mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 13:16:24 +00:00
72933db4e9
Follow-up to #5833 after an independent review of the merged code. - A malformed answer (deeply nested JSON raising RecursionError, or a huge noul integer raising OverflowError outside the try) escaped the fail-open path, and in the per-message task group it cancelled the other messages' requests and dropped every flag of that tool call. Parsing now happens inside the try, which also catches those errors. - The 16 KiB response cap counted decoded bytes, so a compressed body could expand far past it first. Requests now ask for identity encoding and drop encoded responses. - A plain-HTTP loopback endpoint followed HTTP_PROXY/ALL_PROXY, sending the bearer key and excerpt to the proxy in cleartext. Such endpoints now ignore proxy environment variables; HTTPS endpoints keep them. Tests cover each case, including a real local server behind an unreachable proxy, and pin previously untested behavior: independent per-request deadlines, the sync hook without a task store, the >= threshold and all four named remote tools, warnings for messages that share a tool-call ID, consumed flags, and scanning past host messages. The root README no longer says the excerpt is always PII-redacted, and the example README documents the new limits and that the sync path's deadline does not cover a stalled DNS lookup. Co-authored-by: Totoro-qaq <279883115+Totoro-qaq@users.noreply.github.com>