Commit History
-
fix: pre-release audit round 12 — 33 bugs fixed across all tiers
Tier 1 (ship-blockers): - README/verifier layer count corrected to 7-layer/10-point - SQL keyword regex now strips quoted strings before checking - validate_citations counts unique sources, extracts from body only - Provider-specific error messages for all 3 LLM backends - Missing config error handling in ingest.py entry point Tier 2 (quality): - SQL injection: alphanumeric validation on interpolated values - LIKE wildcard escaping with ESCAPE clause - Fallback builds fresh keyword query instead of re-running failed SQL - NaN/NaT/inf filtering across all tabular readers - Merged docx table cells deduplicated via element identity - .env double-escaping fix in setup wizard - Verification LLM exceptions skip correction instead of triggering it - References check handles SQL and web sources - Dead pre-loop validate_citations removed - KB meta extension detection uses Path.suffix - QU prompt omits SQL fields when no schema available - Redundant collection.count() eliminated - Row padding f…fbd18c8
-
feat: brief KB overview for system prompt + original query cross-check
- System prompt now uses a concise 3-5 sentence KB overview instead of the full detailed listing, saving tokens for actual context - QU prompt still gets the full detailed overview for routing decisions - Response LLM now sees the original raw input alongside the reformulated display_query so it can cross-check intent if QU misunderstood Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>c23d859 -
feat: LLM-generated welcome summary for knowledge base contents
Replace raw KB overview on welcome page with a concise, friendly LLM-generated summary that highlights available topics, data volume, and suggests example questions. Falls back to truncated raw text if LLM call fails. Web UI caches summary in session state. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>7e9f52f -
fix: Round 8 audit — 15 bugs fixed across 10 files (1 CRITICAL, 7 HIGH, 3 MEDIUM, 4 LOW)
Security fixes: - CRITICAL: execute comment-stripped SQL query (not original) to prevent injection bypass - HIGH: iterative comment stripping to handle nested comment attacks - HIGH: expand dangerous SQL keyword blocklist from 11 to 23 entries - HIGH: data loss prevention — deferred clear only on first successful embed Robustness fixes: - HIGH: parse_verification_result(None) crash guard - HIGH: try/except on all verification loop generate() calls - HIGH: empty rows guard in Excel reader - MEDIUM: strict boolean normalization for verification pass/fail - MEDIUM: R-style "na" added to null string detection - MEDIUM: broad exception handling for Gemini API errors Minor fixes: - LOW: distinct error message for empty LLM response vs no sources - LOW: bounds check on setup wizard model selection - LOW: route/sql_query keys in CLI and web fallback dicts - LOW: SQL fallback extended to route="both" Cross-checked by 2 verification agents — all fixes confirmed correct. 165/165 tests passing,…9093d8f -
fix: 10 bugs (4 HIGH + 6 MEDIUM) from comprehensive codebase audit
HIGH fixes: - H1: Gemini blocked-response detection in verifier (safety filter short-circuit) - H2: Config load crash guard in app_web.py (st.stop instead of traceback) - H3: Brace-escape user text in kb_meta.py prompts (prevent KeyError) - H4: Web UI clarification state tracking (pending_clarification_question) MEDIUM fixes: - M1: Preserve leading zeros as TEXT in sql_ingest type inference - M2: Deferred clearing in ingest.py prevents data loss on total failure - M3: Strip markdown fences from LLM-generated SQL in sql_retriever - M4: max_iterations=0 guard in verifier (skip verification, do not refuse) - M5: Add clarification QA to conversation history for pronoun resolution - M6: Remove hardcoded knowledge_base/ prefix in retriever source paths Also adds CLAUDE.md, docs/plans/, full test suite (162 tests, 17 files), and updates WORKLOG.md with audit results. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>1330e5c
-
fix: harden source display, subdirectory paths, and chunk ID uniqueness
- app_cli: _format_sources now includes SQL results in /sources output - ingest: source_name uses full relative path (preserves subdirectories) - ingest: chunk IDs use full path prefix to prevent collisions - kb_meta: import _escape_braces from prompts instead of duplicating Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>01b9f34 -
docs: update README with KB self-awareness section and fix missing connection note
- Add "KB Self-Awareness: The Meta Overview" section explaining how the chatbot knows what it knows and can answer meta-questions - Update "What This Does", "How It Works", key design principles, and Advantages to highlight KB awareness as a core capability - Add connection note to deterministic fallback overview for multi-dataset KBs (was specified in design but missing from implementation) - Add test assertion for connection note Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>864852c -
feat: add KB meta overview for meta-question answering and LLM awareness
Generate an LLM-powered high-level summary of the knowledge base at ingestion time. The overview is stored as a ChromaDB chunk (enabling vector search for meta-questions like "what data do you have?") and injected into QU and system prompts (giving the LLM full KB awareness for routing and contextualized answers). New: src/kb_meta.py, tests/test_kb_meta.py (20 tests) Modified: ingest.py, prompts.py, query_engine.py, verifier.py Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>8f35c1b