When the LLM generates a <tool_call> block followed by a self-generated
<tool_result> block in the same response, the fake result must be stripped
before appending to message history. The real tool result will be injected
separately by the system.
This fixes a React Hallucination bug where models could fabricate tool
results that didn't actually come from tool invocations.
The API retrieval layer hardcoded reddit as the default platform in 11+ locations. When a Twitter-only simulation was run, all data retrieval APIs silently returned empty results because they looked for reddit_simulation.db which did not exist. This commit reads the simulation enable_twitter/enable_reddit config to determine the correct default platform.
Fixes#150
fetch_all_nodes already had a max_items guard (default 2000) but
fetch_all_edges had no such safeguard, allowing unbounded memory growth
on graphs with large numbers of edges.
Add _MAX_EDGES = 5000 constant and mirror the same loop-guard pattern
from fetch_all_nodes: cap the result list, emit a warning log, and
break pagination once the limit is reached.
Upgrade the transitive Python dependency NLTK from 3.9.2 to 3.10.0 to address CVE-2025-14009. The contributor title said 3.9.3, but the reviewed lockfile resolves 3.10.0.
- Add return type annotation (list[str]) to Config.validate()
- Add type annotations (msg: str, -> None) to logger convenience functions
- Add FileParser.is_supported() classmethod for checking file format support
DEBUG defaults to True (FLASK_DEBUG env var is 'True' unless overridden) and the server binds to 0.0.0.0. When debug mode is active, Flask enables the Werkzeug interactive debugger, which allows arbitrary Python code execution via the browser-accessible debugger console if an exception is triggered. Combined with the public bind address this creates a remote code execution vector on any deployment that forgets to set FLASK_DEBUG=False.
Affected files: config.py
Signed-off-by: ChinhLee <76194645+chinhkrb113@users.noreply.github.com>
Background threads (graph building, simulation prep, report generation,
profile generation) now inherit the requesting user's locale preference.
Previously these fell back to 'zh' because Flask request context was
unavailable in spawned threads.
Ensure poster_type stays PascalCase English and stance stays English enum
values regardless of language setting. Only natural language fields follow
the user's language preference.
The language instruction was causing LLM to change entity/relation naming
conventions. Now explicitly enforce PascalCase/UPPER_SNAKE_CASE for technical
identifiers while only applying language preference to description fields.
TaskManager.list_tasks() already returns a list of dicts (it calls
t.to_dict() internally at task.py:170). The endpoint then called
.to_dict() again on these plain dicts, raising AttributeError on
every request to GET /api/graph/tasks.
666ghj
IagoMelo01
MiroFish Contributor
karesansui
harshitanand
orbisai0security
lllopic
Sami Rusani
ChinhLee
ghostubborn
warren618