* feat: support client context capabilities (cherry picked from commit b7c223f9415dcd545cbe05a5f5a6e47073a42d68) [Totoro-qaq: resolved onto main. The persisted-reminder middleware hunks and their tests are dropped (delivery is redesigned in a follow-up); the RunCreateRequest description moved to app/gateway/run_models.py.] * fix: address client context review comments (cherry picked from commit bce6da6b819228eda58e887872720b6f9b5fab69) [Totoro-qaq: middleware hunks dropped with the redesigned delivery.] * feat(agents): deliver client context as a request-scoped data block The cherry-picked #3106 put context.client into the persisted first-turn reminder, with change detection and a "not provided" clear marker. Main has since moved the date reminder to a SystemMessage, made request-scoped context (the project block, #5443) request-only, and agents/AGENTS.md now requires user-influenced values to ride the HumanMessage data channel, never system text. Render runtime.context["client"] on every model call in DynamicContextMiddleware.wrap_model_call/awrap_model_call as one hidden HumanMessage right after the leading SystemMessages, where DurableContext puts its data. It is never a state update and never flagged dynamic_context_reminder, so nothing is checkpointed, summarized or replayed, and a run without a client gets no block. An unchanged client keeps the previous request as the next request's prefix. The renderer sanitizes again (direct graph callers bypass the Gateway), html-escapes values and frames them with frame_untrusted_text: the same --- BEGIN/END USER INPUT --- boundary the user's own turn and the MCP task notification get. The lead prompt treats everything outside those markers as framework data, so unframed values would rank above the user's own text; framed, context.client can say nothing the same caller could not already say in input.messages. client_context joins _BLOCKED_TAG_NAMES so a forged block in user input or a tool result is escaped, and one static, value-free sentence in the lead prompt names the block as untrusted hints, never instructions, permissions or identity. The now unused empty-context marker is removed. * fix(gateway): log dropped context.client fields without values A run request is never rejected over context.client: unknown fields, nested values and malformed entries are silently dropped, the same leniency as the other context keys. That left no signal when a custom client sent something the Gateway ignored (review on #3106). Route both the config.context.client and the body context.client paths through one helper that emits a debug line whenever sanitizing changed the value. Like the malformed client_timezone branch, the line carries no values; unlike client_timezone, client.name and preference strings are free caller-controlled text, so they are never logged, not even sanitized. A clean client, an explicit null or an absent key logs nothing. Tests also pin the config-only path (sanitized before the early return) and the end-to-end start_run admission: the sanitized client reaches config["context"] and never configurable. * fix(runtime): bound numeric client context preferences String preferences are capped at 200 characters, but integers were kept at any size. A JSON body may carry integers of up to 4300 digits, so 32 of them rendered a block of about 138,000 characters, re-sent on every model call of the run. In-process callers could also pass an int past the str() digit limit, which failed the model call, or a number subclass with its own __str__. Keep integers within JavaScript's Number.MAX_SAFE_INTEGER, the range a browser client can send exactly, and coerce numbers to plain int and float. * docs(api): describe client context as advisory request-scoped hints The cherry-picked section described a hidden reminder that no longer exists. Document what a custom client can rely on: the allow-list and its limits (strings, the integer range, and only the first 32 entries of each map), debug-level logging of dropped fields, runtime-only forwarding, and delivery as a per-request user-role block, framed like user input, rather than system text or thread history. Only top-level context.client is documented. An explicit config.context.client is sanitized for the run as well, but the run record keeps the caller's config as sent, so it is not offered as an alternative. It also answers the #3106 review: capabilities and preferences are advisory hints, not enforcement, which belongs outside the model; name is informational and never for authorization; the same object should be sent on every run to keep the cached prefix stable; subagents and embedded DeerFlowClient runs do not receive it, and server-started runs (schedules, IM channels, GitHub agents, MCP notifications, extensions unless the plugin passes one) carry none. * fix(context): declare client delivery and keep client out of configurable The request-only <client_context> block is model-visible, so DynamicContextMiddleware now declares its delivery and the sanitizer's limits in release_policy_parameters(); runs before and after this change no longer share a policy fingerprint. build_run_config copies body.config['configurable'] verbatim and configurable is persisted with checkpoints, so a client placed there is dropped instead of being stored raw. Client context stays runtime-only. Document context.client in the README and in the middleware guide. * fix(context): apply the PII redaction policy to the client block DynamicContextMiddleware adds the <client_context> message inside the outer PiiRedactionMiddleware, and the hidden message is not re-sanitized, so with pii_redaction enabled a preference such as an email address reached the model verbatim while the same address in the user turn was redacted. Pass the rendered block through the shared redact_text seam with this middleware's app_config.pii_redaction, and declare the setting in release_policy_parameters(). * fix(context): keep client hints out of stored run config --------- Co-authored-by: Blair Leng <25675774+BlairLeng@users.noreply.github.com> Co-authored-by: Totoro-qaq <279883115+Totoro-qaq@users.noreply.github.com>
DeerFlow Frontend
Like the original DeerFlow 1.0, we would love to give the community a minimalistic and easy-to-use web interface with a more modern and flexible architecture.
Tech Stack
- Framework: Next.js 16 with App Router
- UI: React 19, Tailwind CSS 4, Shadcn UI, MagicUI and React Bits
- AI Integration: LangGraph SDK and Vercel AI Elements
Quick Start
Prerequisites
- Node.js 22+
- pnpm 10.26.2+
Installation
# Install dependencies
pnpm install
# Copy environment variables
cp .env.example .env
# Edit .env with your configuration
Development
# Start development server
pnpm dev
# The app will be available at http://localhost:3000
Build & Test
# Type check
pnpm typecheck
# Check formatting
pnpm format
# Apply formatting
pnpm format:write
# Lint
pnpm lint
# Run unit tests
pnpm test
# One-time setup: install Playwright Chromium browser
pnpm exec playwright install chromium
# Run E2E tests (builds and starts production server automatically)
pnpm test:e2e
# Build for production
pnpm build
# Start production server
pnpm start
Site Map
├── / # Landing page
├── /chats # Chat list
├── /chats/new # New chat page
└── /chats/[thread_id] # A specific chat page
Configuration
Environment Variables
Key environment variables (see .env.example for full list):
# Backend API URL (optional, uses local Next.js/nginx proxy by default)
NEXT_PUBLIC_BACKEND_BASE_URL="http://localhost:8001"
# LangGraph-compatible API URL (optional, uses local Next.js/nginx proxy by default)
NEXT_PUBLIC_LANGGRAPH_BASE_URL="http://localhost:8001/api"
Project Structure
tests/
├── e2e/ # E2E tests (Playwright, Chromium, mocked backend)
└── unit/ # Unit tests (mirrors src/ layout)
src/
├── app/ # Next.js App Router pages
│ ├── api/ # API routes
│ ├── showcase/ # Allowlisted public read-only demos
│ ├── workspace/ # Main workspace pages
│ └── mock/ # Mock/demo pages
├── components/ # React components
│ ├── ui/ # Reusable UI components
│ ├── workspace/ # Workspace-specific components
│ ├── landing/ # Landing page components
│ └── ai-elements/ # AI-related UI elements
├── core/ # Core business logic
│ ├── api/ # API client & data fetching
│ ├── artifacts/ # Artifact management
│ ├── config/ # App configuration
│ ├── i18n/ # Internationalization
│ ├── mcp/ # MCP integration
│ ├── messages/ # Message handling
│ ├── models/ # Data models & types
│ ├── settings/ # User settings
│ ├── skills/ # Skills system
│ ├── threads/ # Thread management
│ ├── todos/ # Todo system
│ └── utils/ # Utility functions
├── hooks/ # Custom React hooks
├── lib/ # Shared libraries & utilities
├── server/ # Server-side code
│ └── better-auth/ # Authentication setup and session helpers
└── styles/ # Global styles
Scripts
| Command | Description |
|---|---|
pnpm dev |
Start development server with Webpack |
pnpm build |
Build for production |
pnpm start |
Start production server |
pnpm test |
Run unit tests with Rstest |
pnpm test:e2e |
Run E2E tests with Playwright |
pnpm format |
Check formatting with Prettier |
pnpm format:write |
Apply formatting with Prettier |
pnpm lint |
Run ESLint |
pnpm lint:fix |
Fix ESLint issues |
pnpm typecheck |
Run TypeScript type checking |
pnpm check |
Run both lint and typecheck |
Development Notes
HTML artifact previews keep an opaque iframe sandbox. Static sibling images,
responsive image sources, classic scripts, stylesheets, CSS imports and CSS
url() resources in the same thread's artifact route are fetched by the
authenticated parent and inlined as data URLs. Existing external
resources and external <base> URLs retain their browser behavior. Resource
preparation is capped at 32 resources, 4 MiB per resource, 16 MiB total, eight
nested CSS imports, 24 MiB of expanded references and ten seconds; unavailable or oversized resources show a
partial-preview notice. Switching artifacts cancels preparation and releases
the generated document Blob URL.
Resource 401 responses remain local to the partial preview; only the document
load uses the application's login-redirect policy. Preparation preserves the
original doctype (including its absence) and handles inline SVG styles.
This supports static generated reports rather than a complete website runtime.
ES module imports, resources created dynamically by JavaScript, fetch()/XHR,
iframes and navigation still follow opaque-origin browser restrictions and do
not receive the parent session. View source or download the files when a report
requires those features.
- Uses pnpm workspaces (see
packageManagerin package.json) - Webpack is the default development bundler until the upstream Turbopack PostCSS worker leak is fixed in a stable Next.js release (#5132). Set
DEER_FLOW_DEV_BUNDLER=turboto opt in to Turbopack for local diagnosis, orDEER_FLOW_DEV_BUNDLER=webpackto select Webpack explicitly. Reconsider the default after the stable fix is verified on macOS arm64 and Linux. - Environment validation can be skipped with
SKIP_ENV_VALIDATION=1(useful for Docker) - Backend API URLs are optional; nginx proxy is used by default in development
License
MIT License. See LICENSE for details.