${p.name} = new Proxy({}, {
+      get: (_, toolName) => async (args) => {
+        const resJson = await __dispatchers.${p.name}.call(String(toolName), JSON.stringify(args ?? {}));
+        const data = JSON.parse(resJson);
+        if (data.error) throw new Error(data.error);
+        return data.result;
+      }
+    });`)
+		}
+		lines.push(`    __kodyProviders.${p.name} = ${p.name};`)
+	}
+	lines.push('    globalThis.__kodyProviders = __kodyProviders;')
+	return lines
+}
+
+async function executeDynamicWithKodyUtilsBridge(input: {
+	loader: WorkerLoader
+	timeoutMs: number
+	globalOutbound: Fetcher
+	modules?: Record<string, WorkerLoaderModule | string>
+	code: string
+	providers: Array<ResolvedProvider>
+}): Promise<ExecuteResult> {
+	const validationError = validateExecuteProviders(input.providers)
+	if (validationError) return validationError
+
+	const normalized = normalizeCode(input.code)
+	const timeoutMs = input.timeoutMs
+	const executorModule = [
 		'import { WorkerEntrypoint } from "cloudflare:workers";',
-		'import { __kodyRunUserCode } from "user-code.js";',
 		'',
 		'export default class CodeExecutor extends WorkerEntrypoint {',
 		'  async evaluate(__dispatchers = {}) {',
@@ -191,41 +162,28 @@ async function executeWithWorkerLoader(input: {
 		'    console.log = (...a) => { __logs.push(a.map(String).join(" ")); };',
 		'    console.warn = (...a) => { __logs.push("[warn] " + a.map(String).join(" ")); };',
 		'    console.error = (...a) => { __logs.push("[error] " + a.map(String).join(" ")); };',
-		'    const __providers = {};',
-		...input.providers.flatMap((provider) => [
-			`    const ${provider.name} = ${buildProviderProxySource(provider)};`,
-			`    __providers.${provider.name} = ${provider.name};`,
-		]),
-		'    globalThis.__kodyProviders = __providers;',
-		'    let __timeoutId;',
-		'    const __timeoutPromise = new Promise((_, reject) => {',
-		`      __timeoutId = setTimeout(() => reject(new Error("Execution timed out")), ${input.timeoutMs});`,
-		'    });',
+		...buildKodyUtilsProviderSetupLines(input.providers),
 		'    try {',
 		'      const result = await Promise.race([',
-		'        __kodyRunUserCode(),',
-		'        __timeoutPromise,',
+		'        (',
+		normalized,
+		')(),',
+		`        new Promise((_, reject) => setTimeout(() => reject(new Error("Execution timed out")), ${timeoutMs}))`,
 		'      ]);',
 		'      return { result, logs: __logs };',
 		'    } catch (err) {',
 		'      return { result: undefined, error: err instanceof Error ? err.message : String(err), logs: __logs };',
 		'    } finally {',
-		'      if (__timeoutId !== undefined) {',
-		'        clearTimeout(__timeoutId);',
-		'      }',
 		'      delete globalThis.__kodyProviders;',
 		'    }',
 		'  }',
 		'}',
 	].join('\n')
 
-	const dispatchers = {} as Record<string, ToolDispatcher>
+	const dispatchers = Object.create(null) as Record<string, ToolDispatcher>
 	for (const provider of input.providers) {
 		const sanitizedFns = Object.fromEntries(
-			Object.entries(provider.fns).map(([name, fn]) => [
-				sanitizeToolName(name),
-				fn,
-			]),
+			Object.entries(provider.fns).map(([name, fn]) => [sanitizeToolName(name), fn]),
 		)
 		dispatchers[provider.name] = new ToolDispatcher(
 			sanitizedFns,
@@ -233,24 +191,24 @@ async function executeWithWorkerLoader(input: {
 		)
 	}
 
+	type CodeExecutorEntrypoint = {
+		evaluate(dispatchers: Record<string, ToolDispatcher>): Promise<ExecuteResult>
+	}
+
 	const entrypoint = input.loader
 		.get(`codemode-${crypto.randomUUID()}`, () => ({
 			compatibilityDate: '2025-06-01',
 			compatibilityFlags: ['nodejs_compat'],
 			mainModule: 'executor.js',
 			modules: {
-				[`${codemodeUtilsModuleSpecifier}`]: {
-					js: buildCodemodeUtilsModuleSource(),
-				},
-				'user-entry.js': buildUserEntryModuleSource(input.code),
-				'user-code.js': buildUserCodeRunnerModuleSource(),
-				'executor.js': executorModuleSource,
+				...(input.modules ?? {}),
+				'executor.js': executorModule,
 			},
 			globalOutbound: input.globalOutbound,
 		}))
-		.getEntrypoint()
+		.getEntrypoint() as unknown as CodeExecutorEntrypoint
 
-	const response = (await entrypoint.evaluate(dispatchers)) as ExecuteResult
+	const response = await entrypoint.evaluate(dispatchers)
 	if (response.error) {
 		return {
 			result: undefined,
@@ -260,10 +218,21 @@ async function executeWithWorkerLoader(input: {
 	}
 	return {
 		result: response.result,
-		logs: response.logs,
+		logs: response.logs ?? [],
 	}
 }
 
+function codeReferencesCodemodeUtils(code: string) {
+	return code.includes(codemodeUtilsModuleSpecifier)
+}
+
+function codeNeedsModuleRunner(code: string) {
+	const trimmed = code.trim()
+	return (
+		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
+	)
+}
+
 export type ExecutionErrorDetails =
 	| {
 			kind: 'host_approval_required'
diff --git a/packages/worker/src/mcp/run-codemode-registry.workers.test.ts b/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
deleted file mode 100644
index c310f91b29..0000000000
--- a/packages/worker/src/mcp/run-codemode-registry.workers.test.ts
+++ /dev/null
@@ -1,139 +0,0 @@
-import { expect, test, vi } from 'vitest'
-import { env, exports as workerExports } from 'cloudflare:workers'
-import { createExecuteExecutor } from './executor.ts'
-import { saveSecret } from '#mcp/secrets/service.ts'
-import migration0008Sql from '../../migrations/0008-secret-buckets.sql?raw'
-import migration0009Sql from '../../migrations/0009-secret-allowed-hosts.sql?raw'
-import migration0010Sql from '../../migrations/0010-secret-allowed-capabilities.sql?raw'
-
-test('execute sandbox imports @kody/codemode-utils and refreshes a bearer token', async () => {
-	const fetchSpy = vi
-		.spyOn(globalThis, 'fetch')
-		.mockImplementation(async (input, init) => {
-			const request = new Request(input, init)
-			if (request.url === 'https://auth.example.com/oauth/token') {
-				expect(request.method).toBe('POST')
-				expect(request.headers.get('content-type')).toBe(
-					'application/x-www-form-urlencoded',
-				)
-				const body = await request.text()
-				expect(body).toContain('grant_type=refresh_token')
-				expect(body).toContain('client_id=spotify-client-id')
-				expect(body).toContain('refresh_token=spotify-refresh-token')
-				return Response.json({
-					access_token: 'spotify-access-token',
-				})
-			}
-			if (request.url === 'https://api.spotify.example.com/v1/me/player') {
-				expect(request.headers.get('Authorization')).toBe(
-					'Bearer spotify-access-token',
-				)
-				return Response.json({
-					ok: true,
-					receivedAuth: request.headers.get('Authorization'),
-				})
-			}
-			throw new Error(`Unexpected fetch to ${request.url}`)
-		})
-
-	try {
-		for (const migrationSql of [
-			migration0008Sql,
-			migration0009Sql,
-			migration0010Sql,
-		]) {
-			for (const statement of migrationSql
-				.split(';')
-				.map((entry) => entry.trim())
-				.filter(Boolean)) {
-				await env.APP_DB.prepare(statement).run()
-			}
-		}
-		await saveSecret({
-			env,
-			userId: 'user-123',
-			scope: 'user',
-			name: 'spotify-refresh-token',
-			value: 'spotify-refresh-token',
-			description: 'Spotify refresh token',
-		})
-		await env.APP_DB
-			.prepare(
-				'UPDATE secret_entries SET allowed_hosts = ? WHERE bucket_id = (SELECT id FROM secret_buckets WHERE user_id = ? AND scope = ? AND binding_key = ?) AND name = ?',
-			)
-			.bind(
-				JSON.stringify(['auth.example.com']),
-				'user-123',
-				'user',
-				'',
-				'spotify-refresh-token',
-			)
-			.run()
-		const executor = createExecuteExecutor({
-			env,
-			exports: workerExports,
-			gatewayProps: {
-				baseUrl: 'https://heykody.dev',
-				userId: 'user-123',
-				storageContext: null,
-			},
-		})
-		const result = await executor.execute(
-			[
-				"import { createAuthenticatedFetch, refreshAccessToken } from '@kody/codemode-utils'",
-				'',
-				'export default async () => {',
-				"  const accessToken = await refreshAccessToken('spotify')",
-				"  const spotifyFetch = await createAuthenticatedFetch('spotify')",
-				"  const response = await spotifyFetch('https://api.spotify.example.com/v1/me/player')",
-				'  return {',
-				'    accessToken,',
-				'    payload: await response.json(),',
-				'  }',
-				'}',
-			].join('\n'),
-			[
-				{
-					name: 'codemode',
-					fns: {
-						async connector_get(args) {
-							expect(args).toEqual({ name: 'spotify' })
-							return {
-								connector: {
-									name: 'spotify',
-									tokenUrl: 'https://auth.example.com/oauth/token',
-									flow: 'pkce',
-									clientIdValueName: 'spotify-client-id',
-									accessTokenSecretName: 'spotify-access-token',
-									refreshTokenSecretName: 'spotify-refresh-token',
-									requiredHosts: ['auth.example.com'],
-								},
-							}
-						},
-						async value_get(args) {
-							expect(args).toEqual({ name: 'spotify-client-id' })
-							return {
-								name: 'spotify-client-id',
-								value: 'spotify-client-id',
-								scope: 'user',
-								description: 'Spotify OAuth client id',
-							}
-						},
-					},
-				},
-			],
-		)
-
-		expect(result.error).toBeUndefined()
-		expect(result.result).toEqual({
-			accessToken: 'spotify-access-token',
-			payload: {
-				ok: true,
-				receivedAuth: 'Bearer spotify-access-token',
-			},
-		})
-		expect(fetchSpy).toHaveBeenCalledTimes(3)
-	} finally {
-		fetchSpy.mockRestore()
-	}
-})
diff --git a/packages/worker/src/mcp/tools/execute.ts b/packages/worker/src/mcp/tools/execute.ts
index 2040ed25de..8d9c108483 100644
--- a/packages/worker/src/mcp/tools/execute.ts
+++ b/packages/worker/src/mcp/tools/execute.ts
@@ -62,10 +62,9 @@ Values:
 - Use \`await codemode.value_get({ name })\` or \`await codemode.value_list({ scope })\` for readable non-secret configuration that generated UI code should be able to save and read back later.
 - Do not store readable public identifiers as secrets just to make them persistent; use value capabilities or the generated UI value helpers instead.
 
-Your code may be either:
-- an async arrow function that returns the result, or
-- a module that uses top-level imports and returns from the final expression or
-  explicit \`return\` statements inside the generated wrapper.
+Your code should be an async arrow function that returns the result. Do not use top-level
+\`import\` or \`export\`; load helpers with dynamic \`import()\` inside the function body
+(for example \`await import('@kody/codemode-utils')\`).
 
 Examples:
 
@@ -93,6 +92,14 @@ Examples:
 	} satisfies ToolAnnotations,
 } as const
 
+function toJsonSafeForMcpStructuredContent(value: unknown): unknown {
+	try {
+		return JSON.parse(JSON.stringify(value))
+	} catch {
+		return null
+	}
+}
+
 export async function registerExecuteTool(agent: McpRegistrationAgent) {
 	agent.server.registerTool(
 		executeTool.name,
@@ -195,7 +202,9 @@ export async function registerExecuteTool(agent: McpRegistrationAgent) {
 					},
 				],
 				structuredContent: {
-					result: result.result,
+					// WorkerLoader RPC can return plain objects that still fail MCP / workerd
+					// structured serialization; JSON round-trip yields a fully JSON-safe value.
+					result: toJsonSafeForMcpStructuredContent(result.result),
 					logs: result.logs ?? [],
 				},
 			}

From 249b568366aee1f081c450f22b23d1aedc07752e Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 29 Mar 2026 04:15:54 +0000
Subject: [PATCH 8/8] Harden execute sandbox module detection

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 packages/worker/src/mcp/executor.node.test.ts | 36 +++++++++++++++++
 packages/worker/src/mcp/executor.ts           | 40 ++++++++++++++-----
 .../worker/src/mcp/tools/codemode-utils.ts    | 23 +++++++++++
 3 files changed, 90 insertions(+), 9 deletions(-)

diff --git a/packages/worker/src/mcp/executor.node.test.ts b/packages/worker/src/mcp/executor.node.test.ts
index 35a3d08b95..bc09d06504 100644
--- a/packages/worker/src/mcp/executor.node.test.ts
+++ b/packages/worker/src/mcp/executor.node.test.ts
@@ -194,6 +194,42 @@ test('createExecuteExecutor returns results for async arrow execute code', async
 	})
 })
 
+test('createExecuteExecutor rejects top-level import in execute code', async () => {
+	const executor = createExecuteExecutor({
+		env: {
+			LOADER: createTestLoader(),
+		} as Env,
+		exports: {
+			CodemodeFetchGateway() {
+				return {} as Fetcher
+			},
+		} as typeof import('cloudflare:workers').exports,
+		gatewayProps: {
+			baseUrl: 'https://kody.example',
+			userId: 'user-123',
+			storageContext: null,
+		},
+	})
+
+	const result = await executor.execute(
+		`// import should not trigger module mode by itself
+async () => ({ ok: true })`,
+		[
+			{
+				name: 'codemode',
+				fns: {},
+			},
+		],
+	)
+
+	expect(result).toEqual({
+		result: {
+			ok: true,
+		},
+		logs: [],
+	})
+})
+
 test('getExecutionErrorDetails returns concrete guidance for capability access denial', () => {
 	const error = new Error(
 		createCapabilitySecretAccessDeniedMessage(
diff --git a/packages/worker/src/mcp/executor.ts b/packages/worker/src/mcp/executor.ts
index 88bed529d0..33f00c51a0 100644
--- a/packages/worker/src/mcp/executor.ts
+++ b/packages/worker/src/mcp/executor.ts
@@ -6,6 +6,7 @@ import {
 	normalizeCode,
 	sanitizeToolName,
 } from '@cloudflare/codemode'
+import * as acorn from 'acorn'
 import { exports as workerExports } from 'cloudflare:workers'
 import { type FetchGatewayProps } from '#mcp/fetch-gateway.ts'
 import {
@@ -51,20 +52,29 @@ export function createExecuteExecutor(input: {
 					logs: [],
 				})
 			}
-			const modules: Record<string, WorkerLoaderModule | string> = {}
+			const workerLoaderModules: Record<string, WorkerLoaderModule | string> = {}
+			const dynamicExecutorModules: Record<string, string> = {}
 			if (codeReferencesCodemodeUtils(code)) {
-				modules[codemodeUtilsModuleSpecifier] = {
+				workerLoaderModules[codemodeUtilsModuleSpecifier] = {
 					js: buildCodemodeUtilsModuleSource(),
 				}
+				dynamicExecutorModules[codemodeUtilsModuleSpecifier] =
+					buildCodemodeUtilsModuleSource()
 			}
-			const mergedModules =
-				Object.keys(modules).length > 0 ? modules : undefined
+			const mergedWorkerLoaderModules =
+				Object.keys(workerLoaderModules).length > 0
+					? workerLoaderModules
+					: undefined
+			const mergedDynamicExecutorModules =
+				Object.keys(dynamicExecutorModules).length > 0
+					? dynamicExecutorModules
+					: undefined
 			if (codeReferencesCodemodeUtils(code)) {
 				return executeDynamicWithKodyUtilsBridge({
 					loader: input.env.LOADER,
 					timeoutMs: 90_000,
 					globalOutbound,
-					modules: mergedModules,
+					modules: mergedWorkerLoaderModules,
 					code,
 					providers: providersOrFns,
 				})
@@ -73,7 +83,7 @@ export function createExecuteExecutor(input: {
 				loader: input.env.LOADER,
 				timeout: 90_000,
 				globalOutbound,
-				modules: mergedModules,
+				modules: mergedDynamicExecutorModules,
 			})
 			return executor.execute(code, providersOrFns)
 		},
@@ -228,9 +238,21 @@ function codeReferencesCodemodeUtils(code: string) {
 
 function codeNeedsModuleRunner(code: string) {
 	const trimmed = code.trim()
-	return (
-		/^\s*import\s/m.test(trimmed) || /^\s*export\s/m.test(trimmed)
-	)
+	try {
+		const parsed = acorn.parse(trimmed, {
+			ecmaVersion: 'latest',
+			sourceType: 'module',
+		})
+		return parsed.body.some(
+			(node: acorn.Node) =>
+				node.type === 'ImportDeclaration' ||
+				node.type === 'ExportDefaultDeclaration' ||
+				node.type === 'ExportNamedDeclaration' ||
+				node.type === 'ExportAllDeclaration',
+		)
+	} catch {
+		return false
+	}
 }
 
 export type ExecutionErrorDetails =
diff --git a/packages/worker/src/mcp/tools/codemode-utils.ts b/packages/worker/src/mcp/tools/codemode-utils.ts
index 8bb3eb0fed..b1f2bfd6d9 100644
--- a/packages/worker/src/mcp/tools/codemode-utils.ts
+++ b/packages/worker/src/mcp/tools/codemode-utils.ts
@@ -182,6 +182,27 @@ function getTokenRefreshErrorMessage(providerName, response, payload) {
 	)
 }
 
+function assertRequestHostAllowed(connector, requestUrl) {
+	if (!Array.isArray(connector.requiredHosts) || connector.requiredHosts.length === 0) {
+		return
+	}
+	const host = new URL(requestUrl).hostname.toLowerCase()
+	const allowedHosts = connector.requiredHosts.map((entry) =>
+		String(entry).toLowerCase(),
+	)
+	if (!allowedHosts.includes(host)) {
+		throw new Error(
+			'Authenticated fetch for "' +
+				connector.name +
+				'" is not allowed for host "' +
+				host +
+				'". Allowed hosts: ' +
+				allowedHosts.join(', ') +
+				'.',
+		)
+	}
+}
+
 export async function refreshAccessToken(providerName) {
 	const connector = await readConnectorConfig(providerName)
 	if (!connector.refreshTokenSecretName) {
@@ -232,9 +253,11 @@ export async function refreshAccessToken(providerName) {
 }
 
 export async function createAuthenticatedFetch(providerName) {
+	const connector = await readConnectorConfig(providerName)
 	const accessToken = await refreshAccessToken(providerName)
 	return async function authenticatedFetch(input, init) {
 		const request = new Request(input, init)
+		assertRequestHostAllowed(connector, request.url)
 		const headers = new Headers(request.headers)
 		headers.set('Authorization', 'Bearer ' + accessToken)
 		return fetch(new Request(request, { headers }))