{"record":{"id":"4e9d1352892ce8b0","repo":"github/copilot-sdk","slug":"invalid-field-entry-there-is-no-bare-wildc","errorCode":null,"errorMessage":"Invalid ${field} entry '*': there is no bare wildcard. Use one or more of `new ToolSet().addBuiltIn('*')`, `.addMcp('*')`, or `.addCustom('*')` to target a specific source.","messagePattern":"Invalid (.+?) entry '\\*': there is no bare wildcard\\. Use one or more of `new ToolSet\\(\\)\\.addBuiltIn\\('\\*'\\)`, `\\.addMcp\\('\\*'\\)`, or `\\.addCustom\\('\\*'\\)` to target a specific source\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodejs/src/client.ts","lineNumber":319,"sourceCode":"}\n\n/**\n * Catches misuse of `availableTools`/`excludedTools` at the SDK boundary so\n * users get an actionable error rather than a silently-empty filter.\n *\n * The runtime treats a bare `\"*\"` as a literal name match for a tool whose\n * name is the single character `*`, which the runtime's charset guard would\n * reject at registration — so the filter effectively matches nothing. We\n * surface that here as an error pointing the developer at the source-qualified\n * forms produced by {@link ToolSet}.\n */\nfunction validateToolFilterList(field: string, list: string[] | undefined): void {\n    if (!list) {\n        return;\n    }\n    for (const entry of list) {\n        if (entry === \"*\") {\n            throw new Error(\n                `Invalid ${field} entry '*': there is no bare wildcard. ` +\n                    \"Use one or more of `new ToolSet().addBuiltIn('*')`, `.addMcp('*')`, \" +\n                    \"or `.addCustom('*')` to target a specific source.\"\n            );\n        }\n    }\n}\n\n/**\n * Extract transform callbacks from a system message config and prepare the wire payload.\n * Function-valued actions are replaced with `{ action: \"transform\" }` for serialization,\n * and the original callbacks are returned in a separate map.\n */\nfunction extractTransformCallbacks(systemMessage: SessionConfig[\"systemMessage\"]): {\n    wirePayload: SessionConfig[\"systemMessage\"];\n    transformCallbacks: Map<string, SectionTransformFn> | undefined;\n} {\n    if (!systemMessage || systemMessage.mode !== \"customize\" || !systemMessage.sections) {","sourceCodeStart":301,"sourceCodeEnd":337,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/nodejs/src/client.ts#L301-L337","documentation":"CopilotClient.create_session() raises this ValueError when both github_token and github_token_provider arguments are supplied. The two options are alternative ways to supply GitHub credentials - a static token string or a dynamic provider callable/object - and the library cannot honor both at once, so it fails fast at argument-validation time before any session is created.","triggerScenarios":"Calling create_session(...) with both a github_token string and a github_token_provider set (both not None). Also occurs when config objects or wrappers merge credential fields from multiple sources into one call.","commonSituations":"Migrating code from a static token to a provider-based token while leaving the old github_token argument in place; a factory function that forwards optional credential parameters and sets both; examples/tests where env vars supply one option and code supplies the other.","solutions":["Remove one of the two arguments: pass only github_token OR only github_token_provider to create_session.","If you need dynamic token refresh, drop the static github_token and keep github_token_provider.","If a static token is sufficient, drop github_token_provider and keep github_token.","If arguments come from a shared config, assert exactly one of the two is set before calling the API."],"exampleFix":"// before\nawait client.create_session(\n    github_token=os.environ[\"GH_TOKEN\"],\n    github_token_provider=my_provider,\n)\n// after\nawait client.create_session(\n    github_token_provider=my_provider,\n)","handlingStrategy":"validation","validationCode":"if github_token is not None and github_token_provider is not None:\n    raise ValueError(\"Pass either github_token or github_token_provider, not both\")","typeGuard":"def has_conflicting_credentials(kwargs: dict) -> bool:\n    return kwargs.get(\"github_token\") is not None and kwargs.get(\"github_token_provider\") is not None","tryCatchPattern":"try:\n    await client.create_session(...)\nexcept ValueError as e:\n    if \"mutually exclusive\" in str(e):\n        ...  # drop one credential option and retry","preventionTips":["Never pass both github_token and github_token_provider in the same call.","Centralize credential selection in one helper that picks exactly one source.","Review wrappers/helpers that forward credential kwargs blindly."],"tags":["argument-validation","authentication","python"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}