Commit Graph

  • 1300c6d36b
    feat(authz): add pluggable AuthorizationProvider protocol and config scaffolding (Phase 0, #4063) (#4127) hataa 2026-07-15 10:03:33 +08:00
  • f3e4e5f8f0
    ci(helm): publish chart to charts/ namespace prefix on GHCR (#4175) Zheng Feng 2026-07-15 08:54:36 +08:00
  • 0dd90ccfde
    fix(agents): require config.yaml in update_agent's legacy-agent guard (#4166) Daoyuan Li 2026-07-14 17:13:17 -07:00
  • 8e96a6a252
    fix(security): html-escape the conversation block in MEMORY_UPDATE_PROMPT (#4162) Aari 2026-07-14 23:35:46 +08:00
  • 656f6b364c
    fix(skills): recognize fully deleted public skill packages in review CI (#4169) Daoyuan Li 2026-07-14 08:08:33 -07:00
  • 713ee544b7
    fix(agents): stop persisting base64 image data in checkpoint state (#4140) qin-chenghan 2026-07-14 23:02:26 +08:00
  • 51bb19fa1b
    fix(channels): drop redundant GitHub review-comment webhook fan-out (#4131) Daoyuan Li 2026-07-14 07:56:50 -07:00
  • 60e50537f3
    fix(subagents): prohibit task tool in general-purpose system prompt (#4161) qin-chenghan 2026-07-14 22:51:21 +08:00
  • 9c77046d10
    fix(middleware): drop orphan ToolMessages so strict providers don't 400 (#4080) 黄云龙 2026-07-14 22:43:47 +08:00
  • cdefd4a8aa
    fix(mcp): invalidate tools cache on config content + path, not just newer mtime (#4124) Daoyuan Li 2026-07-14 07:40:51 -07:00
  • abd0c7a585
    docs(api): document stateless /api/runs/stream endpoint (#4177) yym36991 2026-07-14 22:33:57 +08:00
  • c57cf221d3
    fix(security): html-escape the summary input blocks in the summarization prompt (#4182) Aari 2026-07-14 21:51:47 +08:00
  • e492bb1c68
    fix(middleware): window LoopDetection tool-frequency counter so long runs don't false-trip (#4072) 黄云龙 2026-07-14 21:45:37 +08:00
  • 88a1311fe8
    fix(DB): legacy backfill creates missing Index objects on existing tables (#4090) 黄云龙 2026-07-14 21:41:35 +08:00
  • 13fd8e229a
    fix(checkpoint): persist run duration in checkpoints for history reads (#4118) Vanzeren 2026-07-14 21:37:47 +08:00
  • fabadae416
    add Volcengine Coding Plan to quikly setup (#4141) pclin 2026-07-14 13:01:58 +08:00
  • 192ea5155e
    Revert "fix(firecrawl): align tools with installed firecrawl-py v2 SDK surfac…" (#4165) Willem Jiang 2026-07-14 11:57:48 +08:00
  • b7b4b49bfe
    fix(firecrawl): align tools with installed firecrawl-py v2 SDK surface (#4151) 黄云龙 2026-07-14 11:29:47 +08:00
  • 24648194ae
    fix(frontend): show branch action only for completed turns (#4147) Huixin615 2026-07-14 11:11:43 +08:00
  • 41b137c4c4
    fix(security): block forged framework tags in the input guardrail (#4155) Aari 2026-07-14 11:04:11 +08:00
  • 446fa03801
    fix(context): resolve context compress bug (#4065) AnoobFeng 2026-07-14 10:43:13 +08:00
  • 81b3ed0188
    fix(skillscan): recognize remaining outbound network sinks (#4153) Aari 2026-07-14 09:55:38 +08:00
  • 79cdd99fca
    fix(mcp): validate MCP tool names at load so deferred prompts stay inert (#4154) Aari 2026-07-14 09:49:43 +08:00
  • e2816eaa97
    fix(models): scope the OpenAI-compat rules to BaseChatOpenAI, not a class-path allowlist (#4146) Aari 2026-07-14 09:32:53 +08:00
  • 4af6178358
    feat(trace): add agent observability with Monocle (#4024) Mohammed Ansari 2026-07-13 17:58:06 -07:00
  • e361122b9a
    fix(security): html-escape subagent descriptions before the <subagent_system> block (#4157) Yufeng He 2026-07-14 08:14:21 +08:00
  • 8cc4b3abeb
    fix(sandbox): the sandbox provisioner api exposes endpoints need to check API KEY (#4116) OrbisAI Security 2026-07-14 05:21:59 +05:30
  • e32456d337
    fix(memory): coerce stored confidence in the three remaining raw reads (#4034) Aari 2026-07-14 07:40:49 +08:00
  • b53c1ae0e0
    fix(runs): cancel degrades to lease takeover for multi-worker (#4064) heart-scalpel 2026-07-14 07:37:59 +08:00
  • 3e7baba39a
    fix(models): apply stream_chunk_timeout default to all BaseChatOpenAI subclasses (#4102) Daoyuan Li 2026-07-13 06:28:44 -07:00
  • a94ea9325b
    fix(agents): load SOUL.md from agent dirs without config.yaml (#4136) qin-chenghan 2026-07-13 21:13:33 +08:00
  • 807c3c5218
    fix(security): html-escape SOUL.md before it enters the <soul> prompt block (#4137) Yufeng He 2026-07-13 19:33:40 +08:00
  • 4e209827f3
    feat(agent): Add subagent total delegation cap (#4115) DanielWalnut 2026-07-13 19:26:07 +08:00
  • 95a35f3725
    docs(deployment-guide): fix stale userdata PVC subPath (#4139) Xinmin Zeng 2026-07-13 19:08:13 +08:00
  • 63e2da1401
    fix landing hero background positioning (#4092) nonoge 2026-07-13 17:38:49 +07:00
  • 2fa0505070
    fix(skills): activate a slash skill once per run, not per model call (#4103) Daoyuan Li 2026-07-13 03:38:32 -07:00
  • bcee5a9061
    refactor(sandbox): give the host→virtual output-mask regex a single owner (#4108) Aari 2026-07-13 18:34:41 +08:00
  • 62f905342c
    fix(tool_search): remove MAX_RESULTS cap on select: exact-name lookups (#4086) 黄云龙 2026-07-13 17:57:34 +08:00
  • 37580862b9
    fix(channels): scope the slash-skill whitelist check to the run's owner (#4129) Aari 2026-07-13 16:14:36 +08:00
  • cbbd72a1ab
    fix(skillscan): recognize remaining requests/httpx HTTP methods as network sinks (#4130) Yufeng He 2026-07-13 16:11:17 +08:00
  • 216309426f
    test(front): cover artifact image path variants (#4134) chaoxi007 2026-07-13 12:40:42 +08:00
  • 42544755ac
    fix(skills): escape untrusted skill metadata before it enters the model prompt (#4128) Aari 2026-07-13 10:40:22 +08:00
  • 2bd0f56a0f
    fix(subagents): classify recursion-capped LLM error fallbacks as failed (#4056) Daoyuan Li 2026-07-12 09:06:46 -07:00
  • 08fd218b83
    fix(sandbox): use os.sep in reverse-resolve containment check on Windows (#4058) Daoyuan Li 2026-07-12 09:01:22 -07:00
  • c82fba41d9
    fix(sandbox): guard the command path-translation regex with a segment boundary (#4110) Aari 2026-07-12 23:42:58 +08:00
  • 0542d3c5f3
    fix(sandbox): allow bash after cwd setup failure (#4051) 明年我18 2026-07-12 23:40:52 +08:00
  • 897be7e064
    fix(skillscan): detect os.environ access via from-import pattern (#4087) 黄云龙 2026-07-12 23:34:26 +08:00
  • 224f8de2cf
    fix(goal): prevent continuation_count regression from racing continuations (#4088) 黄云龙 2026-07-12 23:33:52 +08:00
  • 035045716e
    fix: CVE-2026-33128 security vulnerability (#4125) OrbisAI Security 2026-07-12 20:52:46 +05:30
  • 490deeb931
    fix(memory): coerce null source.confidence so it no longer blocks memory updates (#4074) 黄云龙 2026-07-12 23:22:09 +08:00
  • 6af6cfc70b
    fix(memory): don't gate memory-update parse on optional factsToRemove key (#4075) 黄云龙 2026-07-12 23:14:21 +08:00
  • c4b651fb9d
    Fix lost loop_capped stop reason when a subagent's run_id is None (#4059) Daoyuan Li 2026-07-12 08:12:20 -07:00
  • d2ab5bb819
    fix(sandbox): str_replace on empty file only returns OK when old_str is empty (#4079) 黄云龙 2026-07-12 23:04:59 +08:00
  • d8d8a34114
    fix(memory): coerce null confidence when ranking search results (#4076) 黄云龙 2026-07-12 23:00:45 +08:00
  • a9145e426c
    feat(frontend): show real project version on About page (#4126) Zheng Feng 2026-07-12 22:54:03 +08:00
  • 2730ee1f7b
    fix(memory): replace busy timer spin with deferred single re-run flag (#4073) 黄云龙 2026-07-12 20:41:41 +08:00
  • 65d474202f
    fix(front): Show assistant text during tool steps (#4114) DanielWalnut 2026-07-12 19:50:15 +08:00
  • feb287077e
    fix(security): html-escape memory context summaries rendered into the injection prompt (#4119) Aari 2026-07-12 18:22:22 +08:00
  • 74392e1470
    Fix require_mention gating on whitespace-only bot_login/mention_login (#4055) Daoyuan Li 2026-07-12 00:51:22 -07:00
  • 8be7411da8
    fix(runtime): serialize SQLite event-store writes to prevent per-thread seq collisions (#4077) 黄云龙 2026-07-12 13:03:02 +08:00
  • b650456c6d
    fix(streaming): drop silent delta-discard in _merge_stream_text (#4085) 黄云龙 2026-07-12 12:13:02 +08:00
  • b963282f5e
    fix(mcp): per-server fail-soft OAuth priming + persist rotated refresh_token (#4084) 黄云龙 2026-07-12 11:59:36 +08:00
  • 18c32beaf1
    fix(runs): re-buffer subagent event batch on flush failure instead of dropping (#4082) 黄云龙 2026-07-12 11:51:31 +08:00
  • f85ee590e1
    docs(backend): add IM channel connections and GitHub agents architecture diagrams (#4112) 黄云龙 2026-07-12 11:42:55 +08:00
  • 97e2268d52
    fix(sandbox): stop glob/grep/ls from surfacing disabled skills' files (#4096) Aari 2026-07-12 11:32:41 +08:00
  • 5edc7a889e
    fix(security): neutralize prompt-injection tags in web_capture results (#4099) Daoyuan Li 2026-07-11 20:24:24 -07:00
  • 158c4f9622
    fix(security): html-escape memory facts rendered into the injection prompt (#4097) Aari 2026-07-12 11:03:46 +08:00
  • 736c412b4c
    fix: CVE-2026-35209 security vulnerability (#4106) OrbisAI Security 2026-07-12 06:43:50 +05:30
  • 7bdf9412cc
    fix(front): stabilize artifact paths during streaming (#4094) Huixin615 2026-07-12 09:00:12 +08:00
  • 88b0484898
    fix(channels): validate channel provider before resolving its config (#4100) Daoyuan Li 2026-07-11 17:54:03 -07:00
  • 64837b6c45
    fix: CVE-2026-49477 security vulnerability (#4093) OrbisAI Security 2026-07-12 06:11:16 +05:30
  • c143c0415b
    fix(config): Make the sync checkpointer honor the unified database config (#3994) Daoyuan Li 2026-07-11 17:15:32 -07:00
  • 0519c8a5cd
    fix(wecom): guard null quote fields in _on_ws_text to prevent AttributeError (#4069) 黄云龙 2026-07-12 07:52:45 +08:00
  • 1ebf59fe24
    fix(tools): stop capping tool_search's select: at MAX_RESULTS (#4054) Aari 2026-07-12 00:17:11 +08:00
  • 9101fb6a67
    fix: CVE-2026-49476 security vulnerability (#4089) OrbisAI Security 2026-07-11 21:40:48 +05:30
  • 1df9abc924
    fix(sandbox): guard the output-masking regex with a segment boundary (#4053) Aari 2026-07-11 23:32:11 +08:00
  • 97935b081b
    fix(front): resolve relative artifact image paths (#4038) chaoxi007 2026-07-11 23:23:35 +08:00
  • 08fdf61516
    fix(sandbox): handle one-sided line ranges in read_file (#4078) 黄云龙 2026-07-11 23:20:53 +08:00
  • ca18cf0b24
    fix(agent): reserve ellipsis room so the local title respects max_chars (#4052) Aari 2026-07-11 23:15:03 +08:00
  • 8ade23d779
    fix(artifacts): honor trusted owner-user-id header (#3982) d33kayyy 2026-07-11 22:05:03 +07:00
  • 2839a3632e
    fix(frontend): avoid highlighting code while streaming (#4068) Huixin615 2026-07-11 22:56:29 +08:00
  • ad9ec65c6f
    fix(stream_bridge): add stream_exists to MemoryStreamBridge, fixing SSE hang on reconnect after cleanup (#4071) 黄云龙 2026-07-11 22:46:10 +08:00
  • 4fd521e88e
    fix(guardrails): empty allowlist must deny all tools instead of failing open (#4067) 黄云龙 2026-07-11 18:40:07 +08:00
  • 7d1a8fb753
    ci: add nightly build for images + helm chart (#4050) Zheng Feng 2026-07-11 18:29:48 +08:00
  • 3bc3af2530
    fix(runs): close multi-worker ownership gaps in run atomicity (#3948) (#4003) heart-scalpel 2026-07-11 16:05:30 +08:00
  • 41658c5ff4
    feat(skills): add skill review quality gate (#4037) Ryker_Feng 2026-07-11 15:58:07 +08:00
  • 6389fc03fd
    fix: ensure visible response after tool runs (#4033) Huixin615 2026-07-11 15:53:14 +08:00
  • aafd5077b2
    feat(subagents): show effective model and token usage on task cards (#4049) Nan Gao 2026-07-11 09:41:57 +02:00
  • 938391c1ab
    fix(memory): html-escape memory state in MEMORY_UPDATE_PROMPT (#4044) (#4060) 黄云龙 2026-07-11 15:34:14 +08:00
  • c2002d9fac
    feat(memory): add memory tool sets (#4023) Vanzeren 2026-07-11 15:28:16 +08:00
  • bbb3deb231
    fix(subagents): classify LLM error fallbacks as failed (#4042) Nan Gao 2026-07-11 03:25:15 +02:00
  • d6b6b7f1b0
    test: add unit tests for deerflow.utils.llm_text (#4046) 黄云龙 2026-07-11 09:18:12 +08:00
  • 54f3c43fe3
    fix(security): html-escape fact content in memory prompt sections (#4028) Tianye Song 2026-07-11 08:54:45 +08:00
  • 747806a9f6
    docs(i18n): sync Langfuse tracing sections into ja/fr/ru README translations (#4045) 黄云龙 2026-07-11 08:38:35 +08:00
  • 8fbf101de3
    fix(subagents): inject durable context before compaction (#4040) Nan Gao 2026-07-11 02:29:42 +02:00
  • 79611673d7
    Fix circuit breaker wedging after a non-retriable half-open probe (#3991) Daoyuan Li 2026-07-10 16:54:15 -07:00
  • be637163a6
    feat(frontend): add voice dictation input (#4036) Ryker_Feng 2026-07-10 23:13:06 +08:00
  • a2a949b178
    Fix UnboundLocalError in memory injection when facts are empty (#3992) Daoyuan Li 2026-07-10 07:27:56 -07:00
  • 1fa91fa39d
    Fix AttributeError in ThreadDataMiddleware when runtime.context is None (#3989) Daoyuan Li 2026-07-10 07:13:50 -07:00
  • 446ae98649
    fix(sandbox): guard the reverse path-translation regex with a segment boundary (#4035) Aari 2026-07-10 21:38:08 +08:00