Tencent/WeKnora · error

chunk %s is not within the current @mention scope

Error message

chunk %s is not within the current @mention scope

What it means

Document-level mention-scope rejection for a chunk: KB containment and enablement passed, but the chunk's owning document is not within the @mention/allowed document scope, so the fine-grained check denies access to the chunk.

Source

Thrown at internal/agent/tools/scope_authorization.go:132

		if err == nil {
			err = fmt.Errorf("empty result")
		}
		return nil, fmt.Errorf("chunk %s not found: %w", chunkID, err)
	}
	if !chunk.IsEnabled {
		return nil, fmt.Errorf("chunk %s is disabled", chunk.ID)
	}
	if !searchTargets.ContainsKB(chunk.KnowledgeBaseID) {
		return nil, fmt.Errorf("knowledge base %s is not within the current Agent scope", chunk.KnowledgeBaseID)
	}
	allowed, err := searchTargetsAllowKnowledgeID(
		ctx, searchTargets, chunk.KnowledgeID, chunk.KnowledgeBaseID, knowledgeService,
	)
	if err != nil {
		return nil, fmt.Errorf("failed to validate chunk scope: %w", err)
	}
	if !allowed {
		return nil, fmt.Errorf("chunk %s is not within the current @mention scope", chunk.ID)
	}
	return chunk, nil
}

// validateKnowledgeBaseIDsInSearchTargets rejects hallucinated, stale, or
// out-of-scope bN values after the model-context registry resolves them.
func validateKnowledgeBaseIDsInSearchTargets(searchTargets types.SearchTargets, kbIDs []string) error {
	for _, kbID := range dedupNonEmptyStrings(kbIDs) {
		if !searchTargets.ContainsKB(kbID) {
			return fmt.Errorf("knowledge base %s is not within the current Agent scope", kbID)
		}
	}
	return nil
}

// resolveAuthorizedSourceRefs validates Wiki source_refs/suspected IDs against
// the same Agent scope and rebuilds the stored "uuid|title" representation
// from server data instead of trusting a model-supplied title suffix.

View on GitHub (pinned to 988cbb0330)

Solutions

1. Include the owning document in the mention/allowed scope
2. Verify scope resolution maps the chunk to the expected document
3. Adjust scope bindings rather than bypassing the check

When it happens

Trigger: Thrown at internal/agent/tools/scope_authorization.go:132 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/87303540e76416d5. Report an issue: GitHub.