From 0d6fc33c00025211a3ac2842717f5aeb4447bfca Mon Sep 17 00:00:00 2001 From: David Soff Date: Tue, 2 Jun 2026 18:28:32 +0200 Subject: [PATCH] fix(context_enhancer): refactor embed_query_sparse to use stdin (#4) fix(context_enhancer): refactor embed_query_sparse to use stdin instead of f-string interpolation - Eliminates shlex.quote() crash with apostrophes (SyntaxError in subprocess) - Eliminates user text interpolation into Python code string - Hardcodes BM25 model name (was already hardcoded module-level) - Corrects FastEmbed API usage: model.embed([query]) instead of model.embed(string) --- scripts/context_enhancer.py | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/scripts/context_enhancer.py b/scripts/context_enhancer.py index ef6303c..5d9ae5a 100755 --- a/scripts/context_enhancer.py +++ b/scripts/context_enhancer.py @@ -167,22 +167,21 @@ def embed_query(text: str) -> Optional[List[float]]: def embed_query_sparse(text: str) -> Optional[Tuple[List[int], List[float]]]: """ Generate sparse BM25 embedding via FastEmbed (subprocess in ai-lab venv). + Query text passes via stdin — never embedded in a -c code string. Fail-open: if it fails, return None. Caller falls back to dense-only. """ try: - # Shell-quote the text to prevent injection in Python -c - import shlex - safe_text = shlex.quote(text) result = subprocess.run( - [_FASTEMBED_PYTHON, "-c", f"""\ -import os, sys + [_FASTEMBED_PYTHON, "-c", """\ +import os, sys, json sys.path.insert(0, os.environ["FASTEMBED_SITEPKGS"]) from fastembed.sparse import SparseTextEmbedding -import json -model = SparseTextEmbedding(model_name=\\"{BM25_MODEL}\\") -sparse = list(model.embed({safe_text}))[0] -print(json.dumps({{\\"indices\\": sparse.indices.tolist(), \\"values\\": sparse.values.tolist()}})) +query = sys.stdin.read() +model = SparseTextEmbedding(model_name="Qdrant/bm25") +sparse = list(model.embed([query]))[0] +print(json.dumps({"indices": sparse.indices.tolist(), "values": sparse.values.tolist()})) """], + input=text, capture_output=True, text=True, timeout=15 ) data = json.loads(result.stdout.strip())