mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-11-12 14:00:35 +00:00
2a97ec3e58
* docs: turn README into an index and move reference detail to docs/guide The README had grown to 393 KB because every change appended its notes there. The text moves verbatim into 18 topic guides under docs/guide/; only headings are re-leveled and relative links re-pointed. The README keeps the introduction, a quick start and a guide index. Contributor test notes move to CONTRIBUTING.md. * docs: send user docs to topic guides and budget the root README The rule 'update README.md for user-facing changes' is what grew the README. Guidance now points to docs/guide/, and check_agent_guidance.py fails when the root README exceeds 16 KiB (AG003). * chore: remove unreferenced screenshots and finished plan notes pr-build/ holds two PR screenshots (3 MB) from #1986. plans/ holds the plan for the merged #4049. docs/SKILL_NAME_CONFLICT_FIX.md is a February change note. Nothing references them. * docs: route always-loaded AGENTS.md files to scoped guides * docs(agents): cut scoped guides to scope, verify, traps, decisions Each AGENTS.md keeps four kinds of content: the scope of the directory, the verification commands, traps a local test run does not show, and decisions the code cannot state. Values, field lists, function inventories, test names, issue numbers and history are deleted, because the code, the tests and git state them. Search and fetch providers share one community guide. Four guides with no remaining content are removed. The size check now allows 6 KiB per file (hard limit 8 KiB) and 24 KiB per chain (hard limit 32 KiB). * style: format frontend guide table and guidance test imports --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
1.8 KiB
1.8 KiB
Authentication state (core/auth/)
cd frontend && pnpm rstest run core/auth
Query ownership
AuthProviderpublishes the query owner: a user ID, confirmed logout, or unknown. It stays outsideQueryClientProvider. An owner change remounts the consumers with a new client, clears the old cache and cancels its queries, so one account never reads another account's cache.- Confirmed logout unmounts the consumers at once. A refresh that was superseded cannot restore an earlier owner.
Recovery from unknown auth
- Connectivity alone never authenticates. A visible
onlineevent revalidates unknown auth. Confirmed logout and static demos do not probe. - Wakeups are single-flight. Only the current request releases the in-flight guard. Reconnects during a pending refresh collapse into one follow-up, which runs only if auth is still unknown.
isLoadingstays in the effect dependencies, so a failed request that leaves auth unchanged still drains pending wakeups.
Disabled accounts and redirects
account_disabledmaps to a login redirect with a stated reason on three surfaces: the server-side auth result, the shared fetcher's 401 handling andAuthProvider.refreshUser. Sign-up keeps the backend message, so a suspended account cannot be probed.- A sign-in bounce keeps path, query and fragment. The workspace layout
cannot read the URL, so the unauthenticated case renders
WorkspaceLoginRedirectand notredirect(), and never renderschildren. - The admin users page parses both endpoints with
userSchema, so a malformed payload fails the load and no phantom row appears. It sends only{disabled}. Like model management, it does not query in static-website mode. - Forms trim emails and leave passwords unchanged.