Fixes#19356
The file-commit endpoints resolved a dataset or folder id but never
checked that the caller can access it. Any logged-in user could read
another tenant's commit history, diffs, and file contents, pull version
history for any file id, and create commits in a workspace they don't
own. Sibling artifact routes in dataset_api.py apply
KnowledgebaseService.accessible for the same data; these did not.
### Summary
The API docs now describe the optional language field for dataset
creation and updates. They document trimming, validation limits,
defaults, and unchanged update behavior.
Fix GET /api/v1/memories list filters — memory_type, tenant_id, owner_ids, ids now read all repeated query keys (was only first). Matches /datasets//documents pattern.
Add user attribution to embedding calls — forwards user on OpenAI-compatible providers via current_llm_user(). Excludes LocalAI/Xinference (reject unknown fields). Accepts user_id on ingest/parse/chunk endpoints; redacts from logs. Omitted = unchanged. Go/vision/TTS/ASR out of scope.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Fix MCP session cleanup — now properly awaits server task and closes transport contexts/executors before stopping event loop. Wakes queued callers on shutdown.
Fix OAuth callback URL examples in docs — now use /api/v1/auth/oauth/<channel>/callback (was stale /v1/user/oauth/callback).
Co-authored-by: 谢金城 <xiejincheng@xgd.com>
Co-authored-by: Jin Hai <haijin.chn@gmail.com>
Fix#19019 — MCP _fetch_all_datasets() used wrong total key (total vs total_datasets), causing extra empty-page requests. Now reads total_datasets with fallback.
Fixes a family of table-retrieval truncation bugs and an action-session
infinite loop in the agentic RAG medium path, all root-caused on a
tabular-reasoning question
1. action_session turn cap enforced (action_session.py)
_route checked _pending_calls before attempts, so a model that kept
emitting tool calls never hit the 4-turn finalize — a single session
could burn the whole pass budget (219 retrievals / 600s observed). Added
_route_after_tool: after a tool batch, the turn budget is checked and
the session converges to finalize instead of looping back to run_action.
2. Table chunks kept whole through retrieval (search.py,
text_processing.py, action_session.py)
Three truncation points hid mid-table answer rows from the session
model:
- grep_search narrowed table chunks to 700 chars
(_GREP_OUT_CHARS_PER_CHUNK)
- _narrow_content only passed HTML tables (<table>/<tr/<td) whole —
markdown pipe tables were sentence-window narrowed
- _admit_evidence truncated the model-facing output to 1200 chars even
though the pool held the full chunk，non-table chunks keep the existing
truncation paths unchanged.
3. SCA sees more evidence (agentic_rag_graph.py, sufficient_context.py)
_SCA_VIEW_CAP 24 → 60; _SCA_CLAIMS_CONTEXT_MAX 9000 → 48000;
table-bearing evidence anchors rendered in full (bounded by the context
budget).
4. Supporting: runtime instrumentation for rounds/slots/retrievals, LLM
token accounting, slot-evidence preservation through SCA, dedup
checkpoints. Timeout/budget constants restored to upstream defaults.
---------
Co-authored-by: Loong <213221738@seu.edu.cn>
Co-authored-by: Hermes Agent <hermes-agent@localhost>
Sbaaoui Idriss
Harsh Kashyap
Guofang.Tang
Muhammad Zuhaib Zahid
Sourav Rajvi
brucehu
Yingfeng
buua436
Lynn
K.P
Harsh Kashyap
euvre
Wang Qi
Gonghan-Princess
MarMar Labs
Manan Bansal
ÖnderyandCursor
Lem0nTea2002
maoyifeng
mkaaadandcoderabbitai[bot]
Yash Raj Pandey
xu jiaming
