github/deer-flow
1
0
Fork 0
mirror of https://github.com/bytedance/deer-flow.git synced 2026-09-09 13:39:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(doc): update the CHANGLOG with the latest change in main branch (#5004)

Browse Source 
* Update the CHANGELOG with latest changes

* update the Chinese version of CHANGELOG
This commit is contained in:
Willem Jiang 2026-08-25 10:00:31 +08:00 committed by GitHub
parent 943d148e5e
commit 2a261d2276
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 1134 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

668
CHANGELOG.md
View File

@ -81,6 +81,10 @@ This section accumulates work toward the **2.1.0** milestone
Deployments that relied on the old default now snapshot 100x more often in
delta mode -- set `database.checkpoint_delta.snapshot_frequency: 1000`
explicitly to keep the previous cadence. ([#4516])
- **docker:** The published entry port now binds to loopback (`127.0.0.1`) by
default in both compose files, matching the documented local-trust deployment
model. Deployments that relied on the old `0.0.0.0` binding must set
`BIND_HOST` to expose the stack on other interfaces. ([#4618])
### Added
@ -113,7 +117,7 @@ This section accumulates work toward the **2.1.0** milestone
thread storage from O(N²) to near-linear for long research/coding runs.
([#4292])
- **runtime:** Delta-mode checkpoint history cache (memory/redis) with O(1)
incremental composition, configured via `database.checkpoint_cache`.
incremental composition, configured via `database.checkpoint_cache`. ([#4638])
- **agent:** Config-declared lead-agent middlewares let deployments add custom
`AgentMiddleware` classes without patching the runtime chain. ([#3964])
- **agents:** Per-agent model and generation settings (`temperature`,
@ -125,7 +129,26 @@ This section accumulates work toward the **2.1.0** milestone
instead of injecting the full manifest. ([#4174])
- **scheduler:** `scheduler.recursion_limit` in `config.yaml` sets the LangGraph
super-step cap for scheduled runs (default 1000, matching the web UI's
interactive budget, clamped by `max_recursion_limit`).
interactive budget, clamped by `max_recursion_limit`). ([#4848])
- **runtime:** Every tool call now carries a runtime-stamped, tamper-evident
tool receipt, and a bounded receipt ledger is injected into the model
context so agents can cite execution evidence in their reports. Enabled
by default via the new `verification` config section. ([#4659])
- **clarification:** Human-input (clarification) cards support structured
form fields, so an agent can request exactly the input it needs instead
of free text only. ([#4406])
- **subagents:** Built-in subagents now receive the current-date context
anchor, so delegated tasks involving relative dates behave like tasks the
lead agent handles directly. ([#4797])
- **subagents:** A Settings page manages a deployment-level Subagent catalog
(admin-managed worker definitions alongside built-in and `config.yaml`
ones), and Custom Agents can restrict delegation to an explicit worker
allowlist enforced at both prompt and execution time. ([#4887])
- **subagents:** Subagent concurrency is now governed by one process-wide
capacity controller, and an opt-in `batch_task` tool runs large
collections of independent items as durable, resumable SQL-backed batches
with leases, bounded retries, pause/resume/cancel, and a chat panel for
tracking progress. ([#4998])
#### Memory
@ -143,6 +166,13 @@ This section accumulates work toward the **2.1.0** milestone
- **memory:** Memory message processing adds a conversation watermark,
trivial-turn filtering, and a durable queue so extraction no longer re-feeds
the full conversation every turn. ([#4447])
- **memory:** A built-in FTS5/BM25 retrieval adapter provides full-text
search over stored memories without an external retrieval service.
([#4360])
- **memory:** New pluggable memory backends: OpenViking and mem0 over HTTP,
plus Honcho as a user-model memory provider. ([#4509], [#4528], [#4730])
- **memory:** A hybrid fact eviction policy blends multiple signals when
deciding which stored facts to drop as memory fills. ([#4789])
#### Skills
@ -151,6 +181,8 @@ This section accumulates work toward the **2.1.0** milestone
skill's schema on demand instead of loading all skills up front. ([#3033],
[#3775])
- **skills:** Per-user custom skill isolation with sandbox mounting. ([#3889])
- **skills:** The skill list reopens after a skill is selected, so several
skills can be attached in a row. ([#4639])
#### Models & integrations
@ -168,6 +200,27 @@ This section accumulates work toward the **2.1.0** milestone
- **community:** Lark/Feishu CLI integration bundles the runtime install, the
official `lark-*` skill pack, and an interactive auth flow so the integration
is no longer environment-dependent. ([#3971])
- **integrations:** Lark/Feishu app credentials can be switched per user
from Settings > Integrations: new App ID/Secret values are validated
before anything is committed, and the previous OAuth token is revoked
after a successful switch. ([#4703])
- **acp:** MiniMax Code (`mcode acp`) is supported and documented as a
native external coding agent, and ACP thought chunks are no longer
concatenated into tool results. ([#4846])
#### MCP
- **mcp:** A durable task runtime for MCP: long-running tool tasks survive
Gateway restarts through a durable driver, and their progress and
completion notifications surface in the chat UI. ([#4665], [#4690],
[#4833])
- **mcp:** Shared MCP servers can inject per-user credentials: a single
server entry authenticates each DeerFlow user with their own header
value, unmapped users are denied by default, and stored credentials are
masked in Gateway API responses. ([#4868])
- **mcp:** Per-server `tool_name_prefix` option lets servers that already
namespace their own tools keep their original tool names; the default
behavior is unchanged. ([#4624])
#### Channels
@ -175,6 +228,13 @@ This section accumulates work toward the **2.1.0** milestone
`DEERFLOW_CHANNEL_USER_ID`. ([#3926])
- **channels:** Queue rapid same-thread messages and preserve topic-card
previews across batches. ([#3988])
- **channels:** Inbound webhook deduplication moves to Postgres, so several
Gateway pods can serve the same IM channel without double-processing
events. ([#4210])
- **channels:** DingTalk inbound messages support file and image
attachments. ([#4423])
- **channels:** New Buzz (Nostr) channel connector, including the frontend
experience for the channel. ([#4649], [#4727])
#### Auth & guardrails
@ -189,6 +249,12 @@ This section accumulates work toward the **2.1.0** milestone
- **authz:** Built-in RBAC authorization provider with a unified factory, plus
tool-authorization enforcement at both assembly (tools removed before the
model sees them) and runtime (denied calls blocked). ([#4260], [#4370])
- **authz:** Gateway route permissions are derived from the configured
AuthorizationProvider rather than a fixed table. ([#4439])
- **authz:** Model authorization is enforced at Gateway routes and again in
the agent runtime, and `sandbox:execute` is checked when a sandbox is
acquired - users can no longer reach models or sandboxes they are not
authorized for. ([#4540], [#4911])
#### Sandbox & provisioner
@ -196,6 +262,31 @@ This section accumulates work toward the **2.1.0** milestone
with a warm pool. ([#3883], [#3940], [#3951])
- **provisioner:** ClusterIP Services and scoped per-skill PVC mounts, plus a
configurable sandbox container port. ([#4016], [#3928])
- **sandbox:** New cloud sandbox providers: Tenki and OpenSandbox.
([#4382], [#4877])
- **sandbox:** An optional lark-cli credential broker sidecar (K8s
provisioner mode) keeps Lark app secrets and OAuth tokens out of the
sandbox filesystem entirely - the sandbox sees only a shim that forwards
commands to a loopback broker in the pod. Off by default. ([#4501])
#### Extensions & plugins
- **extensions:** An out-of-tree Python extension system: extensions can
contribute middleware, task-lifecycle and system-model observers, Gateway
services, and HTTP routers, and are managed with `deerflow extensions`
install/enable/disable/remove. ([#4636], [#4684], [#4780])
- **extensions:** Extensions can observe what the agent did - message
provenance, middleware policy declarations, agent-assembly fingerprints,
context-compaction records, guardrail decisions, and the MCP origin of a
tool. `deerflow-extension-api` moves to 0.2.0; extensions written against
0.1 are refused at startup with an install hint. ([#4863])
#### Persistence
- **persistence:** A custom PostgreSQL schema can be selected via
`postgres_schema`; ORM, LangGraph checkpointer, and store tables are all
created there, and the schema is created automatically at startup.
([#3442])
#### Frontend
@ -214,6 +305,21 @@ This section accumulates work toward the **2.1.0** milestone
- **frontend:** Localized AI-assistance disclaimer. ([#4374])
- **frontend:** Pin recent chats. ([#4442])
- **frontend:** Validate `/goal` objective length in the composer. ([#4337])
- **frontend:** Real-time context window usage is shown as a conversation
grows. ([#3183])
- **frontend:** The latest user turn can be edited and rerun in place.
([#4377])
- **frontend:** Replies can be typed and sent while a clarification card is
pending. ([#4530])
- **suggestions:** The number of follow-up suggestions is configurable via
`suggestions.max_suggestions` (default 3). ([#4533])
- **artifacts:** Text artifacts can be edited inline in the artifact panel.
([#4596])
- **frontend:** Browser Live is available in Custom Agent chats. ([#4719])
- **threads:** Branched conversations get distinguishing titles
(automatic `Title (2)`, `Title (3)` sibling numbering) and the
recent-chats list shows parent-child lineage with tree connectors.
([#4983])
#### Observability & tooling
@ -226,6 +332,7 @@ This section accumulates work toward the **2.1.0** milestone
support thinking, and a Volcengine Coding Plan quick-setup path was added.
([#3428], [#4141])
- **tui:** `clear` command. ([#4306])
- **tui:** The TUI supports a transparent terminal background. ([#4631])
### Changed
@ -272,10 +379,20 @@ This section accumulates work toward the **2.1.0** milestone
eliminating duplicated pattern compilation. ([#4108])
- **docs:** `AGENTS.md` is now the source of truth for agent guidance, imported
by `CLAUDE.md` via `@AGENTS.md`; module guides refreshed. ([#3770])
- **memory:** The OpenViking memory backend now uses the official OpenViking
adapter; the old trusted-mode `auth_mode`/`account` fields are rejected in
favor of a credential-bound USER API key. ([#4707])
- **gateway:** Threads created before the run-event journal have their
checkpoint history backfilled as seed events before the first new run, so
legacy conversations stay visible and correctly ordered after an upgrade.
([#4590])
- **agents:** Subagent delegation is now routed by net benefit: the lead agent
defaults to direct execution unless parallel latency, specialist capability,
or context isolation clearly pays off. ([#4384])
### Fixed
- **artifacts:** Keep explicit full-file loading scoped to the source thread, so a same-path artifact in another conversation keeps its 1 MiB preview.
- **artifacts:** Keep explicit full-file loading scoped to the source thread, so a same-path artifact in another conversation keeps its 1 MiB preview. ([#4634])
- **sandbox:** `SandboxAuditMiddleware` no longer blocks ordinary command
substitution that only captures output. The rule now judges *position* instead
of matching any `$(`: `x=$(curl url)`, `echo $(curl url)`, an argument, and a
@ -294,7 +411,7 @@ This section accumulates work toward the **2.1.0** milestone
Variable expansions whose name merely starts with a risky executable
(`$shell`, `$bashrc`, `$python_version`) and lookalike binaries
(`shellcheck`, `shasum`) are no longer false positives.
([#4611])
([#4611], [#4623])
- **mcp:** Isolate Settings > Tools enable/disable updates to one MCP server, so
an unrelated disallowed stdio command no longer blocks every switch; allow
disabling a disallowed target while still rejecting its re-enable, preserve
@ -302,7 +419,7 @@ This section accumulates work toward the **2.1.0** milestone
SSE/HTTP servers, surface backend validation details in the UI, and atomically
replace the shared config for MCP, skill, and embedded-client updates so
interrupted writes cannot leave it truncated.
([#4574])
([#4574], [#4577])
- **runtime:** Thread metadata now switches to `running` only after the run passes
the startup barrier, so pending-cancelled runs no longer briefly project
`running`; clients may observe the prior thread status during worker startup.
@ -543,12 +660,271 @@ This section accumulates work toward the **2.1.0** milestone
with a new per-server `session_init_timeout` (default 60s, `null` disables),
so a hung stdio server can no longer block agent construction, or the whole
Gateway event loop, indefinitely. `tool_call_timeout` still bounds individual
stdio tool calls.
stdio tool calls. ([#4657])
- **runtime:** Tool-output budget externalization no longer trips run delivery
verification. The default `.tool-results` storage dir (and any custom
`tool_output.storage_subdir`) is excluded from workspace-change snapshots and
produced-artifact detection, so a run that only externalized oversized tool
outputs succeeds instead of failing as an error.
outputs succeeds instead of failing as an error. ([#4657])
- **frontend:** Hide stale follow-up suggestion chips while a turn is still
streaming. ([#3396])
- **frontend:** Fix streaming render glitches: stop the word animation from
replaying, keep step text stable, preserve message order during long runs,
and keep reasoning above the answer. ([#4266], [#4510], [#4513], [#4578])
- **frontend:** Encode thread IDs in chat routes so IDs with special
characters no longer break navigation. ([#4302])
- **frontend:** Render citation links from React children. ([#4486])
- **frontend:** Localize conversation export failure messages. ([#4493])
- **frontend:** Sync side panel state when a drag collapses the panel. ([#4556])
- **frontend:** Render one workspace-change card per run instead of
duplicates. ([#4559])
- **frontend:** Refresh the active artifact's content when it changes. ([#4584])
- **gateway:** Reject non-positive read limits in API requests. ([#4284])
- **gateway:** Handle a null `config.configurable` when resolving the thread
id instead of failing. ([#4301])
- **gateway:** Unify thread id validation across API routes. ([#4589])
- **gateway:** Merge concurrent thread metadata updates instead of letting
them silently overwrite each other's changes. ([#4489])
- **gateway:** Expose the run metadata response header to cross-origin
clients, so a split-origin frontend learns new run ids instead of staying
stuck on the new-thread placeholder route until reload. ([#4535])
- **gateway:** Replay edit and rerun from a settled checkpoint so the edited
prompt actually runs (previously a first turn's edit replayed the original
prompt and vanished after reload), and keep a manual rename through the
rerun. ([#4534], [#4539])
- **runtime:** Cancel a run from any live gateway worker, not only the one
that owns it, so the stop button no longer depends on request routing.
([#4500])
- **runtime:** Close a replacement run when interrupt or rollback admission
is cancelled mid-flight, instead of stranding an unseen active run on the
thread. ([#4472])
- **runtime:** Regenerating a response now preserves the thread's current
title and supports the latest interrupted response whose partial message
never reached a checkpoint. ([#4480], [#4524])
- **agents:** Classify web_fetch error pages such as 404s as errors rather
than successful evidence, so retries and stagnation guards can react.
([#4314])
- **agents:** Handle XML-to-dict option shapes when normalizing
clarification choices. ([#4527])
- **subagents:** Run delegated subagents with isolated callbacks and lazy
skill activation, fixing cross-event-loop failures and passive skills
stripping baseline tools like `write_file`. ([#4497])
- **sandbox:** Handle overwrite-wrapped state when ensuring the sandbox is
initialized. ([#4429])
- **sandbox:** Reconcile E2B sandboxes safely: pick the first healthy
candidate, adopt the canonical instance per user and thread, defer a
peer's live duplicates, and reap orphans after a grace window. ([#4443])
- **sandbox:** Claim ownership before destroying a sandbox that failed its
readiness check, so a peer gateway can no longer adopt the not-yet-ready
sandbox and kill a live turn. ([#4505])
- **sandbox:** Allow grep to search a single file. ([#4512])
- **sandbox:** Enforce the E2B capacity limit deployment-wide when sandbox
ownership uses Redis, so multiple gateways cannot create past it. ([#4575])
- **skills:** Activate managed integration skills from the managed
integrations root on slash invocation. ([#4570])
- **skills:** Offload blocking filesystem IO when updating a skill and
serialize concurrent writes. ([#3565])
- **mcp:** Ignore oversized path-like text. ([#4582])
- **memory:** Harden long-term memory: reject duplicate facts inside the
create critical section, truncate injected mem0 context on entry
boundaries, and keep task-scoped instructions such as "inspect only" out
of long-term memory. ([#4599], [#4600], [#4604])
- **scheduler:** Keep a successfully launched scheduled run's slot and run
id when post-launch bookkeeping fails, preventing a later dispatch from
launching a duplicate run. ([#4504])
- **config:** Treat a deleted extensions config file as absent instead of
raising, so tool and skill config resolution keeps working. ([#4275])
- **config:** Normalize the `postgres://` short scheme for the async ORM
engine. ([#4293])
- **console:** Disable cost reporting when model pricing mixes currencies
instead of reporting a meaningless cross-currency total. ([#4564])
- **browserless:** Accept the `timeout` config key and harden its coercion.
([#4519])
- **docker:** Send `Connection: upgrade` only when the browser requests it,
fixing login-page refresh loops when the Docker dev stack is accessed via
a remote host. ([#4250])
- **runtime:** Group JSONL batch event writes by run, so a batch covering
several runs no longer lands all events in the first run's file and makes
later runs unreadable through per-run APIs. ([#4938])
- **runtime:** Restore standalone LangGraph Studio compatibility: the graph
entrypoint and file-based app load again, the Studio identity can discover
system assistants, and the documented `langgraph dev` workflow works.
([#4760], [#4838])
- **gateway:** Stamp `turn_duration` on a run's last AI message only in
`/messages/page`, so multi-step turns no longer repeat the same run
lifetime as thinking latency on every intermediate message. ([#4755])
- **gateway:** Preserve exact history attribution beyond the event page
limit, so older AI messages on long-lived threads are no longer credited
to a later turn's run and duration. ([#4953])
- **gateway:** Reject MCP task cancellation with HTTP 503 when the task
worker is stopped, instead of acknowledging a cancellation that would
never run. ([#4963])
- **middleware:** Correct four context-handling defects: fallback
dynamic-context injection targets the latest user message instead of
resurrecting an old prompt as the current turn; bare string blocks in
list-form user content are sanitized like all other user text; duplicate
placeholders are no longer emitted for the same invalid tool call; and
summarization no longer compresses away the current request's user message
while leaving the previous turn's behind. ([#4667], [#4668], [#4693],
[#4882])
- **middleware:** Restore the system-prompt injection that teaches the model
about the `write_todos` tool, which the todo middleware's model-call
override had silently dropped. ([#4735])
- **agents:** Make SQL agent-store signatures content-sensitive, so an agent
update that reuses its previous timestamp no longer leaves the GitHub
agent registry serving stale webhook routing. ([#4709])
- **tools:** Resolve presented files with the runtime user, so `present_files`
no longer rejects valid artifacts as outside the outputs directory when
the request user context is unavailable. ([#4677])
- **tools:** Retain a strong reference to deferred subagent cleanup tasks, so
garbage collection can no longer destroy a pending cleanup and leak
cancelled subagent records, locks, and memory. ([#4928])
- **subagents:** Give every background subagent run a server-side execution
ID, so concurrent runs that reuse a provider tool-call ID can no longer
overwrite, poll, or cancel each other's state. ([#4758])
- **harness:** Offload ACP workspace creation and MCP config loading from the
event loop, so invoking an ACP agent no longer raises blocking-IO errors
or stalls other async work. ([#4965])
- **mcp:** Reject non-finite `poll_after_seconds` values on task snapshots
when they arrive, so a bad polling interval no longer crashes scheduling
and persistence after a successful poll. ([#4750])
- **mcp:** Keep the configured `grant_type` authoritative over
`extra_token_params` during OAuth token exchange, so extra parameters can
no longer silently switch the configured flow and be rejected by the token
endpoint. ([#4860])
- **mcp:** Exclude the internal stdio MCP temp directory (`.mcp/tmp`) from
workspace changes, so MCP temporary and debug files no longer appear
alongside user deliverables or crowd real changes out of the file budget.
([#4898])
- **mcp:** Cancel the remote task when a durable task submission is cancelled
mid-flight, so an interrupted submission no longer leaves a remote task
running with no record to poll or stop. ([#4933])
- **sandbox:** Accept the documented E2B reconciliation config fields, so
valid E2B configuration no longer produces misleading startup warnings.
([#4772])
- **sandbox:** Bound E2B mount upload resource use per file, per mount, and
across the whole upload pass (shared size and file budgets plus a
wall-clock deadline), so large mounts can no longer spike Gateway memory
or hold sandbox capacity indefinitely. ([#4812], [#4842])
- **sandbox:** Preserve trailing whitespace in E2B-synced filenames and
tolerate out-of-range remote mtimes, so output sync no longer re-downloads
files repeatedly or aborts mid-sync. ([#4861])
- **sandbox:** Reject non-finite Redis lease-timing values in sandbox
ownership config at parse time instead of crashing with an `OverflowError`
during startup. ([#4960])
- **sandbox:** Resolve structured skill reads through the sandbox provider's
path mappings, so `read_file` opens legacy and per-user custom skills
under the same enabled-state projection as `ls` and shell execution.
([#4792])
- **skills:** Parse Responses API content blocks in the moderation scanner,
so valid skill-management decisions returned as content blocks are no
longer rejected as unparseable. ([#4936])
- **memory:** Reject non-positive and non-finite timeout and character-limit
settings in the Honcho and Mem0 backends at config parse time, so a bad
value fails fast instead of silently truncating stored text or crashing on
the first HTTP call. ([#4783], [#4823])
- **memory:** Scope custom-agent bootstrap facts to the selected agent's
bucket, so facts learned during setup no longer leak into the default
bucket and influence ordinary lead-agent conversations. ([#4804])
- **artifacts:** Support atomic saves on Windows, and serve a SHA-256 ETag on
artifact reads so inline preview and editing work on non-secure contexts
such as plain-HTTP LAN origins where `crypto.subtle` is unavailable.
([#4629], [#4865])
- **frontend:** Keep conversation order stable around long runs: the
submitted user message no longer renders twice or sinks below its own
processing steps, and after a mid-run page reload a turn's steps can no
longer appear above the user message that started the run. ([#4620],
[#4660])
- **frontend:** Stop matching `<header>` as `<head>` when injecting the base
href into HTML artifact previews, so relative assets in report fragments
that begin with `<header>` now load in the sandboxed preview iframe.
([#4625])
- **frontend:** Open landing-page case studies on a public read-only
`/showcase/` route so anonymous visitors are no longer redirected to
login. ([#4635])
- **frontend:** Sort the chats page by pinned state, so pinned threads no
longer render below unpinned ones. ([#4643])
- **frontend:** Keep `<think>` pairs written inside markdown inline code in
the rendered content instead of hollowing them out into the Reasoning
panel, and restore the copy button for turns that contain only reasoning.
([#4647])
- **frontend:** Surface model-loading failures with a workspace error banner
and retry action instead of a silently empty model list. ([#4840])
- **frontend:** Preserve copy and other actions on completed assistant
messages while a later turn is still streaming. ([#4844])
- **frontend:** Keep the browser live stream connected after a successful
reconnect instead of tearing down the new socket and immediately creating
another. ([#4951])
- **frontend:** Reuse the shared clipboard fallback when copying the Lark
authorization link, so the copy action works in browsers without the
Clipboard API. ([#4767])
- **frontend:** Use consistent "DeerFlow" casing in the composer disclaimer
and fix the "What's New" heading on the landing page. ([#4970])
- **channels:** Bound inbound intake with a fixed worker pool and bounded
admission queues, and await real cross-thread tasks on shutdown, so
message floods are rejected promptly instead of accumulating and channel
shutdown no longer tears down transports with work still in flight.
([#4800], [#4816])
- **channels:** Offload outbound attachment file IO for Feishu, Telegram, and
WeCom to worker threads, so sending a large artifact no longer stalls the
Gateway event loop. ([#4633])
- **channels:** Run Telegram connection-identity lookups on the Gateway event
loop, so inbound messages and commands no longer crash with a cross-loop
error when channel connections are enabled. ([#4815])
- **feishu:** Keep file receiving off the event loop and preserve every
inbound attachment: duplicate provider filenames no longer overwrite each
other, writes can no longer be redirected outside the thread bucket, and a
failed attachment no longer blocks the rest of the message. ([#4627],
[#4903])
- **dingtalk:** Strip leading `@bot` mentions before command classification,
so slash commands like `/new` sent in group chats are recognized instead
of treated as plain chat. ([#4724])
- **discord:** Refuse to start typing-indicator loops after the channel
stops, so shutdown no longer leaves an infinite typing task sending
events in the background. ([#4752])
- **wecom:** Serialize WebSocket start/stop transitions and await the SDK's
real receive-task shutdown, so stopping the WeCom channel can no longer
return before the socket closes or clear a newer connection's state.
([#4762])
- **buzz:** Drop replayed events across reconnects using a persistent
seen-id store, so the agent no longer re-answers the last message in a
channel after a relay or Gateway restart. ([#4888])
- **lark:** Keep the CLI lock directory writable inside sandboxes while the
credential-bearing config root stays read-only, restoring Lark API
commands that previously failed with a read-only filesystem error.
([#4701])
- **scheduler:** Enforce the global `max_concurrent_runs` budget for manual
triggers too, returning HTTP 409 when the cap is reached instead of
letting manual launches exceed it. ([#4769])
- **scheduler:** Coerce serialized task timestamps on read, so
scheduled-task operations no longer fail when string-form timestamp values
reach the database layer. ([#4785])
- **scheduler:** Support safe multi-instance scheduler recovery: startup no
longer treats live runs owned by peer Gateway instances as local
leftovers, so a restarting instance cannot interrupt a live run or trigger
a duplicate execution; multi-instance mode is opt-in via
`scheduler.multi_instance`. ([#4713])
- **scheduler:** Enqueue busy scheduled task runs instead of skipping them:
occurrences that hit a busy reused thread now wait in a durable queue
(bounded by `scheduler.queue_timeout_seconds`) and survive Gateway
restarts, and the UI explains the queueing behavior. ([#4918])
- **cli:** Add `--recursion-limit` to headless `--print`, `--json`, and
`--cli` runs, so long-running agent loops are no longer stuck at the
default recursion limit of 100. ([#4615])
- **dev:** Exclude backend runtime state from the Uvicorn reload watcher in
the backend `make dev` launcher, so an agent task writing files under the
runtime tree can no longer restart the Gateway and reset concurrent
users' requests. ([#4759])
- **dev:** Resolve diagnostic script paths from the script's own location, so
root diagnostic commands work when invoked from any working directory.
([#4736])
- **docker:** Harden local and container startup: `make up` waits for the
Gateway health probe before declaring the stack ready, Docker startup no
longer aborts when `.env` is missing, the Gateway can write
`extensions_config.json` in production, runtime data stays out of the
image build context, log commands resolve the checkout root correctly,
and the default loopback origins are allowed so the dev setup page can
hydrate. ([#4658], [#4806], [#4852], [#4853], [#4956], [#4959])
### Performance
@ -564,6 +940,10 @@ This section accumulates work toward the **2.1.0** milestone
chunk. ([#4425])
- **frontend:** Stop re-deriving message content on every stream chunk.
([#4441])
- **sandbox:** `read_file` reads only the requested line range from the
sandbox instead of fetching the whole file first. ([#3824])
- **browser:** Encode Browser Live progress frames as JPEG to cut progress
payload size. ([#4836])
### Security
@ -590,6 +970,77 @@ This section accumulates work toward the **2.1.0** milestone
- **auth:** Persist the `csrf_token` cookie for the access-token lifetime.
([#3872])
- **storage:** Stop persisting base64 image data in checkpoint state. ([#4140])
- **mcp:** Reject legacy MCP credentials in run metadata. ([#4448])
- **mcp:** Constrain stdio launcher arguments and environment variables at
the config API, rejecting launcher flags and env names that could turn an
allowlisted `npx`/`uvx` server registration into arbitrary code execution.
([#4617])
- **auth:** Harden validation of the post-login `next` path. ([#4587])
- **runtime:** Honor the LangGraph Server's authenticated user identity
across agents, uploads, thread data, memory, and skills, and reject
client-supplied auth identity fields. ([#4538])
- **frontend:** Send the session cookie on model, workspace-change, and
ranged artifact reads in split-origin deployments. ([#4827])
- **frontend:** Restore sanitization in custom streamdown rehype chains, so
artifact markdown previews and the memory settings summary can no longer
render hostile HTML such as `javascript:` links or `on*` event handlers.
([#4987])
- **skills:** Copy projected skill files instead of hardlinking them, so a
sandboxed write can no longer mutate the canonical skill source, and fail
closed on a drifted projection namespace on every platform, including
Windows. ([#4825], [#4830])
- **scripts:** Redact secret-shaped keys (`db_pass`, `signing_key`, ...)
wherever they appear in bundled config, not only under well-known key
names. ([#4242])
### Documentation
- **docs:** Clarify how `LocalSandboxProvider` resolves `sandbox.mounts[].host_path`
under production Docker, with gateway bind-mount and config examples. ([#3833])
- **docs:** Document that Crawl4AI >= 0.9 requires a bearer token. ([#4518])
- **docs:** Document the GitHub inbound-dedupe TTL semantics, including what
redeliveries are not deduped, and tighten the redelivery tests. ([#4274])
- **docs:** Update the agent AGENTS.md and ARCHITECTURE.md guides. ([#4817])
- **docs:** Document the Honcho memory backend with a dedicated guide and a
long-term memory section entry in the README. ([#4822])
### Internal
- **tests:** Migrate frontend unit tests to rstest and run hook-level tests in
a DOM environment. ([#3703], [#4453])
- **tests:** Require explicit opt-in for live client tests. ([#4482])
- **tests:** Rename the LLM-error test stand-in instead of the shared
FakeError. ([#4744])
- **tests:** Replace the magic unwritable absolute path in tool-output tests
with a self-constructed failure condition. ([#4722])
- **tests:** Add multi-turn message-stream invariants as graph integration
tests. ([#3708])
- **tests:** Add trace-based behavioral tests with Monocle Test Tools,
asserting agent routing, tool calls, and token/duration cost. ([#4025])
- **tests:** Cover passive skill tool visibility in the MCP layer. ([#4247])
- **tests:** Add SQL and concurrent-reconciler coverage for lease-aware orphan
recovery. ([#4427])
- **tests:** Restore memory updater regression coverage. ([#4490])
- **tests:** Lock in POST logout from the gateway-offline banner. ([#4506])
- **tests:** Document known instance-client false negatives in the SkillScan
tests. ([#4644])
- **refactor:** Extract frontend placeholder detection into a tested utility.
([#3783])
- **refactor:** Consolidate E2B client lifecycle helpers and reuse the kill
helper during warm-pool eviction. ([#4262], [#4298])
- **refactor:** Name the E2B capacity-ledger meta-field count so the admission
offset is explicit. ([#4764])
- **dev:** Trace self/cls attribute chains and local aliases in the
blocking-IO detector's call graph, closing false negatives. ([#4200])
- **ci:** Publish the lark-cli-init and lark-broker images. ([#4558])
- **dev:** Route host-side pnpm consumers through a shared runner with a
Corepack fallback so local workflows work without a pnpm shim. ([#4405])
- **bench:** Add an isolated checkpoint channel-mode benchmark comparing `full`
and `delta` across latency, storage, and replay metrics. ([#4395])
- **deps:** Bump `cryptography` 49.0.0 -> 50.0.0, `postcss` 8.4.31 -> 8.5.25,
`h2` 4.3.0 -> 4.4.1, `langgraph-checkpoint-sqlite` and
`langgraph-checkpoint-postgres` 3.1.0 -> 3.1.1, and `nanoid` 5.1.6 -> 5.1.16.
([#4681], [#4683], [#4737], [#4738], [#4747], [#4748])
## [2.0.0] — 2026-06-15
@ -1423,3 +1874,206 @@ with **180 merged pull requests** since the first 2.0 milestone tag.
[#4516]: https://github.com/bytedance/deer-flow/pull/4516
[#4611]: https://github.com/bytedance/deer-flow/issues/4611
[#4745]: https://github.com/bytedance/deer-flow/pull/4745
[#4574]: https://github.com/bytedance/deer-flow/issues/4574
[#4577]: https://github.com/bytedance/deer-flow/pull/4577
[#4623]: https://github.com/bytedance/deer-flow/pull/4623
[#4634]: https://github.com/bytedance/deer-flow/pull/4634
[#4638]: https://github.com/bytedance/deer-flow/pull/4638
[#4848]: https://github.com/bytedance/deer-flow/pull/4848
[#3183]: https://github.com/bytedance/deer-flow/pull/3183
[#3396]: https://github.com/bytedance/deer-flow/pull/3396
[#3442]: https://github.com/bytedance/deer-flow/pull/3442
[#3565]: https://github.com/bytedance/deer-flow/pull/3565
[#3703]: https://github.com/bytedance/deer-flow/pull/3703
[#3708]: https://github.com/bytedance/deer-flow/pull/3708
[#3783]: https://github.com/bytedance/deer-flow/pull/3783
[#3824]: https://github.com/bytedance/deer-flow/pull/3824
[#3833]: https://github.com/bytedance/deer-flow/pull/3833
[#4025]: https://github.com/bytedance/deer-flow/pull/4025
[#4200]: https://github.com/bytedance/deer-flow/pull/4200
[#4210]: https://github.com/bytedance/deer-flow/pull/4210
[#4242]: https://github.com/bytedance/deer-flow/pull/4242
[#4247]: https://github.com/bytedance/deer-flow/pull/4247
[#4250]: https://github.com/bytedance/deer-flow/pull/4250
[#4262]: https://github.com/bytedance/deer-flow/pull/4262
[#4266]: https://github.com/bytedance/deer-flow/pull/4266
[#4274]: https://github.com/bytedance/deer-flow/pull/4274
[#4275]: https://github.com/bytedance/deer-flow/pull/4275
[#4284]: https://github.com/bytedance/deer-flow/pull/4284
[#4293]: https://github.com/bytedance/deer-flow/pull/4293
[#4298]: https://github.com/bytedance/deer-flow/pull/4298
[#4301]: https://github.com/bytedance/deer-flow/pull/4301
[#4302]: https://github.com/bytedance/deer-flow/pull/4302
[#4314]: https://github.com/bytedance/deer-flow/pull/4314
[#4360]: https://github.com/bytedance/deer-flow/pull/4360
[#4377]: https://github.com/bytedance/deer-flow/pull/4377
[#4382]: https://github.com/bytedance/deer-flow/pull/4382
[#4384]: https://github.com/bytedance/deer-flow/pull/4384
[#4395]: https://github.com/bytedance/deer-flow/pull/4395
[#4405]: https://github.com/bytedance/deer-flow/pull/4405
[#4406]: https://github.com/bytedance/deer-flow/pull/4406
[#4423]: https://github.com/bytedance/deer-flow/pull/4423
[#4427]: https://github.com/bytedance/deer-flow/pull/4427
[#4429]: https://github.com/bytedance/deer-flow/pull/4429
[#4439]: https://github.com/bytedance/deer-flow/pull/4439
[#4443]: https://github.com/bytedance/deer-flow/pull/4443
[#4448]: https://github.com/bytedance/deer-flow/pull/4448
[#4453]: https://github.com/bytedance/deer-flow/pull/4453
[#4472]: https://github.com/bytedance/deer-flow/pull/4472
[#4480]: https://github.com/bytedance/deer-flow/pull/4480
[#4482]: https://github.com/bytedance/deer-flow/pull/4482
[#4486]: https://github.com/bytedance/deer-flow/pull/4486
[#4489]: https://github.com/bytedance/deer-flow/pull/4489
[#4490]: https://github.com/bytedance/deer-flow/pull/4490
[#4493]: https://github.com/bytedance/deer-flow/pull/4493
[#4497]: https://github.com/bytedance/deer-flow/pull/4497
[#4500]: https://github.com/bytedance/deer-flow/pull/4500
[#4501]: https://github.com/bytedance/deer-flow/pull/4501
[#4504]: https://github.com/bytedance/deer-flow/pull/4504
[#4505]: https://github.com/bytedance/deer-flow/pull/4505
[#4506]: https://github.com/bytedance/deer-flow/pull/4506
[#4509]: https://github.com/bytedance/deer-flow/pull/4509
[#4510]: https://github.com/bytedance/deer-flow/pull/4510
[#4512]: https://github.com/bytedance/deer-flow/pull/4512
[#4513]: https://github.com/bytedance/deer-flow/pull/4513
[#4518]: https://github.com/bytedance/deer-flow/pull/4518
[#4519]: https://github.com/bytedance/deer-flow/pull/4519
[#4524]: https://github.com/bytedance/deer-flow/pull/4524
[#4527]: https://github.com/bytedance/deer-flow/pull/4527
[#4528]: https://github.com/bytedance/deer-flow/pull/4528
[#4530]: https://github.com/bytedance/deer-flow/pull/4530
[#4533]: https://github.com/bytedance/deer-flow/pull/4533
[#4534]: https://github.com/bytedance/deer-flow/pull/4534
[#4535]: https://github.com/bytedance/deer-flow/pull/4535
[#4538]: https://github.com/bytedance/deer-flow/pull/4538
[#4539]: https://github.com/bytedance/deer-flow/pull/4539
[#4540]: https://github.com/bytedance/deer-flow/pull/4540
[#4556]: https://github.com/bytedance/deer-flow/pull/4556
[#4558]: https://github.com/bytedance/deer-flow/pull/4558
[#4559]: https://github.com/bytedance/deer-flow/pull/4559
[#4564]: https://github.com/bytedance/deer-flow/pull/4564
[#4570]: https://github.com/bytedance/deer-flow/pull/4570
[#4575]: https://github.com/bytedance/deer-flow/pull/4575
[#4578]: https://github.com/bytedance/deer-flow/pull/4578
[#4582]: https://github.com/bytedance/deer-flow/pull/4582
[#4584]: https://github.com/bytedance/deer-flow/pull/4584
[#4587]: https://github.com/bytedance/deer-flow/pull/4587
[#4589]: https://github.com/bytedance/deer-flow/pull/4589
[#4590]: https://github.com/bytedance/deer-flow/pull/4590
[#4596]: https://github.com/bytedance/deer-flow/pull/4596
[#4599]: https://github.com/bytedance/deer-flow/pull/4599
[#4600]: https://github.com/bytedance/deer-flow/pull/4600
[#4604]: https://github.com/bytedance/deer-flow/pull/4604
[#4615]: https://github.com/bytedance/deer-flow/pull/4615
[#4617]: https://github.com/bytedance/deer-flow/pull/4617
[#4618]: https://github.com/bytedance/deer-flow/pull/4618
[#4620]: https://github.com/bytedance/deer-flow/pull/4620
[#4624]: https://github.com/bytedance/deer-flow/pull/4624
[#4625]: https://github.com/bytedance/deer-flow/pull/4625
[#4627]: https://github.com/bytedance/deer-flow/pull/4627
[#4629]: https://github.com/bytedance/deer-flow/pull/4629
[#4631]: https://github.com/bytedance/deer-flow/pull/4631
[#4633]: https://github.com/bytedance/deer-flow/pull/4633
[#4635]: https://github.com/bytedance/deer-flow/pull/4635
[#4636]: https://github.com/bytedance/deer-flow/pull/4636
[#4639]: https://github.com/bytedance/deer-flow/pull/4639
[#4643]: https://github.com/bytedance/deer-flow/pull/4643
[#4644]: https://github.com/bytedance/deer-flow/pull/4644
[#4647]: https://github.com/bytedance/deer-flow/pull/4647
[#4649]: https://github.com/bytedance/deer-flow/pull/4649
[#4657]: https://github.com/bytedance/deer-flow/pull/4657
[#4658]: https://github.com/bytedance/deer-flow/pull/4658
[#4659]: https://github.com/bytedance/deer-flow/pull/4659
[#4660]: https://github.com/bytedance/deer-flow/pull/4660
[#4665]: https://github.com/bytedance/deer-flow/pull/4665
[#4667]: https://github.com/bytedance/deer-flow/pull/4667
[#4668]: https://github.com/bytedance/deer-flow/pull/4668
[#4677]: https://github.com/bytedance/deer-flow/pull/4677
[#4681]: https://github.com/bytedance/deer-flow/pull/4681
[#4683]: https://github.com/bytedance/deer-flow/pull/4683
[#4684]: https://github.com/bytedance/deer-flow/pull/4684
[#4690]: https://github.com/bytedance/deer-flow/pull/4690
[#4693]: https://github.com/bytedance/deer-flow/pull/4693
[#4701]: https://github.com/bytedance/deer-flow/pull/4701
[#4703]: https://github.com/bytedance/deer-flow/pull/4703
[#4707]: https://github.com/bytedance/deer-flow/pull/4707
[#4709]: https://github.com/bytedance/deer-flow/pull/4709
[#4713]: https://github.com/bytedance/deer-flow/pull/4713
[#4719]: https://github.com/bytedance/deer-flow/pull/4719
[#4722]: https://github.com/bytedance/deer-flow/pull/4722
[#4724]: https://github.com/bytedance/deer-flow/pull/4724
[#4727]: https://github.com/bytedance/deer-flow/pull/4727
[#4730]: https://github.com/bytedance/deer-flow/pull/4730
[#4735]: https://github.com/bytedance/deer-flow/pull/4735
[#4736]: https://github.com/bytedance/deer-flow/pull/4736
[#4737]: https://github.com/bytedance/deer-flow/pull/4737
[#4738]: https://github.com/bytedance/deer-flow/pull/4738
[#4744]: https://github.com/bytedance/deer-flow/pull/4744
[#4747]: https://github.com/bytedance/deer-flow/pull/4747
[#4748]: https://github.com/bytedance/deer-flow/pull/4748
[#4750]: https://github.com/bytedance/deer-flow/pull/4750
[#4752]: https://github.com/bytedance/deer-flow/pull/4752
[#4755]: https://github.com/bytedance/deer-flow/pull/4755
[#4758]: https://github.com/bytedance/deer-flow/pull/4758
[#4759]: https://github.com/bytedance/deer-flow/pull/4759
[#4760]: https://github.com/bytedance/deer-flow/pull/4760
[#4762]: https://github.com/bytedance/deer-flow/pull/4762
[#4764]: https://github.com/bytedance/deer-flow/pull/4764
[#4767]: https://github.com/bytedance/deer-flow/pull/4767
[#4769]: https://github.com/bytedance/deer-flow/pull/4769
[#4772]: https://github.com/bytedance/deer-flow/pull/4772
[#4780]: https://github.com/bytedance/deer-flow/pull/4780
[#4783]: https://github.com/bytedance/deer-flow/pull/4783
[#4785]: https://github.com/bytedance/deer-flow/pull/4785
[#4789]: https://github.com/bytedance/deer-flow/pull/4789
[#4792]: https://github.com/bytedance/deer-flow/pull/4792
[#4797]: https://github.com/bytedance/deer-flow/pull/4797
[#4800]: https://github.com/bytedance/deer-flow/pull/4800
[#4804]: https://github.com/bytedance/deer-flow/pull/4804
[#4806]: https://github.com/bytedance/deer-flow/pull/4806
[#4812]: https://github.com/bytedance/deer-flow/pull/4812
[#4815]: https://github.com/bytedance/deer-flow/pull/4815
[#4816]: https://github.com/bytedance/deer-flow/pull/4816
[#4817]: https://github.com/bytedance/deer-flow/pull/4817
[#4822]: https://github.com/bytedance/deer-flow/pull/4822
[#4823]: https://github.com/bytedance/deer-flow/pull/4823
[#4825]: https://github.com/bytedance/deer-flow/pull/4825
[#4827]: https://github.com/bytedance/deer-flow/pull/4827
[#4830]: https://github.com/bytedance/deer-flow/pull/4830
[#4833]: https://github.com/bytedance/deer-flow/pull/4833
[#4836]: https://github.com/bytedance/deer-flow/pull/4836
[#4838]: https://github.com/bytedance/deer-flow/pull/4838
[#4840]: https://github.com/bytedance/deer-flow/pull/4840
[#4842]: https://github.com/bytedance/deer-flow/pull/4842
[#4844]: https://github.com/bytedance/deer-flow/pull/4844
[#4846]: https://github.com/bytedance/deer-flow/pull/4846
[#4852]: https://github.com/bytedance/deer-flow/pull/4852
[#4853]: https://github.com/bytedance/deer-flow/pull/4853
[#4860]: https://github.com/bytedance/deer-flow/pull/4860
[#4861]: https://github.com/bytedance/deer-flow/pull/4861
[#4863]: https://github.com/bytedance/deer-flow/pull/4863
[#4865]: https://github.com/bytedance/deer-flow/pull/4865
[#4868]: https://github.com/bytedance/deer-flow/pull/4868
[#4877]: https://github.com/bytedance/deer-flow/pull/4877
[#4882]: https://github.com/bytedance/deer-flow/pull/4882
[#4887]: https://github.com/bytedance/deer-flow/pull/4887
[#4888]: https://github.com/bytedance/deer-flow/pull/4888
[#4898]: https://github.com/bytedance/deer-flow/pull/4898
[#4903]: https://github.com/bytedance/deer-flow/pull/4903
[#4911]: https://github.com/bytedance/deer-flow/pull/4911
[#4918]: https://github.com/bytedance/deer-flow/pull/4918
[#4928]: https://github.com/bytedance/deer-flow/pull/4928
[#4933]: https://github.com/bytedance/deer-flow/pull/4933
[#4936]: https://github.com/bytedance/deer-flow/pull/4936
[#4938]: https://github.com/bytedance/deer-flow/pull/4938
[#4951]: https://github.com/bytedance/deer-flow/pull/4951
[#4953]: https://github.com/bytedance/deer-flow/pull/4953
[#4956]: https://github.com/bytedance/deer-flow/pull/4956
[#4959]: https://github.com/bytedance/deer-flow/pull/4959
[#4960]: https://github.com/bytedance/deer-flow/pull/4960
[#4963]: https://github.com/bytedance/deer-flow/pull/4963
[#4965]: https://github.com/bytedance/deer-flow/pull/4965
[#4970]: https://github.com/bytedance/deer-flow/pull/4970
[#4983]: https://github.com/bytedance/deer-flow/pull/4983
[#4987]: https://github.com/bytedance/deer-flow/pull/4987
[#4998]: https://github.com/bytedance/deer-flow/pull/4998

473
CHANGELOG_zh.md
View File

@ -13,6 +13,13 @@
### ⚠ 不兼容变更（Breaking Changes）
- **技能：** 沙箱现在将 `/mnt/skills` 保留给“仅启用项”的托管投影视图。
`DEER_FLOW_HOST_SKILLS_PATH` 与 `SKILLS_HOST_PATH` 不再使用；Docker/AIO 和
hostPath 部署会从 `DEER_FLOW_HOST_BASE_DIR` 推导投影路径。指向 `/mnt/skills`
或其子路径的 E2B operator 挂载会被跳过并告警，避免遮蔽托管投影；请将额外内容
挂载到其他容器路径。用户投影会从磁盘重读全局启用状态，使切换在下一次获取沙箱时
跨 Gateway worker 生效。既有 E2B 沙箱在重建前仍保留创建时快照；PVC 模式暂不提供
已禁用技能的文件系统隔离。([#4178])
- **沙箱：** E2B 现在将 `sandbox.replicas` 作为进程级容量上限来强制执行。默认的
`wait` 策略会等待 `acquire_timeout`，随后令当前智能体回合失败。DeerFlow 不会自
动重试该回合。可使用 `burst` 配合 `burst_limit` 允许有限地超出额度多开 VM。`reject`
@ -49,6 +56,14 @@
接入的自定义后端。这是有意为之——静默返回空比启动期报错更糟。修复方式：切换到 `mode:
middleware`，或覆盖 `search()`（并设置 `supports_search=True`）。([#4324])
- **配置：** `database.checkpoint_delta_snapshot_frequency` 已迁移为
`database.checkpoint_delta.snapshot_frequency`，默认值从 `1000` 改为 `10`。
旧顶层字段仍会在告警后映射到新字段，显式的新字段优先。依赖旧默认值的 delta
模式部署现在会将快照频率提高 100 倍；如需保留原节奏，请显式设置为 `1000`。([#4516])
- **Docker：** 两份 compose 文件发布的入口端口现在默认只绑定回环地址
(`127.0.0.1`)。依赖旧 `0.0.0.0` 绑定的部署必须设置 `BIND_HOST` 才能向其他网卡
暴露服务。([#4618])
### 新增
#### 智能体与运行时
@ -78,6 +93,22 @@
投递失败时不再误报成功。([#4365])
- **上传：** 通过 `list_uploaded_files` 工具懒加载历史文件，而非注入完整清单。([#4174])
- **运行时：** Delta 模式 checkpoint 历史缓存（内存/Redis）支持 O(1) 增量合成，
通过 `database.checkpoint_cache` 配置。([#4638])
- **调度器：** `scheduler.recursion_limit` 可设置定时运行的 LangGraph super-step
上限（默认 1000，与 Web UI 一致，并受 `max_recursion_limit` 限制）。([#4848])
- **运行时：** 每次工具调用都会携带由运行时签发且可防篡改的工具回执；有界回执账本
会注入模型上下文，使智能体能在报告中引用执行证据。默认通过新的 `verification`
配置节启用。([#4659])
- **澄清：** 人工输入卡片支持结构化表单字段，智能体可精确请求所需信息。([#4406])
- **子智能体：** 内置子智能体会接收当前日期上下文锚点，使相对日期任务与主智能体
直接处理时表现一致。([#4797])
- **子智能体：** 设置页新增部署级子智能体目录；自定义智能体可配置显式 worker
allowlist，并在 prompt 与执行阶段同时强制执行。([#4887])
- **子智能体：** 并发由统一的进程级容量控制器管理；可选 `batch_task` 工具可把大量
独立项目作为基于 SQL 的持久、可恢复批次执行，支持租约、有限重试、暂停、恢复与
取消，并在聊天中展示进度。([#4998])
#### 记忆
- **记忆：** 记忆合并（consolidation）合成碎片化的事实，并通过 LLM 为每条事实分
配的 `expected_valid_days` / `staleFactsToExtend` 进行过期审查，剪除静默过期的
@ -90,27 +121,54 @@
- **记忆：** 记忆消息处理新增会话水位（watermark）、无意义回合过滤与持久化队列，
使抽取不再每回合都重新喂入完整会话。([#4447])
- **记忆：** 内置 FTS5/BM25 检索适配器，无需外部服务即可对已存记忆全文搜索。([#4360])
- **记忆：** 新增可插拔后端：通过 HTTP 接入 OpenViking 与 mem0，以及作为用户模型
记忆 provider 的 Honcho。([#4509]、[#4528]、[#4730])
- **记忆：** 混合事实淘汰策略综合多种信号，决定容量满时应丢弃哪些事实。([#4789])
#### 技能
- **技能：** 原生 SkillScan（阶段一）在加载时静态分析技能包；`describe_skill` 支
持延迟发现，模型按需获取技能 schema，而非一开始就加载全部技能。([#3033]、[#3775])
- **技能：** 按用户的自定义技能隔离，并配合沙箱挂载。([#3889])
- **技能：** 选中一个技能后技能列表会重新打开，便于连续附加多个技能。([#4639])
#### 模型与集成
- **社区工具：** 新增网络检索 / 抓取引擎——GroundRoute、Crawl4AI（`web_fetch`）与
fastCRW provider——并新增 Browserless `web_capture` 截图工具和 Brave `image_search`
。([#3675]、[#3821]、[#3585]、[#3881]、[#3866])
- **MCP：** MCP 工具调用支持按 server 的 `tool_call_timeout`，并提供路由提示引导
模型选用正确的 server。([#3843]、[#4004])
- **MCP：** 新增官方 OpenViking `/mcp` 示例，通过 DeerFlow 通用 MCP 客户端暴露其
原生工具集。([#4745])
- **社区工具：** 将“智能体化浏览器控制”作为会话的一等能力——基于 Playwright 的浏
览器会话由智能体操作，用户可在工作区中观察或接管。([#4187])
- **社区工具：** Lark / 飞书 CLI 集成打包了运行时安装、官方 `lark-*` 技能包与交
互式授权流程，使该集成不再依赖手动环境配置。([#3971])
- **集成：** 可在“设置 > 集成”中按用户切换 Lark/飞书应用凭据；新 App ID/Secret
会在写入前校验，成功切换后撤销旧 OAuth token。([#4703])
- **ACP：** 支持 MiniMax Code (`mcode acp`) 作为原生外部编码智能体；ACP thought
chunk 不再拼接进工具结果。([#4846])
#### MCP
- **MCP：** 新增持久任务运行时：长时工具任务通过持久 driver 跨 Gateway 重启继续，
进度与完成通知显示在聊天 UI 中。([#4665]、[#4690]、[#4833])
- **MCP：** 共享 MCP server 可注入按用户区分的凭据；未映射用户默认拒绝，存储的
凭据在 Gateway API 响应中脱敏。([#4868])
- **MCP：** 新增按 server 的 `tool_name_prefix`，让已自行命名空间化工具的 server
保留原始工具名；默认行为不变。([#4624])
#### 渠道
- **渠道：** 把 IM 的 `channel_user_id` 以 `DEERFLOW_CHANNEL_USER_ID` 暴露给沙箱
命令。([#3926])
- **渠道：** 对同一会话的密集消息进行排队，并在批次间保留话题卡片预览。([#3988])
- **渠道：** 入站 webhook 去重迁移到 Postgres，使多个 Gateway Pod 可同时服务同一
IM 渠道而不重复处理事件。([#4210])
- **渠道：** 钉钉入站消息支持文件与图片附件。([#4423])
- **渠道：** 新增 Buzz (Nostr) 渠道连接器及配套前端体验。([#4649]、[#4727])
#### 认证与防护
- **认证：** 通用 OIDC / SSO 认证，并支持 Keycloak。([#3506])
- **护栏：** 已认证的运行时上下文在 `GuardrailRequest` 中暴露，安全干预以 run 事
@ -121,12 +179,34 @@
- **鉴权：** 内置 RBAC 鉴权 provider 与统一工厂，并在装配期（模型可见前移除工具
）与运行期（拒绝被禁用的调用）双重强制执行工具鉴权。([#4260]、[#4370])
- **鉴权：** Gateway 路由权限改由已配置的 `AuthorizationProvider` 推导，不再使用
固定表。([#4439])
- **鉴权：** 模型权限会在 Gateway 路由和智能体运行时双重执行，获取沙箱时还会校验
`sandbox:execute`。([#4540]、[#4911])
#### 沙箱与 provisioner
- **沙箱：** 新增 E2B 与 BoxLite（micro-VM）沙箱 provider；BoxLite 自带预热池。([#3883]
、[#3940]、[#3951])
- **provisioner：** ClusterIP Service 与按技能作用域的 PVC 挂载，并支持配置沙箱
容器端口。([#4016]、[#3928])
- **沙箱：** 新增云沙箱 provider：Tenki 与 OpenSandbox。([#4382]、[#4877])
- **沙箱：** K8s provisioner 模式新增可选的 lark-cli 凭据 broker sidecar，将 Lark
应用密钥与 OAuth token 移出沙箱文件系统；沙箱只看到转发命令的 shim。默认关闭。
([#4501])
#### 扩展与插件
- **扩展：** 新增 out-of-tree Python 扩展系统，可贡献中间件、任务生命周期与系统模型
observer、Gateway 服务和 HTTP 路由，并用 `deerflow extensions` 管理。([#4636]、
[#4684]、[#4780])
- **扩展：** 扩展可观察消息来源、中间件策略、智能体装配指纹、上下文压缩、护栏决策
和工具的 MCP 来源。`deerflow-extension-api` 升至 0.2.0，0.1 扩展会在启动时被拒绝。
([#4863])
#### 持久化
- **持久化：** 可通过 `postgres_schema` 选择自定义 PostgreSQL schema；ORM、LangGraph
checkpointer 与 store 表均创建在其中，启动时自动创建。([#3442])
#### 前端
- **前端：** 支持对助手回合进行分支，以及针对引用追问的侧边对话。([#3950]、[#3934])
- **前端：** 支持重新生成最新回答。([#3637])
@ -141,6 +221,15 @@
- **前端：** 支持置顶最近会话。([#4442])
- **前端：** 在输入框中校验 `/goal` 目标长度。([#4337])
- **前端：** 实时显示上下文窗口使用量。([#3183])
- **前端：** 可原地编辑并重新运行最近一次用户回合。([#4377])
- **前端：** 澄清卡片待处理时仍可输入并发送回复。([#4530])
- **建议：** 可通过 `suggestions.max_suggestions` 配置后续建议数量（默认 3）。([#4533])
- **Artifact：** 可在 artifact 面板中内联编辑文本 artifact。([#4596])
- **前端：** 自定义智能体聊天支持 Browser Live。([#4719])
- **会话：** 分支会话自动使用 `Title (2)`、`Title (3)` 等编号区分标题，最近会话
列表以树形连接线展示父子关系。([#4983])
#### 可观测性与工具
- **可观测性：** trace-id 关联与增强日志，以及通过 Monocle 实现的智能体可观测性
。([#3902]、[#4024])
@ -150,8 +239,17 @@
，并新增火山引擎 Coding Plan 快速安装路径。([#3428]、[#4141])
- **TUI：** `clear` 命令。([#4306])
- **TUI：** 支持透明终端背景。([#4631])
### 变更
- **前端性能：** 保持公共根页面和本地化文档静态化；懒加载关闭的工作区面板及编辑器/
高亮依赖；增量推导流式消息状态；限制流式 Markdown 工作量；虚拟化超长消息与聊天
列表；暂停屏幕外装饰效果，并对代表性路由设置 JS/CSS 预算。
- **浏览器：** 协商二进制 Browser Live JPEG 帧，兼容旧 JSON/base64 协议；每次刷新
只呈现最新帧，并撤销已替换的 object URL。
- **Artifact：** 普通文本 artifact 支持 HTTP byte-range 流式读取；Web UI 初始预览
限制为 1 MiB，用户显式请求后才加载完整文件。
- **沙箱：** Helm chart 现在默认将每个沙箱的 Service 设为 `ClusterIP` 而非 `NodePort`
，因此代码执行沙箱只能通过集群内 Service DNS（`http://sandbox-<id>-svc.<ns>.svc.cluster.local`
）访问，不再绑定到每个节点（包括 GKE / EKS / AKS 上外部可达的）网卡。升级时现
@ -176,6 +274,13 @@
- **文档：** `AGENTS.md` 成为智能体指引的权威来源，`CLAUDE.md` 通过 `@AGENTS.md`
导入；模块指南同步刷新。([#3770])
- **记忆：** OpenViking 后端改用官方适配器；旧 trusted-mode 的 `auth_mode`/`account`
字段会被拒绝，改用绑定凭据的 USER API key。([#4707])
- **网关：** 在 run-event journal 出现之前创建的会话，会在首次新 run 前把 checkpoint
历史回填为 seed event，使旧会话升级后仍可见且顺序正确。([#4590])
- **智能体：** 子智能体委派改按净收益路由；除非并行延迟、专长能力或上下文隔离明确
有益，否则主智能体默认直接执行。([#4384])
### 修复
- **运行时：** 会话元数据现在仅在 run 通过启动屏障后才切换为 `running`，待取消的
@ -351,6 +456,119 @@
- **前端：** 允许非 localhost 主机访问 dev-server。([#4471])
- **内容安全：** 回填空的内容过滤响应，避免污染会话。([#4394])
- **工具：** 从 `list_uploaded_files` 的 schema 中排除注入的 runtime。([#4376])
- **Artifact：** 显式加载完整文件时限定在来源会话内，使其他会话中同路径 artifact
仍保持 1 MiB 预览。([#4634])
- **沙箱：** `SandboxAuditMiddleware` 改为按命令替换所处位置判断风险：普通输出捕获
不再误拦，而命令位置、解释器代码参数、`eval`/`source`、process substitution 与
here-string 中执行下载内容仍会阻止；heredoc 正文继续按数据处理。([#4611]、[#4623])
- **MCP：** 设置页的启停只校验目标 server；允许禁用已不合规目标但拒绝重新启用，
支持规范中的 `transport` 别名、展示后端校验详情，并以原子方式更新共享配置。([#4574]、[#4577])
- **MCP：** 用按 server 的 `session_init_timeout`（默认 60 秒，`null` 可关闭）限制工具
发现与持久 stdio session 初始化，避免挂起 server 阻塞智能体装配或 Gateway 事件循环。([#4657])
- **运行时：** `.tool-results` 等超大工具输出外置目录不再计入工作区变更和产物检测，
仅外置工具输出的 run 不会再被投递校验误判失败。([#4657])
- **前端：** 回合仍在流式输出时隐藏旧的后续建议。([#3396])
- **前端：** 修复流式渲染抖动：不重复播放逐字动画、稳定步骤文本和消息顺序，并保持
reasoning 位于答案上方。([#4266]、[#4510]、[#4513]、[#4578])
- **前端：** 聊天路由中的 thread id 现在会编码，特殊字符不再破坏导航。([#4302])
- **前端：** 从 React children 正确渲染引用链接。([#4486])
- **前端：** 本地化会话导出失败消息。([#4493])
- **前端：** 拖拽折叠面板时同步侧边面板状态。([#4556])
- **前端：** 每个 run 只渲染一张工作区变更卡片。([#4559])
- **前端：** 活动 artifact 发生变化时刷新其内容。([#4584])
- **网关：** 拒绝 API 请求中的非正读取上限。([#4284])
- **网关：** 解析 thread id 时兼容为 null 的 `config.configurable`。([#4301])
- **网关：** 统一各 API 路由的 thread id 校验。([#4589])
- **网关：** 合并并发的会话元数据更新，避免相互静默覆盖。([#4489])
- **网关：** 向跨域客户端暴露 run 元数据响应 header，使分离部署的前端能及时获知新 run id。([#4535])
- **网关：** 从稳定 checkpoint 执行“编辑并重跑”，确保编辑后的 prompt 真正运行，
并在重跑后保留手动标题。([#4534]、[#4539])
- **运行时：** 可从任意存活 Gateway worker 取消 run，停止按钮不再依赖请求路由。([#4500])
- **运行时：** interrupt 或 rollback admission 中途取消时关闭替代 run，避免留下不可见的活动 run。([#4472])
- **运行时：** 重新生成响应时保留当前标题，并支持最近一次尚未写入 checkpoint 的中断响应。([#4480]、[#4524])
- **智能体：** 将 404 等 `web_fetch` 错误页识别为错误证据，使重试和停滞保护能够响应。([#4314])
- **智能体：** 规范化澄清选项时兼容 XML-to-dict 形态。([#4527])
- **子智能体：** 委派执行使用隔离 callback 与惰性技能激活，修复跨事件循环错误及被动
技能移除 `write_file` 等基础工具的问题。([#4497])
- **沙箱：** 初始化沙箱时兼容被 `Overwrite` 包裹的状态。([#4429])
- **沙箱：** 安全协调 E2B 沙箱：选择首个健康候选、按用户与会话采纳规范实例、延后
处理 peer 的活动副本，并在宽限期后回收孤儿。([#4443])
- **沙箱：** 销毁 readiness 失败的沙箱前先取得所有权，避免 peer 采纳后误杀活动回合。([#4505])
- **沙箱：** `grep` 支持搜索单个文件。([#4512])
- **沙箱：** 使用 Redis 所有权时在部署范围内强制 E2B 容量上限。([#4575])
- **技能：** 斜杠调用可从托管 integrations 根目录激活集成技能。([#4570])
- **技能：** 更新技能时把阻塞文件 IO 移出事件循环，并序列化并发写入。([#3565])
- **MCP：** 忽略过大的类路径文本。([#4582])
- **记忆：** 在创建临界区拒绝重复事实，按条目边界截断 mem0 注入上下文，并阻止
“仅检查”等任务级指令进入长期记忆。([#4599]、[#4600]、[#4604])
- **调度器：** 启动成功后的记账若失败，仍保留 run slot 与 run id，防止后续重复启动。([#4504])
- **配置：** 被删除的 extensions 配置文件按不存在处理，工具与技能配置解析仍可继续。([#4275])
- **配置：** 为异步 ORM engine 规范化 `postgres://` 短 scheme。([#4293])
- **控制台：** 模型定价混用货币时禁用成本汇总，避免输出无意义总额。([#4564])
- **Browserless：** 接受 `timeout` 配置键并加固类型转换。([#4519])
- **Docker：** 仅在浏览器请求升级时发送 `Connection: upgrade`，修复远程访问 Docker
dev stack 时登录页循环刷新。([#4250])
- **运行时：** JSONL 批量事件按 run 分组写入，避免跨多个 run 的批次全落入首个文件。([#4938])
- **运行时：** 恢复独立 LangGraph Studio 兼容：图入口、文件式 app、系统助手发现与
`langgraph dev` 工作流重新可用。([#4760]、[#4838])
- **网关：** 只在 `/messages/page` 中把 `turn_duration` 标到 run 的最后一条 AI 消息。([#4755])
- **网关：** 跨越 event 分页上限仍保持精确历史归因，旧 AI 消息不再归到后续 run。([#4953])
- **网关：** MCP task worker 停止时以 HTTP 503 拒绝取消请求。([#4963])
- **中间件：** 修复动态上下文目标、列表字符串净化、重复无效工具占位符，以及摘要误
压缩当前用户请求等四个上下文问题。([#4667]、[#4668]、[#4693]、[#4882])
- **中间件：** 恢复向模型说明 `write_todos` 工具的系统 prompt 注入。([#4735])
- **智能体：** SQL agent-store 签名改为内容敏感，时间戳复用时注册表也不会继续提供旧路由。([#4709])
- **工具：** 使用运行时用户解析待展示文件，避免有效 artifact 被误判在 outputs 外。([#4677])
- **工具：** 强引用延迟子智能体清理任务，防止 GC 销毁待执行清理并泄漏记录与锁。([#4928])
- **子智能体：** 每个后台执行使用服务端 execution ID，复用 provider tool-call ID 的
并发 run 不再覆盖、轮询或取消彼此状态。([#4758])
- **Harness：** 把 ACP workspace 创建与 MCP 配置加载移出事件循环。([#4965])
- **MCP：** 收到 task snapshot 时拒绝非有限 `poll_after_seconds`。([#4750])
- **MCP：** OAuth token 交换中以配置的 `grant_type` 为准，`extra_token_params` 不再能
静默切换 flow。([#4860])
- **MCP：** 从工作区变更排除内部 stdio 临时目录 `.mcp/tmp`。([#4898])
- **MCP：** 持久任务提交中途取消时同时取消远端任务。([#4933])
- **沙箱：** 接受文档中的 E2B reconciliation 配置字段。([#4772])
- **沙箱：** 按文件、挂载及整个上传过程限制 E2B mount 上传的大小、文件数和时间。([#4812]、[#4842])
- **沙箱：** 保留 E2B 同步文件名尾部空白并容忍越界远端 mtime。([#4861])
- **沙箱：** 配置解析时拒绝 Redis 所有权中的非有限租约时间值。([#4960])
- **沙箱：** 结构化技能读取经沙箱 provider 路径映射解析，与 `ls`/shell 使用同一启用状态投影。([#4792])
- **技能：** moderation scanner 支持 Responses API content block，合法技能管理决策不再误判不可解析。([#4936])
- **记忆：** Honcho 与 Mem0 在配置解析时拒绝非正或非有限的 timeout/字符上限。([#4783]、[#4823])
- **记忆：** 自定义智能体 bootstrap 事实限定到所选智能体 bucket。([#4804])
- **Artifact：** Windows 支持原子保存；读取响应提供 SHA-256 ETag，使普通 HTTP LAN
等无 `crypto.subtle` 环境也能预览和编辑。([#4629]、[#4865])
- **前端：** 长 run 前后保持会话顺序稳定，用户消息不再重复或落到自身步骤之后。([#4620]、[#4660])
- **前端：** HTML artifact 注入 base href 时不再把 `<header>` 误判为 `<head>`。([#4625])
- **前端：** 落地页案例通过公开只读 `/showcase/` 路由打开。([#4635])
- **前端：** 聊天页按置顶状态排序。([#4643])
- **前端：** Markdown inline code 中的 `<think>` 保持原样，并恢复纯 reasoning 回合的复制按钮。([#4647])
- **前端：** 模型加载失败时显示工作区错误 banner 与重试操作。([#4840])
- **前端：** 后续回合流式输出时仍保留已完成助手消息的复制等操作。([#4844])
- **前端：** Browser Live 重连成功后保持新连接，不再立即拆除并再次重连。([#4951])
- **前端：** 复制 Lark 授权链接时复用 clipboard fallback。([#4767])
- **前端：** 统一使用“DeerFlow”大小写并修复落地页 “What's New” 标题。([#4970])
- **渠道：** 用固定 worker pool 与有界队列限制入站流量，关闭时等待真实跨线程任务。([#4800]、[#4816])
- **渠道：** 飞书、Telegram 与企业微信发送附件时把文件 IO 移到 worker 线程。([#4633])
- **渠道：** Telegram connection identity 查询回到 Gateway 事件循环执行。([#4815])
- **飞书：** 接收文件保持事件循环非阻塞，避免重名覆盖、越界写入，并让单个附件失败不阻塞其余消息。([#4627]、[#4903])
- **钉钉：** 命令分类前剥离前导 `@bot`，群聊中的 `/new` 等命令可被识别。([#4724])
- **Discord：** 渠道停止后不再启动 typing-indicator 循环。([#4752])
- **企业微信：** 序列化 WebSocket 启停并等待 SDK 接收任务真正结束。([#4762])
- **Buzz：** 用持久 seen-id store 丢弃重连后的重复事件。([#4888])
- **Lark：** 沙箱内 CLI lock 目录保持可写，含凭据的 config 根目录仍为只读。([#4701])
- **调度器：** 手动触发也遵守全局 `max_concurrent_runs`，达到上限返回 HTTP 409。([#4769])
- **调度器：** 读取时转换序列化的任务时间戳。([#4785])
- **调度器：** 支持安全的多实例恢复，启动时不会把 peer 的活动 run 当成本地残留；
通过 `scheduler.multi_instance` 显式启用。([#4713])
- **调度器：** busy 的定时 occurrence 改为进入持久队列而非跳过，由
`scheduler.queue_timeout_seconds` 限制等待并可跨 Gateway 重启。([#4918])
- **CLI：** headless `--print`、`--json` 与 `--cli` 新增 `--recursion-limit`。([#4615])
- **开发：** backend `make dev` 的 Uvicorn watcher 排除运行时状态，智能体写文件不再重启 Gateway。([#4759])
- **开发：** 诊断脚本按自身位置解析路径，可从任意工作目录运行根诊断命令。([#4736])
- **Docker：** 加固本地与容器启动：`make up` 等待健康检查，允许缺失 `.env`，生产
环境可写 extensions 配置，运行数据不进入构建上下文，日志命令正确解析 checkout，
默认回环 origin 可完成 dev setup hydration。([#4658]、[#4806]、[#4852]、[#4853]、[#4956]、[#4959])
### 性能优化
@ -362,6 +580,8 @@
- **消息：** 按组为工具调用结果建立索引。([#4411])
- **前端：** 流式渲染按帧预算合并，而非逐 chunk 渲染。([#4425])
- **前端：** 不再在每个流式 chunk 上重新推导消息内容。([#4441])
- **沙箱：** `read_file` 只从沙箱读取请求的行范围，不再先获取整个文件。([#3824])
- **浏览器：** Browser Live 进度帧改用 JPEG 编码，减小传输负载。([#4836])
### 安全
@ -381,6 +601,52 @@
。([#3855]、[#3985]、[#3982]、[#4203])
- **认证：** 在 access-token 生命周期内持久化 `csrf_token` cookie。([#3872])
- **存储：** 不再在 checkpoint 状态中持久化 base64 图片数据。([#4140])
- **MCP：** 拒绝 run metadata 中的旧版 MCP 凭据。([#4448])
- **MCP：** 在配置 API 中限制 stdio launcher 参数与环境变量，防止 allowlist 中的
`npx`/`uvx` 注册被参数或环境变量转化为任意代码执行。([#4617])
- **认证：** 加固登录后 `next` 路径校验。([#4587])
- **运行时：** 在智能体、上传、ThreadData、记忆与技能中遵循 LangGraph Server 的
已认证用户身份，并拒绝客户端提供的身份字段。([#4538])
- **前端：** 分离 origin 部署中，模型、工作区变更和 range artifact 请求会发送 session cookie。([#4827])
- **前端：** 恢复自定义 Streamdown rehype 链的净化，artifact Markdown 与记忆设置
摘要不再能渲染 `javascript:` 链接或 `on*` handler 等恶意 HTML。([#4987])
- **技能：** 投影技能文件改为复制而非 hardlink，沙箱写入不能再修改规范来源；所有
平台（含 Windows）遇到漂移的投影命名空间都会 fail closed。([#4825]、[#4830])
- **脚本：** support bundle 中任意位置的 secret-shaped key（如 `db_pass`、
`signing_key`）都会脱敏。([#4242])
### 文档
- **文档：** 说明生产 Docker 下 `LocalSandboxProvider` 如何解析
`sandbox.mounts[].host_path`，并给出 Gateway bind-mount 与配置示例。([#3833])
- **文档：** 说明 Crawl4AI >= 0.9 需要 bearer token。([#4518])
- **文档：** 记录 GitHub 入站去重 TTL 语义及不会被去重的重投递，并收紧测试。([#4274])
- **文档：** 更新智能体 `AGENTS.md` 与 `ARCHITECTURE.md` 指南。([#4817])
- **文档：** 新增 Honcho 记忆后端专门指南，并在 README 加入长期记忆入口。([#4822])
### 内部改进
- **测试：** 前端单元测试迁移到 rstest，并在 DOM 环境运行 hook 级测试。([#3703]、[#4453])
- **测试：** live client 测试要求显式 opt-in。([#4482])
- **测试：** LLM 错误测试替身不再复用共享 `FakeError`。([#4744])
- **测试：** 工具输出测试用自构造失败条件替代魔法不可写绝对路径。([#4722])
- **测试：** 新增多回合消息流图集成不变量测试。([#3708])
- **测试：** 使用 Monocle Test Tools 新增 trace 行为测试，校验路由、工具调用和 token/时长成本。([#4025])
- **测试：** 覆盖 MCP 层中被动技能的工具可见性。([#4247])
- **测试：** 为感知租约的孤儿恢复增加 SQL 与并发 reconciler 覆盖。([#4427])
- **测试：** 恢复 memory updater 回归测试。([#4490])
- **测试：** 锁定 Gateway offline banner 的 POST logout 行为。([#4506])
- **测试：** 在 SkillScan 测试中记录已知 instance-client 假阴性。([#4644])
- **重构：** 抽取并测试前端 placeholder 检测工具。([#3783])
- **重构：** 合并 E2B client 生命周期 helper，并在 warm-pool 淘汰时复用 kill helper。([#4262]、[#4298])
- **重构：** 命名 E2B capacity ledger 的 meta-field 数量，使 admission offset 明确。([#4764])
- **开发：** blocking-IO detector 的调用图追踪 self/cls 属性链和本地别名。([#4200])
- **CI：** 发布 lark-cli-init 与 lark-broker 镜像。([#4558])
- **开发：** host 侧 pnpm 调用统一经带 Corepack fallback 的 runner。([#4405])
- **基准：** 新增隔离的 checkpoint channel-mode 基准，对比 `full` 与 `delta` 的延迟、存储和回放。([#4395])
- **依赖：** 升级 `cryptography` 49.0.0 -> 50.0.0、`postcss` 8.4.31 -> 8.5.25、
`h2` 4.3.0 -> 4.4.1、两个 `langgraph-checkpoint-*` 3.1.0 -> 3.1.1，以及
`nanoid` 5.1.6 -> 5.1.16。([#4681]、[#4683]、[#4737]、[#4738]、[#4747]、[#4748])
## [2.0.0] — 2026-06-15
@ -1166,3 +1432,210 @@ DeerFlow 2.0 是围绕"超级智能体"框架的彻底重写，核心包含子
[#4468]: https://github.com/bytedance/deer-flow/pull/4468
[#4469]: https://github.com/bytedance/deer-flow/pull/4469
[#4471]: https://github.com/bytedance/deer-flow/pull/4471
+[#3183]: https://github.com/bytedance/deer-flow/pull/3183
[#3396]: https://github.com/bytedance/deer-flow/pull/3396
[#3442]: https://github.com/bytedance/deer-flow/pull/3442
[#3565]: https://github.com/bytedance/deer-flow/pull/3565
[#3703]: https://github.com/bytedance/deer-flow/pull/3703
[#3708]: https://github.com/bytedance/deer-flow/pull/3708
[#3783]: https://github.com/bytedance/deer-flow/pull/3783
[#3824]: https://github.com/bytedance/deer-flow/pull/3824
[#3833]: https://github.com/bytedance/deer-flow/pull/3833
[#4025]: https://github.com/bytedance/deer-flow/pull/4025
[#4178]: https://github.com/bytedance/deer-flow/pull/4178
[#4200]: https://github.com/bytedance/deer-flow/pull/4200
[#4210]: https://github.com/bytedance/deer-flow/pull/4210
[#4242]: https://github.com/bytedance/deer-flow/pull/4242
[#4247]: https://github.com/bytedance/deer-flow/pull/4247
[#4250]: https://github.com/bytedance/deer-flow/pull/4250
[#4262]: https://github.com/bytedance/deer-flow/pull/4262
[#4266]: https://github.com/bytedance/deer-flow/pull/4266
[#4274]: https://github.com/bytedance/deer-flow/pull/4274
[#4275]: https://github.com/bytedance/deer-flow/pull/4275
[#4284]: https://github.com/bytedance/deer-flow/pull/4284
[#4293]: https://github.com/bytedance/deer-flow/pull/4293
[#4298]: https://github.com/bytedance/deer-flow/pull/4298
[#4301]: https://github.com/bytedance/deer-flow/pull/4301
[#4302]: https://github.com/bytedance/deer-flow/pull/4302
[#4314]: https://github.com/bytedance/deer-flow/pull/4314
[#4360]: https://github.com/bytedance/deer-flow/pull/4360
[#4377]: https://github.com/bytedance/deer-flow/pull/4377
[#4382]: https://github.com/bytedance/deer-flow/pull/4382
[#4384]: https://github.com/bytedance/deer-flow/pull/4384
[#4395]: https://github.com/bytedance/deer-flow/pull/4395
[#4405]: https://github.com/bytedance/deer-flow/pull/4405
[#4406]: https://github.com/bytedance/deer-flow/pull/4406
[#4423]: https://github.com/bytedance/deer-flow/pull/4423
[#4427]: https://github.com/bytedance/deer-flow/pull/4427
[#4429]: https://github.com/bytedance/deer-flow/pull/4429
[#4439]: https://github.com/bytedance/deer-flow/pull/4439
[#4443]: https://github.com/bytedance/deer-flow/pull/4443
[#4448]: https://github.com/bytedance/deer-flow/pull/4448
[#4453]: https://github.com/bytedance/deer-flow/pull/4453
[#4472]: https://github.com/bytedance/deer-flow/pull/4472
[#4480]: https://github.com/bytedance/deer-flow/pull/4480
[#4482]: https://github.com/bytedance/deer-flow/pull/4482
[#4486]: https://github.com/bytedance/deer-flow/pull/4486
[#4489]: https://github.com/bytedance/deer-flow/pull/4489
[#4490]: https://github.com/bytedance/deer-flow/pull/4490
[#4493]: https://github.com/bytedance/deer-flow/pull/4493
[#4497]: https://github.com/bytedance/deer-flow/pull/4497
[#4500]: https://github.com/bytedance/deer-flow/pull/4500
[#4501]: https://github.com/bytedance/deer-flow/pull/4501
[#4504]: https://github.com/bytedance/deer-flow/pull/4504
[#4505]: https://github.com/bytedance/deer-flow/pull/4505
[#4506]: https://github.com/bytedance/deer-flow/pull/4506
[#4509]: https://github.com/bytedance/deer-flow/pull/4509
[#4510]: https://github.com/bytedance/deer-flow/pull/4510
[#4512]: https://github.com/bytedance/deer-flow/pull/4512
[#4513]: https://github.com/bytedance/deer-flow/pull/4513
[#4516]: https://github.com/bytedance/deer-flow/pull/4516
[#4518]: https://github.com/bytedance/deer-flow/pull/4518
[#4519]: https://github.com/bytedance/deer-flow/pull/4519
[#4524]: https://github.com/bytedance/deer-flow/pull/4524
[#4527]: https://github.com/bytedance/deer-flow/pull/4527
[#4528]: https://github.com/bytedance/deer-flow/pull/4528
[#4530]: https://github.com/bytedance/deer-flow/pull/4530
[#4533]: https://github.com/bytedance/deer-flow/pull/4533
[#4534]: https://github.com/bytedance/deer-flow/pull/4534
[#4535]: https://github.com/bytedance/deer-flow/pull/4535
[#4538]: https://github.com/bytedance/deer-flow/pull/4538
[#4539]: https://github.com/bytedance/deer-flow/pull/4539
[#4540]: https://github.com/bytedance/deer-flow/pull/4540
[#4556]: https://github.com/bytedance/deer-flow/pull/4556
[#4558]: https://github.com/bytedance/deer-flow/pull/4558
[#4559]: https://github.com/bytedance/deer-flow/pull/4559
[#4564]: https://github.com/bytedance/deer-flow/pull/4564
[#4570]: https://github.com/bytedance/deer-flow/pull/4570
[#4574]: https://github.com/bytedance/deer-flow/issues/4574
[#4575]: https://github.com/bytedance/deer-flow/pull/4575
[#4577]: https://github.com/bytedance/deer-flow/pull/4577
[#4578]: https://github.com/bytedance/deer-flow/pull/4578
[#4582]: https://github.com/bytedance/deer-flow/pull/4582
[#4584]: https://github.com/bytedance/deer-flow/pull/4584
[#4587]: https://github.com/bytedance/deer-flow/pull/4587
[#4589]: https://github.com/bytedance/deer-flow/pull/4589
[#4590]: https://github.com/bytedance/deer-flow/pull/4590
[#4596]: https://github.com/bytedance/deer-flow/pull/4596
[#4599]: https://github.com/bytedance/deer-flow/pull/4599
[#4600]: https://github.com/bytedance/deer-flow/pull/4600
[#4604]: https://github.com/bytedance/deer-flow/pull/4604
[#4611]: https://github.com/bytedance/deer-flow/issues/4611
[#4615]: https://github.com/bytedance/deer-flow/pull/4615
[#4617]: https://github.com/bytedance/deer-flow/pull/4617
[#4618]: https://github.com/bytedance/deer-flow/pull/4618
[#4620]: https://github.com/bytedance/deer-flow/pull/4620
[#4623]: https://github.com/bytedance/deer-flow/pull/4623
[#4624]: https://github.com/bytedance/deer-flow/pull/4624
[#4625]: https://github.com/bytedance/deer-flow/pull/4625
[#4627]: https://github.com/bytedance/deer-flow/pull/4627
[#4629]: https://github.com/bytedance/deer-flow/pull/4629
[#4631]: https://github.com/bytedance/deer-flow/pull/4631
[#4633]: https://github.com/bytedance/deer-flow/pull/4633
[#4634]: https://github.com/bytedance/deer-flow/pull/4634
[#4635]: https://github.com/bytedance/deer-flow/pull/4635
[#4636]: https://github.com/bytedance/deer-flow/pull/4636
[#4638]: https://github.com/bytedance/deer-flow/pull/4638
[#4639]: https://github.com/bytedance/deer-flow/pull/4639
[#4643]: https://github.com/bytedance/deer-flow/pull/4643
[#4644]: https://github.com/bytedance/deer-flow/pull/4644
[#4647]: https://github.com/bytedance/deer-flow/pull/4647
[#4649]: https://github.com/bytedance/deer-flow/pull/4649
[#4657]: https://github.com/bytedance/deer-flow/pull/4657
[#4658]: https://github.com/bytedance/deer-flow/pull/4658
[#4659]: https://github.com/bytedance/deer-flow/pull/4659
[#4660]: https://github.com/bytedance/deer-flow/pull/4660
[#4665]: https://github.com/bytedance/deer-flow/pull/4665
[#4667]: https://github.com/bytedance/deer-flow/pull/4667
[#4668]: https://github.com/bytedance/deer-flow/pull/4668
[#4677]: https://github.com/bytedance/deer-flow/pull/4677
[#4681]: https://github.com/bytedance/deer-flow/pull/4681
[#4683]: https://github.com/bytedance/deer-flow/pull/4683
[#4684]: https://github.com/bytedance/deer-flow/pull/4684
[#4690]: https://github.com/bytedance/deer-flow/pull/4690
[#4693]: https://github.com/bytedance/deer-flow/pull/4693
[#4701]: https://github.com/bytedance/deer-flow/pull/4701
[#4703]: https://github.com/bytedance/deer-flow/pull/4703
[#4707]: https://github.com/bytedance/deer-flow/pull/4707
[#4709]: https://github.com/bytedance/deer-flow/pull/4709
[#4713]: https://github.com/bytedance/deer-flow/pull/4713
[#4719]: https://github.com/bytedance/deer-flow/pull/4719
[#4722]: https://github.com/bytedance/deer-flow/pull/4722
[#4724]: https://github.com/bytedance/deer-flow/pull/4724
[#4727]: https://github.com/bytedance/deer-flow/pull/4727
[#4730]: https://github.com/bytedance/deer-flow/pull/4730
[#4735]: https://github.com/bytedance/deer-flow/pull/4735
[#4736]: https://github.com/bytedance/deer-flow/pull/4736
[#4737]: https://github.com/bytedance/deer-flow/pull/4737
[#4738]: https://github.com/bytedance/deer-flow/pull/4738
[#4744]: https://github.com/bytedance/deer-flow/pull/4744
[#4745]: https://github.com/bytedance/deer-flow/pull/4745
[#4747]: https://github.com/bytedance/deer-flow/pull/4747
[#4748]: https://github.com/bytedance/deer-flow/pull/4748
[#4750]: https://github.com/bytedance/deer-flow/pull/4750
[#4752]: https://github.com/bytedance/deer-flow/pull/4752
[#4755]: https://github.com/bytedance/deer-flow/pull/4755
[#4758]: https://github.com/bytedance/deer-flow/pull/4758
[#4759]: https://github.com/bytedance/deer-flow/pull/4759
[#4760]: https://github.com/bytedance/deer-flow/pull/4760
[#4762]: https://github.com/bytedance/deer-flow/pull/4762
[#4764]: https://github.com/bytedance/deer-flow/pull/4764
[#4767]: https://github.com/bytedance/deer-flow/pull/4767
[#4769]: https://github.com/bytedance/deer-flow/pull/4769
[#4772]: https://github.com/bytedance/deer-flow/pull/4772
[#4780]: https://github.com/bytedance/deer-flow/pull/4780
[#4783]: https://github.com/bytedance/deer-flow/pull/4783
[#4785]: https://github.com/bytedance/deer-flow/pull/4785
[#4789]: https://github.com/bytedance/deer-flow/pull/4789
[#4792]: https://github.com/bytedance/deer-flow/pull/4792
[#4797]: https://github.com/bytedance/deer-flow/pull/4797
[#4800]: https://github.com/bytedance/deer-flow/pull/4800
[#4804]: https://github.com/bytedance/deer-flow/pull/4804
[#4806]: https://github.com/bytedance/deer-flow/pull/4806
[#4812]: https://github.com/bytedance/deer-flow/pull/4812
[#4815]: https://github.com/bytedance/deer-flow/pull/4815
[#4816]: https://github.com/bytedance/deer-flow/pull/4816
[#4817]: https://github.com/bytedance/deer-flow/pull/4817
[#4822]: https://github.com/bytedance/deer-flow/pull/4822
[#4823]: https://github.com/bytedance/deer-flow/pull/4823
[#4825]: https://github.com/bytedance/deer-flow/pull/4825
[#4827]: https://github.com/bytedance/deer-flow/pull/4827
[#4830]: https://github.com/bytedance/deer-flow/pull/4830
[#4833]: https://github.com/bytedance/deer-flow/pull/4833
[#4836]: https://github.com/bytedance/deer-flow/pull/4836
[#4838]: https://github.com/bytedance/deer-flow/pull/4838
[#4840]: https://github.com/bytedance/deer-flow/pull/4840
[#4842]: https://github.com/bytedance/deer-flow/pull/4842
[#4844]: https://github.com/bytedance/deer-flow/pull/4844
[#4846]: https://github.com/bytedance/deer-flow/pull/4846
[#4848]: https://github.com/bytedance/deer-flow/pull/4848
[#4852]: https://github.com/bytedance/deer-flow/pull/4852
[#4853]: https://github.com/bytedance/deer-flow/pull/4853
[#4860]: https://github.com/bytedance/deer-flow/pull/4860
[#4861]: https://github.com/bytedance/deer-flow/pull/4861
[#4863]: https://github.com/bytedance/deer-flow/pull/4863
[#4865]: https://github.com/bytedance/deer-flow/pull/4865
[#4868]: https://github.com/bytedance/deer-flow/pull/4868
[#4877]: https://github.com/bytedance/deer-flow/pull/4877
[#4882]: https://github.com/bytedance/deer-flow/pull/4882
[#4887]: https://github.com/bytedance/deer-flow/pull/4887
[#4888]: https://github.com/bytedance/deer-flow/pull/4888
[#4898]: https://github.com/bytedance/deer-flow/pull/4898
[#4903]: https://github.com/bytedance/deer-flow/pull/4903
[#4911]: https://github.com/bytedance/deer-flow/pull/4911
[#4918]: https://github.com/bytedance/deer-flow/pull/4918
[#4928]: https://github.com/bytedance/deer-flow/pull/4928
[#4933]: https://github.com/bytedance/deer-flow/pull/4933
[#4936]: https://github.com/bytedance/deer-flow/pull/4936
[#4938]: https://github.com/bytedance/deer-flow/pull/4938
[#4951]: https://github.com/bytedance/deer-flow/pull/4951
[#4953]: https://github.com/bytedance/deer-flow/pull/4953
[#4956]: https://github.com/bytedance/deer-flow/pull/4956
[#4959]: https://github.com/bytedance/deer-flow/pull/4959
[#4960]: https://github.com/bytedance/deer-flow/pull/4960
[#4963]: https://github.com/bytedance/deer-flow/pull/4963
[#4965]: https://github.com/bytedance/deer-flow/pull/4965
[#4970]: https://github.com/bytedance/deer-flow/pull/4970
[#4983]: https://github.com/bytedance/deer-flow/pull/4983
[#4987]: https://github.com/bytedance/deer-flow/pull/4987
[#4998]: https://github.com/bytedance/deer-flow/pull/4998