@wentorai/research-plugins 1.4.0 → 1.4.3

package/src/tools/orcid.ts

@@ -72,6 +72,9 @@ export function createOrcidTools(
         }),
       }),
       execute: async (input: { orcid: string }) => {
+        if (!input?.orcid) {
+          return toolResult({ error: 'orcid parameter is required (e.g., "0000-0002-1825-0097")' });
+        }
         const orcid = input.orcid.replace(/^https?:\/\/orcid\.org\//, "");
 
         const result = await trackedFetch(

package/src/tools/osf-preprints.ts

@@ -1,6 +1,6 @@
 import { Type } from "@sinclair/typebox";
 import type { OpenClawPluginApi, OpenClawPluginToolContext } from "openclaw/plugin-sdk";
-import { toolResult, trackedFetch, isTrackedError } from "./util.js";
+import { toolResult, trackedFetch, isTrackedError, validParam } from "./util.js";
 
 const BASE = "https://api.osf.io/v2";
 
@@ -36,7 +36,8 @@ export function createOsfPreprintsTools(
         const params = new URLSearchParams({
           "page[size]": String(Math.min(input.size ?? 10, 100)),
         });
-        if (input.provider) params.set("filter[provider]", input.provider);
+        const provider = validParam(input.provider);
+        if (provider) params.set("filter[provider]", provider);
         if (input.page) params.set("page", String(input.page));
 
         const result = await trackedFetch(

package/src/tools/pubmed.ts

@@ -1,6 +1,6 @@
 import { Type } from "@sinclair/typebox";
 import type { OpenClawPluginApi, OpenClawPluginToolContext } from "openclaw/plugin-sdk";
-import { toolResult, trackedFetch, isTrackedError } from "./util.js";
+import { toolResult, trackedFetch, isTrackedError, validParam, validEnum } from "./util.js";
 
 const EUTILS = "https://eutils.ncbi.nlm.nih.gov/entrez/eutils";
 
@@ -41,17 +41,21 @@ export function createPubMedTools(
         min_date?: string;
         max_date?: string;
       }) => {
+        const sort = validEnum(input.sort, ["relevance", "pub_date"] as const, "relevance");
+        const minDate = validParam(input.min_date);
+        const maxDate = validParam(input.max_date);
+
         const searchParams = new URLSearchParams({
           db: "pubmed",
           term: input.query,
           retmax: String(Math.min(input.max_results ?? 10, 100)),
           retmode: "json",
-          sort: input.sort ?? "relevance",
+          sort,
           usehistory: "y",
         });
-        if (input.min_date) searchParams.set("mindate", input.min_date);
-        if (input.max_date) searchParams.set("maxdate", input.max_date);
-        if (input.min_date || input.max_date) searchParams.set("datetype", "pdat");
+        if (minDate) searchParams.set("mindate", minDate);
+        if (maxDate) searchParams.set("maxdate", maxDate);
+        if (minDate || maxDate) searchParams.set("datetype", "pdat");
 
         const searchTracked = await trackedFetch("pubmed", `${EUTILS}/esearch.fcgi?${searchParams}`);
         if (isTrackedError(searchTracked)) return searchTracked;
@@ -109,6 +113,9 @@ export function createPubMedTools(
         pmid: Type.String({ description: "PubMed ID (numeric string)" }),
       }),
       execute: async (input: { pmid: string }) => {
+        if (!input?.pmid) {
+          return toolResult({ error: 'pmid parameter is required (numeric PubMed ID, e.g., "33116299")' });
+        }
         const params = new URLSearchParams({
           db: "pubmed",
           id: input.pmid,

package/src/tools/unpaywall.ts

@@ -22,6 +22,9 @@ export function createUnpaywallTools(
         }),
       }),
       execute: async (input: { doi: string }) => {
+        if (!input?.doi) {
+          return toolResult({ error: 'doi parameter is required (e.g., "10.1038/nature12373")' });
+        }
         const doi = input.doi.replace(/^https?:\/\/doi\.org\//, "");
         const tracked = await trackedFetch(
           "unpaywall",

package/src/tools/util.ts

@@ -150,3 +150,36 @@ export function isTrackedError(
 ): result is ReturnType<typeof toolResult> {
   return "content" in result && "details" in result;
 }
+
+// ── LLM Input Sanitization ──────────────────────────────────────────────
+
+const INVALID_PARAM_VALUES = new Set(["undefined", "null", "none", "None", ""]);
+
+/**
+ * Sanitize an optional string parameter from LLM tool calls.
+ *
+ * LLMs (especially weaker models) sometimes pass the literal string "undefined"
+ * or "null" instead of omitting the parameter. The nullish coalescing operator
+ * (`??`) does NOT catch these because they are truthy strings.
+ *
+ * Returns the value if valid, or `undefined` if it's a known non-value.
+ */
+export function validParam(value: string | undefined | null): string | undefined {
+  if (value == null) return undefined;
+  if (INVALID_PARAM_VALUES.has(value.trim())) return undefined;
+  return value;
+}
+
+/**
+ * Validate a string parameter against a whitelist of allowed values.
+ * Returns the value if it matches, or the fallback otherwise.
+ */
+export function validEnum<T extends string>(
+  value: string | undefined | null,
+  allowed: readonly T[],
+  fallback: T,
+): T {
+  const clean = validParam(value);
+  if (clean && (allowed as readonly string[]).includes(clean)) return clean as T;
+  return fallback;
+}

package/src/tools/zenodo.ts

@@ -1,6 +1,6 @@
 import { Type } from "@sinclair/typebox";
 import type { OpenClawPluginApi, OpenClawPluginToolContext } from "openclaw/plugin-sdk";
-import { toolResult, trackedFetch, isTrackedError } from "./util.js";
+import { toolResult, trackedFetch, isTrackedError, validParam } from "./util.js";
 
 const BASE = "https://zenodo.org/api";
 
@@ -48,9 +48,12 @@ export function createZenodoTools(
           q: input.query,
           size: String(Math.min(input.size ?? 10, 100)),
         });
-        if (input.type) params.set("type", input.type);
-        if (input.sort) params.set("sort", input.sort);
-        if (input.access_right) params.set("access_right", input.access_right);
+        const type = validParam(input.type);
+        if (type) params.set("type", type);
+        const sort = validParam(input.sort);
+        if (sort) params.set("sort", sort);
+        const accessRight = validParam(input.access_right);
+        if (accessRight) params.set("access_right", accessRight);
 
         const result = await trackedFetch("zenodo", `${BASE}/records?${params}`, undefined, 10_000);
         if (isTrackedError(result)) return result;
@@ -103,6 +106,9 @@ export function createZenodoTools(
         }),
       }),
       execute: async (input: { record_id: string }) => {
+        if (!input?.record_id) {
+          return toolResult({ error: 'record_id parameter is required (e.g., "1234567")' });
+        }
         const id = input.record_id.replace(/\D/g, "");
         const result = await trackedFetch("zenodo", `${BASE}/records/${id}`, undefined, 10_000);
         if (isTrackedError(result)) return result;