The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
README.md	2026-09-24	22.8 kB	0
v2.1.0 Release source code.tar.gz	2026-09-24	26.3 MB	1
v2.1.0 Release source code.zip	2026-09-24	28.0 MB	0
Totals: 3 Items		54.3 MB	1

DeerFlow 2.1.0

DeerFlow 2.1 builds on the 2.0 super-agent harness with a focus on trust, scale, and operability: verifiable agent execution, durable batch delegation, pluggable memory backends, four new sandbox providers, an out-of-tree extension system, and enterprise-grade authentication and authorization — wrapped in a much richer workspace with projects, conversation branching, and referenced conversations.

This release closes the 2.1.0 milestone with 772 merged PRs since the 2.0.0 release.

📖 Full notes: CHANGELOG.md · 中文版

⚠️ Breaking changes

Trace ids are unconditional — every Gateway HTTP response carries an X-Trace-Id header, and logging.enhance.enabled now controls log output only. Client-supplied deerflow_trace_id values in run metadata are overwritten so header, logs, and the persisted run cannot disagree — send the X-Trace-Id request header to pin a correlation id. ([#5119])
/mnt/skills is reserved for managed enabled-only skill projections. DEER_FLOW_HOST_SKILLS_PATH / SKILLS_HOST_PATH are no longer used, and E2B operator mounts targeting that path are skipped with a warning. ([#4178])
sandbox.replicas is enforced for E2B as a capacity limit; the default wait policy can now fail the agent turn instead of growing past the cap. ([#4391])
A SKILL.md directory is a runtime package boundary — nested SKILL.md files are supporting data, no longer registered as independent skills. ([#4098])
Memory is pluggable (memory.manager_class): DeerMem-private settings move into memory.backend_config (auto-migrated with a warning), /memory/config changed shape, storage_path is now a root directory (legacy file-style values are dropped with a warning), custom storage classes move to a new path and take config in __init__, and a backend without search() fails fast in tool mode. ([#4122], [#4023], [#4324])
database.checkpoint_delta_snapshot_frequency moved to database.checkpoint_delta.snapshot_frequency and its default changed from 1000 to 10 — set it explicitly to keep the old cadence. ([#4516])
Docker binds loopback by default — the published entry port binds 127.0.0.1 in both compose files, matching the documented local-trust deployment model; set BIND_HOST to expose the stack on other interfaces. ([#4618])

✨ Highlights

Verifiable agent execution — every tool call carries a tamper-evident, runtime-stamped receipt and a bounded receipt ledger reaches the model context; subagent reports must cite tool receipts with verifiable deliverable handles that the lead agent cross-checks; and acceptance_criteria on delegations are checked deterministically parent-side (file existence, recorded test-command exit status), with anything undecidable reported UNVERIFIED. ([#4659], [#5076], [#5090], [#5109], [#4365])
Subagents at scale — a system-maintained delegation ledger prevents redundant re-delegation and a total cap bounds fan-out ([#3877], [#4115]); one process-wide capacity controller governs concurrency, and the opt-in batch_task tool runs large collections of independent items as durable, resumable SQL-backed batches with leases, retries, pause/resume/cancel, and a chat progress panel ([#4998], [#5289]); task(context_mode="snapshot") carries a dispatch-time copy of the parent conversation ([#5367]); and subagent step history is persisted and displayed in the thread. ([#3845])
Scheduled tasks grow up — interval schedules join once and cron ([#5291]); upcoming cron occurrences can be previewed before saving ([#5381]); run history filters server-side by status and pages backwards in the UI ([#5384], [#5363]); tasks can pin lead_agent or a custom agent ([#5286], [#5288]); busy occurrences queue durably across restarts ([#4918]); and multi-instance recovery no longer interrupts live runs. ([#4713])
Pluggable memory — new OpenViking, mem0, and Honcho backends over HTTP ([#4509], [#4528], [#4730]); a built-in FTS5/BM25 retrieval adapter ([#4360]); LLM-assisted consolidation and staleness pruning ([#3996], [#3860], [#4143]); incremental per-agent fact storage ([#4279]); a hybrid eviction policy ([#4789]); guaranteed correction-fact injection ([#3592]); and opt-in write-side fact dedup. ([#5254])
More sandboxes, tighter control — new E2B, BoxLite (micro-VM with warm pool), Tenki, and OpenSandbox providers ([#3883], [#3940], [#3951], [#4382], [#4877]); opt-in isolated / domain-allowlist network egress for local Docker sandboxes, with denied domains approvable through the Human Input card ([#5152]); and hardened local containers — bridge-gateway port binds, default seccomp, dropped capabilities. ([#4986])
Out-of-tree extensions — Python extensions contribute middleware, lifecycle and system-model observers, Gateway services, and HTTP routers, managed with deerflow extensions install/upgrade/enable/disable/remove ([#4636], [#4684], [#4780], [#5347]); a 0.2 extension API lets extensions observe what the agent did ([#4863]); and a new RunEvidenceReader contract drives durable, cursor-based changed-run discovery. ([#5405])
Enterprise auth & authorization — generic OIDC/SSO with Keycloak support ([#3506]); personal access tokens with scoped route policies ([#5041]); a built-in RBAC provider with tool, model, and sandbox authorization enforced at both assembly and runtime ([#4260], [#4370], [#4540], [#4911], [#4439]); local self-registration can be closed to SSO-only provisioning ([#4311]); and account preferences survive a cleared browser. ([#5397])
MCP as production infrastructure — a durable task runtime survives Gateway restarts and reports progress in the chat UI ([#4665], [#4690], [#4833]); shared servers can inject per-user credentials or map request-scoped secrets to headers ([#4868], [#5010]); servers are managed from Settings ([#5022]); and a hung stdio server can no longer stall the Gateway or agent assembly. ([#4657], [#5217])
Richer runtime — per-run token budgets shared additively across the lead agent and subagents ([#3412]); goal continuations with a tracked, capped count ([#3858]); dual-mode checkpoint storage cuts long-run thread storage from O(N²) to near-linear ([#4292], [#4638]); durable context survives summarization ([#3556], [#3887], [#3906]); opt-in task notes and compacted-history recall ([#5382]); a run can read referenced earlier conversations, grantable from the SDK and the composer ([#5399], [#5463], [#5465]); structured clarification form fields ([#4406]); and configurable recursion limits for Gateway and scheduled runs. ([#5390], [#4848])
Models & knowledge — per-agent model and generation settings ([#4347]); an optional request-admission limiter paces calls per provider ([#5432]); per-user model favorites ([#5441]); a Z.AI GLM-5.3-Flash profile and MiniMax Code ACP support ([#5074], [#4846]); opt-in knowledge_search over RAGFlow or LightRAG ([#4955], [#5209]); Playwright-backed agentic browser control ([#4187]); and new search providers — Serply, Tencent Cloud WSA, Sofya, GroundRoute, Crawl4AI, fastCRW, and Parallel — with native recency filters. ([#5023], [#5057], [#5099], [#5239], [#3675], [#3821], [#3585], [#3881], [#3866], [#5028])
Workspace — Projects organize chats, with per-project instructions, a document shelf, and two-way file promotion ([#5265], [#5443]); assistant turns branch into side conversations with distinguishing titles ([#3950], [#3934], [#4983]); the latest answer regenerates and user turns edit and rerun in place ([#3637], [#4377]); chats archive, restore, and pin ([#5236], [#4442]); a conversation outline navigates long chats ([#5025]); CSV/TSV artifacts preview as tables ([#5284]); text artifacts stream over byte ranges and a run's files download as one zip ([#5056], [#5117]); MCP servers, integrations, and skills move into a dedicated Capability Center ([#5468]); and Custom Agents get display names, a deployment-level subagent catalog, and stateless memory_enabled: false mode. ([#5324], [#4887], [#5167])
Channels — a new Buzz (Nostr) connector ([#4649], [#4727]); /agent list / /agent use IM commands switch a conversation to the owner's Custom Agents ([#5168]); Postgres-backed webhook dedup lets several pods serve the same channel ([#4210]); and DingTalk gains file/image attachments. ([#4423])

🚀 Performance

Dual-mode checkpoint storage with LangGraph DeltaChannel cuts thread storage from O(N²) to near-linear for long research/coding runs. ([#4292])
Chat streams request messages-tuple + updates + custom instead of full values snapshots — retransmitted history was ~75% of SSE payload. ([#5159])
Index MemoryRunStore by thread_id and MemoryRunEventStore events by run_id to eliminate O(n) scans. ([#3562], [#3686])
read_file reads only the requested line range from the sandbox instead of fetching the whole file first. ([#3824])
view_image injects content via wrap_model_call, so up to 20 MB of base64 no longer sits in two checkpoints per viewed image. ([#5014])
Cache sandbox path-rewrite and output-masking regexes per instance. ([#3648], [#3713])
Frontend: coalesce streaming renders to a frame budget, stop re-deriving message content on every chunk, cache settled copy-data derivation, and enforce route JS/CSS budgets. ([#4425], [#4441], [#5095])
Browser Live frames encode as JPEG, cutting progress payload size. ([#4836])
Bound gateway memory after terminal runs. ([#5112])
Deduplicate streamed AI messages via a seen-id set (O(n²) → O(n)). ([#3687])
Index tool-call results per group. ([#4411])

🔒 Security

Skill review gate — SkillScan now receives every file byte for byte (binaries, nested archives, and NUL bytes no longer escape scanning), archive extraction is capped by member count as well as size, and installer, export guard, and scanner share one code-file/executable-magic definition. ([#5431], [#4241])
Prompt-injection defenses — new input-sanitization middleware with both bypasses closed; untrusted content in model prompts (memory facts, SOUL.md, subagent descriptions, skill metadata) HTML-escaped; MindIE tool-response framing escaped; and web_capture and MCP-sourced tool results sanitized through the same trust boundary as the built-in web tools. ([#3662], [#5375], [#4028], [#4253], [#4839])
Sandbox hardening — local Docker sandboxes bind published ports to the Docker bridge gateway, run Docker's default seccomp profile, drop all capabilities, and get no-new-privileges; SSH_AUTH_SOCK is scrubbed from the sandbox environment; and projected skill files are copies, not hardlinks, so a sandboxed write cannot mutate the canonical source. ([#4986], [#5145], [#4825], [#4830])
Secrets — inherited secret environment variables are scrubbed from the skill environment; MCP stdio launcher arguments and env vars are constrained at the config API; credentials that cannot travel as HTTP header values are rejected at the config boundary; and skill toggles no longer persist resolved $VAR secrets into extensions_config.json. ([#4018], [#4617], [#5066], [#5357])
Artifacts — the outputs-only write guard is no longer fooled by percent-encoded dot segments or symlinks, and XML artifacts (any +xml type included) are served as download attachments so active content cannot call the API with the viewer's session. ([#5321], [#5353])
Authorization — an empty tool allowlist now denies instead of failing open; run-create is enforced on stateless stream/wait endpoints; a revoked sandbox:execute grant is re-checked before sandbox reuse; custom-Agent skill allowlists are enforced at the sandbox filesystem level; and cancel/rollback actions on GET stream joins are rejected with 405. ([#4067], [#5030], [#5006], [#5077], [#5092])
Other — SSRF guard for self-hosted web_fetch providers; Lark CLI credential trees enforce private ACLs on Windows; and streamdown sanitization is restored in custom rehype chains. ([#3942], [#5141], [#4987])

🐛 Notable fixes

Runs & runtime — cancel a run from any live gateway worker, not only the owner; cross-worker idempotent reuse no longer permanently blocks the thread; keyed retries resolve the request user consistently; the shutdown run drain survives repeated cancellation; and a repair migration heals databases that silently skipped the run-change clock schema. ([#4500], [#5393], [#5401], [#5487], [#5517])
Middleware — loop detection keys read_file by exact line range, so paging through a file no longer trips the hard stop; max_turns now grants the turns it names (it was passed as LangGraph super-steps, ~7–8 per turn); token budgets hold across goal continuations; guards that remove tool calls no longer break every later Claude/Responses turn; and retried model calls re-deliver queued warnings. ([#5486], [#5485], [#5410], [#5447], [#5433])
Subagents — a subagent keeps its instructions after context compaction; a delegated subagent's error no longer fails the parent run; repeatedly cancelled subagents no longer leak their execution slot; and Windows acceptance checks fail closed on out-of-scope commands. ([#5454], [#5407], [#5477], [#5162])
Sandbox tools — remote list_dir / glob / grep report failures instead of inventing "empty directory" or "no matches"; read_file truncation is reported in lines with the exact resume point; host-path masking handles $PATH-style joins and forward-slash Windows spellings; concurrent subagents work past the AIO shell-session ceiling; and CJK tool output is no longer garbled in PowerShell. ([#5264], [#5422], [#5380], [#5474], [#5418], [#5373], [#5178], [#5440])
Models — the Claude Code OAuth token is read once per process, so title, summarization, and subagent models stop losing their credential; models with supports_reasoning_effort no longer fail to build; Codex invalid tool calls are paired with their results; and api_base is honored on every BaseChatOpenAI subclass. ([#5411], [#5403], [#5509], [#4146])
Channels — WeCom clips and splits over the 20 KB protocol cap instead of dropping the reply; one undecodable WeChat message no longer drops its batch; a dead Discord client no longer hangs outbound sends and freezes the channel pool; Telegram rich_messages renders only when the text actually contains rich constructs; and WeChat/WeCom inbound media is streamed, size-bounded, and host-allowlisted. ([#5148], [#4231], [#5227], [#5470], [#5225])
Skills & secrets — toggling a skill no longer writes resolved secrets into extensions_config.json; restore $VAR references and rotate any credential exposed this way. ([#5357])
Scheduler — the global max_concurrent_runs budget is enforced on SQLite (not just Postgres) and for manual triggers; and a dispatch race that could launch two runs for one task is closed. ([#5469], [#4769], [#4105])
MCP — parallel synchronous calls to one stdio server no longer cancel each other's connection; the session pool holds its capacity limit under concurrent initialization; and durable task polling preserves pooled sessions across protocol timeouts. ([#5396], [#4962], [#5027])
Frontend — message order stays stable across long runs and reconnects; human-input cards keep the turn that requested them; the user's input is restored after an incremental stream reconnect; sidebar chat deletion asks for confirmation first; and the client emits a streamed tool call once, with its complete arguments. ([#5293], [#4892], [#5428], [#5406], [#5408])

📦 Deploy & ops

Docker — the published entry port binds loopback by default (see breaking changes); make up waits for a real Gateway health probe before declaring the stack ready; startup tolerates a missing .env; and Windows Git Bash preflight and socket handling work. ([#4618], [#4658], [#4806], [#5371], [#5402])
Kubernetes — per-sandbox Services default to ClusterIP instead of NodePort, so sandboxes are reachable only inside the cluster ([#4190]); ClusterIP Services and scoped per-skill PVC mounts ([#4016], [#3928]); and an optional Lark credential broker sidecar keeps app secrets out of the sandbox filesystem. ([#4501])
Health & readiness — the new GET /health/ready runs a bounded database probe and returns 503 while the database is unreachable; /health stays pure liveness. ([#5166])
Nginx — thread routes that wait on a model call allow 600 seconds (a slow /compact no longer returns 504 for work that was applied), and long chat prompts pass /api/langgraph/ without a raw 500. ([#5505], [#4277])
Configuration — a custom PostgreSQL schema is selected via postgres_schema and created automatically ([#3442]); recursion_limit and scheduler.recursion_limit are deployment-configurable ([#5390], [#4848]); and make dev preserves the ollama uv extra across restarts. ([#5318])
Upgrades — startup tolerates a database migrated to the reviewed newer revision, keeping rollback possible ([#5219]); legacy threads get run-event seed backfill ([#4590]); and Postgres connections survive idle timeouts via pool_recycle. ([#4230])
CI & packaging — the backend unit-test workflow splits into four parallel shards with isolated Postgres/Redis ([#5137]); and the renamed tenki package replaces the PyPI-removed tenki-sandbox. ([#5087])

🙌 Thanks

Huge thanks to the 178 contributors who landed 772 merged PRs in the 2.1.0 milestone, and to everyone who filed issues, tested builds, and shared feedback. DeerFlow 2.1 wouldn't exist without you.

In alphabetical order: