mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-27 05:30:39 +00:00
9d0509925e
* fix(sandbox): reject write_file payloads that are the elision placeholder The tool-output budget middleware replaces a superseded write_file payload with a deterministic placeholder in the model-bound request only. That placeholder is text the model sees in its own history, so it can imitate it and submit it back as real write_file content: #7319 reports a delivered file that was 194 bytes of placeholder. write_file now rejects a payload that is the placeholder (whole payload, allowing only surrounding whitespace) with an actionable error telling the model to read_file the target path and write the real content; nothing is written. The match is whole-payload on purpose: a substring guard would block legitimate edits to this repository, whose constants.py and persistence docs quote the template verbatim. The placeholder wording moves to one shared constant, WRITE_ELISION_PLACEHOLDER_TEMPLATE in deerflow.constants, which the middleware renders from and the guard matches on, so the two cannot drift. Regression tests fail on base (7 failed, 6 passed) and pass with the fix; near-miss payloads that merely quote the placeholder still write. Refs #7319 * fix(sandbox): match complete write elision placeholders * docs: clarify write placeholder validation scope * chore: re-trigger CLA status check * fix(sandbox): preflight async writes and trim guidance --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>