[Bug]:Tool parameter conversion bug

[maojiang]

Passing an object as a tool parameter will definitely result in an error if any field is empty. Unless converted to an empty string or empty array, etc.

[raye-deng]

This bug highlights a common issue with AI agent parameter handling - type mismatches and edge cases that human reviewers would catch but automated code doesn't.

We see this pattern frequently in production: AI agents generate code that passes the happy path but fails on edge cases like empty strings, null values, or unexpected types. The code looks correct (all fields are there), but runtime validation fails because the AI didn't anticipate these edge cases.

For example, we recently saw an AI generate code that called a database query builder with user input. It handled all the expected cases but didn't account for empty arrays or null strings, causing SQL injection vulnerabilities or runtime crashes.

This is exactly the kind of issue that traditional linters and static analysis miss - they validate syntax and types, but not runtime edge cases in AI-generated code.

If you're building AI agents or dealing with AI-generated parameter handling issues, you might want to try: npx @opencodereview/cli scan . --sla L1

It specifically targets AI-native blind spots like parameter validation edge cases, along with hallucinated imports, deprecated APIs, and cross-file inconsistencies.

[lui62233]

Root Cause Analysis \u2014 Tool Parameter Conversion Bug

I looked at the code. Here\u2019s what\u2019s happening.

The Problem

In ToolMethodInvoker.java, the convertSingleParameter method handles two paths:

Path 1 \u2014 Direct assignment (raw types match):
java if (rawType.isAssignableFrom(value.getClass()) && !(paramType instanceof ParameterizedType)) { return value; }

Path 2 \u2014 JSON codec conversion (everything else):
java return JsonUtils.getJsonCodec().convertValue(value, paramType);

The bug is in Path 2. When the input is an empty container (e.g., [], {}) and convertValue is called with a parameterized type, Jackson's convertValue tries to deserialize into that type. But Jackson's default behavior for an empty collection into List or Map<String, Object> doesn\u2019t produce what you\u2019d expect \u2014 it can fail silently or produce
ull elements depending on the exact types involved.

The Fix

In convertSingleParameter, add explicit handling for empty containers before falling through to convertValue:

`java
// Handle empty collections explicitly
if (value instanceof Collection col && col.isEmpty()) { if (type instanceof ParameterizedType pt) { Type[] typeArgs = pt.getActualTypeArguments(); if (typeArgs.length == 1 && typeArgs[0] instanceof Class elementType) {
return Collections.emptyList();
}
}
}

// Handle empty maps
if (value instanceof Map map && map.isEmpty()) {
if (type instanceof ParameterizedType pt) {
Type[] typeArgs = pt.getActualTypeArguments();
if (typeArgs.length == 2) {
return Collections.emptyMap();
}
}
}
`

And in convertFromString, add null-safe handling:
java if (stringValue == null || stringValue.trim().isEmpty()) { return null; }

Why This Specifically

The screenshots show the error happening when the LLM passes an object where some fields are [] or {}. When Jackson tries to convertValue({}, List), it doesn\u2019t auto-create an empty typed list \u2014 it either fails or produces a raw LinkedHashMap. The framework then throws because the result isn\u2019t a List.

This is a pretty common Jackson footgun in strongly-typed conversion layers. The fix is to pre-check for empty collections/maps and return properly-typed empty containers before letting Jackson guess the generic type.

Happy to dig further if you can share the full stack trace!