DATA
6de0bf9f5b
Vendored deer-flow upstream (bytedance/deer-flow) plus prompt-injection hardening: - New deerflow.security package: content_delimiter, html_cleaner, sanitizer (8 layers — invisible chars, control chars, symbols, NFC, PUA, tag chars, horizontal whitespace collapse with newline/tab preservation, length cap) - New deerflow.community.searx package: web_search, web_fetch, image_search backed by a private SearX instance, every external string sanitized and wrapped in <<<EXTERNAL_UNTRUSTED_CONTENT>>> delimiters - All native community web providers (ddg_search, tavily, exa, firecrawl, jina_ai, infoquest, image_search) replaced with hard-fail stubs that raise NativeWebToolDisabledError at import time, so a misconfigured tool.use path fails loud rather than silently falling back to unsanitized output - Native client back-doors (jina_client.py, infoquest_client.py) stubbed too - Native-tool tests quarantined under tests/_disabled_native/ (collect_ignore_glob via local conftest.py) - Sanitizer Layer 7 fix: only collapse horizontal whitespace, preserve newlines and tabs so list/table structure survives - Hardened runtime config.yaml references only the searx-backed tools - Factory overlay (backend/) kept in sync with deer-flow tree as a reference / source See HARDENING.md for the full audit trail and verification steps.
139 lines
4.4 KiB
Markdown
139 lines
4.4 KiB
Markdown
# DeerFlow Frontend
|
|
|
|
Like the original DeerFlow 1.0, we would love to give the community a minimalistic and easy-to-use web interface with a more modern and flexible architecture.
|
|
|
|
## Tech Stack
|
|
|
|
- **Framework**: [Next.js 16](https://nextjs.org/) with [App Router](https://nextjs.org/docs/app)
|
|
- **UI**: [React 19](https://react.dev/), [Tailwind CSS 4](https://tailwindcss.com/), [Shadcn UI](https://ui.shadcn.com/), [MagicUI](https://magicui.design/) and [React Bits](https://reactbits.dev/)
|
|
- **AI Integration**: [LangGraph SDK](https://www.npmjs.com/package/@langchain/langgraph-sdk) and [Vercel AI Elements](https://vercel.com/ai-sdk/ai-elements)
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
- Node.js 22+
|
|
- pnpm 10.26.2+
|
|
|
|
### Installation
|
|
|
|
```bash
|
|
# Install dependencies
|
|
pnpm install
|
|
|
|
# Copy environment variables
|
|
cp .env.example .env
|
|
# Edit .env with your configuration
|
|
```
|
|
|
|
### Development
|
|
|
|
```bash
|
|
# Start development server
|
|
pnpm dev
|
|
|
|
# The app will be available at http://localhost:3000
|
|
```
|
|
|
|
### Build
|
|
|
|
```bash
|
|
# Type check
|
|
pnpm typecheck
|
|
|
|
# Check formatting
|
|
pnpm format
|
|
|
|
# Apply formatting
|
|
pnpm format:write
|
|
|
|
# Lint
|
|
pnpm lint
|
|
|
|
# Build for production
|
|
pnpm build
|
|
|
|
# Start production server
|
|
pnpm start
|
|
```
|
|
|
|
## Site Map
|
|
|
|
```
|
|
├── / # Landing page
|
|
├── /chats # Chat list
|
|
├── /chats/new # New chat page
|
|
└── /chats/[thread_id] # A specific chat page
|
|
```
|
|
|
|
## Configuration
|
|
|
|
### Environment Variables
|
|
|
|
Key environment variables (see `.env.example` for full list):
|
|
|
|
```bash
|
|
# Backend API URLs (optional, uses nginx proxy by default)
|
|
NEXT_PUBLIC_BACKEND_BASE_URL="http://localhost:8001"
|
|
# LangGraph API URLs (optional, uses nginx proxy by default)
|
|
NEXT_PUBLIC_LANGGRAPH_BASE_URL="http://localhost:2024"
|
|
```
|
|
|
|
## Project Structure
|
|
|
|
```
|
|
src/
|
|
├── app/ # Next.js App Router pages
|
|
│ ├── api/ # API routes
|
|
│ ├── workspace/ # Main workspace pages
|
|
│ └── mock/ # Mock/demo pages
|
|
├── components/ # React components
|
|
│ ├── ui/ # Reusable UI components
|
|
│ ├── workspace/ # Workspace-specific components
|
|
│ ├── landing/ # Landing page components
|
|
│ └── ai-elements/ # AI-related UI elements
|
|
├── core/ # Core business logic
|
|
│ ├── api/ # API client & data fetching
|
|
│ ├── artifacts/ # Artifact management
|
|
│ ├── config/ # App configuration
|
|
│ ├── i18n/ # Internationalization
|
|
│ ├── mcp/ # MCP integration
|
|
│ ├── messages/ # Message handling
|
|
│ ├── models/ # Data models & types
|
|
│ ├── settings/ # User settings
|
|
│ ├── skills/ # Skills system
|
|
│ ├── threads/ # Thread management
|
|
│ ├── todos/ # Todo system
|
|
│ └── utils/ # Utility functions
|
|
├── hooks/ # Custom React hooks
|
|
├── lib/ # Shared libraries & utilities
|
|
├── server/ # Server-side code
|
|
│ └── better-auth/ # Authentication setup and session helpers
|
|
└── styles/ # Global styles
|
|
```
|
|
|
|
## Scripts
|
|
|
|
| Command | Description |
|
|
| ------------------- | --------------------------------------- |
|
|
| `pnpm dev` | Start development server with Turbopack |
|
|
| `pnpm build` | Build for production |
|
|
| `pnpm start` | Start production server |
|
|
| `pnpm format` | Check formatting with Prettier |
|
|
| `pnpm format:write` | Apply formatting with Prettier |
|
|
| `pnpm lint` | Run ESLint |
|
|
| `pnpm lint:fix` | Fix ESLint issues |
|
|
| `pnpm typecheck` | Run TypeScript type checking |
|
|
| `pnpm check` | Run both lint and typecheck |
|
|
|
|
## Development Notes
|
|
|
|
- Uses pnpm workspaces (see `packageManager` in package.json)
|
|
- Turbopack enabled by default in development for faster builds
|
|
- Environment validation can be skipped with `SKIP_ENV_VALIDATION=1` (useful for Docker)
|
|
- Backend API URLs are optional; nginx proxy is used by default in development
|
|
|
|
## License
|
|
|
|
MIT License. See [LICENSE](../LICENSE) for details.
|