Initial commit: hardened DeerFlow factory

Vendored deer-flow upstream (bytedance/deer-flow) plus prompt-injection
hardening:

- New deerflow.security package: content_delimiter, html_cleaner,
  sanitizer (8 layers — invisible chars, control chars, symbols, NFC,
  PUA, tag chars, horizontal whitespace collapse with newline/tab
  preservation, length cap)
- New deerflow.community.searx package: web_search, web_fetch,
  image_search backed by a private SearX instance, every external
  string sanitized and wrapped in <<<EXTERNAL_UNTRUSTED_CONTENT>>>
  delimiters
- All native community web providers (ddg_search, tavily, exa,
  firecrawl, jina_ai, infoquest, image_search) replaced with hard-fail
  stubs that raise NativeWebToolDisabledError at import time, so a
  misconfigured tool.use path fails loud rather than silently falling
  back to unsanitized output
- Native client back-doors (jina_client.py, infoquest_client.py)
  stubbed too
- Native-tool tests quarantined under tests/_disabled_native/
  (collect_ignore_glob via local conftest.py)
- Sanitizer Layer 7 fix: only collapse horizontal whitespace, preserve
  newlines and tabs so list/table structure survives
- Hardened runtime config.yaml references only the searx-backed tools
- Factory overlay (backend/) kept in sync with deer-flow tree as a
  reference / source

See HARDENING.md for the full audit trail and verification steps.

deer-flow/.agent/skills/smoke-test/scripts/check_local_env.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+set -e
+
+echo "=========================================="
+echo "  Checking Local Development Environment"
+echo "=========================================="
+echo ""
+
+all_passed=true
+
+# Check Node.js
+echo "1. Checking Node.js..."
+if command -v node >/dev/null 2>&1; then
+    NODE_VERSION=$(node --version | sed 's/v//')
+    NODE_MAJOR=$(echo "$NODE_VERSION" | cut -d. -f1)
+    if [ "$NODE_MAJOR" -ge 22 ]; then
+        echo "✓ Node.js is installed (version: $NODE_VERSION)"
+    else
+        echo "✗ Node.js version is too old (current: $NODE_VERSION, required: 22+)"
+        all_passed=false
+    fi
+else
+    echo "✗ Node.js is not installed"
+    all_passed=false
+fi
+echo ""
+
+# Check pnpm
+echo "2. Checking pnpm..."
+if command -v pnpm >/dev/null 2>&1; then
+    echo "✓ pnpm is installed (version: $(pnpm --version))"
+else
+    echo "✗ pnpm is not installed"
+    echo "  Install command: npm install -g pnpm"
+    all_passed=false
+fi
+echo ""
+
+# Check uv
+echo "3. Checking uv..."
+if command -v uv >/dev/null 2>&1; then
+    echo "✓ uv is installed (version: $(uv --version))"
+else
+    echo "✗ uv is not installed"
+    all_passed=false
+fi
+echo ""
+
+# Check nginx
+echo "4. Checking nginx..."
+if command -v nginx >/dev/null 2>&1; then
+    echo "✓ nginx is installed (version: $(nginx -v 2>&1))"
+else
+    echo "✗ nginx is not installed"
+    echo "  macOS: brew install nginx"
+    echo "  Linux: install it with the system package manager"
+    all_passed=false
+fi
+echo ""
+
+# Check ports
+echo "5. Checking ports..."
+if ! command -v lsof >/dev/null 2>&1; then
+    echo "✗ lsof is not installed, so port availability cannot be verified"
+    echo "  Install lsof and rerun this check"
+    all_passed=false
+else
+    for port in 2026 3000 8001 2024; do
+        if lsof -i :$port >/dev/null 2>&1; then
+            echo "⚠  Port $port is already in use:"
+            lsof -i :$port | head -2
+            all_passed=false
+        else
+            echo "✓ Port $port is available"
+        fi
+    done
+fi
+echo ""
+
+# Summary
+echo "=========================================="
+echo "  Environment Check Summary"
+echo "=========================================="
+echo ""
+if [ "$all_passed" = true ]; then
+    echo "✅ All environment checks passed!"
+    echo ""
+    echo "Next step: run make install to install dependencies"
+    exit 0
+else
+    echo "❌ Some checks failed. Please fix the issues above first"
+    exit 1
+fi