DeerFlow 2.0.0

DeerFlow 2.0 is a ground-up rewrite around a "super agent" harness that
orchestrates sub-agents, persistent memory, sandboxed execution,
and an extensible skills/tools system. It shares no code with the 1.x line,
which lives on the main-1.x branch.

This release closes the 2.0.0 milestone
with 182 merged PRs since the first 2.0 milestone tag.

📖 Full notes: CHANGELOG.md · 中文版

⚠️ Breaking change

• Run hydration — runs now hydrate from RunStore and persist interrupted
  status. Cancellation now requires the worker who owns the run; cross-worker
  cancels return 409 instead of silently appearing successful. ([fix(harness)!: hydrate runs from RunStore and persist interrupted status #2932])

✨ Highlights

• Custom agents that update themselves — agents can persist edits to their
  own SOUL.md / config.yaml from a normal chat, with full per-user
  isolation. ([feat(agent): add custom-agent self-updates with user isolation #2713])
• User-owned IM channel connections — users can bind their own Slack,
  Telegram, Discord, Feishu/Lark, DingTalk, WeChat, and WeCom accounts on top
  of operator-configured bots. ([feat(im): Add user-owned IM channel connections #3487])
• More models & community search — StepFun and MiMo reasoning models,
  MiniMax for image/video/podcast skills plus a new music-generation skill,
  and Brave Search / SearXNG / Browserless / Serper Google Images tools.
  ([feat(models): add StepFun reasoning model adapter #3461], [feat(provider) Add patched MiMo reasoning content support #3298], [feat: MiniMax provider for image/video/podcast skills + new music-generation skill #3437], [feat(community): add Brave Search web search tool #3528], [feat(community): add SearXNG and Browserless web search/fetch tools #3451], [feat(community): add Serper Google Images provider for image_search #3575])
• Richer channels — Discord gets mention-only mode, thread routing, and
  typing indicators; Telegram streams replies by editing the placeholder
  message in place. ([feat(channels): enhance Discord with mention-only mode, thread routing, and typing indicators #2842], [feat(telegram): stream agent replies by editing the placeholder message in place #3534])
• Configurable loop detection with per-tool frequency overrides and
  deferred warning injection. ([Make loop detection configurable #2586], [feat(loop-detection): make loop detection configurable with per-tool frequency overrides #2711], [feat(loop-detection): defer warning injection #2752])
• Subagent token usage streams to the header in real time, with spans
  attributed to the parent thread's Langfuse trace. ([feat: stream subagent token usage to header via terminal task events  #2882], [feat(subagents): attribute subagent spans to parent thread's Langfuse… #3611])
• Trace polish — clean lead_agent / custom-agent trace names; session_id
  • user_id propagated to Langfuse; non-ASCII memory traces no longer escape.
    ([feat(trace):LangGraph -> lead_agent and set custom agent_name to run_name #3101], [fix(tracing): propagate session_id and user_id into Langfuse traces #2944], [fix(trace):memory 中文 in trace info is unicode escape sequence. #3104])
• Token-usage tracking on by default, with refined display modes and usage
  attributed to the actual models. ([enable token usage by default #2841], [feat: refine token usage display modes #2329], [fix(gateway): attribute token usage to actual models #3658])
• Flexible memory & suggestions — opt out of tiktoken in restricted
  networks via memory.token_counting; make AI follow-up suggestions optional.
  ([feat(memory): add memory.token_counting config to avoid tiktoken network dependency (#3429) #3465], [feat(suggest_agent): make AI follow-up suggestions optional  #3591])

🚀 Performance

• Push thread metadata filters into SQL. ([perf(harness): push thread metadata filters into SQL #2865])
• Index runs by thread_id in RunManager to eliminate O(n) scans. ([perf(runtime): index runs by thread_id to avoid O(n) scans in RunManager #3499])
• Index messages in MemoryRunEventStore to eliminate O(n) scans. ([perf(runtime): index messages in MemoryRunEventStore to avoid O(n) scans #3531])
• Cache Base.to_dict column reflection per class. ([perf(persistence): cache Base.to_dict column reflection per class (#3653) #3654])
• Speed up should_ignore_name in glob/grep sandbox walks. ([perf(sandbox): speed up should_ignore_name in glob/grep walks (#3655) #3657])

🔒 Security

• Reject symlinked upload destinations on Linux and Windows.
  ([[security] fix(upload): reject symlinked upload destinations #2623], [fix(uploads): add Windows support for safe symlink-protected uploads #2794])
• Mask sensitive values in MCP config responses; harden the endpoint.
  ([fix(security): mask sensitive values in MCP config API responses #2667], [fix(security): harden MCP config endpoint #3425])
• Reject cross-site auth POSTs. ([[security] fix(auth): reject cross-site auth POSTs #2740])
• Cap skill artifact preview decompression (zip-bomb defense). ([[security] fix(gateway): cap skill artifact preview decompression #2963])
• Mount the host Docker socket only in aio (DooD) sandbox mode. ([fix(security): mount host Docker socket only in aio (DooD) sandbox mode #3517])
• Don't bind-mount host CLI auth dirs by default. ([fix(security): do not bind-mount host CLI auth dirs by default #3521])

🐛 Notable fixes

• Memory runs on a persistent event loop instead of a short-lived one
  asyncio.run(); queued updates isolated per agent; wrapped JSON responses
  parsed correctly. ([fix(memory): replace short-lived asyncio.run() with persistent event loop #2627], [fix(memory): isolate queued memory updates by agent #2941], [fix(memory): parse wrapped memory update json responses #3252])
• Runs hydrate from the persistent store after a gateway restart, return
  ISO 8601 timestamps, and have an idempotent cancel. ([fix(runs): restore historical runs from persistent store after gateway restart #2989], [fix(gateway): return ISO 8601 timestamps from threads endpoints #2599], [fix(gateway): make cancel idempotent for already-interrupted runs #3058])
• Subagents isolated from the parent run's checkpointer; timeout terminal
  state atomic; respect model overrides for tools/middleware. ([fix(subagent): isolate subagent from parent run checkpointer #3559],
  [fix(subagents): make subagent timeout terminal state atomic #2583], [fix(subagents): use model override for tools and middleware #2641])
• Sandbox readiness polling no longer blocks the event loop;
  /mnt/user-data contract enforced at the API boundary; PVC data scoped per
  user; Windows/Git Bash MSYS path conversion disabled. ([fix(sandbox): avoid blocking sandbox readiness polling #2822], [fix(sandbox): uphold /mnt/user-data contract at Sandbox API boundary (#2873) #2881],
  [fix(sandbox): scope provisioner PVC data by user #2973], [fix(sandbox): disable MSYS path conversion for Git Bash #2766])
• Auth auto-generated JWT secrets persist across restarts; setup-status
  uses cached responses instead of 429. ([fix(auth): persist auto-generated JWT secret to survive restarts #2933], [fix(auth): replace setup-status 429 rate limit with cached response #2915])
• Frontend fixes a swallowed first message, login flicker / resize-observer
  loop, duplicate optimistic messages, deeply nested list render crashes, and
  thread isolation on new chats. ([fix(chat): prevent first user message from being swallowed in new conversations #2731], [fix(frontend): resolve login page flickering and resize observer loop. #2954], [fix(frontend): avoid duplicate optimistic user message #3002], [[bug] Uncaught RangeError: Maximum call stack size exceeded #3393], [fix(frontend): cap deeply nested list indentation to prevent render crash (#3393) #3570],
  [fix(frontend): isolate new chat thread messages #3508])
• Channels — user-owned IM now requires a bound identity, scopes files, and
  helper commands to the owner, makes the provider state authoritative, and makes
  The connect flow is deterministic, backed by shared retry helpers and
  operational guardrails. ([fix(channels): require bound identity for user-owned IM messages #3578], [fix(channels): scope IM files and helper commands to owner #3579], [fix(channels): make runtime provider state authoritative #3580], [fix(channels): harden runtime credential management APIs #3581], [fix(channels): make channel connect flow deterministic #3582],
  [fix(channels): centralize shared channel retry helpers #3583], [fix(channels): add operational guardrails #3584])
• Streaming & history — interrupts propagate through SSE values events for
  the LangGraph SDK, and base64 image payloads are stripped from streamed and
  history responses to keep the UI responsive. ([fix(runtime): propagate interrupt through SSE values events for LangGraph SDK #3605], [fix(serialization): strip base64 image data from streamed values events #3631], [fix(history): strip base64 image data from REST endpoint responses (#3496) #3535])
• Frontend (more) — the workspace chat list paginates beyond 50 threads,
  stays interactive when the SSR auth probe can't reach the gateway, and gets a
  mobile-friendly layout. ([fix(frontend): paginate workspace chat list beyond 50 threads (#3482) #3485], [fix(frontend): keep workspace interactive when SSR auth probe cannot reach gateway (#3493) #3495], [fix(frontend): improve mobile workspace layout #3646])

📦 Deploy & ops

• Docker Gateway defaults to a single worker (multi-worker breakage).
  ([fix(docker): default Gateway to a single worker to prevent multi-worker breakage #3475])
• Docker nginx resolves upstream names at request time. ([fix(docker):force ngix to resolve upstream names at request time #2717])
• Packaging adds postgres extra for store/checkpointer support. ([fix(packaging): add postgres extra for store/checkpointer supportFix postgres extra install guidance #2584])
• Scripts preserve uv extras across make dev restarts; clean up local
  nginx on stop; exclude runtime state from gateway reload. ([fix(scripts): preserve uv extras across make dev restarts (#2754) #2767], [fix: clean up local nginx on stop #3005],
  [fix(dev): exclude runtime state from gateway reload #3426])

🙌 Thanks

Huge thanks to the 40 contributors who landed 180 merged PRs in the 2.0.0 milestone, and to everyone who filed issues, tested builds, and shared feedback. DeerFlow 2.0 wouldn't exist without you.

In alphabetical order:

• @18062706139fcz — Ryker_Feng
• @64johnlee — john lee
• @airene — Airene Fang
• @AnoobFeng — AnoobFeng
• @chetan655 — Chetan Sharma
• @ech0hol — Zhipeng Zheng
• @Eilen6316 — Eilen Shin
• @fancyboi999 — Xinmin Zeng
• @ggnnggez — Nan Gao
• @greatmengqi — greatmengqi
• @hata33 — hataa
• @heart-scalpel — heart-scalpel
• @he-yufeng — Yufeng He
• @hetaoBackend — DanielWalnut
• @Hinotoi-agent — Hinotobi
• @Huixin615 — Huixin615
• @idefav — idefav
• @jinghuan-Chen — jinghuan-Chen
• @Kiteeater — KiteEater
• @kibabsquirrel — Lawrance_YXLiao
• @knight0940 — Amorend
• @Layau-code — YuJitang
• @liuchuan01 — liuchuan01
• @LittleChenLiya — Admire
• @ly-wang19 — ly-wang19
• @NewAmorend — Amorend
• @nguyen0096 — Nguyen DN
• @p-yf — yangyufan
• @player0718 — Lucy Shen
• @ShenAC-SAC — AochenShen99
• @shenlihust — 魔力鸟
• @sunshine-lang — sunsine
• @stphtt — stphtt
• @wahajahmed010 — Wahaj Ahmed
• @whhe — He Wang
• @WillemJiang — Willem Jiang
• @xunliu — Xun
• @yangzheli — yangzheli
• @yitang — Yi Tang
• @Yuyi-Ao — Yuyi Ao
• @zengxi — zengxi
• @zwj110610 — zgenu

See the full author and PR list on the
milestone page.