Spaces:
Paused
Paused
Commit History
-
feat: switch to stable workhorse models (gpt-4.1, sonnet-4-6, gemini-2.5-flash)
- OpenAI: gpt-4.1 (default), gpt-4.1-mini, gpt-4.1-nano - Anthropic: claude-sonnet-4-6 (default), claude-haiku-4-5, claude-opus-4-6 - Gemini: gemini-2.5-flash (default), gemini-2.5-pro, gemini-2.0-flash - GPT-5/reasoning restricted-param handling preserved for manual config - README config example updated to match Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>6d5b557
-
fix: handle GPT-5 restricted parameters (no temperature, developer role)
GPT-5 models do not support custom temperature or the system role, similar to reasoning models. Unified detection via _is_restricted_model() for all models requiring max_completion_tokens and developer role. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>05c53af -
fix: use max_completion_tokens for GPT-5 (replaces deprecated max_tokens)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>549355f -
feat: upgrade to GPT-5 series, increase default max_tokens to 8192
- OpenAI models: gpt-5 and gpt-5-mini only (removed GPT-4 series) - Default max_tokens raised from 2048 to 8192 across all providers - Added o4-mini to reasoning model detection - Updated setup wizard fallback lists and defaults Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>68a6539 -
fix: Round 14 — 28 Tier 1 + Tier 2 bugs fixed across 17 source files
Anti-hallucination integrity (T1): - #100: Detect verification LLM system failure (all calls fail → refuse) - #101: Fix validate_citations SQL/web source matching (dead code → working) - #102: Citation count uses chunks (citable units) not unique files - #103: Clamp max_iterations to min 1 (can't bypass via iterations=0) Pre-release quality (T2 HIGH): - #104: Add LIKE ESCAPE in all SQL fallback paths - #105: Gemini safety block returns "" (was bypassing stack) - #106: Cap reasoning model budget at 128000 - #107: Handle non-numeric temperature/max_tokens gracefully - #108: Fix clarification history duplication Pre-release quality (T2 MEDIUM): - #109: Anthropic temperature clamp to 1.0 - #110: SQL query 10-second timeout via progress handler - #111: Rich markup escape for user/LLM content - #112: All 6 readers wrapped in try/except (corrupt files don't abort) - #113: Collection cache invalidation after re-ingestion - #114: Web UI message history capped at 200 - #115: Setup wizard confi…f95cdb7 -
fix: pre-release audit round 12 — 33 bugs fixed across all tiers
Tier 1 (ship-blockers): - README/verifier layer count corrected to 7-layer/10-point - SQL keyword regex now strips quoted strings before checking - validate_citations counts unique sources, extracts from body only - Provider-specific error messages for all 3 LLM backends - Missing config error handling in ingest.py entry point Tier 2 (quality): - SQL injection: alphanumeric validation on interpolated values - LIKE wildcard escaping with ESCAPE clause - Fallback builds fresh keyword query instead of re-running failed SQL - NaN/NaT/inf filtering across all tabular readers - Merged docx table cells deduplicated via element identity - .env double-escaping fix in setup wizard - Verification LLM exceptions skip correction instead of triggering it - References check handles SQL and web sources - Dead pre-loop validate_citations removed - KB meta extension detection uses Path.suffix - QU prompt omits SQL fields when no schema available - Redundant collection.count() eliminated - Row padding f…fbd18c8
-
fix: curated model lists, reasoning model token scaling, skip temp files
- Restrict each provider to 3 supported models instead of fetching all from API (OpenAI: gpt-4.1/4o/4o-mini, Anthropic: sonnet/opus/haiku, Gemini: 2.5-pro/2.5-flash/2.0-flash) - Scale up max_completion_tokens 4x for OpenAI reasoning models (o1/o3/o4) since reasoning tokens count against the budget - Skip ~$ temp Excel files during ingestion - Log LLM errors in codebook description generation for debugging Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>112b4f4 -
fix: pre-release audit round 9 — anti-hallucination hardening + error handling
CRITICAL: Correction prompt now includes previous response for targeted fixing instead of blind regeneration (AH-06). HIGH fixes: - Add deterministic citation audit Layer 4.5 (AH-12) - Strengthen verification to 10-point checklist with exact-evidence requirement (AH-07) - Warn when verification disabled or max_iterations=0 (AH-08) - Fix Gemini NameError crash in ValueError handler (ERR-1) - Add error handling to OpenAI/Anthropic with sanitized messages (ERR-2) - Clear stale data when knowledge_base/ is empty (BUG-P1) MEDIUM fixes: - Sanitize Gemini exception messages to prevent API key leaks (SEC-1) - Add config.yaml to .gitignore (SEC-2) - Detect Gemini error strings in verifier guard - Recompute citation warnings each verification iteration 174/174 tests passing. Bug fix log updated. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>91410f8 -
fix: Round 8 audit — 15 bugs fixed across 10 files (1 CRITICAL, 7 HIGH, 3 MEDIUM, 4 LOW)
Security fixes: - CRITICAL: execute comment-stripped SQL query (not original) to prevent injection bypass - HIGH: iterative comment stripping to handle nested comment attacks - HIGH: expand dangerous SQL keyword blocklist from 11 to 23 entries - HIGH: data loss prevention — deferred clear only on first successful embed Robustness fixes: - HIGH: parse_verification_result(None) crash guard - HIGH: try/except on all verification loop generate() calls - HIGH: empty rows guard in Excel reader - MEDIUM: strict boolean normalization for verification pass/fail - MEDIUM: R-style "na" added to null string detection - MEDIUM: broad exception handling for Gemini API errors Minor fixes: - LOW: distinct error message for empty LLM response vs no sources - LOW: bounds check on setup wizard model selection - LOW: route/sql_query keys in CLI and web fallback dicts - LOW: SQL fallback extended to route="both" Cross-checked by 2 verification agents — all fixes confirmed correct. 165/165 tests passing,…9093d8f -
fix: 6-agent debug audit — 8 bugs fixed across codebase
Multi-agent systematic audit found and fixed: HIGH: - Empty model="" overrode provider defaults, causing API errors when no model configured (llm/__init__.py + all 3 providers) - Vector-to-SQL fallback was dead code — QU layer now preserves sql_query regardless of route, and prompt asks LLM to generate fallback sql_query - SQL validation strengthened with keyword blocklist (INSERT, DELETE, DROP, ALTER, CREATE, ATTACH, DETACH, PRAGMA, LOAD_EXTENSION) — first layer of two-layer SQL injection defense MEDIUM: - Verification prompt no longer leaks internal chunk ID naming (CHUNK-LOCAL, CHUNK-SQL) into correction loop — uses user-facing language instead - config_loader now gives friendly FileNotFoundError directing user to run setup.py, instead of raw traceback - config.yaml opened with explicit encoding="utf-8" for cross-platform safety - OpenAI model filter narrowed from startswith("o") to startswith("o1","o3","o4") 153 tests pass (152 existing + 1 new SQL validation test). …106354e
-
fix: harden codebase against format injection, empty responses, and unsafe config access
- Add _escape_braces() to all prompt builders to prevent str.format() crash when user documents contain {placeholder} patterns - Fix app_web.py display_query fallback to preserve clarification context - Add empty-response guards to all 3 LLM providers (openai, anthropic, gemini) - Replace all remaining direct dict access with .get() + defaults - Add 2 regression tests for curly-brace format injection - Expand query engine tests with display_query coverage - 62 tests pass across 13 test files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>9815e49 -
Initial commit: RAG Research Chatbot Template
Citation-verified research assistant with 6-layer anti-hallucination stack, 15 file format readers, 3 LLM providers, and dual CLI/Web interfaces. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>0017280