Allow to propagate query params to sdk#74
Allow to propagate query params to sdk#74infoshoc wants to merge 1 commit intolucy-demo-branch-DONT-mergefrom
Conversation
| baseUrl: z.url().optional(), | ||
| proxy: proxySchema.optional(), | ||
| integration: z.string().optional(), | ||
| queryParams: z.any().optional(), |
There was a problem hiding this comment.
Zod schema uses z.any() instead of typed record
Medium Severity
The Zod schema uses z.any() for queryParams but the TypeScript type declares it as Record<string, string>. This validation gap means the schema accepts values that don't match the expected type (e.g., nested objects, numbers, arrays). When spread into URLSearchParams, non-string values will be coerced via .toString(), causing objects to become [object Object] in the URL. The schema could use z.record(z.string(), z.string()).optional() to match the type.
| api_key: apiKey, | ||
| model: options.model.name, | ||
| ...(queryParams || {}), | ||
| }); |
There was a problem hiding this comment.
Query params can override reserved URL parameters
Medium Severity
The queryParams spread happens after api_key and model in the object passed to URLSearchParams. In JavaScript object spread, later properties override earlier ones. If queryParams contains api_key or model keys, they will silently replace the SDK-configured values, potentially causing authentication failures or model mismatches where the URL path uses one model but the query parameter specifies another.


This is required to support priority queue for @naed90 and other "demos" PR409
Note
Medium Risk
Adds a new
queryParamsoption that alters the realtime WebRTC/WebSocket connection URL, which could affect connectivity if parameters are malformed or unexpected. Scope is limited to SDK option plumbing and URL construction.Overview
Adds support for passing arbitrary
queryParamsthroughcreateDecartClientinto the realtime client.Realtime connection URL generation now builds the WebRTC/WebSocket query string via
URLSearchParams, always includingapi_keyandmodeland appending any providedqueryParams.Written by Cursor Bugbot for commit 8f77f55. This will update automatically on new commits. Configure here.