mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-06 21:08:43 +00:00
8ade23d779
* fix(artifacts): honor trusted owner-user-id header The artifact endpoint resolved paths only via the effective user, so a trusted internal caller acting on behalf of an owner (carrying X-DeerFlow-Owner-User-Id) read the synthetic internal user's storage and 404'd on files the owner's run had written. Resolve the owner via get_trusted_internal_owner_user_id and pass it through resolve_thread_virtual_path (now accepting an optional user_id), matching the memory and threads routers. Browser/API callers send no such header and fall back to the effective user, so their behavior is unchanged. * fix(artifacts): normalize trusted owner id through make_safe_user_id The owner-user-id header carries the raw platform owner id, while runs store files under the make_safe_user_id bucket. Resolve artifacts with the normalized id, mirroring the memory router.