Aari c24bf383e5

fix(gateway): expose the run metadata header to split-origin clients (#4535) ...

A browser client served from a different origin than the Gateway never
learns the id of the run it just created, so a brand-new thread keeps its
placeholder route for the whole session and every action gated on an
established thread — edit and rerun, regenerate, branch — stays hidden
until the page is reloaded.

Run-creating routes return the run's id in `Content-Location`, and the
LangGraph SDK resolves run metadata from that header alone. It is not
CORS-safelisted, so a cross-origin response hides it from JS unless the
server lists it in `Access-Control-Expose-Headers`. `useStream`'s
`onCreated` therefore never fires and the app cannot rewrite its route.

Expose it. `GATEWAY_CORS_ORIGINS` is a supported deployment mode, so the
CORS middleware has to carry everything that mode needs to read. Same-origin
nginx deployments are unaffected because CORS never applies to them.

2026-07-29 00:09:02 +08:00

..

channels

feat(channels): share inbound webhook dedupe across pods via Postgres (#4210)

2026-07-27 23:07:40 +08:00

gateway

fix(gateway): expose the run metadata header to split-origin clients (#4535)

2026-07-29 00:09:02 +08:00

scheduler

fix(scheduler): close duplicate dispatch race (#4105)

2026-07-24 21:41:09 +08:00

__init__.py

refactor: split backend into harness (deerflow.*) and app (app.*) (#1131)

2026-03-14 22:55:52 +08:00