- OpenAI models: gpt-5 and gpt-5-mini only (removed GPT-4 series)
- Default max_tokens raised from 2048 to 8192 across all providers
- Added o4-mini to reasoning model detection
- Updated setup wizard fallback lists and defaults
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-agent systematic audit found and fixed:
HIGH:
- Empty model="" overrode provider defaults, causing API errors when no
model configured (llm/__init__.py + all 3 providers)
- Vector-to-SQL fallback was dead code — QU layer now preserves sql_query
regardless of route, and prompt asks LLM to generate fallback sql_query
- SQL validation strengthened with keyword blocklist (INSERT, DELETE, DROP,
ALTER, CREATE, ATTACH, DETACH, PRAGMA, LOAD_EXTENSION) — first layer
of two-layer SQL injection defense
MEDIUM:
- Verification prompt no longer leaks internal chunk ID naming (CHUNK-LOCAL,
CHUNK-SQL) into correction loop — uses user-facing language instead
- config_loader now gives friendly FileNotFoundError directing user to run
setup.py, instead of raw traceback
- config.yaml opened with explicit encoding="utf-8" for cross-platform safety
- OpenAI model filter narrowed from startswith("o") to startswith("o1","o3","o4")
153 tests pass (152 existing + 1 new SQL validation test).
…
fix: harden codebase against format injection, empty responses, and unsafe config access
- Add _escape_braces() to all prompt builders to prevent str.format() crash
when user documents contain {placeholder} patterns
- Fix app_web.py display_query fallback to preserve clarification context
- Add empty-response guards to all 3 LLM providers (openai, anthropic, gemini)
- Replace all remaining direct dict access with .get() + defaults
- Add 2 regression tests for curly-brace format injection
- Expand query engine tests with display_query coverage
- 62 tests pass across 13 test files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix: use .get() for all config access + add CLAUDE.md and docs to repo
- src/ingest.py: replace cfg["paths"]["vector_db"] and
cfg["paths"]["knowledge_base"] with .get() + defaults
- src/llm/__init__.py: replace cfg["llm"]["provider"] and
cfg["llm"].get(...) with safe llm_cfg = cfg.get("llm", {})
- src/search/__init__.py: replace r['authors'], r['title'], etc.
with .get() + defaults in web results formatter
- app_web.py: respect max_clarifications config (was hardcoded to
allow 1 round regardless of config)
- tests/test_setup.py: add missing assertions for retrieval.top_k
and retrieval.max_distance
- Add CLAUDE.md, docs/plans/, docs/WORKLOG.md to the repository
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Citation-verified research assistant with 6-layer anti-hallucination stack,
15 file format readers, 3 LLM providers, and dual CLI/Web interfaces.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
