mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 21:26:39 +00:00
1794c40888
* fix(community): screen tavily and exa web_search result URLs The Tavily and Exa web_search tools returned provider URLs to the model unfiltered, so a loopback, link-local or metadata-service address in a result reached the agent. Brave and Serper already pass result URLs through safe_public_result_url; do the same here, blanking a non-public URL while keeping the row's title and snippet. * fix(community): screen result URLs in the remaining web_search providers youcom, tencent_wsa, serply (url and scholar pdf_url), groundroute, sofya, ddg_search, fastcrw, firecrawl and searxng handed provider-supplied URLs to the model unfiltered. Route each through safe_public_result_url, as brave, serper, tavily and exa do: a non-public URL is blanked and the row's title and snippet are kept. The test now drives every listed provider's web_search tool with a stubbed provider payload carrying a metadata, loopback or public URL. * fix(community): screen brave, serper and webz web_search result URLs The remaining text-search providers still returned result URLs verbatim. Serper's comment documented that policy; it now screens organic links like its image results. The shared provider test covers all fourteen providers and asserts the snippet survives screening. * docs(tests): describe text-search URL screening coverage --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>