fix: don't mutate caller's fmtOptions when hiddenFields is passed

[CedricConday]

Problem

When a request is made with both fmtOptions and hiddenFields, the request builders assign the caller's fmtOptions object to queryParams.fmt_options by reference and then write hidden_fields onto it:

if (fmtOptions) {
  queryParams.fmt_options = fmtOptions;          // same reference as the caller's object
}
if (hiddenFields) {
  if (queryParams.fmt_options) {
    queryParams.fmt_options.hidden_fields = hiddenFields;   // <-- mutates the caller's object
  }
}

So calling e.g. getAutocompleteResults mutates the object the caller passed in. Reusing the same fmtOptions object across calls silently accumulates a hidden_fields key.

Reproduction

const fmtOptions = { fields: ['id', 'name'] };
client.autocomplete.getAutocompleteResults('shoes', { fmtOptions, hiddenFields: ['price', 'stock'] });
console.log(fmtOptions);
// { fields: ['id','name'], hidden_fields: ['price','stock'] }  ← caller's object was mutated

Fix

Shallow-copy fmtOptions on assignment so the serialized request is identical while the caller's input is left intact:

queryParams.fmt_options = { ...fmtOptions };

Applied to the five modules that exhibit the mutation: autocomplete, search, browse, recommendations, quizzes. agent.js assigns by reference too but never writes to it, so it is unaffected and left unchanged.

Tests

Adds spec/src/modules/fmtOptions-immutability.js — an offline regression spec (stubbed fetch, no API key/network) asserting the caller's fmtOptions is not mutated across all five modules. Verified it fails on the current code and passes with the fix. eslint clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DbUHs855FyBt2J7cG2Qmhh

[Copilot]

Pull request overview

Fixes an API-footgun where passing both fmtOptions and hiddenFields caused request builders to mutate the caller’s fmtOptions object, by shallow-copying fmtOptions before adding hidden_fields. Adds a regression spec to ensure fmtOptions remains immutable across the affected modules.

Changes:

• Shallow-copy fmtOptions into queryParams.fmt_options to prevent caller object mutation when hiddenFields (and related fmt mutations) are applied.
• Apply the fix across autocomplete, search, browse, recommendations, and quizzes modules.
• Add an offline regression spec covering all five modules.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/modules/search.js	Copy fmtOptions before adding hidden_fields / fmt mutations to avoid mutating caller input.
src/modules/recommendations.js	Copy fmtOptions before adding hidden_fields.
src/modules/quizzes.js	Copy fmtOptions before adding hidden_fields.
src/modules/browse.js	Copy fmtOptions before adding hidden_fields / fmt mutations.
src/modules/autocomplete.js	Copy fmtOptions before adding hidden_fields.
spec/src/modules/fmtOptions-immutability.js	Adds regression coverage ensuring fmtOptions is not mutated by calls across modules.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[CedricConday]

Checking back in — still current against master.

src/modules/autocomplete.js:97 assigns the caller's fmtOptions to queryParams.fmt_options by reference, then line 103 writes hidden_fields onto it, so the object the caller passed in is mutated. The same pattern is in browse.js, quizzes.js, recommendations.js and search.js, which is why the fix touches all five.

One thing worth flagging: no CI has ever run on this PR, so the checks list is empty rather than green. I think that needs a maintainer to approve the workflow for a fork. Happy to rebase if that helps kick it off.