fix: prevent DEFAULT_PARAMETERS from overriding user-provided values

[spidershield-contrib]

Summary

Fixes #127

The default parameter application loop iterated over searchParams keys and unconditionally replaced matching values from defaults. This caused user-provided values to be silently overwritten by DEFAULT_PARAMETERS.

Changes

File	Change
src/index.ts	Reverse loop direction: iterate defaults keys, only apply when user value is undefined/null

Before / After

Before (buggy):

for (const key in searchParams) {       // iterates user params
  if (key in defaults) {
    searchParams[key] = defaults[key];  // always overwrites
  }
}

After (fixed):

for (const key in defaults) {           // iterates defaults
  if (key in searchParams && (searchParams[key] === undefined || searchParams[key] === null)) {
    searchParams[key] = defaults[key];  // only fills gaps
  }
}

Test Plan

• npx tsc --noEmit — zero errors
• With DEFAULT_PARAMETERS='{"max_results":5}', calling tavily_search(query="test", max_results=10) should return 10 results (not 5)
• With DEFAULT_PARAMETERS='{"search_depth":"basic"}', calling tavily_search(query="test") should use "basic" (default fills the gap)

---

Note

Low Risk
Low risk: changes are localized to tavily_search request parameter merging and should only affect how defaults are applied; main risk is subtle behavior changes for callers relying on old (buggy) overriding behavior.

Overview
Fixes tavily_search parameter merging so DEFAULT_PARAMETERS no longer overwrites explicitly provided user arguments; defaults are now applied only when the user value is undefined/null.

Also normalizes include_domains/exclude_domains so they are never undefined (coalesced to []) to match the Tavily API’s expected array types.

^{Written by Cursor Bugbot for commit b7b2a3a. This will update automatically on new commits. Configure here.}

---

Found by SpiderShield security scanner

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}