
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@uipath/functions-tool
Advanced tools
Affected versions:
UiPath CLI tool for JS/TS and Python Functions — thin passthrough to uipath-functions / uipath
UiPath CLI plugin for JS/TS and Python Functions. Installed as a tool in the uip CLI.
This package is a thin passthrough plugin. It does not contain build logic — it detects the project language and delegates every command to the appropriate language-specific CLI:
cliRunner(args) from @uipath/coded-functions-js-cli — bundled into dist/tool.js, called in-processuipath <args> (resolved from the codedagents-tool cache or PATH)Studio Web publish (JS/TS)
→ FunctionsTool.buildAsync() ← packager-tool-functions (browser packager)
→ buildFunctionsPackage() ← shared library in @uipath/coded-functions-js-packager
Studio Web publish (Python) ← TODO: not yet implemented
→ FunctionsTool.buildAsync() ← returns error; Python Functions team to implement
(see feat/functions-packager-wrapper)
CLI: uip functions pack (JS/TS)
→ cliRunner(["pack"]) ← @uipath/coded-functions-js-cli (bundled into dist/tool.js)
→ buildFunctionsPackage() ← same shared library, called in-process
CLI: uip functions pack (Python)
→ uipath pack ← Python CLI subprocess, entirely separate
uip functions <verb>
cli.ts:buildProgram()
discoverTools() → loads dist/tool.js via dynamic import
program.command("functions") → registerCommands(sub-program)
"setup" (hidden) → registerSetupCommand (runs natively, JS/TS only)
verifies Node ≥20 + tsx; does NOT install uipath-functions
anything else → command:* handler → runPassthrough(args)
init/new: ensureSetup() first (Node ≥20 + tsx, idempotent)
detectLanguage(cwd)
uipath.json functions map → JS or Python
fallback: package.json → JS, pyproject.toml → Python
unknown (fresh dir) → peek --language flag, default JS
JS/TS → cliRunner(args) from bundled @uipath/coded-functions-js-cli ← in-process
Python → spawn(uipath, args, { stdio: "inherit" })
process.exit(child exit code)
| Signal | Result |
|---|---|
uipath.json functions map extension .ts/.js | javascript |
uipath.json functions map extension .py | python |
package.json present | javascript (fallback) |
pyproject.toml present | python (fallback) |
| Neither (fresh directory) | peek --language arg; default javascript |
| Command | JS/TS → uipath-functions (in-process) | Python → uipath (spawn) |
|---|---|---|
uip functions new | new --name <n> [--empty] — scaffold project | uipath new <n> --type function — scaffold in-place |
uip functions init | ❌ not supported — use new --empty | uipath init — discover entrypoints, write entry-points.json etc. |
uip functions serve | serve — hot-reload server | (no equivalent — use run) |
uip functions run <name> | run <name> — call local HTTP server | uipath run <entrypoint> — execute directly |
uip functions pack | pack | uipath pack |
uip functions publish | publish | uipath publish |
uip functions push | push — sync to Studio Web | uipath push — sync to Studio Web |
Why
initis Python-only: Python'spackandpushare dumb readers — they requireentry-points.json/bindings.json/project.uiprojto already exist and will hard-fail otherwise.uipath initdoes the code introspection step that generates these files. JS/TSpackandpushintrospect inline viatsx, so no separate init step is needed.
Arg translation for Python:
--language/-lis dropped before forwarding (Python CLI has no such flag).--name <n>is converted to a positional argument (uipath new <n>).
uip functions setupis hidden from help. JS/TS-only — verifies Node.js ≥20 and tsx. Called automatically beforenewis forwarded. Callable manually for repair:uip functions setup [--force]
# ── JS/TS project ────────────────────────────────────────────────────────────
uip functions new --name my-fn --language ts # scaffold + hello world; npm install runs automatically
uip functions new --name my-fn --empty # scaffold empty project (no sample function)
cd my-fn
uip functions serve # hot-reload server on :7070
uip functions run hello --input '{"x":1}' # invoke against local server
uip functions push # sync to Studio Web
uip functions pack && uip functions publish # deploy to Orchestrator
# ── Python project ───────────────────────────────────────────────────────────
# Prereq: uipath CLI installed (pip install uipath)
uip functions new --name my-fn --language py # scaffold in current directory + sample function
uip functions init # introspect code → entry-points.json, bindings.json, project.uiproj
# (required before pack/push; re-run whenever function signatures change)
uip functions run main '{"message":"hi"}' # run function directly (no server needed)
uip functions push # sync to Studio Web
uip functions pack && uip functions publish # deploy to Orchestrator
# ── After first command, --language is never needed again ────────────────────
# uipath.json is created with .ts/.py entries; detectLanguage reads it automatically
uip functions pack
uip functions publish
uip functions push
uip functions new| Flag | Description | Applies to |
|---|---|---|
--name <name> | Project name / directory (default: my-functions) | JS/TS |
--language <lang> | ts (default), js, py, or python | both |
--empty | Skip hello world — create an empty project | JS/TS |
--languageis a router flag consumed byfunctions-tool. It is never forwarded to either CLI.--nameis forwarded touipath-functionsas--name <n>(JS/TS) or as a positional arg touipath new <n>(Python).--emptyis forwarded touipath-functions new --empty. Has no effect for Python (Pythonnewdoes not support it).
uip functions init (Python only)No flags — forwards directly to uipath init. For JS/TS projects this command exits with an error and suggests uip functions new --empty.
uip functions serve (JS/TS only)| Flag | Description |
|---|---|
--runtime <runtime> | node (default) or deno |
--port <port> | Port to listen on (default: 7070) |
uip functions run <name>| Flag | Description | Applies to |
|---|---|---|
--port <port> | Port the local server is on (default: 7070) | JS/TS |
--input <json> | JSON input payload (default: {}) | JS/TS |
positional <input> | JSON input string | Python (uipath run <entrypoint> '<json>') |
uip functions pack| Flag | Description | Applies to |
|---|---|---|
--nolock | Exclude lock file from the package | JS/TS |
uip functions publish| Flag | Description | Applies to |
|---|---|---|
--url <url> | UiPath platform URL (or UIPATH_URL env) | JS/TS |
--org <org> | Organization name (or UIPATH_ORGANIZATION_NAME env) | JS/TS |
--tenant <tenant> | Tenant name (or UIPATH_TENANT_NAME env) | JS/TS |
--token <token> | Access token (or UIPATH_ACCESS_TOKEN env) | JS/TS |
--feed-id <id> | Feed ID — skips the interactive picker (CI use) | JS/TS |
For Python, credentials are managed by the
uipathPython CLI independently (via its own auth flow). The--url/--org/--tenant/--tokenflags are not forwarded to Python; runuipath auth loginbefore using push/publish with Python projects.
uip functions push| Flag | Description | Applies to |
|---|---|---|
--url <url> | UiPath platform URL (or UIPATH_URL env) | JS/TS |
--project-id <id> | Studio Web project ID — mandatory (or UIPATH_PROJECT_ID env) | JS/TS |
--org <org> | Organization name (or UIPATH_ORGANIZATION_NAME env) | JS/TS |
--tenant <tenant> | Tenant name (or UIPATH_TENANT_NAME env) | JS/TS |
--token <token> | Access token (or UIPATH_ACCESS_TOKEN env) | JS/TS |
For Python, credentials are managed by the
uipathPython CLI independently — the--url/--org/--tenant/--token/--project-idflags are not forwarded. Runuipath auth loginbefore using push with Python projects.
uip functions new --language py scaffolds an agent instead of a function when uipath-langchain is installed. Tracked in uipath-python#1543.| File | Contents |
|---|---|
~/.uipcli/.functions-tool-cache.json | Cached Node.js path + version (written by ensureSetup) |
~/.uipcli/.codedagents-tool-cache.json | Read to resolve Python uipath binary path |
FAQs
UiPath CLI tool for JS/TS and Python Functions — thin passthrough to uipath-functions / uipath
We found that @uipath/functions-tool demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 24 open source maintainers collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.