Continues #18929, which could not be reopened. Details at the bottom.
### Summary
`create_commit`'s delete branch writes a column the model does not have.
### Summary
1. The web UI default system prompt template reads "Your answer must be derived **solely** from this dataset: `{knowledge}`", but the reasoning path rendered {knowledge} as an empty string (kws["knowledge"] = "",
mirroring Python's kwargs.setdefault("knowledge", "")). Under some LLMs, the first-turn model read the empty binding as "the dataset is empty" and refused to call the rag tool at all.
2. [ID:Slot 0] — the compose model cited slot-table rows ("Research Summary" lines) as citations. No citation regex matched the form (Slot is non-numeric), so it passed through decoration untouched.
3. [ID:1-3] — the model occasionally compressed consecutive citations into a range. Range markers cannot be resolved to a single source and are not part of the citation format. Fixed at both layers:
- prompts (citation_prompt.md ): citations must be spelled out individually ([ID:1][ID:2][ID:3]); ranges are forbidden.
- decoration: ExpandRangeCitations expands [ID:a-b] (covering space, "~", fullwidth wave and em/en dash variants; a > b swapped) into per-item [ID:n] markers when both ends are within the pool.
Fixes#19356
The file-commit endpoints resolved a dataset or folder id but never
checked that the caller can access it. Any logged-in user could read
another tenant's commit history, diffs, and file contents, pull version
history for any file id, and create commits in a workspace they don't
own. Sibling artifact routes in dataset_api.py apply
KnowledgebaseService.accessible for the same data; these did not.
### Summary
The API docs now describe the optional language field for dataset
creation and updates. They document trimming, validation limits,
defaults, and unchanged update behavior.
Fix GET /api/v1/memories list filters — memory_type, tenant_id, owner_ids, ids now read all repeated query keys (was only first). Matches /datasets//documents pattern.
Add user attribution to embedding calls — forwards user on OpenAI-compatible providers via current_llm_user(). Excludes LocalAI/Xinference (reject unknown fields). Accepts user_id on ingest/parse/chunk endpoints; redacts from logs. Omitted = unchanged. Go/vision/TTS/ASR out of scope.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Fix MCP session cleanup — now properly awaits server task and closes transport contexts/executors before stopping event loop. Wakes queued callers on shutdown.
Fix OAuth callback URL examples in docs — now use /api/v1/auth/oauth/<channel>/callback (was stale /v1/user/oauth/callback).
Co-authored-by: 谢金城 <xiejincheng@xgd.com>
Co-authored-by: Jin Hai <haijin.chn@gmail.com>
MarMar Labs
Ehsan
Öndery
Taranum Wasu
xugangqiang
Yash Raj Pandey
Sbaaoui Idriss
dependabot[bot]
huyua9
Jin Hai
Yingfeng
Harsh Kashyap
Guofang.Tang
Muhammad Zuhaib Zahid
Sourav Rajvi
brucehu
buua436
Lynn
K.P
Harsh Kashyap
euvre
Wang Qi
Gonghan-Princess
Manan Bansal
Lem0nTea2002
maoyifeng
mkaaadandcoderabbitai[bot]