Skip to content

Conversation

@infoshoc
Copy link
Contributor

@infoshoc infoshoc commented Jan 29, 2026

This is required to support priority queue for @naed90 and other "demos" PR409


Note

Medium Risk
Adds a new queryParams option that alters the realtime WebRTC/WebSocket connection URL, which could affect connectivity if parameters are malformed or unexpected. Scope is limited to SDK option plumbing and URL construction.

Overview
Adds support for passing arbitrary queryParams through createDecartClient into the realtime client.

Realtime connection URL generation now builds the WebRTC/WebSocket query string via URLSearchParams, always including api_key and model and appending any provided queryParams.

Written by Cursor Bugbot for commit 8f77f55. This will update automatically on new commits. Configure here.

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

baseUrl: z.url().optional(),
proxy: proxySchema.optional(),
integration: z.string().optional(),
queryParams: z.any().optional(),
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Zod schema uses z.any() instead of typed record

Medium Severity

The Zod schema uses z.any() for queryParams but the TypeScript type declares it as Record<string, string>. This validation gap means the schema accepts values that don't match the expected type (e.g., nested objects, numbers, arrays). When spread into URLSearchParams, non-string values will be coerced via .toString(), causing objects to become [object Object] in the URL. The schema could use z.record(z.string(), z.string()).optional() to match the type.

Fix in Cursor Fix in Web

api_key: apiKey,
model: options.model.name,
...(queryParams || {}),
});
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Query params can override reserved URL parameters

Medium Severity

The queryParams spread happens after api_key and model in the object passed to URLSearchParams. In JavaScript object spread, later properties override earlier ones. If queryParams contains api_key or model keys, they will silently replace the SDK-configured values, potentially causing authentication failures or model mismatches where the URL path uses one model but the query parameter specifies another.

Fix in Cursor Fix in Web

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant