Skip to content

BossTermMcpConfig.toolNamePrefix is unvalidated — a prefix with a space kills the whole session #351

Description

@kshivang

Raised repeatedly during #349 and deliberately left out of scope there.

toolNamePrefix is concatenated straight onto every built-in tool name (BossTermMcpServer.toolName()). OpenAI function names must match ^[a-zA-Z0-9_-]{1,64}$, and an illegal name does not fail as one broken tool — the whole session.update is rejected, every tool disappears, and the call dies. So an embedder setting toolNamePrefix = "boss console_" (or anything with a space, slash, or dot) silently loses Boss Calling entirely, with the cause buried in a Realtime error field.

#349 added a legalName() filter, but it only guards the path where a voiceToolSource is present — it filters the assembled array at merge time. The standalone path still has the gap, and standalone is the configuration where the prefix is least likely to have been exercised.

The validation belongs with the config that accepts the value, not with the voice merge that happens to notice it downstream: reject an illegal toolNamePrefix at BossTermMcpConfig construction, so an embedder finds out at wiring time rather than when a user tries to make a call.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions