mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-11 14:38:38 +00:00
* refactor(gateway): issue request trace ids unconditionally The request trace id was gated behind logging.enhance.enabled at every entry point, so downstream code had to keep asking whether one existed: a header-provenance flag in its own ContextVar, a precedence resolver, and three-level carrier fallbacks at each consumer. Bind one unconditionally instead. TraceMiddleware covers Gateway HTTP; ensure_trace_context covers the entry points that never touch ASGI -- scheduled occurrences, MCP task notification runs, IM channel messages, and the embedded client -- each scoped to one unit of work so a long-lived worker task cannot leak one occurrence's id into the next. The ContextVar becomes the only source; the response header, runtime context, run metadata and log records are derived outputs. Consumers now use ensure_trace_id() or resolve_trace_id(*carriers) and drop their presence guards. Removed: resolve_deerflow_trace_id, the header-provenance flag and its three helpers, set/reset_current_trace_id, is_trace_correlation_enabled and its gateway alias. BREAKING CHANGE: every Gateway HTTP response now carries X-Trace-Id and it cannot be turned off; logging.enhance.enabled controls log output only. Installations on the default enabled: false will start seeing the header. No config keys were added or removed. * fix(gateway): stop persisting a caller-supplied trace id on the run record body.metadata forks two ways: through build_run_config into the live run config, which the run worker restamps, and through create_or_reject into the run record that the runs API echoes verbatim. Only the first was covered, so a client sending metadata.deerflow_trace_id made the most durable and most visible surface of a run disagree with the X-Trace-Id and the log lines the same request produced -- a correlation id that does not match the logs is worse than none. Stamp the server-issued id once at the trust boundary so both forks receive it, preserving the caller's own metadata keys. Close the same gap on config.context, which reaches the runtime context by a separate path: _build_runtime_context no longer merges server-owned keys from the caller, and _install_runtime_context assigns rather than setdefaults. A thread's metadata is no longer seeded with the run-scoped id of whichever run created it -- one thread spans many runs and as many trace ids. Found by driving a real run through the Gateway and reading the run back from the runs API; every unit test built its metadata by hand and so could not see it. * fix(gateway): expose X-Trace-Id to split-origin browser clients X-Trace-Id is not on the CORS safelist, so a browser client served from a separate origin could not read it -- and those are exactly the clients that cannot read the Gateway's logs either, leaving them with nothing to quote in a bug report. Same-origin nginx deployments were unaffected, which is why this stayed hidden. Add it to CORS_EXPOSED_HEADERS beside Content-Location, referencing TRACE_ID_HEADER rather than repeating the literal. * fix(gateway): keep X-Trace-Id on unhandled-exception 500s Starlette's ServerErrorMiddleware sits outside every user middleware and emits unhandled-exception 500s through the raw send, so those responses never pass TraceMiddleware's header-writing wrapper. The 500 for a server bug is exactly the response a user most needs to correlate with a log line, and it was the one response that shipped without the id. TraceMiddleware now tracks whether http.response.start has been sent. On an exception with no response started it emits its own plain 500 carrying the header, then re-raises: the outer ServerErrorMiddleware sees the response already started and only re-raises too, so the server's exception logging is untouched. An exception mid-stream keeps propagating unchanged — a second response start cannot be sent, and the already-written header stands. The trace id is printable ASCII by construction (normalize_trace_id / generate_trace_id), which is what makes the raw latin-1 header encoding safe. * fix(gateway): strip the forged trace id from the persisted request echo The run-record fix stopped a forged metadata.deerflow_trace_id on the authoritative metadata surface, but the raw request echo still carried one: create_or_reject persists body.config verbatim as runs.kwargs_json, which the runs API serves back. A client posting config.context.deerflow_trace_id therefore still got its forged value stored and echoed on one API surface while the header, logs, run metadata, and checkpoint all carried the real id — the id is ignored as input there, so echoing it back only manufactures disagreement. Two changes close it. redact_config_secrets — already the shared scrub for that echo, applied at admission and again at serve time, so historical records are covered too — now also drops deerflow_trace_id from config.metadata and config.context. And build_run_config now merges run metadata onto a copy of the caller's config["metadata"] instead of updating it in place: the nested values of the request config are reference copies, so the in-place merge was writing the server-stamped key through into body.config, contaminating the "what the client sent" record before it was persisted (and incidentally masking the forged-value echo on the metadata container). The regression test posts a forged id through body.metadata, config.metadata, and config.context at once and reads the kwargs echo back off the run record, failing if either leak returns. * docs(harness): record the trace-echo scrub, 500 fallback, and accepted retry divergence The trace section of the harness AGENTS.md now covers the two fixes that close the derived-output rule (the kwargs-echo scrub in redact_config_secrets plus build_run_config's copy merge, and TraceMiddleware's own 500 for unhandled exceptions), and CHANGELOG gains their Fixed entries. It also writes down the one accepted divergence: a crash-recovered scheduled launch reuses the durable run through its idempotency key, and start_run returns early on idempotency_reused without restamping — so the run record keeps the first attempt's deerflow_trace_id while the retry's own log lines carry the freshly minted id of its ensure_trace_context binding. The divergence is confined to the crash-recovery window and is accepted rather than fixed: restamping on reuse would rewrite a persisted record for a run that already exists, which is worse than two ids that each correlate their own attempt's logs. Written down so the next reader of the scheduler recovery path does not diagnose it as a bug. * docs(config): align the logging.enhance schema note with the unconditional trace id The config-module AGENTS.md still described logging.enhance as the gate for the Gateway X-Trace-Id header and Langfuse deerflow_trace_id. That model is gone: ids are issued unconditionally and this block decides log output only. Left as-is, the stale wording invites an agent to "restore" a header gate it believes was lost. Reworded to match the sibling AGENTS.md files and config.example.yaml, with a pointer to the Request Trace Context section that owns the full model. * docs(changelog): link the trace entries to #5119 The five new entries pointed at the ([#XXXX]) placeholder with no reference definition, rendering as literal text instead of a link — and RELEASING.md step 2 relies on those references when the section becomes release notes. All five now point at #5119, with the definition appended to the reference block. * refactor(harness): rename _stream_without_trace_context to _stream_turn The name asserted the opposite of what the method now does. It was accurate while logging.enhance.enabled could route stream() around the trace scope; with the gate gone it is the only stream implementation left, and it binds the id itself via ensure_trace_id(). Private, so the rename touches only the definition and the one stream() call site. * docs(harness): fit the trace-context guidance inside the AGENTS.md chain budget The expanded Request Trace Context section pushed the effective AGENTS.md chain for agents/middlewares to 99,815 bytes, past the 98,304 hard limit scripts/check_agent_guidance.py enforces in CI (AG002). Compressed the section from 7,359 to 4592 bytes with no facts removed: the entry-point table, the derived-output rule and its enforcement points, the accepted scheduled-retry divergence, the two resolution helpers, the stream() binding rationale, the log-output-only gate, the CORS listing, the 500 fallback, and the test map all remain. Sized against the merge, not just the branch: current main grew the same chain by ~724 bytes, so the check was verified on the merged tree as well (97,772 bytes; branch tree 97,048). * fix(gateway): declare content-length on the fallback 500 The pre-response 500 declared content-type but no content-length, leaving the framing to the ASGI server: chunked on HTTP/1.1, close-delimited on HTTP/1.0 — the one wire difference from the ServerErrorMiddleware response it replaces, which sends content-length: 21. The explicit header keeps the fallback byte-identical to what clients saw before. * docs(readme): drop the trace-correlation condition from the translations The zh/ja/fr/ru Langfuse sections still said metadata.deerflow_trace_id matches X-Trace-Id "when request trace correlation is enabled". The id now always matches and that condition no longer exists, so each bullet states the unconditional match and that logging.enhance.enabled only controls whether the id is printed into logs — the one piece of the feature a user can still configure. * test(gateway): pin TraceMiddleware wiring through create_app() Every X-Trace-Id test exercised a hand-built four-route app, so the real stack's add_middleware(TraceMiddleware) line was pinned by nothing: deleting it — or short-circuiting above it — passed CI while silently dropping both the response header and the ambient id the run-record stamp and enhanced log records derive from. One case now drives /health through create_app() and asserts the inbound id round-trips; mutation-checked by removing the wiring line, which fails exactly this test. * docs(gateway): note the fallback 500 is CORS-opaque The pre-response 500 is emitted outside CORSMiddleware — the exception has already unwound past it — so it carries no Access-Control-Allow-Origin and a split-origin browser client cannot read the id on this one response, unchanged from the ServerErrorMiddleware 500 it replaces. Documented on the class and in the CHANGELOG entry rather than fixed: replicating the origin allowlist outside CORSMiddleware would let the two policies drift. * fix(harness): keep abandoned-stream cleanup inside the trace binding stream() binds the turn's id around each next(inner) and resets it before yielding, but the finally's inner.close() ran after that binding was gone. Abandoning the stream therefore drove the inner LangGraph generator's GeneratorExit/finally path with no trace id — or an unrelated ambient one from whichever context ran the close — so cancellation and finalization logs and callbacks did not correlate with the turn they belong to. inner.close() is now wrapped in a local bind/reset of the same turn id. The token is set and reset in the same frame, never across a yield, so the per-step cross-context safety is preserved even when GC closes the generator from another Context — pinned by the existing copy_context close test, which now exercises this path. The regression test records the id from the inner generator's finally and fails without the binding. * test(harness): teach the worker-trace fake about RunManager.cleanup Upstream #5112 (bound gateway memory after terminal runs) added a run_manager.cleanup(run_id) call to run_agent's finalization, so the merge-commit CI run failed all five worker-trace-binding tests with AttributeError on this PR's _FakeRunManager. The fake gains the same no-op shape as its other methods. * docs(gateway): bring the gateway AGENTS.md back under its soft budget Upstream #5092 grew backend/app/gateway/AGENTS.md to 40,966 bytes, 6 over the 40,960 soft budget that test_agent_guidance_check.py::test_repository_guidance_stays_below_soft_budgets_and_avoids_doc_indexes enforces — its Unit Tests run on main was cancelled by push concurrency, so main is currently red on that test and every PR merge-run inherits the failure. Two whitespace/wording trims in the row #5092 touched (a doubled space, and "its configured `context_window`" → "its `context_window`") bring the file to 40,953 with no content change. --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
308 lines
10 KiB
Python
308 lines
10 KiB
Python
"""Trace binding at the entry points that no ASGI middleware can reach.
|
|
|
|
``TraceMiddleware`` covers Gateway HTTP traffic (``test_trace_middleware.py``)
|
|
and ``DeerFlowClient.stream`` covers embedded callers
|
|
(``test_client_langfuse_metadata.py``). The remaining ways work enters DeerFlow
|
|
hold no HTTP request at all: the scheduled-task poller, MCP task notification
|
|
runs, and IM channels, which keep long-lived provider connections. Each must
|
|
bind a trace id of its own, scoped to one unit of work, or everything
|
|
downstream falls back to an unattributed id.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from datetime import UTC, datetime, timedelta
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
|
|
from app.channels.manager import ChannelManager
|
|
from app.channels.message_bus import InboundMessage, MessageBus
|
|
from app.channels.store import ChannelStore
|
|
from app.scheduler.service import ScheduledTaskService
|
|
from deerflow.config.app_config import AppConfig, reset_app_config, set_app_config
|
|
from deerflow.trace_context import get_current_trace_id, request_trace_context
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Scheduled tasks
|
|
# --------------------------------------------------------------------------
|
|
|
|
|
|
class _StubTaskRepo:
|
|
def __init__(self, rows):
|
|
self.rows = rows
|
|
self.claimed = False
|
|
|
|
async def claim_due_tasks(self, **_kwargs):
|
|
if self.claimed:
|
|
return []
|
|
self.claimed = True
|
|
return self.rows
|
|
|
|
async def claim_dispatch_lease(self, task_id, **_kwargs):
|
|
return next((dict(row) for row in self.rows if row["id"] == task_id), None)
|
|
|
|
async def release_queued_admission_lease(self, task_id):
|
|
return False
|
|
|
|
async def release_dispatch_lease(self, task_id, **_kwargs):
|
|
return True
|
|
|
|
async def get_internal(self, task_id):
|
|
row = next((item for item in self.rows if item["id"] == task_id), None)
|
|
return dict(row) if row is not None else None
|
|
|
|
async def update_after_launch(self, *_args, **_kwargs):
|
|
return None
|
|
|
|
|
|
class _StubRunRepo:
|
|
async def list_queued_runs(self, *, limit):
|
|
return []
|
|
|
|
async def expire_queued_runs(self, **_kwargs):
|
|
return []
|
|
|
|
async def recover_expired_launch_claims(self, **_kwargs):
|
|
return 0
|
|
|
|
async def get_active_run(self, task_id):
|
|
return None
|
|
|
|
async def claim_queued_run(self, run_record_id, **_kwargs):
|
|
return {"id": run_record_id, "status": "launching"}
|
|
|
|
async def create(self, **kwargs):
|
|
return {"id": kwargs["run_record_id"]}
|
|
|
|
async def reconcile_launched_run(self, run_record_id, **_kwargs):
|
|
return True
|
|
|
|
async def update_status(self, run_record_id, **_kwargs):
|
|
return True
|
|
|
|
|
|
def _scheduled_task(task_id: str) -> dict:
|
|
return {
|
|
"id": task_id,
|
|
"user_id": "user-1",
|
|
"thread_id": f"thread-{task_id}",
|
|
"context_mode": "reuse_thread",
|
|
"assistant_id": "lead_agent",
|
|
"prompt": "Summarize thread",
|
|
"schedule_type": "once",
|
|
"schedule_spec": {"run_at": "2026-07-02T01:00:00+00:00"},
|
|
"timezone": "UTC",
|
|
}
|
|
|
|
|
|
def _make_service(rows, launch_run) -> ScheduledTaskService:
|
|
return ScheduledTaskService(
|
|
task_repo=_StubTaskRepo(rows),
|
|
task_run_repo=_StubRunRepo(),
|
|
launch_run=launch_run,
|
|
poll_interval_seconds=5,
|
|
lease_seconds=120,
|
|
max_concurrent_runs=3,
|
|
)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_scheduled_launch_runs_under_a_bound_trace_id():
|
|
launched: list[str | None] = []
|
|
|
|
async def fake_launch(**kwargs):
|
|
launched.append(get_current_trace_id())
|
|
return {"run_id": "run-1", "thread_id": kwargs["thread_id"]}
|
|
|
|
service = _make_service([_scheduled_task("task-1")], fake_launch)
|
|
|
|
await service.run_once(now=datetime.now(UTC) + timedelta(days=1))
|
|
|
|
assert launched == [launched[0]]
|
|
assert launched[0], "a scheduled occurrence must not launch without a trace id"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_each_scheduled_occurrence_gets_its_own_trace_id():
|
|
"""One id per poll cycle would merge unrelated tasks into a single trace."""
|
|
launched: list[str | None] = []
|
|
|
|
async def fake_launch(**kwargs):
|
|
launched.append(get_current_trace_id())
|
|
return {"run_id": "run-1", "thread_id": kwargs["thread_id"]}
|
|
|
|
service = _make_service([_scheduled_task("task-1"), _scheduled_task("task-2")], fake_launch)
|
|
|
|
await service.run_once(now=datetime.now(UTC) + timedelta(days=1))
|
|
|
|
assert len(launched) == 2
|
|
assert all(launched)
|
|
assert launched[0] != launched[1]
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_scheduled_trace_scope_closes_after_the_occurrence():
|
|
"""The poller task is long-lived, so a leaked binding would attribute every
|
|
later cycle to the first occurrence it ever ran."""
|
|
|
|
async def fake_launch(**kwargs):
|
|
return {"run_id": "run-1", "thread_id": kwargs["thread_id"]}
|
|
|
|
service = _make_service([_scheduled_task("task-1")], fake_launch)
|
|
|
|
await service.run_once(now=datetime.now(UTC) + timedelta(days=1))
|
|
|
|
assert get_current_trace_id() is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_manual_trigger_keeps_the_requesting_trace():
|
|
"""A manual trigger arrives inside a Gateway request, so the launched run
|
|
stays correlated with the call that asked for it."""
|
|
launched: list[str | None] = []
|
|
|
|
async def fake_launch(**kwargs):
|
|
launched.append(get_current_trace_id())
|
|
return {"run_id": "run-1", "thread_id": kwargs["thread_id"]}
|
|
|
|
task = _scheduled_task("task-1")
|
|
service = _make_service([task], fake_launch)
|
|
|
|
with request_trace_context("gateway-request-1"):
|
|
await service.dispatch_task(task, now=datetime.now(UTC), trigger="manual")
|
|
|
|
assert launched == ["gateway-request-1"]
|
|
|
|
|
|
# --------------------------------------------------------------------------
|
|
# IM channels
|
|
# --------------------------------------------------------------------------
|
|
|
|
|
|
def _inbound(index: int) -> InboundMessage:
|
|
return InboundMessage(
|
|
channel_name="slack",
|
|
chat_id="C1",
|
|
user_id="U1",
|
|
text=f"message-{index}",
|
|
metadata={},
|
|
)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_inbound_messages_are_handled_under_distinct_trace_scopes(tmp_path: Path):
|
|
"""Channels hold long-lived provider connections, so no ASGI middleware
|
|
ever runs for them, and one worker task serves many messages in sequence."""
|
|
bus = MessageBus(inbound_queue_maxsize=4)
|
|
manager = ChannelManager(
|
|
bus=bus,
|
|
store=ChannelStore(path=tmp_path / "store.json"),
|
|
max_concurrency=1,
|
|
)
|
|
seen: list[str | None] = []
|
|
|
|
async def capture_handler(msg: InboundMessage) -> None:
|
|
seen.append(get_current_trace_id())
|
|
|
|
manager._handle_message = capture_handler # type: ignore[method-assign]
|
|
await manager.start()
|
|
try:
|
|
await bus.publish_inbound(_inbound(0))
|
|
await bus.publish_inbound(_inbound(1))
|
|
async with asyncio.timeout(2):
|
|
while len(seen) < 2:
|
|
await asyncio.sleep(0)
|
|
finally:
|
|
await manager.stop()
|
|
|
|
assert all(seen), "an inbound message must not be handled without a trace id"
|
|
assert seen[0] != seen[1], "each message is its own unit of work"
|
|
assert get_current_trace_id() is None
|
|
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Gateway run launchers
|
|
# --------------------------------------------------------------------------
|
|
|
|
|
|
@pytest.fixture
|
|
def _stub_app_config():
|
|
"""Keep the launchers independent from a developer-local config.yaml."""
|
|
set_app_config(AppConfig.model_validate({"sandbox": {"use": "deerflow.sandbox.local:LocalSandboxProvider"}}))
|
|
yield
|
|
reset_app_config()
|
|
|
|
|
|
@pytest.fixture
|
|
def launcher_traces(monkeypatch):
|
|
"""Capture the trace id bound around each ``start_run`` the launchers make."""
|
|
seen: list[str | None] = []
|
|
|
|
async def fake_start_run(_body, thread_id, _request, **_kwargs):
|
|
seen.append(get_current_trace_id())
|
|
return SimpleNamespace(run_id="run-1", thread_id=thread_id)
|
|
|
|
monkeypatch.setattr("app.gateway.services.start_run", fake_start_run)
|
|
return seen
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_scheduled_launcher_binds_a_trace_context(_stub_app_config, launcher_traces):
|
|
from app.gateway.services import launch_scheduled_thread_run
|
|
|
|
await launch_scheduled_thread_run(
|
|
app=SimpleNamespace(),
|
|
thread_id="thread-sched",
|
|
assistant_id="lead_agent",
|
|
prompt="Summarize thread",
|
|
owner_user_id="user-1",
|
|
metadata={"scheduled_task_run_id": "run-row-1"},
|
|
)
|
|
|
|
assert launcher_traces[0], "a scheduled launch must not reach start_run untraced"
|
|
assert get_current_trace_id() is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_mcp_notification_launcher_binds_a_trace_context(_stub_app_config, launcher_traces):
|
|
"""Driven from the MCP task service's own background loop, so one scope per
|
|
notification keeps every delivery attempt separately correlatable."""
|
|
from app.gateway.services import launch_mcp_task_notification_run
|
|
|
|
for attempt in (1, 2):
|
|
await launch_mcp_task_notification_run(
|
|
app=SimpleNamespace(),
|
|
thread_id="thread-mcp",
|
|
assistant_id="lead_agent",
|
|
owner_user_id="user-1",
|
|
task_id="task-1",
|
|
dispatch_version=1,
|
|
dispatch_attempt=attempt,
|
|
event={"status": "completed"},
|
|
)
|
|
|
|
assert all(launcher_traces)
|
|
assert launcher_traces[0] != launcher_traces[1]
|
|
assert get_current_trace_id() is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_launcher_keeps_the_requesting_trace(_stub_app_config, launcher_traces):
|
|
"""Reached from inside a Gateway request -- a manual scheduled trigger --
|
|
the launched run stays correlated with the call that asked for it."""
|
|
from app.gateway.services import launch_scheduled_thread_run
|
|
|
|
with request_trace_context("gateway-request-1"):
|
|
await launch_scheduled_thread_run(
|
|
app=SimpleNamespace(),
|
|
thread_id="thread-sched",
|
|
assistant_id="lead_agent",
|
|
prompt="Summarize thread",
|
|
owner_user_id="user-1",
|
|
)
|
|
|
|
assert launcher_traces == ["gateway-request-1"]
|