Skip to content

fix(search): escape FTS5 metacharacters in hybrid query path (#366)#376

Merged
wesm merged 1 commit into
kenn-io:mainfrom
fmasi:fix/hybrid-fts5-escape
Jun 10, 2026
Merged

fix(search): escape FTS5 metacharacters in hybrid query path (#366)#376
wesm merged 1 commit into
kenn-io:mainfrom
fmasi:fix/hybrid-fts5-escape

Conversation

@fmasi

@fmasi fmasi commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Fixes #366.

A hybrid search fails with fts5: syntax error near "?" when the query has FTS5 metacharacters in it, like the ? and , in what's the budget, roughly?. The hybrid path passed the raw query straight into the BM25 MATCH. The fts and vector modes don't, so only hybrid hit this.

Hybrid now runs free text through the same sanitizing the fts path uses: quote each term, append a * prefix, and drop punctuation-only terms. An explicit pre-tokenized FTSQuery still passes through untouched. Natural-language questions, which is what most MCP/LLM clients send, are the main thing this unblocks.

…#366)

In --mode hybrid the engine bound the raw FreeText straight into the
fused CTE's `messages_fts MATCH`, so FTS5 metacharacters in a natural-
language query — e.g. the "?" and "," in `what's the budget, roughly?`
— reached the FTS5 parser unescaped and raised "fts5: syntax error
near ...". --mode fts and --mode vector were unaffected (the former
sanitizes via Store.SearchMessages, the latter has no BM25 branch).

FusedRequest.FTSQuery is documented as a pre-tokenized FTS5 MATCH
expression. When the caller supplies no explicit override, derive one
from FreeText the same way the --mode fts path does: split on
whitespace, drop terms the FTS5 tokenizer would discard
(punctuation-only), and quote-escape + prefix-match each via the
existing query.SQLiteQueryDialect.BuildFTSTerm. An all-tokenless query
yields "", which the fused query already treats as "skip BM25"
(vector-only) rather than dispatching a malformed MATCH. An explicit
FTSQuery override still passes through verbatim.

Tests: TestBuildFTSMatch covers the sanitizer directly;
TestEngine_Hybrid_PunctuationQuery reproduces kenn-io#366 end-to-end against
the real sqlitevec backend and asserts the metacharacter query both
succeeds and still matches on its real terms.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@roborev-ci

roborev-ci Bot commented Jun 10, 2026

Copy link
Copy Markdown

roborev: Combined Review (e9fd679)

No issues found.


Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 4m21s), codex_security (codex/security, done, 46s) | Total: 5m7s

@wesm

wesm commented Jun 10, 2026

Copy link
Copy Markdown
Member

looks good, thanks!

@wesm wesm merged commit c65314d into kenn-io:main Jun 10, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

hybrid search throws an FTS5 syntax error on punctuation in the query

2 participants