deer-flow

mirror of https://github.com/bytedance/deer-flow.git synced 2026-05-23 08:25:57 +00:00

Files

T

fancyboi999 258ca800fe fix(frontend): sanitize JSON export content via the Markdown content path

Address @ShenAC-SAC's BUG-006 review and the Copilot inline comment on
#3131. The previous cut filtered hidden/tool messages out of the JSON
export but still serialised `msg.content` verbatim, so:

- inline `<think>…</think>` wrappers stayed in the exported `content`
  even with `includeReasoning: false`,
- content-array thinking blocks leaked the `thinking` field,
- `<uploaded_files>…</uploaded_files>` markers leaked the workspace
  paths a user uploaded files to.

JSON now goes through the same sanitiser the Markdown path uses
(`extractContentFromMessage` + `stripUploadedFilesTag`). Reasoning and
tool_calls remain gated behind their `ExportOptions` flags. AI / human
rows that sanitise to empty content with no opted-in reasoning or tool
calls are dropped so the JSON matches the Markdown path's `continue`
on empty assistant fragments.

New regression tests cover the three leak shapes the reviewer called
out plus the empty-content-drop case.

Refs: bytedance/deer-flow#3107 (BUG-006), bytedance/deer-flow#3131 review

2026-05-21 18:52:39 +08:00

api

feat(frontend): set up Vitest frontend testing infrastructure with CI workflow (#2147 )

2026-04-12 18:00:43 +08:00

auth

fix(frontend): restore localhost fallback for getGatewayConfig in prod mode (#2705 ) (#2718 )

2026-05-05 16:27:29 +08:00

messages

fix(middleware): Prevent todo completion reminder IMMessage leak (#2907 )

2026-05-15 22:12:37 +08:00

settings

enable token usage by default (#2841 )