fix: fix conflict

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com>

api/controllers/console/__init__.py

@@ -144,6 +144,7 @@ from .workspace import (
     models,
     plugin,
     rbac,
+    skills,
     snippets,
     tool_providers,
     trigger_providers,
@@ -225,6 +226,7 @@ __all__ = [
     "saved_message",
     "setup",
     "site",
+    "skills",
     "snippet_workflow",
     "snippet_workflow_draft_variable",
     "snippets",

api/controllers/console/tag/tags.py

@@ -59,7 +59,7 @@ class TagBindingRemovePayload(BaseModel):
 
 
 class TagListQueryParam(BaseModel):
-    type: Literal["knowledge", "app", "snippet", ""] = Field("", description="Tag type filter")
+    type: TagType | Literal[""] = Field("", description="Tag type filter")
     keyword: str | None = Field(None, description="Search keyword")
 
 

api/controllers/console/workspace/skills.py

@@ -0,0 +1,834 @@
+"""Console API for workspace-level Skill Management."""
+
+from __future__ import annotations
+
+import io
+
+from flask import request, send_file
+from flask_restx import Resource
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+
+from controllers.common.fields import BinaryFileResponse
+from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.console import console_ns
+from controllers.console.wraps import (
+    account_initialization_required,
+    edit_permission_required,
+    setup_required,
+    with_current_tenant_id,
+    with_current_user,
+)
+from fields.base import ResponseModel
+from libs import helper
+from libs.helper import dump_response
+from libs.login import login_required
+from models.account import Account
+from services.skill_management_service import (
+    SkillAssistMessagePayload,
+    SkillCreatePayload,
+    SkillDraftFileOperationPayload,
+    SkillDraftTreePayload,
+    SkillImportPayload,
+    SkillManagementService,
+    SkillManagementServiceError,
+    SkillMetadataPayload,
+    SkillPublishPayload,
+    SkillRestorePayload,
+    SkillVersionUpdatePayload,
+)
+
+_FILE_UPLOAD_PARAMS = {
+    "file": {
+        "description": "Skill draft file payload",
+        "in": "formData",
+        "type": "file",
+        "required": True,
+    },
+}
+
+
+class WorkspaceSkillsQuery(BaseModel):
+    keyword: str | None = Field(default=None, description="Search keyword matching skill name or description.")
+    page: int = Field(default=1, ge=1, le=99999, description="Page number.")
+    limit: int = Field(default=20, ge=1, le=100, description="Number of items per page.")
+    tag: list[str] = Field(
+        default_factory=list,
+        description="Skill tag filters. Repeat the parameter for multiple tags.",
+    )
+
+
+class SkillDeletePayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    confirmation_name: str | None = Field(
+        default=None,
+        description="Required when deleting a referenced Skill. Must match the Skill name.",
+    )
+
+
+class AgentSkillBindingsPayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    skill_ids: list[str] = Field(default_factory=list, description="Ordered Skill IDs bound to the Agent.")
+
+
+class SkillFileQuery(BaseModel):
+    path: str = Field(description="Skill file path relative to the Skill root.")
+    version_id: str | None = Field(default=None, description="Optional published version ID. Omit for current draft.")
+
+
+class SkillResponse(ResponseModel):
+    id: str
+    name: str
+    display_name: str
+    icon: str
+    description: str
+    tags: list[str] = Field(default_factory=list)
+    name_manually_edited: bool = False
+    visibility: str
+    latest_published_version_id: str | None = None
+    reference_count: int = 0
+    created_by: str | None = None
+    created_by_name: str | None = None
+    updated_by: str | None = None
+    updated_by_name: str | None = None
+    created_at: int
+    updated_at: int
+
+
+class SkillFileResponse(ResponseModel):
+    id: str | None = None
+    path: str
+    kind: str
+    storage: str | None = None
+    mime_type: str | None = None
+    content: str | None = None
+    tool_file_id: str | None = None
+    size: int | None = None
+    hash: str | None = None
+
+
+class SkillFilePreviewResponse(ResponseModel):
+    path: str
+    mime_type: str
+    content: str
+    size: int
+    hash: str
+
+
+class SkillFileUploadResponse(ResponseModel):
+    id: str
+    name: str
+    mime_type: str
+    size: int
+    hash: str
+
+
+class SkillDetailResponse(SkillResponse):
+    files: list[SkillFileResponse] = Field(default_factory=list)
+
+
+class SkillListResponse(ResponseModel):
+    data: list[SkillResponse] = Field(default_factory=list)
+    has_more: bool = False
+    limit: int = 20
+    page: int = 1
+    total: int = 0
+
+
+class SkillTagResponse(ResponseModel):
+    tag: str
+    count: int
+
+
+class SkillTagListResponse(ResponseModel):
+    data: list[SkillTagResponse] = Field(default_factory=list)
+
+
+class SkillVersionResponse(ResponseModel):
+    id: str
+    skill_id: str
+    version_number: int
+    version_name: str
+    publish_note: str
+    hash_code: str
+    archive_size: int
+    published_by: str | None = None
+    published_by_name: str | None = None
+    is_latest: bool = False
+    created_at: int
+
+
+class SkillVersionListResponse(ResponseModel):
+    data: list[SkillVersionResponse] = Field(default_factory=list)
+
+
+class SkillVersionDetailResponse(SkillVersionResponse):
+    files: list[SkillFileResponse] = Field(default_factory=list)
+
+
+class SkillVersionDeleteResponse(ResponseModel):
+    id: str
+    deleted: bool
+    latest_published_version_id: str | None = None
+
+
+class SkillReferenceResponse(ResponseModel):
+    type: str
+    agent_id: str
+    agent_icon: str | None = None
+    agent_icon_background: str | None = None
+    agent_icon_type: str | None = None
+    app_id: str | None = None
+    name: str
+    display_name: str
+    workflow_id: str | None = None
+    workflow_name: str | None = None
+    workflow_icon: str | None = None
+    workflow_icon_background: str | None = None
+    workflow_icon_type: str | None = None
+    workflow_version: str | None = None
+    node_id: str | None = None
+    node_name: str | None = None
+
+
+class SkillReferenceListResponse(ResponseModel):
+    data: list[SkillReferenceResponse] = Field(default_factory=list)
+
+
+class SkillDeleteResponse(ResponseModel):
+    id: str
+    deleted: bool
+
+
+class AgentSkillBindingItemResponse(ResponseModel):
+    id: str
+    priority: int
+    name: str
+    display_name: str
+    icon: str
+    description: str
+    tags: list[str] = Field(default_factory=list)
+    status: str
+    file_count: int
+    latest_published_version_id: str | None = None
+    latest_published_at: int | None = None
+    updated_at: int
+
+
+class AgentSkillBindingsResponse(ResponseModel):
+    agent_id: str
+    skill_ids: list[str] = Field(default_factory=list)
+    data: list[AgentSkillBindingItemResponse] = Field(default_factory=list)
+
+
+register_schema_models(
+    console_ns,
+    WorkspaceSkillsQuery,
+    SkillCreatePayload,
+    SkillAssistMessagePayload,
+    SkillMetadataPayload,
+    SkillDraftFileOperationPayload,
+    SkillDraftTreePayload,
+    SkillPublishPayload,
+    SkillRestorePayload,
+    SkillVersionUpdatePayload,
+    SkillDeletePayload,
+    SkillFileQuery,
+    AgentSkillBindingsPayload,
+)
+
+register_response_schema_models(
+    console_ns,
+    SkillResponse,
+    SkillFileResponse,
+    SkillFilePreviewResponse,
+    SkillFileUploadResponse,
+    SkillDetailResponse,
+    SkillListResponse,
+    SkillTagResponse,
+    SkillTagListResponse,
+    SkillVersionResponse,
+    SkillVersionListResponse,
+    SkillVersionDetailResponse,
+    SkillVersionDeleteResponse,
+    SkillReferenceResponse,
+    SkillReferenceListResponse,
+    SkillDeleteResponse,
+    AgentSkillBindingItemResponse,
+    AgentSkillBindingsResponse,
+    BinaryFileResponse,
+)
+
+
+def _error_response(exc: SkillManagementServiceError) -> tuple[dict[str, object], int]:
+    body: dict[str, object] = {"code": exc.code, "message": exc.message}
+    if exc.details:
+        body["details"] = exc.details
+    return body, exc.status_code
+
+
+@console_ns.route("/workspaces/current/skills")
+class WorkspaceSkillsApi(Resource):
+    @console_ns.doc(params=query_params_from_model(WorkspaceSkillsQuery))
+    @console_ns.response(200, "Workspace skills", console_ns.models[SkillListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str):
+        query_input: dict[str, object] = {
+            "keyword": request.args.get("keyword"),
+            "tag": request.args.getlist("tag"),
+        }
+        if "limit" in request.args:
+            query_input["limit"] = request.args.get("limit")
+        if "page" in request.args:
+            query_input["page"] = request.args.get("page")
+        query = WorkspaceSkillsQuery.model_validate(query_input)
+        result = SkillManagementService().list_skills(
+            tenant_id=current_tenant_id,
+            keyword=query.keyword,
+            page=query.page,
+            limit=query.limit,
+            tags=[tag for tag in query.tag if tag],
+        )
+        return dump_response(SkillListResponse, result)
+
+    @console_ns.expect(console_ns.models[SkillCreatePayload.__name__])
+    @console_ns.response(201, "Skill created", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        try:
+            payload = SkillCreatePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().create_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/files/upload")
+class WorkspaceSkillFileUploadApi(Resource):
+    @console_ns.doc(consumes=["multipart/form-data"], params=_FILE_UPLOAD_PARAMS)
+    @console_ns.response(201, "Skill draft file uploaded", console_ns.models[SkillFileUploadResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        if "file" not in request.files:
+            return {"code": "no_file_uploaded", "message": "no file uploaded"}, 400
+
+        file = request.files["file"]
+        if not file.filename:
+            return {"code": "filename_missing", "message": "filename is required"}, 400
+
+        result = SkillManagementService().upload_file(
+            tenant_id=current_tenant_id,
+            user_id=current_user.id,
+            filename=file.filename,
+            content=file.stream.read(),
+            mime_type=file.mimetype,
+        )
+        return dump_response(SkillFileUploadResponse, result), 201
+
+
+@console_ns.route("/workspaces/current/skills/tags")
+class WorkspaceSkillTagsApi(Resource):
+    @console_ns.response(200, "Workspace Skill tags", console_ns.models[SkillTagListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str):
+        result = SkillManagementService().list_tags(tenant_id=current_tenant_id)
+        return dump_response(SkillTagListResponse, result)
+
+
+@console_ns.route("/workspaces/current/skills/import")
+class WorkspaceSkillImportApi(Resource):
+    @console_ns.doc(description="Import a Skill zip package from multipart form field `file`.")
+    @console_ns.response(201, "Skill imported", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        upload = request.files.get("file")
+        if upload is None:
+            return {"code": "invalid_request", "message": "file is required"}, 400
+        try:
+            payload = SkillImportPayload(content=upload.read(), filename=upload.filename or "skill.zip")
+            result = SkillManagementService().import_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except (ValidationError, ValueError) as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>")
+class WorkspaceSkillApi(Resource):
+    @console_ns.response(200, "Skill detail", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().get_skill(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillDetailResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillMetadataPayload.__name__])
+    @console_ns.response(200, "Skill updated", console_ns.models[SkillResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillMetadataPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().update_metadata(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillDeletePayload.__name__])
+    @console_ns.response(200, "Skill deleted", console_ns.models[SkillDeleteResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_tenant_id
+    def delete(self, current_tenant_id: str, skill_id: str):
+        try:
+            payload = SkillDeletePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().delete_skill(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                confirmation_name=payload.confirmation_name,
+            )
+            return dump_response(SkillDeleteResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/duplicate")
+class WorkspaceSkillDuplicateApi(Resource):
+    @console_ns.response(201, "Skill duplicated", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            result = SkillManagementService().duplicate_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/export")
+class WorkspaceSkillExportApi(Resource):
+    @console_ns.response(200, "Published Skill zip archive")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().pull_published_archive(tenant_id=current_tenant_id, skill_id=skill_id)
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=True,
+                download_name=result.filename,
+            )
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/assist/messages")
+class WorkspaceSkillAssistMessageApi(Resource):
+    """Stream read-only Skill Authoring suggestions from the default workspace model."""
+
+    @console_ns.expect(console_ns.models[SkillAssistMessagePayload.__name__])
+    @console_ns.response(200, "Skill Authoring assistant event stream")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillAssistMessagePayload.model_validate(console_ns.payload or {})
+            response = SkillManagementService().create_assistant_action_stream(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                user_id=current_user.id,
+                message=payload.message,
+                attachments=payload.attachments,
+                model_payload=payload.model,
+                target_path=payload.target_path,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+        return helper.compact_generate_response(response)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files")
+class WorkspaceSkillFilesApi(Resource):
+    @console_ns.expect(console_ns.models[SkillDraftFileOperationPayload.__name__])
+    @console_ns.response(200, "Draft file operation applied", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillDraftFileOperationPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().apply_draft_file_operation(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillDraftTreePayload.__name__])
+    @console_ns.response(200, "Draft files replaced", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def put(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillDraftTreePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().replace_draft_tree(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files/preview")
+class WorkspaceSkillFilePreviewApi(Resource):
+    @console_ns.doc(params=query_params_from_model(SkillFileQuery))
+    @console_ns.response(200, "Skill file text preview", console_ns.models[SkillFilePreviewResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            query = SkillFileQuery.model_validate(
+                {
+                    "path": request.args.get("path"),
+                    "version_id": request.args.get("version_id"),
+                }
+            )
+            result = SkillManagementService().preview_file(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                path=query.path,
+                version_id=query.version_id,
+            )
+            return dump_response(SkillFilePreviewResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files/content")
+class WorkspaceSkillFileContentApi(Resource):
+    @console_ns.doc(params={**query_params_from_model(SkillFileQuery), "download": "Return as an attachment when 1."})
+    @console_ns.response(200, "Skill file content", console_ns.models[BinaryFileResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            query = SkillFileQuery.model_validate(
+                {
+                    "path": request.args.get("path"),
+                    "version_id": request.args.get("version_id"),
+                }
+            )
+            result = SkillManagementService().pull_file(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                path=query.path,
+                version_id=query.version_id,
+            )
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=request.args.get("download") == "1",
+                download_name=result.filename,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/publish")
+class WorkspaceSkillPublishApi(Resource):
+    @console_ns.expect(console_ns.models[SkillPublishPayload.__name__])
+    @console_ns.response(200, "Skill published", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillPublishPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().publish_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/restore")
+class WorkspaceSkillRestoreApi(Resource):
+    @console_ns.expect(console_ns.models[SkillRestorePayload.__name__])
+    @console_ns.response(200, "Skill version restored", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillRestorePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().restore_version(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/references")
+class WorkspaceSkillReferencesApi(Resource):
+    @console_ns.response(200, "Skill references", console_ns.models[SkillReferenceListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().list_skill_references(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillReferenceListResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/versions")
+class WorkspaceSkillVersionsApi(Resource):
+    @console_ns.response(200, "Skill versions", console_ns.models[SkillVersionListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().list_versions(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillVersionListResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/versions/<string:version_id>")
+class WorkspaceSkillVersionApi(Resource):
+    @console_ns.response(200, "Skill version detail", console_ns.models[SkillVersionDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str, version_id: str):
+        try:
+            result = SkillManagementService().get_version(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                version_id=version_id,
+            )
+            return dump_response(SkillVersionDetailResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillVersionUpdatePayload.__name__])
+    @console_ns.response(200, "Skill version updated", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, skill_id: str, version_id: str):
+        try:
+            payload = SkillVersionUpdatePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().update_version(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                version_id=version_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.response(200, "Skill version deleted", console_ns.models[SkillVersionDeleteResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def delete(self, current_tenant_id: str, current_user: Account, skill_id: str, version_id: str):
+        try:
+            result = SkillManagementService().delete_version(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                version_id=version_id,
+            )
+            return dump_response(SkillVersionDeleteResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/agents/<string:agent_id>/skills")
+class WorkspaceAgentSkillBindingsApi(Resource):
+    @console_ns.response(200, "Agent Skill bindings", console_ns.models[AgentSkillBindingsResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, agent_id: str):
+        result = SkillManagementService().list_agent_bindings(tenant_id=current_tenant_id, agent_id=agent_id)
+        return dump_response(AgentSkillBindingsResponse, result)
+
+    @console_ns.expect(console_ns.models[AgentSkillBindingsPayload.__name__])
+    @console_ns.response(200, "Agent Skill bindings replaced", console_ns.models[AgentSkillBindingsResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def put(self, current_tenant_id: str, current_user: Account, agent_id: str):
+        try:
+            payload = AgentSkillBindingsPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().replace_agent_bindings(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                agent_id=agent_id,
+                skill_ids=payload.skill_ids,
+            )
+            return dump_response(AgentSkillBindingsResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+__all__ = [
+    "WorkspaceAgentSkillBindingsApi",
+    "WorkspaceSkillApi",
+    "WorkspaceSkillDuplicateApi",
+    "WorkspaceSkillExportApi",
+    "WorkspaceSkillFilesApi",
+    "WorkspaceSkillImportApi",
+    "WorkspaceSkillPublishApi",
+    "WorkspaceSkillReferencesApi",
+    "WorkspaceSkillRestoreApi",
+    "WorkspaceSkillTagsApi",
+    "WorkspaceSkillVersionApi",
+    "WorkspaceSkillVersionsApi",
+    "WorkspaceSkillsApi",
+]

api/controllers/inner_api/__init__.py

@@ -23,6 +23,7 @@ from .knowledge import retrieval as _knowledge_retrieval
 from .plugin import agent_config as _agent_config
 from .plugin import agent_drive as _agent_drive
 from .plugin import plugin as _plugin
+from .plugin import skills as _skills
 from .workspace import workspace as _workspace
 
 api.add_namespace(inner_api_ns)
@@ -36,6 +37,7 @@ __all__ = [
     "_mail",
     "_plugin",
     "_runtime_credentials",
+    "_skills",
     "_workspace",
     "api",
     "bp",

api/controllers/inner_api/plugin/skills.py

@@ -0,0 +1,54 @@
+"""Inner API for published workspace Skills.
+
+These endpoints are called by trusted runtime services. They expose only
+published Skill artifacts, never draft files or editable metadata.
+"""
+
+from __future__ import annotations
+
+import io
+
+from flask import request, send_file
+from flask_restx import Resource
+from pydantic import BaseModel, ValidationError
+
+from controllers.console.wraps import setup_required
+from controllers.inner_api import inner_api_ns
+from controllers.inner_api.wraps import plugin_inner_api_only
+from services.skill_management_service import SkillManagementService, SkillManagementServiceError
+
+
+class _SkillTargetQuery(BaseModel):
+    tenant_id: str
+
+
+def _target_query_from_request() -> _SkillTargetQuery:
+    return _SkillTargetQuery.model_validate({"tenant_id": request.args.get("tenant_id")})
+
+
+def _error_response(exc: SkillManagementServiceError) -> tuple[dict[str, str], int]:
+    return {"code": exc.code, "message": exc.message}, exc.status_code
+
+
+@inner_api_ns.route("/skills/<string:skill_id>/pull")
+class PublishedSkillPullApi(Resource):
+    @setup_required
+    @plugin_inner_api_only
+    @inner_api_ns.doc("published_skill_pull")
+    def get(self, skill_id: str):
+        try:
+            query = _target_query_from_request()
+            result = SkillManagementService().pull_published_archive(tenant_id=query.tenant_id, skill_id=skill_id)
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=True,
+                download_name=result.filename,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+__all__ = ["PublishedSkillPullApi"]

api/core/app/apps/agent_app/runtime_request_builder.py

@@ -43,6 +43,7 @@ from core.workflow.nodes.agent_v2.runtime_request_builder import (
     build_config_layer_config,
     build_knowledge_layer_config,
     build_shell_layer_config,
+    load_runtime_agent_skill_configs,
 )
 from models.agent_config_entities import AgentSoulConfig, AgentSoulToolsConfig
 from models.provider_ids import ModelProviderID
@@ -125,14 +126,22 @@ class AgentAppRuntimeRequestBuilder:
                 "cli_tool_count": len(agent_soul.tools.cli_tools),
             }
 
+        runtime_config_skills = load_runtime_agent_skill_configs(
+            tenant_id=context.dify_context.tenant_id,
+            agent_id=context.agent_id,
+        )
         config_layer_config, config_warnings = build_config_layer_config(
             agent_soul,
             agent_id=context.agent_id,
             config_version_id=context.agent_config_snapshot_id,
             config_version_kind=context.agent_config_version_kind,
+            runtime_config_skills=runtime_config_skills,
         )
         append_runtime_warnings(metadata, config_warnings)
-        soul_prompt_resolver = build_config_aware_soul_mention_resolver(agent_soul)
+        soul_prompt_resolver = build_config_aware_soul_mention_resolver(
+            agent_soul,
+            runtime_config_skills=runtime_config_skills,
+        )
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_agent_app(

api/core/plugin/plugin_service.py

@@ -66,7 +66,7 @@ from services.enterprise.plugin_manager_service import (
     PreUninstallPluginRequest,
 )
 from services.errors.plugin import PluginInstallationForbiddenError
-from services.feature_service import FeatureService, PluginInstallationScope
+from services.feature_service import FeatureService, PluginInstallationPermissionModel, PluginInstallationScope
 
 logger = logging.getLogger(__name__)
 _provider_entities_adapter: TypeAdapter[list[ProviderEntity]] = TypeAdapter(list[ProviderEntity])
@@ -604,22 +604,30 @@ class PluginService:
             return result
 
     @staticmethod
-    def _check_marketplace_only_permission():
+    def _check_marketplace_only_permission() -> None:
         """
         Check if the marketplace only permission is enabled
         """
-        features = FeatureService.get_system_features()
-        if features.plugin_installation_permission.restrict_to_marketplace_only:
+        permission = PluginService._get_plugin_installation_permission()
+        if permission.restrict_to_marketplace_only:
             raise PluginInstallationForbiddenError("Plugin installation is restricted to marketplace only")
 
     @staticmethod
-    def _check_plugin_installation_scope(plugin_verification: PluginVerification | None):
+    def _get_plugin_installation_permission() -> PluginInstallationPermissionModel:
+        """Resolve the validated policy and reject deny-all before any installation side effect."""
+        permission = FeatureService.get_plugin_installation_permission()
+        if permission.plugin_installation_scope == PluginInstallationScope.NONE:
+            raise PluginInstallationForbiddenError("Installing plugins is not allowed")
+        return permission
+
+    @staticmethod
+    def _check_plugin_installation_scope(plugin_verification: PluginVerification | None) -> None:
         """
         Check the plugin installation scope
         """
-        features = FeatureService.get_system_features()
+        permission = PluginService._get_plugin_installation_permission()
 
-        match features.plugin_installation_permission.plugin_installation_scope:
+        match permission.plugin_installation_scope:
             case PluginInstallationScope.OFFICIAL_ONLY:
                 if (
                     plugin_verification is None
@@ -634,10 +642,10 @@ class PluginService:
                     raise PluginInstallationForbiddenError(
                         "Plugin installation is restricted to official and specific partners"
                     )
-            case PluginInstallationScope.NONE:
-                raise PluginInstallationForbiddenError("Installing plugins is not allowed")
             case PluginInstallationScope.ALL:
                 pass
+            case _:
+                raise PluginInstallationForbiddenError("Plugin installation policy is invalid")
 
     @staticmethod
     def get_debugging_key(tenant_id: str) -> str:
@@ -907,7 +915,7 @@ class PluginService:
         # check if plugin pkg is already downloaded
         manager = PluginInstaller()
 
-        features = FeatureService.get_system_features()
+        permission = PluginService._get_plugin_installation_permission()
 
         try:
             manager.fetch_plugin_manifest(tenant_id, new_plugin_unique_identifier)
@@ -919,7 +927,7 @@ class PluginService:
             response = manager.upload_pkg(
                 tenant_id,
                 pkg,
-                verify_signature=features.plugin_installation_permission.restrict_to_marketplace_only,
+                verify_signature=permission.restrict_to_marketplace_only,
             )
 
             # check if the plugin is available to install
@@ -974,11 +982,11 @@ class PluginService:
         """
         PluginService._check_marketplace_only_permission()
         manager = PluginInstaller()
-        features = FeatureService.get_system_features()
+        permission = PluginService._get_plugin_installation_permission()
         response = manager.upload_pkg(
             tenant_id,
             pkg,
-            verify_signature=features.plugin_installation_permission.restrict_to_marketplace_only,
+            verify_signature=permission.restrict_to_marketplace_only,
         )
         PluginService._check_plugin_installation_scope(response.verification)
 
@@ -996,13 +1004,13 @@ class PluginService:
         pkg = download_with_size_limit(
             f"https://github.com/{repo}/releases/download/{version}/{package}", dify_config.PLUGIN_MAX_PACKAGE_SIZE
         )
-        features = FeatureService.get_system_features()
+        permission = PluginService._get_plugin_installation_permission()
 
         manager = PluginInstaller()
         response = manager.upload_pkg(
             tenant_id,
             pkg,
-            verify_signature=features.plugin_installation_permission.restrict_to_marketplace_only,
+            verify_signature=permission.restrict_to_marketplace_only,
         )
         PluginService._check_plugin_installation_scope(response.verification)
 
@@ -1076,7 +1084,7 @@ class PluginService:
         if not dify_config.MARKETPLACE_ENABLED:
             raise ValueError("marketplace is not enabled")
 
-        features = FeatureService.get_system_features()
+        permission = PluginService._get_plugin_installation_permission()
 
         manager = PluginInstaller()
         try:
@@ -1086,7 +1094,7 @@ class PluginService:
             response = manager.upload_pkg(
                 tenant_id,
                 pkg,
-                verify_signature=features.plugin_installation_permission.restrict_to_marketplace_only,
+                verify_signature=permission.restrict_to_marketplace_only,
             )
             # check if the plugin is available to install
             PluginService._check_plugin_installation_scope(response.verification)
@@ -1108,7 +1116,7 @@ class PluginService:
         # collect actual plugin_unique_identifiers
         actual_plugin_unique_identifiers = []
         metas = []
-        features = FeatureService.get_system_features()
+        permission = PluginService._get_plugin_installation_permission()
 
         # check if already downloaded
         for plugin_unique_identifier in plugin_unique_identifiers:
@@ -1126,7 +1134,7 @@ class PluginService:
                 response = manager.upload_pkg(
                     tenant_id,
                     pkg,
-                    verify_signature=features.plugin_installation_permission.restrict_to_marketplace_only,
+                    verify_signature=permission.restrict_to_marketplace_only,
                 )
                 # check if the plugin is available to install
                 PluginService._check_plugin_installation_scope(response.verification)

api/core/workflow/nodes/agent_v2/runtime_request_builder.py

@@ -38,6 +38,7 @@ from dify_agent.layers.shell import (
 )
 from dify_agent.protocol import CreateRunRequest, DeferredToolResultsPayload
 from pydantic import BaseModel, ValidationError
+from sqlalchemy.exc import OperationalError
 
 from clients.agent_backend import (
     AgentBackendModelConfig,
@@ -206,14 +207,22 @@ class WorkflowAgentRuntimeRequestBuilder:
                 "cli_tool_count": len(agent_soul.tools.cli_tools),
             }
 
+        runtime_config_skills = load_runtime_agent_skill_configs(
+            tenant_id=context.dify_context.tenant_id,
+            agent_id=context.agent.id,
+        )
         config_layer_config, config_warnings = build_config_layer_config(
             agent_soul,
             agent_id=context.agent.id,
             config_version_id=context.snapshot.id,
             config_version_kind="snapshot",
+            runtime_config_skills=runtime_config_skills,
         )
         append_runtime_warnings(metadata, config_warnings)
-        soul_prompt_resolver = build_config_aware_soul_mention_resolver(agent_soul)
+        soul_prompt_resolver = build_config_aware_soul_mention_resolver(
+            agent_soul,
+            runtime_config_skills=runtime_config_skills,
+        )
         soul_prompt = expand_prompt_mentions(agent_soul.prompt.system_prompt, soul_prompt_resolver).strip()
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
@@ -883,11 +892,16 @@ def append_runtime_warnings(metadata: dict[str, Any], warnings: list[dict[str, s
             existing.extend(warnings)
 
 
-def build_config_aware_soul_mention_resolver(agent_soul: AgentSoulConfig):
+def build_config_aware_soul_mention_resolver(
+    agent_soul: AgentSoulConfig,
+    *,
+    runtime_config_skills: Sequence[DifyConfigSkillConfig] = (),
+):
     """Resolve config skill/file mentions and delegate the rest to Agent Soul."""
 
     base_resolver = build_soul_mention_resolver(agent_soul)
     skill_names = {item.name for item in agent_soul.config_skills if not item.is_missing}
+    skill_names.update(item.name for item in runtime_config_skills)
     file_names = {item.name for item in agent_soul.config_files if not item.is_missing}
 
     def _resolve(mention: object) -> str | None:
@@ -905,12 +919,34 @@ def build_config_aware_soul_mention_resolver(agent_soul: AgentSoulConfig):
     return _resolve
 
 
+def load_runtime_agent_skill_configs(*, tenant_id: str, agent_id: str) -> list[DifyConfigSkillConfig]:
+    """Return workspace-bound Skills as prompt-safe runtime config skills."""
+    from services.skill_management_service import SkillManagementService
+
+    try:
+        runtime_skills = SkillManagementService().list_runtime_agent_skills(tenant_id=tenant_id, agent_id=agent_id)
+    except OperationalError as exc:
+        if "no such table: agent_skill_bindings" not in str(exc.orig):
+            raise
+        runtime_skills = []
+    return [
+        DifyConfigSkillConfig(
+            name=str(item["name"]),
+            description=str(item.get("description") or ""),
+            size=cast(int | None, item.get("size")),
+            mime_type=cast(str | None, item.get("mime_type")),
+        )
+        for item in runtime_skills
+    ]
+
+
 def build_config_layer_config(
     agent_soul: AgentSoulConfig,
     *,
     agent_id: str | None = None,
     config_version_id: str | None = None,
     config_version_kind: Literal["snapshot", "draft", "build_draft"] = "snapshot",
+    runtime_config_skills: Sequence[DifyConfigSkillConfig] = (),
 ) -> tuple[DifyConfigLayerConfig, list[dict[str, str]]]:
     """Build the always-present Agent config layer from Agent Soul state.
 
@@ -927,8 +963,23 @@ def build_config_layer_config(
         )
     )
     available_skills = [skill for skill in agent_soul.config_skills if not skill.is_missing]
+    skill_configs = [
+        DifyConfigSkillConfig(
+            name=skill.name,
+            description=skill.description,
+            size=skill.size,
+            mime_type=skill.mime_type,
+        )
+        for skill in available_skills
+    ]
+    seen_skill_names = {skill.name for skill in skill_configs}
+    for skill in runtime_config_skills:
+        if skill.name in seen_skill_names:
+            continue
+        seen_skill_names.add(skill.name)
+        skill_configs.append(skill)
     available_files = [file_ref for file_ref in agent_soul.config_files if not file_ref.is_missing]
-    skill_names = {skill.name for skill in available_skills}
+    skill_names = {skill.name for skill in skill_configs}
     file_names = {file_ref.name for file_ref in available_files}
     warnings: list[dict[str, str]] = [
         {
@@ -965,15 +1016,7 @@ def build_config_layer_config(
                 kind=config_version_kind,
                 writable=config_version_kind == "build_draft",
             ),
-            skills=[
-                DifyConfigSkillConfig(
-                    name=skill.name,
-                    description=skill.description,
-                    size=skill.size,
-                    mime_type=skill.mime_type,
-                )
-                for skill in available_skills
-            ],
+            skills=skill_configs,
             files=[
                 DifyConfigFileConfig(
                     name=file_ref.name,

api/libs/helper.py

@@ -289,7 +289,11 @@ UUIDStr = Annotated[str, AfterValidator(_strict_uuid)]
 
 def alphanumeric(value: str):
     # check if the value is alphanumeric and underlined
-    if re.match(r"^[a-zA-Z0-9_]+$", value):
+    # Use re.fullmatch instead of re.match to reject trailing newlines.
+    # In Python, '$' matches at end-of-string OR just before a trailing newline,
+    # so re.match accepts "tool_name\n". re.fullmatch requires the entire
+    # string to match. Regression for #39666 (sibling of #39234 / #39548).
+    if re.fullmatch(r"^[a-zA-Z0-9_]+$", value):
         return value
 
     raise ValueError(f"{value} is not a valid alphanumeric value")

api/migrations/versions/2026_07_09_1200-a4f8d2c9e1b0_add_workspace_skill_management.py

@@ -0,0 +1,114 @@
+"""add workspace skill management
+
+Revision ID: a4f8d2c9e1b0
+Revises: 6f5a9c2d8e1b
+Create Date: 2026-07-09 12:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import mysql
+
+from models.types import StringUUID
+
+# revision identifiers, used by Alembic.
+revision = "a4f8d2c9e1b0"
+down_revision = "6f5a9c2d8e1b"
+branch_labels = None
+depends_on = None
+
+
+def _uuid_column(name: str, *, nullable: bool = False) -> sa.Column:
+    return sa.Column(name, StringUUID(), nullable=nullable)
+
+
+def _long_text() -> sa.types.TypeEngine:
+    return sa.Text().with_variant(mysql.LONGTEXT(), "mysql")
+
+
+def upgrade() -> None:
+    op.create_table(
+        "skills",
+        _uuid_column("id"),
+        _uuid_column("tenant_id"),
+        sa.Column("name", sa.String(length=64), nullable=False),
+        sa.Column("display_name", sa.String(length=128), nullable=False),
+        sa.Column("icon", sa.String(length=16), nullable=False, server_default="📄"),
+        sa.Column("description", sa.String(length=1024), nullable=False, server_default=""),
+        sa.Column("name_manually_edited", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column("visibility", sa.String(length=32), nullable=False, server_default="workspace"),
+        _uuid_column("latest_published_version_id", nullable=True),
+        _uuid_column("created_by", nullable=True),
+        _uuid_column("updated_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_pkey"),
+        sa.UniqueConstraint("tenant_id", "name", name="skill_tenant_name_unique"),
+    )
+    op.create_index("skills_tenant_updated_at_idx", "skills", ["tenant_id", "updated_at"])
+
+    op.create_table(
+        "skill_draft_files",
+        _uuid_column("id"),
+        _uuid_column("skill_id"),
+        sa.Column("path", sa.String(length=512), nullable=False),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("storage", sa.String(length=32), nullable=True),
+        sa.Column("mime_type", sa.String(length=255), nullable=True),
+        sa.Column("content_text", _long_text(), nullable=True),
+        _uuid_column("tool_file_id", nullable=True),
+        sa.Column("size", sa.BigInteger(), nullable=True),
+        sa.Column("hash", sa.String(length=255), nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_draft_file_pkey"),
+        sa.UniqueConstraint("skill_id", "path", name="skill_draft_file_skill_path_unique"),
+    )
+    op.create_index("skill_draft_files_skill_path_idx", "skill_draft_files", ["skill_id", "path"])
+
+    op.create_table(
+        "skill_versions",
+        _uuid_column("id"),
+        _uuid_column("skill_id"),
+        sa.Column("version_number", sa.Integer(), nullable=False),
+        sa.Column("version_name", sa.String(length=128), nullable=False, server_default=""),
+        sa.Column("publish_note", sa.String(length=1024), nullable=False, server_default=""),
+        sa.Column("manifest", _long_text(), nullable=False),
+        _uuid_column("archive_tool_file_id"),
+        sa.Column("hash_code", sa.String(length=255), nullable=False),
+        sa.Column("archive_size", sa.BigInteger(), nullable=False),
+        _uuid_column("published_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_version_pkey"),
+        sa.UniqueConstraint("skill_id", "version_number", name="skill_version_skill_number_unique"),
+    )
+    op.create_index("skill_versions_skill_created_at_idx", "skill_versions", ["skill_id", "created_at"])
+
+    op.create_table(
+        "agent_skill_bindings",
+        _uuid_column("id"),
+        _uuid_column("tenant_id"),
+        _uuid_column("agent_id"),
+        _uuid_column("skill_id"),
+        sa.Column("priority", sa.Integer(), nullable=False),
+        _uuid_column("created_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="agent_skill_binding_pkey"),
+        sa.UniqueConstraint("tenant_id", "agent_id", "skill_id", name="agent_skill_binding_unique"),
+        sa.UniqueConstraint("tenant_id", "agent_id", "priority", name="agent_skill_binding_priority_unique"),
+    )
+    op.create_index("agent_skill_bindings_skill_idx", "agent_skill_bindings", ["tenant_id", "skill_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("agent_skill_bindings_skill_idx", table_name="agent_skill_bindings")
+    op.drop_table("agent_skill_bindings")
+    op.drop_index("skill_versions_skill_created_at_idx", table_name="skill_versions")
+    op.drop_table("skill_versions")
+    op.drop_index("skill_draft_files_skill_path_idx", table_name="skill_draft_files")
+    op.drop_table("skill_draft_files")
+    op.drop_index("skills_tenant_updated_at_idx", table_name="skills")
+    op.drop_table("skills")

api/migrations/versions/2026_07_22_1500-d2825e7b9c10_scope_agent_debug_conversations.py

@@ -18,31 +18,109 @@ branch_labels = None
 depends_on = None
 
 
+def _is_pg(conn) -> bool:
+    return conn.dialect.name == "postgresql"
+
+
+def _uuid_column(name: str, *, nullable: bool = False, primary_key: bool = False) -> sa.Column:
+    kwargs = {"nullable": nullable, "primary_key": primary_key}
+    if primary_key and _is_pg(op.get_bind()):
+        kwargs["server_default"] = sa.text("uuidv7()")
+    return sa.Column(name, models.types.StringUUID(), **kwargs)
+
+
+def _has_table(table_name: str) -> bool:
+    return sa.inspect(op.get_bind()).has_table(table_name)
+
+
+def _has_column(table_name: str, column_name: str) -> bool:
+    return any(
+        column["name"] == column_name for column in sa.inspect(op.get_bind()).get_columns(table_name)
+    )
+
+
+def _has_unique_constraint(table_name: str, constraint_name: str) -> bool:
+    return any(
+        constraint["name"] == constraint_name
+        for constraint in sa.inspect(op.get_bind()).get_unique_constraints(table_name)
+    )
+
+
 def upgrade():
+    if not _has_table("agent_debug_conversations"):
+        op.create_table(
+            "agent_debug_conversations",
+            _uuid_column("id", primary_key=True),
+            sa.Column("tenant_id", models.types.StringUUID(), nullable=False),
+            sa.Column("agent_id", models.types.StringUUID(), nullable=False),
+            sa.Column("app_id", models.types.StringUUID(), nullable=False),
+            sa.Column("account_id", models.types.StringUUID(), nullable=False),
+            sa.Column("conversation_id", models.types.StringUUID(), nullable=False),
+            sa.Column(
+                "draft_type",
+                sa.String(length=32),
+                nullable=False,
+                server_default=sa.text("'debug_build'"),
+            ),
+            sa.Column("created_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+            sa.PrimaryKeyConstraint("id", name=op.f("agent_debug_conversation_pkey")),
+            sa.UniqueConstraint(
+                "tenant_id",
+                "agent_id",
+                "account_id",
+                "draft_type",
+                name=op.f("agent_debug_conversation_agent_account_draft_type_unique"),
+            ),
+        )
+        op.create_index(
+            "agent_debug_conversation_conversation_idx",
+            "agent_debug_conversations",
+            ["conversation_id"],
+        )
+        op.create_index(
+            "agent_debug_conversation_account_idx",
+            "agent_debug_conversations",
+            ["tenant_id", "account_id"],
+        )
+        return
+
     # Existing pointers have always represented Build chat because the Agent
     # detail API exposes them as ``debug_conversation_id`` for that surface.
-    op.add_column(
+    if not _has_column("agent_debug_conversations", "draft_type"):
+        op.add_column(
+            "agent_debug_conversations",
+            sa.Column(
+                "draft_type",
+                sa.String(length=32),
+                nullable=False,
+                server_default=sa.text("'debug_build'"),
+            ),
+        )
+    if _has_unique_constraint(
         "agent_debug_conversations",
-        sa.Column(
-            "draft_type",
-            sa.String(length=32),
-            nullable=False,
-            server_default=sa.text("'debug_build'"),
-        ),
-    )
-    op.drop_constraint(
         "agent_debug_conversation_agent_account_unique",
+    ):
+        op.drop_constraint(
+            "agent_debug_conversation_agent_account_unique",
+            "agent_debug_conversations",
+            type_="unique",
+        )
+    if not _has_unique_constraint(
         "agent_debug_conversations",
-        type_="unique",
-    )
-    op.create_unique_constraint(
         "agent_debug_conversation_agent_account_draft_type_unique",
-        "agent_debug_conversations",
-        ["tenant_id", "agent_id", "account_id", "draft_type"],
-    )
+    ):
+        op.create_unique_constraint(
+            "agent_debug_conversation_agent_account_draft_type_unique",
+            "agent_debug_conversations",
+            ["tenant_id", "agent_id", "account_id", "draft_type"],
+        )
 
 
 def downgrade():
+    if not _has_table("agent_debug_conversations"):
+        return
+
     debug_conversations = sa.table(
         "agent_debug_conversations",
         sa.column("tenant_id", models.types.StringUUID()),
@@ -64,14 +142,23 @@ def downgrade():
             ),
         )
     )
-    op.drop_constraint(
+    if _has_unique_constraint(
+        "agent_debug_conversations",
         "agent_debug_conversation_agent_account_draft_type_unique",
+    ):
+        op.drop_constraint(
+            "agent_debug_conversation_agent_account_draft_type_unique",
+            "agent_debug_conversations",
+            type_="unique",
+        )
+    if not _has_unique_constraint(
         "agent_debug_conversations",
-        type_="unique",
-    )
-    op.create_unique_constraint(
         "agent_debug_conversation_agent_account_unique",
-        "agent_debug_conversations",
-        ["tenant_id", "agent_id", "account_id"],
-    )
-    op.drop_column("agent_debug_conversations", "draft_type")
+    ):
+        op.create_unique_constraint(
+            "agent_debug_conversation_agent_account_unique",
+            "agent_debug_conversations",
+            ["tenant_id", "agent_id", "account_id"],
+        )
+    if _has_column("agent_debug_conversations", "draft_type"):
+        op.drop_column("agent_debug_conversations", "draft_type")

api/migrations/versions/2026_07_23_1500-e9f4a1b2c3d5_merge_skill_and_agent_debug_heads.py

@@ -0,0 +1,21 @@
+"""merge skill and agent debug conversation heads
+
+Revision ID: e9f4a1b2c3d5
+Revises: a4f8d2c9e1b0, d2825e7b9c10
+Create Date: 2026-07-23 15:00:00.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "e9f4a1b2c3d5"
+down_revision = ("a4f8d2c9e1b0", "d2825e7b9c10")
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    pass
+
+
+def downgrade():
+    pass

api/models/__init__.py

@@ -113,6 +113,7 @@ from .provider import (
     TenantDefaultModel,
     TenantPreferredModelProvider,
 )
+from .skill import AgentSkillBinding, Skill, SkillDraftFile, SkillFileKind, SkillFileStorage, SkillVersion
 from .snippet import CustomizedSnippet, SnippetType
 from .source import DataSourceApiKeyAuthBinding, DataSourceOauthBinding
 from .task import CeleryTask, CeleryTaskSet
@@ -173,6 +174,7 @@ __all__ = [
     "AgentRuntimeSessionOwnerType",
     "AgentRuntimeSessionStatus",
     "AgentScope",
+    "AgentSkillBinding",
     "AgentSource",
     "AgentStatus",
     "ApiRequest",
@@ -246,6 +248,11 @@ __all__ = [
     "RecommendedApp",
     "SavedMessage",
     "Site",
+    "Skill",
+    "SkillDraftFile",
+    "SkillFileKind",
+    "SkillFileStorage",
+    "SkillVersion",
     "SnippetType",
     "Tag",
     "TagBinding",

api/models/enums.py

@@ -249,6 +249,7 @@ class TagType(StrEnum):
     KNOWLEDGE = "knowledge"
     APP = "app"
     SNIPPET = "snippet"
+    SKILL = "skill"
 
 
 class DatasetMetadataType(StrEnum):

api/models/model.py

@@ -2667,7 +2667,7 @@ class Tag(TypeBase):
         sa.Index("tag_name_idx", "name"),
     )
 
-    TAG_TYPE_LIST = ["knowledge", "app", "snippet"]
+    TAG_TYPE_LIST = ["knowledge", "app", "snippet", "skill"]
 
     id: Mapped[str] = mapped_column(
         StringUUID, insert_default=lambda: str(uuid4()), default_factory=lambda: str(uuid4()), init=False

api/models/skill.py

@@ -0,0 +1,164 @@
+"""Workspace-level Skill Management models.
+
+These tables are the source of truth for reusable workspace Skills. Agent Soul
+``config_skills`` and Agent Drive skill rows remain per-agent runtime/config
+assets; they may consume a published Skill snapshot but do not own the Skill's
+draft, metadata, version history, or Agent binding priority.
+"""
+
+from enum import StrEnum
+
+import sqlalchemy as sa
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import Index, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from models.base import Base, DefaultFieldsMixin
+from models.types import EnumText, JSONModelColumn, LongText, StringUUID
+
+
+class SkillFileKind(StrEnum):
+    """Draft file entry kind."""
+
+    FILE = "file"
+    DIRECTORY = "directory"
+
+
+class SkillFileStorage(StrEnum):
+    """How a draft file's content is stored."""
+
+    TEXT = "text"
+    TOOL_FILE = "tool_file"
+
+
+class SkillVersionManifestFile(BaseModel):
+    """One file entry captured in a published Skill snapshot manifest."""
+
+    path: str
+    mime_type: str | None = None
+    size: int
+    hash: str
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SkillVersionManifest(BaseModel):
+    """Published Skill snapshot file index."""
+
+    files: list[SkillVersionManifestFile]
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class Skill(DefaultFieldsMixin, Base):
+    """Workspace-level reusable Skill metadata and draft status."""
+
+    __tablename__ = "skills"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_pkey"),
+        UniqueConstraint("tenant_id", "name", name="skill_tenant_name_unique"),
+        Index("skills_tenant_updated_at_idx", "tenant_id", "updated_at"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    name: Mapped[str] = mapped_column(sa.String(64), nullable=False)
+    display_name: Mapped[str] = mapped_column(sa.String(128), nullable=False)
+    icon: Mapped[str] = mapped_column(sa.String(16), nullable=False, default="📄", server_default="📄")
+    description: Mapped[str] = mapped_column(sa.String(1024), nullable=False, default="", server_default="")
+    name_manually_edited: Mapped[bool] = mapped_column(
+        sa.Boolean,
+        nullable=False,
+        default=False,
+        server_default=sa.false(),
+    )
+    visibility: Mapped[str] = mapped_column(
+        sa.String(32),
+        nullable=False,
+        default="workspace",
+        server_default="workspace",
+    )
+    latest_published_version_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    created_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    updated_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+class SkillDraftFile(DefaultFieldsMixin, Base):
+    """One draft file or directory in a workspace Skill."""
+
+    __tablename__ = "skill_draft_files"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_draft_file_pkey"),
+        UniqueConstraint("skill_id", "path", name="skill_draft_file_skill_path_unique"),
+        Index("skill_draft_files_skill_path_idx", "skill_id", "path"),
+    )
+
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    path: Mapped[str] = mapped_column(sa.String(512), nullable=False)
+    kind: Mapped[SkillFileKind] = mapped_column(EnumText(SkillFileKind, length=32), nullable=False)
+    storage: Mapped[SkillFileStorage | None] = mapped_column(EnumText(SkillFileStorage, length=32), nullable=True)
+    mime_type: Mapped[str | None] = mapped_column(sa.String(255), nullable=True)
+    content_text: Mapped[str | None] = mapped_column(LongText, nullable=True)
+    tool_file_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    size: Mapped[int | None] = mapped_column(sa.BigInteger, nullable=True)
+    hash: Mapped[str | None] = mapped_column(sa.String(255), nullable=True)
+
+
+class SkillVersion(DefaultFieldsMixin, Base):
+    """Immutable published Skill snapshot.
+
+    ``hash_code`` uniquely identifies a published version for downstream
+    execution audit. It includes Skill identity, version number, and archive
+    content digest instead of being only the archive content hash.
+    """
+
+    __tablename__ = "skill_versions"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_version_pkey"),
+        UniqueConstraint("skill_id", "version_number", name="skill_version_skill_number_unique"),
+        Index("skill_versions_skill_created_at_idx", "skill_id", "created_at"),
+    )
+
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    version_number: Mapped[int] = mapped_column(sa.Integer, nullable=False)
+    version_name: Mapped[str] = mapped_column(sa.String(128), nullable=False, default="", server_default="")
+    publish_note: Mapped[str] = mapped_column(sa.String(1024), nullable=False, default="", server_default="")
+    manifest: Mapped[SkillVersionManifest] = mapped_column(JSONModelColumn(SkillVersionManifest), nullable=False)
+    archive_tool_file_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    hash_code: Mapped[str] = mapped_column(sa.String(255), nullable=False)
+    archive_size: Mapped[int] = mapped_column(sa.BigInteger, nullable=False)
+    published_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+class AgentSkillBinding(DefaultFieldsMixin, Base):
+    """Direct Agent-to-workspace-Skill binding.
+
+    ``priority`` is retained as an internal ordering column for the current
+    schema constraints. Runtime Skill selection is Agent-driven and must not
+    treat it as a matching priority.
+    """
+
+    __tablename__ = "agent_skill_bindings"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="agent_skill_binding_pkey"),
+        UniqueConstraint("tenant_id", "agent_id", "skill_id", name="agent_skill_binding_unique"),
+        UniqueConstraint("tenant_id", "agent_id", "priority", name="agent_skill_binding_priority_unique"),
+        Index("agent_skill_bindings_skill_idx", "tenant_id", "skill_id"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    agent_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    priority: Mapped[int] = mapped_column(sa.Integer, nullable=False)
+    created_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+__all__ = [
+    "AgentSkillBinding",
+    "Skill",
+    "SkillDraftFile",
+    "SkillFileKind",
+    "SkillFileStorage",
+    "SkillVersion",
+    "SkillVersionManifest",
+    "SkillVersionManifestFile",
+]

api/openapi/markdown/console-openapi.md

@@ -9551,7 +9551,7 @@ Remove one or more tag bindings from a target.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | keyword | query | Search keyword | No | string |
-| type | query | Tag type filter | No | string, <br>**Available values:** "", "app", "knowledge", "snippet" |
+| type | query | Tag type filter | No | string |
 
 #### Responses
 
@@ -10087,6 +10087,38 @@ Get list of available agent providers
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [AgentProviderListResponse](#agentproviderlistresponse)<br> |
 
+### [GET] /workspaces/current/agents/{agent_id}/skills
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent Skill bindings | **application/json**: [AgentSkillBindingsResponse](#agentskillbindingsresponse)<br> |
+
+### [PUT] /workspaces/current/agents/{agent_id}/skills
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AgentSkillBindingsPayload](#agentskillbindingspayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent Skill bindings replaced | **application/json**: [AgentSkillBindingsResponse](#agentskillbindingsresponse)<br> |
+
 ### [GET] /workspaces/current/customized-snippets
 **List customized snippets with pagination and search**
 
@@ -11988,6 +12020,341 @@ Returns permission flags that control workspace features like member invitations
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [WorkspaceAccessMatrix](#workspaceaccessmatrix)<br> |
 
+### [GET] /workspaces/current/skills
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| keyword | query | Search keyword matching skill name or description. | No | string |
+| limit | query | Number of items per page. | No | integer, <br>**Default:** 20 |
+| page | query | Page number. | No | integer, <br>**Default:** 1 |
+| tag | query | Skill tag filters. Repeat the parameter for multiple tags. | No | [ string ] |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace skills | **application/json**: [SkillListResponse](#skilllistresponse)<br> |
+
+### [POST] /workspaces/current/skills
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillCreatePayload](#skillcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill created | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [POST] /workspaces/current/skills/files/upload
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill draft file uploaded | **application/json**: [SkillFileUploadResponse](#skillfileuploadresponse)<br> |
+
+### [POST] /workspaces/current/skills/import
+Import a Skill zip package from multipart form field `file`.
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill imported | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [GET] /workspaces/current/skills/tags
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace Skill tags | **application/json**: [SkillTagListResponse](#skilltaglistresponse)<br> |
+
+### [DELETE] /workspaces/current/skills/{skill_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillDeletePayload](#skilldeletepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill deleted | **application/json**: [SkillDeleteResponse](#skilldeleteresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill detail | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [PATCH] /workspaces/current/skills/{skill_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillMetadataPayload](#skillmetadatapayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill updated | **application/json**: [SkillResponse](#skillresponse)<br> |
+
+### [POST] /workspaces/current/skills/{skill_id}/assist/messages
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillAssistMessagePayload](#skillassistmessagepayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 200 | Skill Authoring assistant event stream |
+
+### [POST] /workspaces/current/skills/{skill_id}/duplicate
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill duplicated | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/export
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 200 | Published Skill zip archive |
+
+### [PATCH] /workspaces/current/skills/{skill_id}/files
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillDraftFileOperationPayload](#skilldraftfileoperationpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Draft file operation applied | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [PUT] /workspaces/current/skills/{skill_id}/files
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillDraftTreePayload](#skilldrafttreepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Draft files replaced | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/files/content
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| download | query | Return as an attachment when 1. | No | string |
+| path | query | Skill file path relative to the Skill root. | Yes | string |
+| version_id | query | Optional published version ID. Omit for current draft. | No | string |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill file content | **application/json**: [BinaryFileResponse](#binaryfileresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/files/preview
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| path | query | Skill file path relative to the Skill root. | Yes | string |
+| version_id | query | Optional published version ID. Omit for current draft. | No | string |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill file text preview | **application/json**: [SkillFilePreviewResponse](#skillfilepreviewresponse)<br> |
+
+### [POST] /workspaces/current/skills/{skill_id}/publish
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillPublishPayload](#skillpublishpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill published | **application/json**: [SkillVersionResponse](#skillversionresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/references
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill references | **application/json**: [SkillReferenceListResponse](#skillreferencelistresponse)<br> |
+
+### [POST] /workspaces/current/skills/{skill_id}/restore
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillRestorePayload](#skillrestorepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version restored | **application/json**: [SkillVersionResponse](#skillversionresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/versions
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill versions | **application/json**: [SkillVersionListResponse](#skillversionlistresponse)<br> |
+
+### [DELETE] /workspaces/current/skills/{skill_id}/versions/{version_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+| version_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version deleted | **application/json**: [SkillVersionDeleteResponse](#skillversiondeleteresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/versions/{version_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+| version_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version detail | **application/json**: [SkillVersionDetailResponse](#skillversiondetailresponse)<br> |
+
+### [PATCH] /workspaces/current/skills/{skill_id}/versions/{version_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+| version_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillVersionUpdatePayload](#skillversionupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version updated | **application/json**: [SkillVersionResponse](#skillversionresponse)<br> |
+
 ### [GET] /workspaces/current/tool-labels
 #### Responses
 
@@ -14709,6 +15076,37 @@ Visibility and lifecycle scope of an Agent record.
 | ---- | ---- | ----------- | -------- |
 | result | string |  | Yes |
 
+#### AgentSkillBindingItemResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string |  | Yes |
+| display_name | string |  | Yes |
+| file_count | integer |  | Yes |
+| icon | string |  | Yes |
+| id | string |  | Yes |
+| latest_published_at | integer |  | No |
+| latest_published_version_id | string |  | No |
+| name | string |  | Yes |
+| priority | integer |  | Yes |
+| status | string |  | Yes |
+| tags | [ string ] |  | No |
+| updated_at | integer |  | Yes |
+
+#### AgentSkillBindingsPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| skill_ids | [ string ] | Ordered Skill IDs bound to the Agent. | No |
+
+#### AgentSkillBindingsResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| agent_id | string |  | Yes |
+| data | [ [AgentSkillBindingItemResponse](#agentskillbindingitemresponse) ] |  | No |
+| skill_ids | [ string ] |  | No |
+
 #### AgentSkillRefConfig
 
 | Name | Type | Description | Required |
@@ -21665,6 +22063,186 @@ Simple provider entity response.
 | title | string |  | Yes |
 | use_icon_as_answer_icon | boolean |  | Yes |
 
+#### SkillAssistAttachmentPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| mime_type | string |  | No |
+| name | string |  | Yes |
+| size | integer |  | No |
+| tool_file_id | string |  | Yes |
+
+#### SkillAssistMessagePayload
+
+One user message and optional uploaded context for the read-only Skill Authoring assistant.
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| attachments | [ [SkillAssistAttachmentPayload](#skillassistattachmentpayload) ] |  | No |
+| message | string |  | Yes |
+| model | [SkillAssistModelPayload](#skillassistmodelpayload) |  | No |
+
+#### SkillAssistModelPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| model | string |  | Yes |
+| model_settings | object |  | No |
+| plugin_id | string |  | No |
+| provider | string |  | Yes |
+
+#### SkillCreatePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string |  | No |
+| display_name | string |  | No |
+| icon | string, <br>**Default:** 📄 |  | No |
+| name | string |  | No |
+| tags | [ string ] |  | No |
+
+#### SkillDeletePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| confirmation_name | string | Required when deleting a referenced Skill. Must match the Skill name. | No |
+
+#### SkillDeleteResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| deleted | boolean |  | Yes |
+| id | string |  | Yes |
+
+#### SkillDetailResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| created_at | integer |  | Yes |
+| created_by | string |  | No |
+| created_by_name | string |  | No |
+| description | string |  | Yes |
+| display_name | string |  | Yes |
+| files | [ [SkillFileResponse](#skillfileresponse) ] |  | No |
+| icon | string |  | Yes |
+| id | string |  | Yes |
+| latest_published_version_id | string |  | No |
+| name | string |  | Yes |
+| name_manually_edited | boolean |  | No |
+| reference_count | integer |  | No |
+| tags | [ string ] |  | No |
+| updated_at | integer |  | Yes |
+| updated_by | string |  | No |
+| updated_by_name | string |  | No |
+| visibility | string |  | Yes |
+
+#### SkillDraftFileOperation
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| SkillDraftFileOperation | string |  |  |
+
+#### SkillDraftFileOperationPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | No |
+| expected_updated_at | integer |  | No |
+| hash | string |  | No |
+| mime_type | string |  | No |
+| operation | [SkillDraftFileOperation](#skilldraftfileoperation) |  | Yes |
+| path | string |  | Yes |
+| size | integer |  | No |
+| target_path | string |  | No |
+| tool_file_id | string |  | No |
+
+#### SkillDraftTreeItemPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | No |
+| hash | string |  | No |
+| kind | [SkillFileKind](#skillfilekind) |  | No |
+| mime_type | string |  | No |
+| path | string |  | Yes |
+| size | integer |  | No |
+| storage | [SkillFileStorage](#skillfilestorage) |  | No |
+| tool_file_id | string |  | No |
+
+#### SkillDraftTreePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| expected_updated_at | integer |  | No |
+| files | [ [SkillDraftTreeItemPayload](#skilldrafttreeitempayload) ] |  | No |
+
+#### SkillFileKind
+
+Draft file entry kind.
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| SkillFileKind | string | Draft file entry kind. |  |
+
+#### SkillFilePreviewResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | Yes |
+| hash | string |  | Yes |
+| mime_type | string |  | Yes |
+| path | string |  | Yes |
+| size | integer |  | Yes |
+
+#### SkillFileQuery
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| path | string | Skill file path relative to the Skill root. | Yes |
+| version_id | string | Optional published version ID. Omit for current draft. | No |
+
+#### SkillFileResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | No |
+| hash | string |  | No |
+| id | string |  | No |
+| kind | string |  | Yes |
+| mime_type | string |  | No |
+| path | string |  | Yes |
+| size | integer |  | No |
+| storage | string |  | No |
+| tool_file_id | string |  | No |
+
+#### SkillFileStorage
+
+How a draft file's content is stored.
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| SkillFileStorage | string | How a draft file's content is stored. |  |
+
+#### SkillFileUploadResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| hash | string |  | Yes |
+| id | string |  | Yes |
+| mime_type | string |  | Yes |
+| name | string |  | Yes |
+| size | integer |  | Yes |
+
+#### SkillListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillResponse](#skillresponse) ] |  | No |
+| has_more | boolean |  | No |
+| limit | integer, <br>**Default:** 20 |  | No |
+| page | integer, <br>**Default:** 1 |  | No |
+| total | integer |  | No |
+
 #### SkillManifest
 
 Validated metadata extracted from a Skill package.
@@ -21678,6 +22256,91 @@ Validated metadata extracted from a Skill package.
 | name | string |  | Yes |
 | size | integer |  | Yes |
 
+#### SkillMetadataPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| display_name | string |  | No |
+| expected_updated_at | integer |  | No |
+| icon | string |  | No |
+| tags | [ string ] |  | No |
+
+#### SkillPublishPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| publish_note | string |  | No |
+| version_name | string |  | No |
+
+#### SkillReferenceListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillReferenceResponse](#skillreferenceresponse) ] |  | No |
+
+#### SkillReferenceResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| agent_icon | string |  | No |
+| agent_icon_background | string |  | No |
+| agent_icon_type | string |  | No |
+| agent_id | string |  | Yes |
+| app_id | string |  | No |
+| display_name | string |  | Yes |
+| name | string |  | Yes |
+| node_id | string |  | No |
+| node_name | string |  | No |
+| type | string |  | Yes |
+| workflow_icon | string |  | No |
+| workflow_icon_background | string |  | No |
+| workflow_icon_type | string |  | No |
+| workflow_id | string |  | No |
+| workflow_name | string |  | No |
+| workflow_version | string |  | No |
+
+#### SkillResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| created_at | integer |  | Yes |
+| created_by | string |  | No |
+| created_by_name | string |  | No |
+| description | string |  | Yes |
+| display_name | string |  | Yes |
+| icon | string |  | Yes |
+| id | string |  | Yes |
+| latest_published_version_id | string |  | No |
+| name | string |  | Yes |
+| name_manually_edited | boolean |  | No |
+| reference_count | integer |  | No |
+| tags | [ string ] |  | No |
+| updated_at | integer |  | Yes |
+| updated_by | string |  | No |
+| updated_by_name | string |  | No |
+| visibility | string |  | Yes |
+
+#### SkillRestorePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| publish_note | string |  | No |
+| version_id | string |  | Yes |
+| version_name | string |  | No |
+
+#### SkillTagListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillTagResponse](#skilltagresponse) ] |  | No |
+
+#### SkillTagResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| count | integer |  | Yes |
+| tag | string |  | Yes |
+
 #### SkillToolInferenceResult
 
 | Name | Type | Description | Required |
@@ -21686,6 +22349,60 @@ Validated metadata extracted from a Skill package.
 | inferable | boolean |  | Yes |
 | reason | string |  | No |
 
+#### SkillVersionDeleteResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| deleted | boolean |  | Yes |
+| id | string |  | Yes |
+| latest_published_version_id | string |  | No |
+
+#### SkillVersionDetailResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_size | integer |  | Yes |
+| created_at | integer |  | Yes |
+| files | [ [SkillFileResponse](#skillfileresponse) ] |  | No |
+| hash_code | string |  | Yes |
+| id | string |  | Yes |
+| is_latest | boolean |  | No |
+| publish_note | string |  | Yes |
+| published_by | string |  | No |
+| published_by_name | string |  | No |
+| skill_id | string |  | Yes |
+| version_name | string |  | Yes |
+| version_number | integer |  | Yes |
+
+#### SkillVersionListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillVersionResponse](#skillversionresponse) ] |  | No |
+
+#### SkillVersionResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_size | integer |  | Yes |
+| created_at | integer |  | Yes |
+| hash_code | string |  | Yes |
+| id | string |  | Yes |
+| is_latest | boolean |  | No |
+| publish_note | string |  | Yes |
+| published_by | string |  | No |
+| published_by_name | string |  | No |
+| skill_id | string |  | Yes |
+| version_name | string |  | Yes |
+| version_number | integer |  | Yes |
+
+#### SkillVersionUpdatePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| publish_note | string |  | No |
+| version_name | string |  | No |
+
 #### SnippetDependencyCheckResponse
 
 | Name | Type | Description | Required |
@@ -22153,7 +22870,7 @@ Non-sensitive bootstrap snapshot exposed before Console or Web authentication.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | keyword | string | Search keyword | No |
-| type | string, <br>**Available values:** "", "app", "knowledge", "snippet" | Tag type filter<br>*Enum:* `""`, `"app"`, `"knowledge"`, `"snippet"` | No |
+| type | [TagType](#tagtype)<br>string | Tag type filter | No |
 
 #### TagListResponse
 
@@ -24339,6 +25056,15 @@ Workflow tool configuration
 | ---- | ---- | ----------- | -------- |
 | permission_keys | [ string ] |  | No |
 
+#### WorkspaceSkillsQuery
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| keyword | string | Search keyword matching skill name or description. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. | No |
+| page | integer, <br>**Default:** 1 | Page number. | No |
+| tag | [ string ] | Skill tag filters. Repeat the parameter for multiple tags. | No |
+
 #### WorkspaceTenantResultResponse
 
 | Name | Type | Description | Required |

api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/test_aliyun_trace_utils.py

@@ -1,3 +1,5 @@
+"""Unit tests for Aliyun trace utility transformations and database lookups."""
+
 import json
 from collections.abc import Mapping
 from typing import Any, cast
@@ -25,11 +27,13 @@ from dify_trace_aliyun.utils import (
     serialize_json_data,
 )
 from opentelemetry.trace import Link, StatusCode
+from sqlalchemy.orm import Session
 
 from core.rag.models.document import Document
 from graphon.entities import WorkflowNodeExecution
 from graphon.enums import WorkflowNodeExecutionStatus
 from models import EndUser
+from models.enums import EndUserType
 
 
 def test_get_user_id_from_message_data_no_end_user(monkeypatch: pytest.MonkeyPatch):
@@ -40,35 +44,40 @@ def test_get_user_id_from_message_data_no_end_user(monkeypatch: pytest.MonkeyPat
     assert get_user_id_from_message_data(message_data) == "account_id"
 
 
-def test_get_user_id_from_message_data_with_end_user(monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [(EndUser,)], indirect=True)
+def test_get_user_id_from_message_data_with_end_user(monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session) -> None:
     message_data = MagicMock()
     message_data.from_account_id = "account_id"
     message_data.from_end_user_id = "end_user_id"
 
-    end_user_data = MagicMock(spec=EndUser)
-    end_user_data.session_id = "session_id"
-
-    mock_session = MagicMock()
-    mock_session.get.return_value = end_user_data
+    end_user_data = EndUser(
+        id="end_user_id",
+        tenant_id="tenant_id",
+        app_id="app_id",
+        type=EndUserType.BROWSER,
+        session_id="session_id",
+    )
+    sqlite3_session.add(end_user_data)
+    sqlite3_session.commit()
 
     from dify_trace_aliyun.utils import db
 
-    monkeypatch.setattr(db, "session", mock_session)
+    monkeypatch.setattr(db, "session", sqlite3_session)
 
     assert get_user_id_from_message_data(message_data) == "session_id"
 
 
-def test_get_user_id_from_message_data_end_user_not_found(monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [(EndUser,)], indirect=True)
+def test_get_user_id_from_message_data_end_user_not_found(
+    monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     message_data = MagicMock()
     message_data.from_account_id = "account_id"
     message_data.from_end_user_id = "end_user_id"
 
-    mock_session = MagicMock()
-    mock_session.get.return_value = None
-
     from dify_trace_aliyun.utils import db
 
-    monkeypatch.setattr(db, "session", mock_session)
+    monkeypatch.setattr(db, "session", sqlite3_session)
 
     assert get_user_id_from_message_data(message_data) == "account_id"
 

api/providers/trace/trace-langsmith/tests/unit_tests/langsmith_trace/test_langsmith_trace.py

@@ -1,5 +1,8 @@
+"""Unit tests for LangSmith trace translation with SQLite-backed lookups."""
+
 import collections
 from datetime import datetime, timedelta
+from types import SimpleNamespace
 from typing import override
 from unittest.mock import MagicMock
 
@@ -11,6 +14,7 @@ from dify_trace_langsmith.entities.langsmith_trace_entity import (
     LangSmithRunUpdateModel,
 )
 from dify_trace_langsmith.langsmith_trace import LangSmithDataTrace
+from sqlalchemy.orm import Session
 
 from core.ops.entities.trace_entity import (
     DatasetRetrievalTraceInfo,
@@ -24,6 +28,7 @@ from core.ops.entities.trace_entity import (
 )
 from graphon.enums import BuiltinNodeTypes, WorkflowNodeExecutionMetadataKey
 from models import EndUser
+from models.enums import EndUserType
 
 
 def _dt() -> datetime:
@@ -108,7 +113,8 @@ def test_trace_dispatch(trace_instance, monkeypatch: pytest.MonkeyPatch):
     mocks["generate_name_trace"].assert_called_once_with(info)
 
 
-def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session) -> None:
     # Setup trace info
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
@@ -137,10 +143,10 @@ def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
         workflow_data=workflow_data,
     )
 
-    # Mock dependencies
-    mock_session = MagicMock()
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: mock_session)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
 
     # Mock node executions
     node_llm = MagicMock()
@@ -228,7 +234,10 @@ def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
     assert call_args[4].run_type == LangSmithRunType.retriever
 
 
-def test_workflow_trace_no_start_time(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_no_start_time(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
     workflow_data.finished_at = _dt() + timedelta(seconds=1)
@@ -256,9 +265,10 @@ def test_workflow_trace_no_start_time(trace_instance, monkeypatch: pytest.Monkey
         workflow_data=workflow_data,
     )
 
-    mock_session = MagicMock()
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: mock_session)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
     repo = MagicMock()
     repo.get_by_workflow_execution.return_value = []
     mock_factory = MagicMock()
@@ -271,7 +281,10 @@ def test_workflow_trace_no_start_time(trace_instance, monkeypatch: pytest.Monkey
     assert trace_instance.add_run.called
 
 
-def test_workflow_trace_missing_app_id(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_missing_app_id(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     trace_info = MagicMock(spec=WorkflowTraceInfo)
     trace_info.trace_id = "trace-1"
     trace_info.message_id = None
@@ -287,15 +300,17 @@ def test_workflow_trace_missing_app_id(trace_instance, monkeypatch: pytest.Monke
     trace_info.workflow_run_outputs = {}
     trace_info.error = ""
 
-    mock_session = MagicMock()
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: mock_session)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
 
     with pytest.raises(ValueError, match="No app_id found in trace_info metadata"):
         trace_instance.workflow_trace(trace_info)
 
 
-def test_message_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [(EndUser,)], indirect=True)
+def test_message_trace(trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session) -> None:
     message_data = MagicMock()
     message_data.id = "msg-1"
     message_data.from_account_id = "acc-1"
@@ -321,10 +336,19 @@ def test_message_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
         message_file_data=MagicMock(url="file-url"),
     )
 
-    # Mock EndUser lookup
-    mock_end_user = MagicMock(spec=EndUser)
-    mock_end_user.session_id = "session-id-123"
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db.session.get", lambda model, pk: mock_end_user)
+    end_user = EndUser(
+        id="end-user-1",
+        tenant_id="tenant-1",
+        app_id="app-1",
+        type=EndUserType.BROWSER,
+        session_id="session-id-123",
+    )
+    sqlite3_session.add(end_user)
+    sqlite3_session.commit()
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
 
     trace_instance.add_run = MagicMock()
 
@@ -521,9 +545,13 @@ def test_update_run_error(trace_instance):
         trace_instance.update_run(update_data)
 
 
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
 def test_workflow_trace_usage_extraction_error(
-    trace_instance, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
-):
+    trace_instance,
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+    sqlite3_session: Session,
+) -> None:
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
     workflow_data.finished_at = _dt() + timedelta(seconds=1)
@@ -576,8 +604,10 @@ def test_workflow_trace_usage_extraction_error(
     mock_factory = MagicMock()
     mock_factory.create_workflow_node_execution_repository.return_value = repo
     monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.DifyCoreRepositoryFactory", mock_factory)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: MagicMock())
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
     monkeypatch.setattr(trace_instance, "get_service_account_with_tenant", lambda app_id: MagicMock())
 
     trace_instance.add_run = MagicMock()
@@ -644,9 +674,11 @@ def _make_workflow_trace_info(
     )
 
 
-def _patch_workflow_trace_deps(monkeypatch, trace_instance):
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: MagicMock())
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+def _patch_workflow_trace_deps(monkeypatch, trace_instance, sqlite3_session: Session) -> None:
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
     repo = MagicMock()
     repo.get_by_workflow_execution.return_value = []
     factory = MagicMock()
@@ -656,14 +688,17 @@ def _patch_workflow_trace_deps(monkeypatch, trace_instance):
     trace_instance.add_run = MagicMock()
 
 
-def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_id_uses_message_id_not_external(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     """Chatflow with external trace_id: LangSmith trace_id must be message_id, not external."""
     trace_info = _make_workflow_trace_info(
         message_id="msg-abc",
         workflow_run_id="run-xyz",
         trace_id="external-999",
     )
-    _patch_workflow_trace_deps(monkeypatch, trace_instance)
+    _patch_workflow_trace_deps(monkeypatch, trace_instance, sqlite3_session)
 
     trace_instance.workflow_trace(trace_info)
 
@@ -677,14 +712,17 @@ def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypa
     assert trace_info.metadata.get("external_trace_id") == "external-999"
 
 
-def test_workflow_trace_id_pure_workflow_uses_run_id(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_id_pure_workflow_uses_run_id(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     """Pure workflow (no message_id) with external trace_id: trace_id must be workflow_run_id."""
     trace_info = _make_workflow_trace_info(
         message_id=None,
         workflow_run_id="run-xyz",
         trace_id="external-999",
     )
-    _patch_workflow_trace_deps(monkeypatch, trace_instance)
+    _patch_workflow_trace_deps(monkeypatch, trace_instance, sqlite3_session)
 
     trace_instance.workflow_trace(trace_info)
 

api/services/account_service.py

@@ -1599,7 +1599,9 @@ class TenantService:
         return updated_accounts
 
     @staticmethod
-    def iter_member_account_id_batches(tenant_id: str, batch_size: int, *, session: Session) -> Iterator[list[str]]:
+    def iter_member_account_id_batches(
+        tenant_id: str, batch_size: int, *, session: Session
+    ) -> Iterator[list[str]]:
         """Yield workspace member account ids in bounded, ordered batches."""
         offset = 0
         while True:

api/services/agent/skill_package_service.py

@@ -19,12 +19,11 @@ from __future__ import annotations
 import hashlib
 import io
 import posixpath
-import re
 import zipfile
 import zlib
 
 import yaml
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, ValidationError, field_validator
 
 # Bounds — generous but finite so a hostile upload can't exhaust memory/disk.
 _MAX_ARCHIVE_BYTES = 50 * 1024 * 1024
@@ -33,7 +32,8 @@ _MAX_SKILL_MD_BYTES = 1 * 1024 * 1024
 _MAX_ENTRIES = 5000
 _ALLOWED_EXTENSIONS = (".zip", ".skill")
 _SKILL_MD_NAME = "SKILL.md"
-_HEADING_RE = re.compile(r"^\s*#\s+(.+?)\s*$", re.MULTILINE)
+_SKILL_NAME_PATTERN = r"^[a-z0-9]+(?:-[a-z0-9]+)*$"
+_MAX_SKILL_DESCRIPTION_LENGTH = 1024
 
 
 class SkillPackageError(Exception):
@@ -53,13 +53,18 @@ class SkillPackageError(Exception):
 class SkillManifest(BaseModel):
     """Validated metadata extracted from a Skill package."""
 
-    name: str
-    description: str
+    name: str = Field(min_length=1, max_length=64, pattern=_SKILL_NAME_PATTERN)
+    description: str = Field(min_length=1, max_length=_MAX_SKILL_DESCRIPTION_LENGTH)
     entry_path: str  # path of SKILL.md inside the archive
     files: list[str]  # all (safe) file paths inside the archive
     size: int  # total uncompressed bytes
     hash: str  # sha256 of the archive bytes
 
+    @field_validator("name", "description", mode="before")
+    @classmethod
+    def _strip_required_string(cls, value: object) -> object:
+        return value.strip() if isinstance(value, str) else value
+
 
 class NormalizedSkillPackage(BaseModel):
     """Canonical skill package bytes and metadata ready to store in agent drive."""
@@ -108,14 +113,17 @@ class SkillPackageService:
             normalized_size = sum(max(info.file_size, 0) for info in normalized_members.values())
 
         name, description = self._parse_skill_md(skill_md)
-        manifest = SkillManifest(
-            name=name,
-            description=description,
-            entry_path=_SKILL_MD_NAME,
-            files=sorted(normalized_members),
-            size=normalized_size,
-            hash=hashlib.sha256(normalized_archive_bytes).hexdigest(),
-        )
+        try:
+            manifest = SkillManifest(
+                name=name,
+                description=description,
+                entry_path=_SKILL_MD_NAME,
+                files=sorted(normalized_members),
+                size=normalized_size,
+                hash=hashlib.sha256(normalized_archive_bytes).hexdigest(),
+            )
+        except ValidationError as exc:
+            raise self._manifest_validation_error(exc) from exc
         return NormalizedSkillPackage(
             manifest=manifest,
             archive_bytes=normalized_archive_bytes,
@@ -123,6 +131,31 @@ class SkillPackageService:
             strip_prefix=strip_prefix,
         )
 
+    @staticmethod
+    def _manifest_validation_error(exc: ValidationError) -> SkillPackageError:
+        first_error = exc.errors()[0]
+        loc = first_error["loc"]
+        field = loc[0] if loc else "manifest"
+        error_type = first_error["type"]
+        if field == "name":
+            code = "missing_skill_name" if error_type == "string_too_short" else "invalid_skill_name"
+            message = (
+                "SKILL.md frontmatter name is required"
+                if code == "missing_skill_name"
+                else "SKILL.md frontmatter name must be lowercase letters, numbers, and hyphens only, "
+                "must not start or end with a hyphen, and must be at most 64 characters"
+            )
+            return SkillPackageError(code, message, status_code=400)
+        if field == "description":
+            code = "missing_skill_description" if error_type == "string_too_short" else "invalid_skill_description"
+            message = (
+                "SKILL.md frontmatter description is required"
+                if code == "missing_skill_description"
+                else f"SKILL.md frontmatter description must be at most {_MAX_SKILL_DESCRIPTION_LENGTH} characters"
+            )
+            return SkillPackageError(code, message, status_code=400)
+        return SkillPackageError("invalid_skill_manifest", "SKILL.md frontmatter is invalid", status_code=400)
+
     def _open_archive(self, *, content: bytes, filename: str) -> zipfile.ZipFile:
         self._check_extension(filename)
         if not content:
@@ -280,13 +313,6 @@ class SkillPackageService:
         frontmatter = cls._parse_frontmatter(content)
         name = str(frontmatter.get("name") or "").strip()
         description = str(frontmatter.get("description") or "").strip()
-        if not name:
-            heading = _HEADING_RE.search(content)
-            name = heading.group(1).strip() if heading else ""
-        if not name:
-            raise SkillPackageError(
-                "missing_skill_name", "SKILL.md must declare a name (frontmatter or top heading)", status_code=400
-            )
         return name, description
 
     @staticmethod

api/services/agent_config_service.py

@@ -46,6 +46,7 @@ from models.tools import ToolFile
 from services.agent.config_skill_normalize_service import ConfigSkillNormalizeService
 from services.agent.skill_package_service import SkillPackageError
 from services.agent_drive_service import DriveFileRef
+from services.skill_management_service import SkillManagementService, SkillManagementServiceError
 
 
 class AgentConfigVersionKind(StrEnum):
@@ -98,6 +99,7 @@ class ConfigPushPayload(BaseModel):
 
 @dataclass(slots=True)
 class AgentConfigTarget:
+    tenant_id: str
     agent_id: str
     version_id: str
     kind: AgentConfigVersionKind
@@ -146,6 +148,7 @@ class AgentConfigService:
                 user_id=user_id,
             )
             return AgentConfigTarget(
+                tenant_id=tenant_id,
                 agent_id=target.agent_id,
                 version_id=target.version_id,
                 kind=target.kind,
@@ -191,7 +194,7 @@ class AgentConfigService:
         return {
             "agent_id": target.agent_id,
             "config_version": self._config_version_payload(target),
-            "items": [self._serialize_skill_item(skill) for skill in target.agent_soul.config_skills],
+            "items": self._skill_items_for_target(target),
         }
 
     def list_files(
@@ -233,10 +236,27 @@ class AgentConfigService:
             config_version_kind=config_version_kind,
             user_id=user_id,
         )
-        skill = self._require_skill(target.agent_soul, name=name)
-        file_id = self._available_skill_file_id(skill)
-        payload, mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
-        return ConfigDownload(filename=f"{skill.name}.zip", mime_type=mime_type or "application/zip", payload=payload)
+        try:
+            skill = self._require_skill(target.agent_soul, name=name)
+            file_id = self._available_skill_file_id(skill)
+            payload, mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+            return ConfigDownload(
+                filename=f"{skill.name}.zip",
+                mime_type=mime_type or "application/zip",
+                payload=payload,
+            )
+        except AgentConfigServiceError as exc:
+            if exc.code != "config_skill_not_found":
+                raise
+        try:
+            result = SkillManagementService().pull_runtime_agent_skill(
+                tenant_id=tenant_id,
+                agent_id=agent_id,
+                name=name,
+            )
+            return ConfigDownload(filename=result.filename, mime_type=result.mime_type, payload=result.payload)
+        except SkillManagementServiceError as exc:
+            raise AgentConfigServiceError("config_skill_not_found", "config skill not found", status_code=404) from exc
 
     def download_skill_url(
         self,
@@ -279,9 +299,45 @@ class AgentConfigService:
             config_version_kind=config_version_kind,
             user_id=user_id,
         )
-        skill = self._require_skill(target.agent_soul, name=name)
-        file_id = self._available_skill_file_id(skill)
-        archive_bytes, _mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+        try:
+            skill = self._require_skill(target.agent_soul, name=name)
+            file_id = self._available_skill_file_id(skill)
+            archive_bytes, _mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+            skill_item = self._serialize_skill_item(skill)
+        except AgentConfigServiceError as exc:
+            if exc.code != "config_skill_not_found":
+                raise
+            try:
+                workspace_archive = SkillManagementService().pull_runtime_agent_skill(
+                    tenant_id=tenant_id,
+                    agent_id=agent_id,
+                    name=name,
+                )
+            except SkillManagementServiceError as skill_exc:
+                raise AgentConfigServiceError(
+                    "config_skill_not_found",
+                    "config skill not found",
+                    status_code=404,
+                ) from skill_exc
+            archive_bytes = workspace_archive.payload
+            skill_item = next(
+                (
+                    item
+                    for item in SkillManagementService().list_runtime_agent_skills(
+                        tenant_id=tenant_id,
+                        agent_id=agent_id,
+                    )
+                    if item["name"] == name
+                ),
+                {
+                    "id": name,
+                    "name": name,
+                    "description": "",
+                    "size": None,
+                    "hash": None,
+                    "mime_type": "application/zip",
+                },
+            )
         try:
             archive_items, skill_md = self._inspect_skill_archive(archive_bytes)
         except (OSError, ValueError, zipfile.BadZipFile) as exc:
@@ -291,7 +347,7 @@ class AgentConfigService:
                 status_code=500,
             ) from exc
         return {
-            **self._serialize_skill_item(skill),
+            **skill_item,
             "source": "config_skill_zip",
             "files": archive_items,
             "skill_md": skill_md,
@@ -839,6 +895,7 @@ class AgentConfigService:
                 status_code=404,
             )
         return AgentConfigTarget(
+            tenant_id=tenant_id,
             agent_id=agent_id,
             version_id=version.id,
             kind=config_version_kind,
@@ -1133,9 +1190,7 @@ class AgentConfigService:
         return {
             "agent_id": target.agent_id,
             "config_version": AgentConfigService._config_version_payload(target),
-            "skills": {
-                "items": [AgentConfigService._serialize_skill_item(skill) for skill in target.agent_soul.config_skills]
-            },
+            "skills": {"items": AgentConfigService._skill_items_for_target(target)},
             "files": {
                 "items": [
                     AgentConfigService._serialize_file_item(file_ref) for file_ref in target.agent_soul.config_files
@@ -1145,6 +1200,20 @@ class AgentConfigService:
             "note": target.agent_soul.config_note,
         }
 
+    @staticmethod
+    def _skill_items_for_target(target: AgentConfigTarget) -> list[dict[str, object]]:
+        items = [AgentConfigService._serialize_skill_item(skill) for skill in target.agent_soul.config_skills]
+        seen_names = {str(item["name"]) for item in items}
+        for item in SkillManagementService().list_runtime_agent_skills(
+            tenant_id=target.tenant_id,
+            agent_id=target.agent_id,
+        ):
+            if item["name"] in seen_names:
+                continue
+            seen_names.add(str(item["name"]))
+            items.append(item)
+        return items
+
     @staticmethod
     def _config_version_payload(target: AgentConfigTarget) -> dict[str, object]:
         return {

api/services/feature_service.py

@@ -1,6 +1,8 @@
+import logging
+from collections.abc import Mapping
 from enum import StrEnum
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
 
 from configs import dify_config
 from constants.dsl_version import CURRENT_APP_DSL_VERSION
@@ -10,6 +12,8 @@ from enums.hosted_provider import HostedTrialProvider
 from services.billing_service import BillingInfo, BillingService
 from services.enterprise.enterprise_service import EnterpriseService
 
+logger = logging.getLogger(__name__)
+
 
 class FeatureResponseModel(BaseModel):
     model_config = ConfigDict(json_schema_serialization_defaults_required=True, protected_namespaces=())
@@ -131,6 +135,13 @@ class PluginInstallationPermissionModel(FeatureResponseModel):
     restrict_to_marketplace_only: bool = False
 
 
+class _EnterprisePluginInstallationPermission(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    plugin_installation_scope: PluginInstallationScope = Field(alias="pluginInstallationScope")
+    restrict_to_marketplace_only: bool = Field(alias="restrictToMarketplaceOnly", strict=True)
+
+
 class FeatureModel(FeatureResponseModel):
     billing: BillingModel = BillingModel()
     education: EducationModel = EducationModel()
@@ -285,6 +296,14 @@ class FeatureService:
         """Return whether Enterprise plugin credential policies must be enforced."""
         return dify_config.ENTERPRISE_ENABLED
 
+    @classmethod
+    def get_plugin_installation_permission(cls) -> PluginInstallationPermissionModel:
+        """Resolve the validated deployment-wide plugin installation policy."""
+        if not dify_config.ENTERPRISE_ENABLED:
+            return PluginInstallationPermissionModel()
+
+        return cls._resolve_plugin_installation_permission(EnterpriseService.get_info())
+
     @classmethod
     def get_license(cls) -> LicenseModel:
         """Return full license detail. Enterprise-only; requires an authenticated caller.
@@ -452,6 +471,33 @@ class FeatureService:
                 )
         return license_model
 
+    @classmethod
+    def _resolve_plugin_installation_permission(
+        cls, enterprise_info: Mapping[str, object]
+    ) -> PluginInstallationPermissionModel:
+        if "PluginInstallationPermission" not in enterprise_info:
+            return PluginInstallationPermissionModel()
+
+        try:
+            permission = _EnterprisePluginInstallationPermission.model_validate(
+                enterprise_info["PluginInstallationPermission"]
+            )
+        except ValidationError as exc:
+            # Do not attach the exception because it may contain raw Enterprise configuration values.
+            logger.error(  # noqa: TRY400
+                "Invalid Enterprise plugin installation permission; denying all plugin installations: %s",
+                exc.errors(include_input=False),
+            )
+            return PluginInstallationPermissionModel(
+                plugin_installation_scope=PluginInstallationScope.NONE,
+                restrict_to_marketplace_only=True,
+            )
+
+        return PluginInstallationPermissionModel(
+            plugin_installation_scope=permission.plugin_installation_scope,
+            restrict_to_marketplace_only=permission.restrict_to_marketplace_only,
+        )
+
     @classmethod
     def _fulfill_params_from_enterprise(cls, features: SystemFeatureModel):
         enterprise_info = EnterpriseService.get_info()
@@ -499,11 +545,4 @@ class FeatureService:
                 status=LicenseStatus(license_info.get("status", LicenseStatus.INACTIVE))
             )
 
-        if "PluginInstallationPermission" in enterprise_info:
-            plugin_installation_info = enterprise_info["PluginInstallationPermission"]
-            features.plugin_installation_permission.plugin_installation_scope = plugin_installation_info[
-                "pluginInstallationScope"
-            ]
-            features.plugin_installation_permission.restrict_to_marketplace_only = plugin_installation_info[
-                "restrictToMarketplaceOnly"
-            ]
+        features.plugin_installation_permission = cls._resolve_plugin_installation_permission(enterprise_info)

api/services/tag_service.py

@@ -12,6 +12,7 @@ from werkzeug.exceptions import NotFound
 from models.dataset import Dataset
 from models.enums import TagType
 from models.model import App, Tag, TagBinding
+from models.skill import Skill
 from models.snippet import CustomizedSnippet
 
 type _TagTypeLike = TagType | str
@@ -282,5 +283,13 @@ class TagService:
             )
             if not snippet:
                 raise NotFound("Snippet not found")
+        elif type == "skill":
+            skill = session.scalar(
+                select(Skill)
+                .where(Skill.tenant_id == current_user.current_tenant_id, Skill.id == target_id)
+                .limit(1)
+            )
+            if not skill:
+                raise NotFound("Skill not found")
         else:
             raise NotFound("Invalid binding type")

api/tests/test_containers_integration_tests/controllers/console/datasets/test_data_source.py

@@ -1,494 +1,85 @@
-"""Testcontainers integration tests for controllers.console.datasets.data_source endpoints."""
+"""Integration coverage for Notion page bindings backed by persisted documents."""
 
-from __future__ import annotations
-
-import inspect
-from collections.abc import Iterator
-from datetime import UTC, datetime
-from unittest.mock import MagicMock, PropertyMock, patch
+from inspect import unwrap
+from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
-import pytest
 from flask import Flask
 from sqlalchemy.orm import Session
-from werkzeug.exceptions import NotFound
 
-from controllers.console.datasets import data_source
-from controllers.console.datasets.data_source import (
-    DataSourceApi,
-    DataSourceNotionDatasetSyncApi,
-    DataSourceNotionDocumentSyncApi,
-    DataSourceNotionIndexingEstimateApi,
-    DataSourceNotionListApi,
-    DataSourceNotionPreviewApi,
-)
-from core.rag.index_processor.constant.index_type import IndexStructureType
-from models import Account, DataSourceOauthBinding
+from controllers.console.datasets.data_source import DataSourceNotionListApi
+from models import Account
 from models.dataset import Document
 from models.enums import DataSourceType, DocumentCreatedFrom, IndexingStatus
 
 
-@pytest.fixture
-def current_user() -> Account:
-    account = Account(name="Test User", email="u1@example.com")
-    account.id = "u1"
-    return account
+def test_notion_page_is_marked_bound_from_persisted_document(
+    flask_app_with_containers: Flask,
+    db_session_with_containers: Session,
+) -> None:
+    tenant_id = str(uuid4())
+    dataset_id = str(uuid4())
+    account = Account(name="Test User", email="user@example.com")
+    account.id = str(uuid4())
+    document = Document(
+        tenant_id=tenant_id,
+        dataset_id=dataset_id,
+        position=1,
+        data_source_type=DataSourceType.NOTION_IMPORT,
+        data_source_info='{"notion_page_id": "page-1"}',
+        batch=f"batch-{uuid4()}",
+        name="Notion Page",
+        created_from=DocumentCreatedFrom.WEB,
+        created_by=str(uuid4()),
+        indexing_status=IndexingStatus.COMPLETED,
+        enabled=True,
+    )
+    db_session_with_containers.add(document)
+    db_session_with_containers.commit()
+    runtime = MagicMock(
+        get_online_document_pages=lambda **_kwargs: iter(
+            [
+                MagicMock(
+                    result=[
+                        MagicMock(
+                            workspace_id="workspace-1",
+                            workspace_name="Workspace",
+                            workspace_icon=None,
+                            pages=[
+                                MagicMock(
+                                    page_id="page-1",
+                                    page_name="Page",
+                                    type="page",
+                                    parent_id="parent",
+                                    page_icon=None,
+                                )
+                            ],
+                        )
+                    ]
+                )
+            ]
+        ),
+        datasource_provider_type=lambda: None,
+    )
 
-
-@pytest.fixture
-def mock_engine() -> Iterator[None]:
-    with patch.object(
-        type(data_source.db),
-        "engine",
-        new_callable=PropertyMock,
-        return_value=MagicMock(),
+    with (
+        flask_app_with_containers.test_request_context(f"/?credential_id=c1&dataset_id={dataset_id}"),
+        patch(
+            "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
+            return_value={"token": "token"},
+        ),
+        patch(
+            "controllers.console.datasets.data_source.DatasetService.get_dataset",
+            return_value=MagicMock(data_source_type="notion_import"),
+        ),
+        patch(
+            "core.datasource.datasource_manager.DatasourceManager.get_datasource_runtime",
+            return_value=runtime,
+        ),
     ):
-        yield
-
-
-class TestDataSourceApi:
-    @pytest.fixture
-    def app(self, flask_app_with_containers: Flask) -> Flask:
-        return flask_app_with_containers
-
-    def test_get_success(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.get)
-
-        binding = DataSourceOauthBinding(
-            tenant_id="tenant-1",
-            access_token="token",
-            provider="notion",
-            source_info={
-                "workspace_name": "Workspace",
-                "workspace_id": "workspace-1",
-                "workspace_icon": None,
-                "total": 1,
-                "pages": [
-                    {
-                        "page_id": "page-1",
-                        "page_name": "Page",
-                        "page_icon": {"type": "emoji", "emoji": "P", "url": None},
-                        "parent_id": "parent-1",
-                        "type": "page",
-                    }
-                ],
-            },
-        )
-        binding.id = "b1"
-        binding.created_at = datetime(2026, 5, 25, 1, 2, 3, tzinfo=UTC)
-        binding.disabled = False
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.datasets.data_source.db.session.scalars",
-                return_value=MagicMock(all=lambda: [binding]),
-            ),
-        ):
-            response, status = method(api, "tenant-1")
-
-        assert status == 200
-        assert response["data"][0] == {
-            "id": "b1",
-            "provider": "notion",
-            "created_at": 1779670923,
-            "is_bound": True,
-            "disabled": False,
-            "source_info": {
-                "workspace_name": "Workspace",
-                "workspace_id": "workspace-1",
-                "workspace_icon": None,
-                "pages": [
-                    {
-                        "page_name": "Page",
-                        "page_id": "page-1",
-                        "page_icon": {"type": "emoji", "url": None, "emoji": "P"},
-                        "parent_id": "parent-1",
-                        "type": "page",
-                    }
-                ],
-                "total": 1,
-            },
-            "link": "http://localhost/console/api/oauth/data-source/notion",
-        }
-
-    def test_get_no_bindings(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.get)
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.datasets.data_source.db.session.scalars",
-                return_value=MagicMock(all=lambda: []),
-            ),
-        ):
-            response, status = method(api, "tenant-1")
-
-        assert status == 200
-        assert response["data"] == []
-
-    def test_patch_enable_binding(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.patch)
-
-        binding = MagicMock(id="b1", disabled=True)
-        session = MagicMock()
-        session.scalar.return_value = binding
-
-        with app.test_request_context("/"):
-            response, status = method(api, session, "tenant-1", "b1", "enable")
-
-        assert status == 200
-        assert binding.disabled is False
-
-    def test_patch_disable_binding(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.patch)
-
-        binding = MagicMock(id="b1", disabled=False)
-        session = MagicMock()
-        session.scalar.return_value = binding
-
-        with app.test_request_context("/"):
-            response, status = method(api, session, "tenant-1", "b1", "disable")
-
-        assert status == 200
-        assert binding.disabled is True
-
-    def test_patch_binding_not_found(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.patch)
-        session = MagicMock()
-        session.scalar.return_value = None
-
-        with app.test_request_context("/"):
-            with pytest.raises(NotFound):
-                method(api, session, "tenant-1", "b1", "enable")
-
-    def test_patch_enable_already_enabled(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.patch)
-
-        binding = MagicMock(id="b1", disabled=False)
-        session = MagicMock()
-        session.scalar.return_value = binding
-
-        with app.test_request_context("/"):
-            with pytest.raises(ValueError):
-                method(api, session, "tenant-1", "b1", "enable")
-
-    def test_patch_disable_already_disabled(self, app: Flask) -> None:
-        api = DataSourceApi()
-        method = inspect.unwrap(api.patch)
-
-        binding = MagicMock(id="b1", disabled=True)
-        session = MagicMock()
-        session.scalar.return_value = binding
-
-        with app.test_request_context("/"):
-            with pytest.raises(ValueError):
-                method(api, session, "tenant-1", "b1", "disable")
-
-
-class TestDataSourceNotionListApi:
-    @pytest.fixture
-    def app(self, flask_app_with_containers: Flask) -> Flask:
-        return flask_app_with_containers
-
-    def test_get_credential_not_found(self, app: Flask, current_user: Account) -> None:
-        api = DataSourceNotionListApi()
-        method = inspect.unwrap(api.get)
-
-        with (
-            app.test_request_context("/?credential_id=c1"),
-            patch(
-                "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
-                return_value=None,
-            ),
-        ):
-            with pytest.raises(NotFound):
-                method(api, MagicMock(), "tenant-1", current_user)
-
-    def test_get_success_no_dataset_id(self, app: Flask, current_user: Account, mock_engine: None) -> None:
-        api = DataSourceNotionListApi()
-        method = inspect.unwrap(api.get)
-
-        page = MagicMock(
-            page_id="p1",
-            page_name="Page 1",
-            type="page",
-            parent_id="parent",
-            page_icon=None,
+        response, status = unwrap(DataSourceNotionListApi().get)(
+            DataSourceNotionListApi(), db_session_with_containers, tenant_id, account
         )
 
-        online_document_message = MagicMock(
-            result=[
-                MagicMock(
-                    workspace_id="w1",
-                    workspace_name="My Workspace",
-                    workspace_icon="icon",
-                    pages=[page],
-                )
-            ]
-        )
-
-        with (
-            app.test_request_context("/?credential_id=c1"),
-            patch(
-                "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
-                return_value={"token": "t"},
-            ),
-            patch(
-                "core.datasource.datasource_manager.DatasourceManager.get_datasource_runtime",
-                return_value=MagicMock(
-                    get_online_document_pages=lambda **kw: iter([online_document_message]),
-                    datasource_provider_type=lambda: None,
-                ),
-            ),
-        ):
-            response, status = method(api, MagicMock(), "tenant-1", current_user)
-
-        assert status == 200
-
-    def test_get_success_with_dataset_id(
-        self, app: Flask, current_user: Account, mock_engine: None, db_session_with_containers: Session
-    ) -> None:
-        api = DataSourceNotionListApi()
-        method = inspect.unwrap(api.get)
-        tenant_id = str(uuid4())
-        dataset_id = str(uuid4())
-
-        page = MagicMock(
-            page_id="p1",
-            page_name="Page 1",
-            type="page",
-            parent_id="parent",
-            page_icon=None,
-        )
-
-        online_document_message = MagicMock(
-            result=[
-                MagicMock(
-                    workspace_id="w1",
-                    workspace_name="My Workspace",
-                    workspace_icon="icon",
-                    pages=[page],
-                )
-            ]
-        )
-
-        dataset = MagicMock(data_source_type="notion_import")
-        document = Document(
-            tenant_id=tenant_id,
-            dataset_id=dataset_id,
-            position=1,
-            data_source_type=DataSourceType.NOTION_IMPORT,
-            data_source_info='{"notion_page_id": "p1"}',
-            batch=f"batch-{uuid4()}",
-            name="Notion Page",
-            created_from=DocumentCreatedFrom.WEB,
-            created_by=str(uuid4()),
-            indexing_status=IndexingStatus.COMPLETED,
-            enabled=True,
-        )
-        db_session_with_containers.add(document)
-        db_session_with_containers.commit()
-
-        with (
-            app.test_request_context(f"/?credential_id=c1&dataset_id={dataset_id}"),
-            patch(
-                "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
-                return_value={"token": "t"},
-            ),
-            patch(
-                "controllers.console.datasets.data_source.DatasetService.get_dataset",
-                return_value=dataset,
-            ),
-            patch(
-                "core.datasource.datasource_manager.DatasourceManager.get_datasource_runtime",
-                return_value=MagicMock(
-                    get_online_document_pages=lambda **kw: iter([online_document_message]),
-                    datasource_provider_type=lambda: None,
-                ),
-            ),
-        ):
-            response, status = method(api, db_session_with_containers, tenant_id, current_user)
-
-        assert status == 200
-
-    def test_get_invalid_dataset_type(self, app: Flask, current_user: Account, mock_engine: None) -> None:
-        api = DataSourceNotionListApi()
-        method = inspect.unwrap(api.get)
-
-        dataset = MagicMock(data_source_type="other_type")
-
-        with (
-            app.test_request_context("/?credential_id=c1&dataset_id=ds1"),
-            patch(
-                "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
-                return_value={"token": "t"},
-            ),
-            patch(
-                "controllers.console.datasets.data_source.DatasetService.get_dataset",
-                return_value=dataset,
-            ),
-        ):
-            with pytest.raises(ValueError):
-                method(api, MagicMock(), "tenant-1", current_user)
-
-
-class TestDataSourceNotionPreviewApi:
-    @pytest.fixture
-    def app(self, flask_app_with_containers: Flask) -> Flask:
-        return flask_app_with_containers
-
-    def test_get_preview_success(self, app: Flask) -> None:
-        api = DataSourceNotionPreviewApi()
-        method = inspect.unwrap(api.get)
-
-        extractor = MagicMock(extract=lambda: [MagicMock(page_content="hello")])
-
-        with (
-            app.test_request_context("/?credential_id=c1"),
-            patch(
-                "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
-                return_value={"integration_secret": "t"},
-            ),
-            patch(
-                "controllers.console.datasets.data_source.NotionExtractor",
-                return_value=extractor,
-            ),
-        ):
-            response, status = method(api, "tenant-1", "p1", "page")
-
-        assert status == 200
-
-
-class TestDataSourceNotionIndexingEstimateApi:
-    @pytest.fixture
-    def app(self, flask_app_with_containers: Flask) -> Flask:
-        return flask_app_with_containers
-
-    def test_post_indexing_estimate_success(self, app: Flask) -> None:
-        api = DataSourceNotionIndexingEstimateApi()
-        method = inspect.unwrap(api.post)
-
-        empty_rules: dict[str, object] = {}
-        payload: dict[str, object] = {
-            "notion_info_list": [
-                {
-                    "workspace_id": "w1",
-                    "credential_id": "c1",
-                    "pages": [{"page_id": "p1", "type": "page"}],
-                }
-            ],
-            "process_rule": {"rules": empty_rules},
-            "doc_form": IndexStructureType.PARAGRAPH_INDEX,
-            "doc_language": "English",
-        }
-
-        with (
-            app.test_request_context("/", method="POST", json=payload, headers={"Content-Type": "application/json"}),
-            patch(
-                "controllers.console.datasets.data_source.DocumentService.estimate_args_validate",
-            ),
-            patch(
-                "controllers.console.datasets.data_source.IndexingRunner.indexing_estimate",
-                return_value=MagicMock(model_dump=lambda: {"total_pages": 1}),
-            ),
-        ):
-            response, status = method(api, MagicMock(), "tenant-1")
-
-        assert status == 200
-
-
-class TestDataSourceNotionDatasetSyncApi:
-    @pytest.fixture
-    def app(self, flask_app_with_containers: Flask) -> Flask:
-        return flask_app_with_containers
-
-    def test_get_success(self, app: Flask) -> None:
-        api = DataSourceNotionDatasetSyncApi()
-        method = inspect.unwrap(api.get)
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.datasets.data_source.DatasetService.get_dataset",
-                return_value=MagicMock(),
-            ),
-            patch(
-                "controllers.console.datasets.data_source.DocumentService.get_document_by_dataset_id",
-                return_value=[MagicMock(id="d1")],
-            ),
-            patch(
-                "controllers.console.datasets.data_source.document_indexing_sync_task.delay",
-                return_value=None,
-            ),
-        ):
-            response, status = method(api, MagicMock(), "ds-1")
-
-        assert status == 200
-
-    def test_get_dataset_not_found(self, app: Flask) -> None:
-        api = DataSourceNotionDatasetSyncApi()
-        method = inspect.unwrap(api.get)
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.datasets.data_source.DatasetService.get_dataset",
-                return_value=None,
-            ),
-        ):
-            with pytest.raises(NotFound):
-                method(api, MagicMock(), "ds-1")
-
-
-class TestDataSourceNotionDocumentSyncApi:
-    @pytest.fixture
-    def app(self, flask_app_with_containers: Flask) -> Flask:
-        return flask_app_with_containers
-
-    def test_get_success(self, app: Flask) -> None:
-        api = DataSourceNotionDocumentSyncApi()
-        method = inspect.unwrap(api.get)
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.datasets.data_source.DatasetService.get_dataset",
-                return_value=MagicMock(),
-            ),
-            patch(
-                "controllers.console.datasets.data_source.DocumentService.get_document",
-                return_value=MagicMock(),
-            ),
-            patch(
-                "controllers.console.datasets.data_source.document_indexing_sync_task.delay",
-                return_value=None,
-            ),
-        ):
-            response, status = method(api, MagicMock(), "ds-1", "doc-1")
-
-        assert status == 200
-
-    def test_get_document_not_found(self, app: Flask) -> None:
-        api = DataSourceNotionDocumentSyncApi()
-        method = inspect.unwrap(api.get)
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.datasets.data_source.DatasetService.get_dataset",
-                return_value=MagicMock(),
-            ),
-            patch(
-                "controllers.console.datasets.data_source.DocumentService.get_document",
-                return_value=None,
-            ),
-        ):
-            with pytest.raises(NotFound):
-                method(api, MagicMock(), "ds-1", "doc-1")
+    assert status == 200
+    assert response["notion_info"][0]["pages"][0]["is_bound"] is True

api/tests/test_containers_integration_tests/services/test_messages_clean_service.py

@@ -4,7 +4,7 @@ import datetime
 import json
 import uuid
 from decimal import Decimal
-from unittest.mock import MagicMock, patch
+from unittest.mock import patch
 
 import pytest
 from faker import Faker
@@ -1172,65 +1172,8 @@ class TestMessagesCleanServiceIntegration:
         # Verify all messages were deleted
         assert db_session_with_containers.query(Message).where(Message.id.in_(msg_ids)).count() == 0
 
-    def test_from_time_range_validation(self):
-        """Test that from_time_range raises ValueError for invalid inputs."""
-        policy = MagicMock(spec=BillingDisabledPolicy)
-        now = datetime.datetime.now()
-
-        with pytest.raises(ValueError, match="start_from .* must be less than end_before"):
-            MessagesCleanService.from_time_range(policy, now, now)
-
-        with pytest.raises(ValueError, match="batch_size .* must be greater than 0"):
-            MessagesCleanService.from_time_range(policy, now - datetime.timedelta(days=1), now, batch_size=0)
-
-    def test_from_time_range_success(self):
-        """Test that from_time_range creates a service with correct parameters."""
-        policy = MagicMock(spec=BillingDisabledPolicy)
-        start = datetime.datetime(2024, 1, 1)
-        end = datetime.datetime(2024, 2, 1)
-
-        service = MessagesCleanService.from_time_range(policy, start, end)
-        assert service._start_from == start
-        assert service._end_before == end
-
-    def test_from_days_validation(self):
-        """Test that from_days raises ValueError for invalid inputs."""
-        policy = MagicMock(spec=BillingDisabledPolicy)
-
-        with pytest.raises(ValueError, match="days .* must be greater than or equal to 0"):
-            MessagesCleanService.from_days(policy, days=-1)
-
-        with pytest.raises(ValueError, match="batch_size .* must be greater than 0"):
-            MessagesCleanService.from_days(policy, days=30, batch_size=0)
-
-    def test_from_days_success(self):
-        """Test that from_days creates a service with correct parameters."""
-        policy = MagicMock(spec=BillingDisabledPolicy)
-
-        with patch("services.retention.conversation.messages_clean_service.naive_utc_now") as mock_now:
-            fixed_now = datetime.datetime(2024, 6, 1)
-            mock_now.return_value = fixed_now
-
-            service = MessagesCleanService.from_days(policy, days=10)
-            assert service._start_from is None
-            assert service._end_before == fixed_now - datetime.timedelta(days=10)
-
     def test_batch_delete_message_relations_empty(self, db_session_with_containers: Session):
         """Test that batch_delete_message_relations with empty list does nothing."""
         # Get execute call count before
         MessagesCleanService._batch_delete_message_relations(db_session_with_containers, [])
         # No exception means success — empty list is a no-op
-
-    def test_run_calls_clean_messages(self):
-        """Test that run() delegates to _clean_messages_by_time_range."""
-        policy = MagicMock(spec=BillingDisabledPolicy)
-        service = MessagesCleanService(
-            policy=policy,
-            end_before=datetime.datetime.now(),
-            batch_size=10,
-        )
-        with patch.object(service, "_clean_messages_by_time_range") as mock_clean:
-            mock_clean.return_value = {"total_deleted": 5}
-            result = service.run()
-            assert result == {"total_deleted": 5}
-            mock_clean.assert_called_once()

api/tests/test_containers_integration_tests/services/test_workflow_app_service.py

@@ -3,7 +3,6 @@ from __future__ import annotations
 import json
 import uuid
 from datetime import UTC, datetime, timedelta
-from types import SimpleNamespace
 from unittest.mock import patch
 
 import pytest
@@ -12,13 +11,13 @@ from sqlalchemy.orm import Session
 
 from graphon.enums import WorkflowExecutionStatus
 from models import EndUser, Workflow, WorkflowAppLog, WorkflowArchiveLog, WorkflowRun
-from models.enums import AppTriggerType, CreatorUserRole, EndUserType, WorkflowRunTriggeredFrom
+from models.enums import CreatorUserRole, EndUserType, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowAppLogCreatedFrom
 from services.account_service import AccountService, TenantService
 
 # Delay import of AppService to avoid circular dependency
 # from services.app_service import AppService, CreateAppParams
-from services.workflow_app_service import LogView, WorkflowAppService
+from services.workflow_app_service import WorkflowAppService
 from tests.test_containers_integration_tests.helpers import generate_valid_password
 
 
@@ -1627,73 +1626,3 @@ class TestWorkflowAppService:
         end_user_item = next(d for d in result["data"] if d["created_by_end_user"] is not None)
         assert account_item["created_by_account"].id == account.id
         assert end_user_item["created_by_end_user"].id == end_user.id
-
-
-class TestLogView:
-    def test_details_and_proxy_attributes(self):
-        log = SimpleNamespace(id="log-1", status="succeeded")
-        view = LogView(log=log, details={"trigger_metadata": {"type": "plugin"}})
-
-        assert view.details == {"trigger_metadata": {"type": "plugin"}}
-        assert view.status == "succeeded"
-
-
-class TestHandleTriggerMetadata:
-    def test_returns_empty_dict_when_metadata_missing(self):
-        service = WorkflowAppService()
-        assert service.handle_trigger_metadata("tenant-1", None) == {}
-
-    def test_enriches_plugin_icons(self):
-        service = WorkflowAppService()
-        meta = {
-            "type": AppTriggerType.TRIGGER_PLUGIN.value,
-            "icon_filename": "light.png",
-            "icon_dark_filename": "dark.png",
-        }
-        with patch(
-            "services.workflow_app_service.PluginService.get_plugin_icon_url",
-            side_effect=["https://cdn/light.png", "https://cdn/dark.png"],
-        ) as mock_icon:
-            result = service.handle_trigger_metadata("tenant-1", json.dumps(meta))
-
-        assert result["icon"] == "https://cdn/light.png"
-        assert result["icon_dark"] == "https://cdn/dark.png"
-        assert mock_icon.call_count == 2
-
-    def test_non_plugin_metadata_without_icon_lookup(self):
-        service = WorkflowAppService()
-        meta = {"type": AppTriggerType.TRIGGER_WEBHOOK.value}
-        with patch("services.workflow_app_service.PluginService.get_plugin_icon_url") as mock_icon:
-            result = service.handle_trigger_metadata("tenant-1", json.dumps(meta))
-
-        assert result["type"] == AppTriggerType.TRIGGER_WEBHOOK.value
-        mock_icon.assert_not_called()
-
-
-class TestSafeJsonLoads:
-    @pytest.mark.parametrize(
-        ("value", "expected"),
-        [
-            (None, None),
-            ("", None),
-            ('{"k":"v"}', {"k": "v"}),
-            ("not-json", None),
-            ({"raw": True}, {"raw": True}),
-        ],
-    )
-    def test_handles_various_inputs(self, value, expected):
-        assert WorkflowAppService._safe_json_loads(value) == expected
-
-
-class TestSafeParseUuid:
-    def test_returns_none_for_short_or_invalid_values(self):
-        service = WorkflowAppService()
-        assert service._safe_parse_uuid("short") is None
-        assert service._safe_parse_uuid("x" * 40) is None
-
-    def test_returns_uuid_for_valid_string(self):
-        service = WorkflowAppService()
-        raw = str(uuid.uuid4())
-        result = service._safe_parse_uuid(raw)
-        assert result is not None
-        assert str(result) == raw

api/tests/unit_tests/commands/test_legacy_model_type_migration.py

@@ -6,6 +6,7 @@ import json
 import os
 import threading
 import time
+from collections.abc import Iterator
 from datetime import datetime, timedelta
 from pathlib import Path
 from types import SimpleNamespace
@@ -15,9 +16,12 @@ import pytest
 import sqlalchemy as sa
 from click.testing import CliRunner
 from sqlalchemy.exc import OperationalError
+from sqlalchemy.orm import Session, SessionTransaction, sessionmaker
 
 from graphon.model_runtime.entities.model_entities import ModelType
+from models import Dataset, DatasetPermission, DatasetPermissionEnum
 from models.account import Tenant
+from models.base import TypeBase
 from models.enums import CredentialSourceType
 from models.provider import ProviderModel
 from tests.helpers.legacy_model_type_migration import (
@@ -59,6 +63,40 @@ def command_module():
         )
 
 
+@pytest.fixture
+def rbac_session(sqlite_engine: sa.Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[Session]:
+    """Bind RBAC command reads to persisted SQLite dataset rows."""
+
+    TypeBase.metadata.create_all(
+        sqlite_engine,
+        tables=[Dataset.__table__, DatasetPermission.__table__],
+    )
+    factory = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr("commands.rbac.session_factory.create_session", factory)
+    with factory() as session:
+        yield session
+
+
+def _persist_dataset(
+    session: Session,
+    *,
+    dataset_id: str = "dataset-1",
+    tenant_id: str = "tenant-1",
+    permission: DatasetPermissionEnum = DatasetPermissionEnum.ONLY_ME,
+    created_by: str = "creator-account-1",
+) -> Dataset:
+    dataset = Dataset(
+        id=dataset_id,
+        tenant_id=tenant_id,
+        name=f"Dataset {dataset_id}",
+        permission=permission,
+        created_by=created_by,
+    )
+    session.add(dataset)
+    session.commit()
+    return dataset
+
+
 def _parse_json_lines(output: io.StringIO) -> list[dict[str, object]]:
     return [json.loads(line) for line in output.getvalue().splitlines() if line.strip()]
 
@@ -363,56 +401,35 @@ def test_dataset_permission_rbac_migration_maps_legacy_permissions_to_enum_scope
 
 def test_dataset_permission_rbac_migration_uses_dataset_creator_as_operator(
     command_module,
+    rbac_session: Session,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     rbac_module = importlib.import_module("commands.rbac")
-    dataset_row = SimpleNamespace(
-        id="dataset-1",
-        tenant_id="tenant-1",
-        permission="only_me",
-        created_by="creator-account-1",
-    )
-    execute_results = [[dataset_row], [], []]
+    _persist_dataset(rbac_session)
     calls: list[dict[str, object]] = []
-    session_closed = False
-
-    class FakeExecuteResult:
-        def __init__(self, rows: list[object]) -> None:
-            self._rows = rows
-
-        def all(self) -> list[object]:
-            return self._rows
-
-    class FakeSession:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, traceback) -> None:
-            nonlocal session_closed
-            session_closed = True
-            pass
-
-        def execute(self, stmt):
-            return FakeExecuteResult(execute_results.pop(0))
-
-    class FakeSessionFactory:
-        @staticmethod
-        def create_session() -> FakeSession:
-            return FakeSession()
+    read_transaction_ended = False
 
     def fake_replace_whitelist(**kwargs):
-        assert session_closed is True
+        assert read_transaction_ended is True
         calls.append(kwargs)
 
-    monkeypatch.setattr(rbac_module, "session_factory", FakeSessionFactory)
-    monkeypatch.setattr(rbac_module.RBACService.DatasetAccess, "replace_whitelist", fake_replace_whitelist)
+    def _record_transaction_end(session: Session, transaction: object) -> None:
+        nonlocal read_transaction_ended
+        del transaction
+        if session.get_bind() is rbac_session.get_bind():
+            read_transaction_ended = True
 
-    command_module.migrate_dataset_permissions_to_rbac.callback(
-        tenant_id=None,
-        dataset_id=None,
-        batch_size=500,
-        dry_run=False,
-    )
+    sa.event.listen(Session, "after_transaction_end", _record_transaction_end)
+    monkeypatch.setattr(rbac_module.RBACService.DatasetAccess, "replace_whitelist", fake_replace_whitelist)
+    try:
+        command_module.migrate_dataset_permissions_to_rbac.callback(
+            tenant_id=None,
+            dataset_id=None,
+            batch_size=500,
+            dry_run=False,
+        )
+    finally:
+        sa.event.remove(Session, "after_transaction_end", _record_transaction_end)
 
     assert calls[0]["tenant_id"] == "tenant-1"
     assert calls[0]["account_id"] == "creator-account-1"
@@ -422,41 +439,19 @@ def test_dataset_permission_rbac_migration_uses_dataset_creator_as_operator(
 
 def test_dataset_permission_rbac_migration_dry_run_outputs_structured_proposed_changes(
     command_module,
+    rbac_session: Session,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     rbac_module = importlib.import_module("commands.rbac")
-    dataset_row = SimpleNamespace(
-        id="dataset-1",
-        tenant_id="tenant-1",
-        permission="partial_members",
-        created_by="creator-account-1",
+    dataset = _persist_dataset(rbac_session, permission=DatasetPermissionEnum.PARTIAL_TEAM)
+    rbac_session.add(
+        DatasetPermission(
+            dataset_id=dataset.id,
+            account_id="member-account-1",
+            tenant_id=dataset.tenant_id,
+        )
     )
-    permission_row = SimpleNamespace(dataset_id="dataset-1", account_id="member-account-1")
-    execute_results = [[dataset_row], [permission_row], []]
-
-    class FakeExecuteResult:
-        def __init__(self, rows: list[object]) -> None:
-            self._rows = rows
-
-        def all(self) -> list[object]:
-            return self._rows
-
-    class FakeSession:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, traceback) -> None:
-            pass
-
-        def execute(self, stmt):
-            return FakeExecuteResult(execute_results.pop(0))
-
-    class FakeSessionFactory:
-        @staticmethod
-        def create_session() -> FakeSession:
-            return FakeSession()
-
-    monkeypatch.setattr(rbac_module, "session_factory", FakeSessionFactory)
+    rbac_session.commit()
     monkeypatch.setattr(
         rbac_module.RBACService.DatasetAccess,
         "replace_whitelist",
@@ -1306,50 +1301,36 @@ def test_provider_models_processing_uses_same_plan_locking_and_transaction_entry
     begin_calls: list[str] = []
     configure_calls: list[str] = []
 
-    class _FakeBeginContext:
-        def __init__(self, phase: str) -> None:
-            self._phase = phase
+    def _record_begin(session: Session, transaction: SessionTransaction) -> None:
+        if session.get_bind() is sqlite_engine and transaction.parent is None:
+            begin_calls.append(current_phase["name"])
 
-        def __enter__(self) -> None:
-            begin_calls.append(self._phase)
-
-        def __exit__(self, exc_type, exc, tb) -> bool:
-            return False
-
-    class _FakeSession:
-        def __init__(self, phase: str) -> None:
-            self._phase = phase
-
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, tb) -> bool:
-            return False
-
-        def begin(self) -> _FakeBeginContext:
-            return _FakeBeginContext(self._phase)
-
-    def _fake_session_factory(engine: sa.Engine) -> _FakeSession:
-        return _FakeSession(current_phase["name"])
-
-    def _fake_build_plan(self, session, candidate, *, lock_rows: bool):
+    def _fake_build_plan(self, session: Session, candidate, *, lock_rows: bool):
+        assert session.get_bind() is sqlite_engine
         lock_rows_seen.append((current_phase["name"], lock_rows))
-        return SimpleNamespace(group_row_ids=[str(candidate.row.id)], winner=None, loser_rows=[])
+        return migration_module._ProviderModelGroupPlan(
+            group_row_ids=[str(candidate.row.id)],
+            winner=None,
+            loser_rows=[],
+        )
 
     def _fake_emit_plan(self, plan, *, session, tx_id: str, business_key: dict[str, object]) -> None:
         return None
 
-    def _fake_configure(self, session) -> None:
+    def _fake_configure(self, session: Session) -> None:
+        assert session.get_bind() is sqlite_engine
         configure_calls.append(current_phase["name"])
 
-    monkeypatch.setattr(migration_module, "_session_factory", _fake_session_factory)
     monkeypatch.setattr(migration_module.Migration, "_build_provider_model_group_plan", _fake_build_plan)
     monkeypatch.setattr(migration_module.Migration, "_emit_provider_model_group_plan", _fake_emit_plan)
     monkeypatch.setattr(migration_module.Migration, "_configure_lock_timeout", _fake_configure)
-
-    dry_migration._process_provider_model_group(candidate, business_key)
-    current_phase["name"] = "apply"
-    apply_migration._process_provider_model_group(candidate, business_key)
+    sa.event.listen(Session, "after_transaction_create", _record_begin)
+    try:
+        dry_migration._process_provider_model_group(candidate, business_key)
+        current_phase["name"] = "apply"
+        apply_migration._process_provider_model_group(candidate, business_key)
+    finally:
+        sa.event.remove(Session, "after_transaction_create", _record_begin)
 
     assert [phase for phase, _ in lock_rows_seen] == ["dry", "apply"]
     assert lock_rows_seen[0][1] == lock_rows_seen[1][1]
@@ -1392,6 +1373,22 @@ def test_process_load_balancing_model_config_row_logs_stacktrace_for_lock_timeou
     sqlite_engine: sa.Engine,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
+    create_minimal_legacy_model_type_schema(sqlite_engine)
+    created_at = datetime(2025, 1, 1, 12, 0, 0)
+    _insert_load_balancing_model_config(
+        sqlite_engine,
+        row_id="40000000-0000-0000-0000-000000000001",
+        tenant_id="tenant-1",
+        provider_name="openai",
+        model_name="gpt-4o-mini",
+        model_type="text-generation",
+        name="credential",
+        encrypted_config="{}",
+        credential_id="50000000-0000-0000-0000-000000000001",
+        enabled=True,
+        created_at=created_at,
+        updated_at=created_at,
+    )
     output = io.StringIO()
     migration = migration_module.Migration(
         tenant_id="tenant-1",
@@ -1401,37 +1398,18 @@ def test_process_load_balancing_model_config_row_logs_stacktrace_for_lock_timeou
         model_types=(ModelType.LLM,),
         orm_models=(migration_module.LoadBalancingModelConfig,),
     )
-    candidate = migration_module._RowWithRawModelType(
-        row=SimpleNamespace(id="lb-row-1"),
-        raw_model_type="text-generation",
-        canonical_model_type=ModelType.LLM,
-    )
+    candidate = migration._load_load_balancing_model_config_candidates(None)[0]
     lock_timeout_exc = OperationalError("SELECT 1", {}, SimpleNamespace(pgcode="55P03"))
+    transaction_begins = 0
 
-    class _FakeBeginContext:
-        def __enter__(self) -> None:
-            return None
-
-        def __exit__(self, exc_type, exc, tb) -> bool:
-            return False
-
-    class _FakeSession:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, tb) -> bool:
-            return False
-
-        def begin(self) -> _FakeBeginContext:
-            return _FakeBeginContext()
-
-    def _fake_session_factory(engine: sa.Engine) -> _FakeSession:
-        return _FakeSession()
+    def _record_begin(session: Session, transaction: SessionTransaction) -> None:
+        nonlocal transaction_begins
+        if session.get_bind() is sqlite_engine and transaction.parent is None:
+            transaction_begins += 1
 
     def _fake_reload(self, session, original_candidate, *, lock_rows: bool):
         raise lock_timeout_exc
 
-    monkeypatch.setattr(migration_module, "_session_factory", _fake_session_factory)
     monkeypatch.setattr(migration_module.Migration, "_configure_lock_timeout", lambda self, session: None)
     monkeypatch.setattr(
         migration_module.Migration,
@@ -1439,17 +1417,22 @@ def test_process_load_balancing_model_config_row_logs_stacktrace_for_lock_timeou
         _fake_reload,
     )
 
-    migration._process_load_balancing_model_config_row(candidate)
+    sa.event.listen(Session, "after_transaction_create", _record_begin)
+    try:
+        migration._process_load_balancing_model_config_row(candidate)
+    finally:
+        sa.event.remove(Session, "after_transaction_create", _record_begin)
 
     lines = _parse_json_lines(output)
     assert len(lines) == 1
     assert lines[0]["event"] == "lock_timeout_skipped"
     attrs = cast(dict[str, object], lines[0]["attrs"])
     assert attrs["table_name"] == "load_balancing_model_configs"
-    assert attrs["id"] == "lb-row-1"
+    assert attrs["id"] == str(candidate.row.id)
     assert attrs["error"] == str(lock_timeout_exc)
     assert isinstance(attrs["stacktrace"], str)
     assert "OperationalError" in attrs["stacktrace"]
+    assert transaction_begins == 1
 
 
 def test_process_load_balancing_model_config_row_logs_update_after_sql_execution(
@@ -1457,6 +1440,23 @@ def test_process_load_balancing_model_config_row_logs_update_after_sql_execution
     sqlite_engine: sa.Engine,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
+    create_minimal_legacy_model_type_schema(sqlite_engine)
+    created_at = datetime(2025, 1, 1, 12, 0, 0)
+    row_id = "40000000-0000-0000-0000-000000000002"
+    _insert_load_balancing_model_config(
+        sqlite_engine,
+        row_id=row_id,
+        tenant_id="tenant-1",
+        provider_name="openai",
+        model_name="gpt-4o-mini",
+        model_type="text-generation",
+        name="credential",
+        encrypted_config="{}",
+        credential_id="50000000-0000-0000-0000-000000000002",
+        enabled=True,
+        created_at=created_at,
+        updated_at=created_at,
+    )
     migration = migration_module.Migration(
         tenant_id="tenant-1",
         engine=sqlite_engine,
@@ -1465,42 +1465,33 @@ def test_process_load_balancing_model_config_row_logs_update_after_sql_execution
         model_types=(ModelType.LLM,),
         orm_models=(migration_module.LoadBalancingModelConfig,),
     )
-    candidate = migration_module._RowWithRawModelType(
-        row=SimpleNamespace(id="lb-row-1"),
-        raw_model_type="text-generation",
-        canonical_model_type=ModelType.LLM,
-    )
+    candidate = migration._load_load_balancing_model_config_candidates(None)[0]
     action_log: list[str] = []
 
-    class _FakeBeginContext:
-        def __enter__(self) -> None:
+    def _record_begin(session: Session, transaction: SessionTransaction) -> None:
+        if session.get_bind() is sqlite_engine and transaction.parent is None:
             action_log.append("begin")
 
-        def __exit__(self, exc_type, exc, tb) -> bool:
-            return False
-
-    class _FakeSession:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, tb) -> bool:
-            return False
-
-        def begin(self) -> _FakeBeginContext:
-            return _FakeBeginContext()
-
-        def execute(self, stmt) -> None:
+    def _record_sql(
+        connection: sa.Connection,
+        cursor: object,
+        statement: str,
+        parameters: object,
+        context: object,
+        executemany: bool,
+    ) -> None:
+        del connection, cursor, parameters, context, executemany
+        if statement.lstrip().upper().startswith("UPDATE"):
             action_log.append("sql_execute")
 
-    def _fake_session_factory(engine: sa.Engine) -> _FakeSession:
-        return _FakeSession()
-
     def _fake_configure(self, session) -> None:
         action_log.append("configure_lock_timeout")
 
-    def _fake_reload(self, session, original_candidate, *, lock_rows: bool):
+    original_reload = migration_module.Migration._reload_load_balancing_model_config_candidate
+
+    def _record_reload(self, session: Session, original_candidate, *, lock_rows: bool):
         action_log.append(f"reload_candidate:{lock_rows}")
-        return candidate
+        return original_reload(self, session, original_candidate, lock_rows=lock_rows)
 
     def _fake_log_row_updated(self, *args, **kwargs) -> None:
         action_log.append("log_row_updated")
@@ -1508,12 +1499,11 @@ def test_process_load_balancing_model_config_row_logs_update_after_sql_execution
     def _fake_cache_cleanup(self, *, row_id: str, tx_id: str) -> None:
         action_log.append("cache_cleanup")
 
-    monkeypatch.setattr(migration_module, "_session_factory", _fake_session_factory)
     monkeypatch.setattr(migration_module.Migration, "_configure_lock_timeout", _fake_configure)
     monkeypatch.setattr(
         migration_module.Migration,
         "_reload_load_balancing_model_config_candidate",
-        _fake_reload,
+        _record_reload,
     )
     monkeypatch.setattr(migration_module.Migration, "_log_row_updated", _fake_log_row_updated)
     monkeypatch.setattr(
@@ -1522,7 +1512,13 @@ def test_process_load_balancing_model_config_row_logs_update_after_sql_execution
         _fake_cache_cleanup,
     )
 
-    migration._process_load_balancing_model_config_row(candidate)
+    sa.event.listen(Session, "after_transaction_create", _record_begin)
+    sa.event.listen(sqlite_engine, "before_cursor_execute", _record_sql)
+    try:
+        migration._process_load_balancing_model_config_row(candidate)
+    finally:
+        sa.event.remove(sqlite_engine, "before_cursor_execute", _record_sql)
+        sa.event.remove(Session, "after_transaction_create", _record_begin)
 
     assert action_log == [
         "begin",
@@ -1532,6 +1528,10 @@ def test_process_load_balancing_model_config_row_logs_update_after_sql_execution
         "log_row_updated",
         "cache_cleanup",
     ]
+    with Session(sqlite_engine) as session:
+        persisted = session.get(migration_module.LoadBalancingModelConfig, row_id)
+        assert persisted is not None
+        assert persisted.model_type == ModelType.LLM
 
 
 def test_load_balancing_model_config_cache_delete_failure_logs_stacktrace(

api/tests/unit_tests/controllers/console/datasets/test_data_source.py

@@ -1,18 +1,22 @@
 from __future__ import annotations
 
 import inspect
-from collections.abc import Callable
+from collections.abc import Callable, Iterator
 from datetime import UTC, datetime
-from typing import cast
+from typing import Literal, cast
 from unittest.mock import MagicMock, PropertyMock, patch
-from uuid import uuid4
+from uuid import UUID
 
 import pytest
 from flask import Flask
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+from werkzeug.exceptions import NotFound
 
 from controllers.console.datasets import data_source as module
 from controllers.console.datasets.data_source import DataSourceApi, DataSourceNotionListApi
 from models import Account, DataSourceOauthBinding
+from models.engine import db
 
 ControllerMethod = Callable[..., tuple[dict[str, object], int]]
 
@@ -22,10 +26,15 @@ def unwrap(func: object) -> ControllerMethod:
 
 
 @pytest.fixture
-def flask_app() -> Flask:
+def flask_app() -> Iterator[Flask]:
     app = Flask(__name__)
     app.config["TESTING"] = True
-    return app
+    app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///:memory:"
+    db.init_app(app)
+
+    with app.app_context():
+        DataSourceOauthBinding.__table__.create(db.engine)
+        yield app
 
 
 @pytest.fixture
@@ -35,9 +44,13 @@ def current_user() -> Account:
     return account
 
 
-def test_get_data_source_integrates_serializes_orm_binding(flask_app: Flask) -> None:
+TENANT_ID = "11111111-1111-1111-1111-111111111111"
+BINDING_ID = "22222222-2222-2222-2222-222222222222"
+
+
+def _add_binding(session: Session, *, disabled: bool) -> DataSourceOauthBinding:
     binding = DataSourceOauthBinding(
-        tenant_id="tenant-1",
+        tenant_id=TENANT_ID,
         access_token="token",
         provider="notion",
         source_info={
@@ -55,24 +68,31 @@ def test_get_data_source_integrates_serializes_orm_binding(flask_app: Flask) ->
                 }
             ],
         },
+        disabled=disabled,
     )
-    binding.id = "binding-1"
+    binding.id = BINDING_ID
     binding.created_at = datetime(2026, 5, 25, 1, 2, 3, tzinfo=UTC)
-    binding.disabled = False
+    session.add(binding)
+    session.commit()
+    return binding
 
-    with (
-        flask_app.test_request_context("/"),
-        patch.object(module.db.session, "scalars", return_value=MagicMock(all=lambda: [binding])),
-    ):
-        response, status = unwrap(DataSourceApi().get)(DataSourceApi(), "tenant-1")
+
+def test_get_data_source_integrates_serializes_orm_binding(
+    flask_app: Flask,
+) -> None:
+    binding = _add_binding(db.session, disabled=False)
+    expected_created_at = int(binding.created_at.timestamp())
+
+    with flask_app.test_request_context("/"):
+        response, status = unwrap(DataSourceApi().get)(DataSourceApi(), TENANT_ID)
 
     assert status == 200
     assert response == {
         "data": [
             {
-                "id": "binding-1",
+                "id": BINDING_ID,
                 "provider": "notion",
-                "created_at": 1779670923,
+                "created_at": expected_created_at,
                 "is_bound": True,
                 "disabled": False,
                 "source_info": {
@@ -96,34 +116,75 @@ def test_get_data_source_integrates_serializes_orm_binding(flask_app: Flask) ->
     }
 
 
-def test_get_data_source_integrates_preserves_empty_list_when_no_binding(flask_app: Flask) -> None:
-    with (
-        flask_app.test_request_context("/"),
-        patch.object(module.db.session, "scalars", return_value=MagicMock(all=lambda: [])),
-    ):
-        response, status = unwrap(DataSourceApi().get)(DataSourceApi(), "tenant-1")
+def test_get_data_source_integrates_preserves_empty_list_when_no_binding(
+    flask_app: Flask,
+) -> None:
+    with flask_app.test_request_context("/"):
+        response, status = unwrap(DataSourceApi().get)(DataSourceApi(), TENANT_ID)
 
     assert status == 200
     assert response == {"data": []}
 
 
-def test_patch_data_source_binding_uses_injected_session(flask_app: Flask) -> None:
-    binding = MagicMock(disabled=True)
-    session = MagicMock()
-    session.scalar.return_value = binding
+@pytest.mark.parametrize(
+    ("disabled", "action", "expected_disabled"),
+    [(True, "enable", False), (False, "disable", True)],
+)
+@pytest.mark.parametrize("sqlite_session", [(DataSourceOauthBinding,)], indirect=True)
+def test_patch_data_source_binding_updates_state(
+    flask_app: Flask,
+    sqlite_session: Session,
+    disabled: bool,
+    action: Literal["enable", "disable"],
+    expected_disabled: bool,
+) -> None:
+    _add_binding(sqlite_session, disabled=disabled)
+    sqlite_session.expunge_all()
 
     with flask_app.test_request_context("/"):
-        response, status = unwrap(DataSourceApi().patch)(DataSourceApi(), session, "tenant-1", uuid4(), "enable")
+        response, status = unwrap(DataSourceApi().patch)(
+            DataSourceApi(), sqlite_session, TENANT_ID, UUID(BINDING_ID), action
+        )
 
+    sqlite_session.flush()
+    sqlite_session.expire_all()
+    binding = sqlite_session.scalar(select(DataSourceOauthBinding).where(DataSourceOauthBinding.id == BINDING_ID))
     assert status == 200
     assert response == {"result": "success"}
-    assert binding.disabled is False
-    session.scalar.assert_called_once()
-    session.add.assert_not_called()
-    session.commit.assert_not_called()
+    assert binding is not None
+    assert binding.disabled is expected_disabled
 
 
-def test_notion_pre_import_pages_serializes_frontend_list_shape(flask_app: Flask, current_user: Account) -> None:
+@pytest.mark.parametrize("sqlite_session", [(DataSourceOauthBinding,)], indirect=True)
+def test_patch_data_source_binding_rejects_unknown_binding(
+    flask_app: Flask,
+    sqlite_session: Session,
+) -> None:
+    with flask_app.test_request_context("/"), pytest.raises(NotFound, match="Data source binding not found"):
+        unwrap(DataSourceApi().patch)(DataSourceApi(), sqlite_session, TENANT_ID, UUID(BINDING_ID), "enable")
+
+
+@pytest.mark.parametrize(("disabled", "action"), [(False, "enable"), (True, "disable")])
+@pytest.mark.parametrize("sqlite_session", [(DataSourceOauthBinding,)], indirect=True)
+def test_patch_data_source_binding_rejects_current_state(
+    flask_app: Flask,
+    sqlite_session: Session,
+    disabled: bool,
+    action: Literal["enable", "disable"],
+) -> None:
+    _add_binding(sqlite_session, disabled=disabled)
+    sqlite_session.expunge_all()
+
+    with flask_app.test_request_context("/"), pytest.raises(ValueError):
+        unwrap(DataSourceApi().patch)(DataSourceApi(), sqlite_session, TENANT_ID, UUID(BINDING_ID), action)
+
+
+@pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+def test_notion_pre_import_pages_serializes_frontend_list_shape(
+    flask_app: Flask,
+    current_user: Account,
+    sqlite_session: Session,
+) -> None:
     page = MagicMock(
         page_id="page-1",
         page_name="Page",
@@ -145,8 +206,6 @@ def test_notion_pre_import_pages_serializes_frontend_list_shape(flask_app: Flask
         get_online_document_pages=MagicMock(return_value=iter([online_document_message])),
         datasource_provider_type=MagicMock(return_value="online_document"),
     )
-    session = MagicMock()
-
     with (
         flask_app.test_request_context("/?credential_id=credential-1"),
         patch.object(
@@ -158,7 +217,7 @@ def test_notion_pre_import_pages_serializes_frontend_list_shape(flask_app: Flask
         patch("core.datasource.datasource_manager.DatasourceManager.get_datasource_runtime", return_value=runtime),
     ):
         response, status = unwrap(DataSourceNotionListApi().get)(
-            DataSourceNotionListApi(), session, "tenant-1", current_user
+            DataSourceNotionListApi(), sqlite_session, "tenant-1", current_user
         )
 
     assert status == 200
@@ -183,3 +242,38 @@ def test_notion_pre_import_pages_serializes_frontend_list_shape(flask_app: Flask
     }
     runtime.get_online_document_pages.assert_called_once()
     assert runtime.get_online_document_pages.call_args.kwargs["datasource_parameters"] == {}
+
+
+@pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+def test_notion_pre_import_pages_rejects_missing_credential(
+    flask_app: Flask,
+    current_user: Account,
+    sqlite_session: Session,
+) -> None:
+    with (
+        flask_app.test_request_context("/?credential_id=credential-1"),
+        patch.object(module.DatasourceProviderService, "get_datasource_credentials", return_value=None),
+        pytest.raises(NotFound, match="Credential not found"),
+    ):
+        unwrap(DataSourceNotionListApi().get)(DataSourceNotionListApi(), sqlite_session, TENANT_ID, current_user)
+
+
+@pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+def test_notion_pre_import_pages_rejects_non_notion_dataset(
+    flask_app: Flask,
+    current_user: Account,
+    sqlite_session: Session,
+) -> None:
+    dataset = MagicMock(data_source_type="other_type")
+
+    with (
+        flask_app.test_request_context("/?credential_id=credential-1&dataset_id=dataset-1"),
+        patch.object(
+            module.DatasourceProviderService,
+            "get_datasource_credentials",
+            return_value={"token": "token"},
+        ),
+        patch.object(module.DatasetService, "get_dataset", return_value=dataset),
+        pytest.raises(ValueError, match="Dataset is not notion type"),
+    ):
+        unwrap(DataSourceNotionListApi().get)(DataSourceNotionListApi(), sqlite_session, TENANT_ID, current_user)

api/tests/unit_tests/controllers/console/datasets/test_data_source_notion_apis.py

@@ -0,0 +1,171 @@
+"""Unit tests for controllers.console.datasets.data_source Notion endpoints."""
+
+from __future__ import annotations
+
+import inspect
+from unittest.mock import MagicMock, patch
+
+import pytest
+from flask import Flask
+from sqlalchemy.orm import Session
+from werkzeug.exceptions import NotFound
+
+from controllers.console.datasets.data_source import (
+    DataSourceNotionDatasetSyncApi,
+    DataSourceNotionDocumentSyncApi,
+    DataSourceNotionIndexingEstimateApi,
+    DataSourceNotionPreviewApi,
+)
+from core.rag.index_processor.constant.index_type import IndexStructureType
+from models import Account
+
+
+@pytest.fixture
+def current_user() -> Account:
+    account = Account(name="Test User", email="u1@example.com")
+    account.id = "u1"
+    return account
+
+
+class TestDataSourceNotionPreviewApi:
+    def test_get_preview_success(self, app: Flask) -> None:
+        api = DataSourceNotionPreviewApi()
+        method = inspect.unwrap(api.get)
+
+        extractor = MagicMock(extract=lambda: [MagicMock(page_content="hello")])
+
+        with (
+            app.test_request_context("/?credential_id=c1"),
+            patch(
+                "controllers.console.datasets.data_source.DatasourceProviderService.get_datasource_credentials",
+                return_value={"integration_secret": "t"},
+            ),
+            patch(
+                "controllers.console.datasets.data_source.NotionExtractor",
+                return_value=extractor,
+            ),
+        ):
+            response, status = method(api, "tenant-1", "p1", "page")
+
+        assert status == 200
+
+
+class TestDataSourceNotionIndexingEstimateApi:
+    @pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+    def test_post_indexing_estimate_success(self, app: Flask, sqlite_session: Session) -> None:
+        api = DataSourceNotionIndexingEstimateApi()
+        method = inspect.unwrap(api.post)
+
+        empty_rules: dict[str, object] = {}
+        payload: dict[str, object] = {
+            "notion_info_list": [
+                {
+                    "workspace_id": "w1",
+                    "credential_id": "c1",
+                    "pages": [{"page_id": "p1", "type": "page"}],
+                }
+            ],
+            "process_rule": {"rules": empty_rules},
+            "doc_form": IndexStructureType.PARAGRAPH_INDEX,
+            "doc_language": "English",
+        }
+
+        with (
+            app.test_request_context("/", method="POST", json=payload, headers={"Content-Type": "application/json"}),
+            patch(
+                "controllers.console.datasets.data_source.DocumentService.estimate_args_validate",
+            ),
+            patch(
+                "controllers.console.datasets.data_source.IndexingRunner.indexing_estimate",
+                return_value=MagicMock(model_dump=lambda: {"total_pages": 1}),
+            ),
+        ):
+            response, status = method(api, sqlite_session, "tenant-1")
+
+        assert status == 200
+
+
+class TestDataSourceNotionDatasetSyncApi:
+    @pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+    def test_get_success(self, app: Flask, sqlite_session: Session) -> None:
+        api = DataSourceNotionDatasetSyncApi()
+        method = inspect.unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.data_source.DatasetService.get_dataset",
+                return_value=MagicMock(),
+            ),
+            patch(
+                "controllers.console.datasets.data_source.DocumentService.get_document_by_dataset_id",
+                return_value=[MagicMock(id="d1")],
+            ),
+            patch(
+                "controllers.console.datasets.data_source.document_indexing_sync_task.delay",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, sqlite_session, "ds-1")
+
+        assert status == 200
+
+    @pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+    def test_get_dataset_not_found(self, app: Flask, sqlite_session: Session) -> None:
+        api = DataSourceNotionDatasetSyncApi()
+        method = inspect.unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.data_source.DatasetService.get_dataset",
+                return_value=None,
+            ),
+        ):
+            with pytest.raises(NotFound):
+                method(api, sqlite_session, "ds-1")
+
+
+class TestDataSourceNotionDocumentSyncApi:
+    @pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+    def test_get_success(self, app: Flask, sqlite_session: Session) -> None:
+        api = DataSourceNotionDocumentSyncApi()
+        method = inspect.unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.data_source.DatasetService.get_dataset",
+                return_value=MagicMock(),
+            ),
+            patch(
+                "controllers.console.datasets.data_source.DocumentService.get_document",
+                return_value=MagicMock(),
+            ),
+            patch(
+                "controllers.console.datasets.data_source.document_indexing_sync_task.delay",
+                return_value=None,
+            ),
+        ):
+            response, status = method(api, sqlite_session, "ds-1", "doc-1")
+
+        assert status == 200
+
+    @pytest.mark.parametrize("sqlite_session", [()], indirect=True)
+    def test_get_document_not_found(self, app: Flask, sqlite_session: Session) -> None:
+        api = DataSourceNotionDocumentSyncApi()
+        method = inspect.unwrap(api.get)
+
+        with (
+            app.test_request_context("/"),
+            patch(
+                "controllers.console.datasets.data_source.DatasetService.get_dataset",
+                return_value=MagicMock(),
+            ),
+            patch(
+                "controllers.console.datasets.data_source.DocumentService.get_document",
+                return_value=None,
+            ),
+        ):
+            with pytest.raises(NotFound):
+                method(api, sqlite_session, "ds-1", "doc-1")

api/tests/unit_tests/controllers/console/workspace/test_skills.py

@@ -0,0 +1,394 @@
+from __future__ import annotations
+
+from inspect import unwrap
+from unittest.mock import MagicMock, PropertyMock, patch
+
+import pytest
+from flask import Flask
+
+from controllers.console import console_ns
+from controllers.console.workspace.skills import (
+    WorkspaceAgentSkillBindingsApi,
+    WorkspaceSkillAssistMessageApi,
+    WorkspaceSkillFilesApi,
+    WorkspaceSkillsApi,
+    WorkspaceSkillTagsApi,
+    WorkspaceSkillVersionApi,
+)
+from models.account import Account
+from services.skill_management_service import SkillAssistAttachmentPayload, SkillManagementServiceError
+
+
+@pytest.fixture
+def app() -> Flask:
+    flask_app = Flask("test_workspace_skills")
+    flask_app.config["TESTING"] = True
+    return flask_app
+
+
+@pytest.fixture
+def current_user() -> Account:
+    user = Account(name="Test User", email="test@example.com")
+    user.id = "user-1"
+    return user
+
+
+def _skill_detail() -> dict:
+    return {
+        "id": "skill-1",
+        "name": "finance-sop",
+        "display_name": "Finance SOP",
+        "icon": "📄",
+        "description": "",
+        "tags": [],
+        "name_manually_edited": False,
+        "visibility": "workspace",
+        "latest_published_version_id": None,
+        "reference_count": 0,
+        "created_by": "user-1",
+        "created_by_name": "Test User",
+        "updated_by": "user-1",
+        "updated_by_name": "Test User",
+        "created_at": 1,
+        "updated_at": 1,
+        "files": [
+            {
+                "id": "file-1",
+                "path": "SKILL.md",
+                "kind": "file",
+                "storage": "text",
+                "mime_type": "text/markdown",
+                "content": "---\nname: finance-sop\n---\n# Body",
+                "tool_file_id": None,
+                "size": 32,
+                "hash": "hash",
+            }
+        ],
+    }
+
+
+def test_create_skill_validates_payload_and_returns_detail(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillsApi()
+    method = unwrap(api.post)
+    service = MagicMock()
+    service.create_skill.return_value = _skill_detail()
+
+    with (
+        app.test_request_context("/", method="POST"),
+        patch.object(type(console_ns), "payload", new_callable=PropertyMock, return_value={}),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload, status = method(api, "tenant-1", current_user)
+
+    assert status == 201
+    assert payload["id"] == "skill-1"
+    assert payload["files"][0]["path"] == "SKILL.md"
+    service.create_skill.assert_called_once()
+    assert service.create_skill.call_args.kwargs["tenant_id"] == "tenant-1"
+    assert service.create_skill.call_args.kwargs["user_id"] == "user-1"
+
+
+def test_list_skills_uses_default_pagination_when_query_omits_page_and_limit(app: Flask) -> None:
+    api = WorkspaceSkillsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_skills.return_value = {
+        "data": [],
+        "has_more": False,
+        "limit": 20,
+        "page": 1,
+        "total": 0,
+    }
+
+    with (
+        app.test_request_context("/?keyword=finance&tag=ops&tag=", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1")
+
+    assert payload == {
+        "data": [],
+        "has_more": False,
+        "limit": 20,
+        "page": 1,
+        "total": 0,
+    }
+    service.list_skills.assert_called_once_with(
+        tenant_id="tenant-1",
+        keyword="finance",
+        page=1,
+        limit=20,
+        tags=["ops"],
+    )
+
+
+def test_get_agent_skill_bindings_returns_card_data(app: Flask) -> None:
+    api = WorkspaceAgentSkillBindingsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_agent_bindings.return_value = {
+        "agent_id": "agent-1",
+        "skill_ids": ["skill-1"],
+        "data": [
+            {
+                "id": "skill-1",
+                "priority": 0,
+                "name": "finance-sop",
+                "display_name": "Finance SOP",
+                "icon": "📄",
+                "description": "Handle finance.",
+                "tags": ["Finance"],
+                "status": "published",
+                "file_count": 2,
+                "latest_published_version_id": "version-1",
+                "latest_published_at": 123,
+                "updated_at": 124,
+            }
+        ],
+    }
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "agent-1")
+
+    assert payload["skill_ids"] == ["skill-1"]
+    assert payload["data"][0]["display_name"] == "Finance SOP"
+    assert payload["data"][0]["file_count"] == 2
+    service.list_agent_bindings.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
+
+
+def test_patch_skill_file_operation_validates_payload_and_returns_detail(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillFilesApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.apply_draft_file_operation.return_value = _skill_detail()
+    request_payload = {
+        "operation": "upsert_text",
+        "path": "references/policy.md",
+        "content": "Policy",
+    }
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(type(console_ns), "payload", new_callable=PropertyMock, return_value=request_payload),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", current_user, "skill-1")
+
+    assert payload["id"] == "skill-1"
+    service.apply_draft_file_operation.assert_called_once()
+    call = service.apply_draft_file_operation.call_args.kwargs
+    assert call["tenant_id"] == "tenant-1"
+    assert call["user_id"] == "user-1"
+    assert call["skill_id"] == "skill-1"
+    assert call["payload"].operation == "upsert_text"
+
+
+def test_patch_skill_file_operation_returns_error_details(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillFilesApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.apply_draft_file_operation.side_effect = SkillManagementServiceError(
+        "missing_skill_name",
+        "SKILL.md frontmatter name is required",
+        details={"path": "SKILL.md", "field": "name", "line": 2},
+    )
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={"operation": "delete", "path": "SKILL.md"},
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload, status = method(api, "tenant-1", current_user, "skill-1")
+
+    assert status == 400
+    assert payload == {
+        "code": "missing_skill_name",
+        "message": "SKILL.md frontmatter name is required",
+        "details": {"path": "SKILL.md", "field": "name", "line": 2},
+    }
+
+
+def test_list_skill_tags_returns_filter_options(app: Flask) -> None:
+    api = WorkspaceSkillTagsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_tags.return_value = {"data": [{"tag": "finance", "count": 2}]}
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1")
+
+    assert payload == {"data": [{"tag": "finance", "count": 2}]}
+    service.list_tags.assert_called_once_with(tenant_id="tenant-1")
+
+
+def test_get_skill_version_returns_version_detail(app: Flask) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.get_version.return_value = {
+        "id": "version-1",
+        "skill_id": "skill-1",
+        "version_number": 1,
+        "version_name": "Initial finance policy",
+        "publish_note": "Initial finance policy",
+        "hash_code": "hash-code",
+        "archive_size": 123,
+        "published_by": "user-1",
+        "published_by_name": "Li Wei",
+        "is_latest": True,
+        "created_at": 1,
+        "files": [
+            {
+                "id": None,
+                "path": "SKILL.md",
+                "kind": "file",
+                "storage": "text",
+                "mime_type": "text/markdown",
+                "content": "# Version",
+                "tool_file_id": None,
+                "size": 9,
+                "hash": "file-hash",
+            }
+        ],
+    }
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "skill-1", "version-1")
+
+    assert payload["files"][0]["content"] == "# Version"
+    service.get_version.assert_called_once_with(
+        tenant_id="tenant-1",
+        skill_id="skill-1",
+        version_id="version-1",
+    )
+
+
+def test_patch_skill_version_renames_version(app: Flask) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.update_version.return_value = {
+        "id": "version-1",
+        "skill_id": "skill-1",
+        "version_number": 1,
+        "version_name": "Approval threshold",
+        "publish_note": "",
+        "hash_code": "hash-code",
+        "archive_size": 123,
+        "published_by": "user-1",
+        "published_by_name": "Li Wei",
+        "is_latest": True,
+        "created_at": 1,
+    }
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={"version_name": "Approval threshold"},
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "skill-1", "version-1")
+
+    assert payload["version_name"] == "Approval threshold"
+    service.update_version.assert_called_once()
+    assert service.update_version.call_args.kwargs["payload"].version_name == "Approval threshold"
+
+
+def test_delete_skill_version_returns_new_latest(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.delete)
+    service = MagicMock()
+    service.delete_version.return_value = {
+        "id": "version-2",
+        "deleted": True,
+        "latest_published_version_id": "version-1",
+    }
+
+    with (
+        app.test_request_context("/", method="DELETE"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", current_user, "skill-1", "version-2")
+
+    assert payload == {"id": "version-2", "deleted": True, "latest_published_version_id": "version-1"}
+    service.delete_version.assert_called_once_with(
+        tenant_id="tenant-1",
+        user_id="user-1",
+        skill_id="skill-1",
+        version_id="version-2",
+    )
+
+
+def test_skill_assistant_runs_agent_app_stream(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillAssistMessageApi()
+    method = unwrap(api.post)
+    service = MagicMock()
+    assistant_app = MagicMock()
+    assistant_app.id = "assistant-app-1"
+    service.get_or_create_assistant_app.return_value = (assistant_app, "<skill_draft>draft</skill_draft>")
+    app_model = MagicMock()
+    app_response = MagicMock()
+    compact_response = MagicMock()
+
+    with (
+        app.test_request_context("/", method="POST"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={
+                "attachments": [
+                    {
+                        "tool_file_id": "tool-file-1",
+                        "name": "requirements.md",
+                        "mime_type": "text/markdown",
+                        "size": 128,
+                    }
+                ],
+                "message": "Create an approval checklist.",
+            },
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+        patch(
+            "controllers.console.workspace.skills.db.session",
+            return_value=MagicMock(get=MagicMock(return_value=app_model)),
+        ),
+        patch("controllers.console.workspace.skills.AppGenerateService.generate", return_value=app_response),
+        patch("controllers.console.workspace.skills.helper.compact_generate_response", return_value=compact_response),
+    ):
+        response = method(api, "tenant-1", current_user, "skill-1")
+
+    assert response is compact_response
+    service.get_or_create_assistant_app.assert_called_once_with(
+        tenant_id="tenant-1",
+        skill_id="skill-1",
+        user_id="user-1",
+        attachments=[
+            SkillAssistAttachmentPayload(
+                tool_file_id="tool-file-1",
+                name="requirements.md",
+                mime_type="text/markdown",
+                size=128,
+            )
+        ],
+        message="Create an approval checklist.",
+        model_payload=None,
+    )

api/tests/unit_tests/controllers/service_api/app/test_message.py

@@ -15,12 +15,15 @@ Focus on:
 """
 
 import uuid
+from collections.abc import Iterator
 from inspect import unwrap
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
 import pytest
 from flask import Flask
+from sqlalchemy import Engine
+from sqlalchemy.orm import Session
 from werkzeug.exceptions import BadRequest, InternalServerError, NotFound
 
 from controllers.service_api.app.error import NotChatAppError
@@ -44,6 +47,14 @@ from services.errors.message import (
 from services.message_service import MessageService
 
 
+@pytest.fixture
+def orm_session(sqlite_engine: Engine) -> Iterator[Session]:
+    """Provide a real caller-owned session for MessageService interface tests."""
+
+    with Session(sqlite_engine, expire_on_commit=False) as session:
+        yield session
+
+
 class TestMessageListQuery:
     """Test suite for MessageListQuery Pydantic model."""
 
@@ -253,7 +264,7 @@ class TestMessageService:
         assert callable(MessageService.get_suggested_questions_after_answer)
 
     @patch.object(MessageService, "pagination_by_first_id")
-    def test_pagination_by_first_id_returns_pagination_result(self, mock_pagination):
+    def test_pagination_by_first_id_returns_pagination_result(self, mock_pagination, orm_session: Session):
         """Test pagination_by_first_id returns expected format."""
         mock_result = Mock()
         mock_result.data = []
@@ -267,7 +278,7 @@ class TestMessageService:
             conversation_id=str(uuid.uuid4()),
             first_id=None,
             limit=20,
-            session=Mock(),
+            session=orm_session,
         )
 
         assert hasattr(result, "data")
@@ -275,7 +286,7 @@ class TestMessageService:
         assert hasattr(result, "has_more")
 
     @patch.object(MessageService, "pagination_by_first_id")
-    def test_pagination_raises_conversation_not_exists_error(self, mock_pagination):
+    def test_pagination_raises_conversation_not_exists_error(self, mock_pagination, orm_session: Session):
         """Test pagination raises ConversationNotExistsError."""
         import services.errors.conversation
 
@@ -288,11 +299,11 @@ class TestMessageService:
                 conversation_id="invalid_id",
                 first_id=None,
                 limit=20,
-                session=Mock(),
+                session=orm_session,
             )
 
     @patch.object(MessageService, "pagination_by_first_id")
-    def test_pagination_raises_first_message_not_exists_error(self, mock_pagination):
+    def test_pagination_raises_first_message_not_exists_error(self, mock_pagination, orm_session: Session):
         """Test pagination raises FirstMessageNotExistsError."""
         mock_pagination.side_effect = FirstMessageNotExistsError()
 
@@ -303,11 +314,11 @@ class TestMessageService:
                 conversation_id=str(uuid.uuid4()),
                 first_id="invalid_first_id",
                 limit=20,
-                session=Mock(),
+                session=orm_session,
             )
 
     @patch.object(MessageService, "create_feedback")
-    def test_create_feedback_with_rating_and_content(self, mock_create_feedback):
+    def test_create_feedback_with_rating_and_content(self, mock_create_feedback, orm_session: Session):
         """Test create_feedback with rating and content."""
         mock_create_feedback.return_value = None
 
@@ -317,13 +328,13 @@ class TestMessageService:
             user=Mock(spec=EndUser),
             rating=FeedbackRating.LIKE,
             content="Great response!",
-            session=Mock(),
+            session=orm_session,
         )
 
         mock_create_feedback.assert_called_once()
 
     @patch.object(MessageService, "create_feedback")
-    def test_create_feedback_raises_message_not_exists_error(self, mock_create_feedback):
+    def test_create_feedback_raises_message_not_exists_error(self, mock_create_feedback, orm_session: Session):
         """Test create_feedback raises MessageNotExistsError."""
         mock_create_feedback.side_effect = MessageNotExistsError()
 
@@ -334,11 +345,11 @@ class TestMessageService:
                 user=Mock(spec=EndUser),
                 rating=FeedbackRating.LIKE,
                 content=None,
-                session=Mock(),
+                session=orm_session,
             )
 
     @patch.object(MessageService, "get_all_messages_feedbacks")
-    def test_get_all_messages_feedbacks_returns_list(self, mock_get_feedbacks):
+    def test_get_all_messages_feedbacks_returns_list(self, mock_get_feedbacks, orm_session: Session):
         """Test get_all_messages_feedbacks returns list of feedbacks."""
         mock_feedbacks = [
             {"message_id": str(uuid.uuid4()), "rating": "like"},
@@ -346,13 +357,15 @@ class TestMessageService:
         ]
         mock_get_feedbacks.return_value = mock_feedbacks
 
-        result = MessageService.get_all_messages_feedbacks(app_model=Mock(spec=App), page=1, limit=20, session=Mock())
+        result = MessageService.get_all_messages_feedbacks(
+            app_model=Mock(spec=App), page=1, limit=20, session=orm_session
+        )
 
         assert len(result) == 2
         assert result[0]["rating"] == "like"
 
     @patch.object(MessageService, "get_suggested_questions_after_answer")
-    def test_get_suggested_questions_returns_questions_list(self, mock_get_questions):
+    def test_get_suggested_questions_returns_questions_list(self, mock_get_questions, orm_session: Session):
         """Test get_suggested_questions_after_answer returns list of questions."""
         mock_questions = ["What about this aspect?", "Can you elaborate on that?", "How does this relate to...?"]
         mock_get_questions.return_value = mock_questions
@@ -362,14 +375,14 @@ class TestMessageService:
             user=Mock(spec=EndUser),
             message_id=str(uuid.uuid4()),
             invoke_from=Mock(),
-            session=Mock(),
+            session=orm_session,
         )
 
         assert len(result) == 3
         assert isinstance(result[0], str)
 
     @patch.object(MessageService, "get_suggested_questions_after_answer")
-    def test_get_suggested_questions_raises_disabled_error(self, mock_get_questions):
+    def test_get_suggested_questions_raises_disabled_error(self, mock_get_questions, orm_session: Session):
         """Test get_suggested_questions_after_answer raises SuggestedQuestionsAfterAnswerDisabledError."""
         mock_get_questions.side_effect = SuggestedQuestionsAfterAnswerDisabledError()
 
@@ -379,11 +392,11 @@ class TestMessageService:
                 user=Mock(spec=EndUser),
                 message_id=str(uuid.uuid4()),
                 invoke_from=Mock(),
-                session=Mock(),
+                session=orm_session,
             )
 
     @patch.object(MessageService, "get_suggested_questions_after_answer")
-    def test_get_suggested_questions_raises_message_not_exists_error(self, mock_get_questions):
+    def test_get_suggested_questions_raises_message_not_exists_error(self, mock_get_questions, orm_session: Session):
         """Test get_suggested_questions_after_answer raises MessageNotExistsError."""
         mock_get_questions.side_effect = MessageNotExistsError()
 
@@ -393,7 +406,7 @@ class TestMessageService:
                 user=Mock(spec=EndUser),
                 message_id="invalid_message_id",
                 invoke_from=Mock(),
-                session=Mock(),
+                session=orm_session,
             )
 
 

api/tests/unit_tests/controllers/service_api/dataset/rag_pipeline/test_rag_pipeline_workflow.py

@@ -24,6 +24,7 @@ from unittest.mock import Mock, patch
 
 import pytest
 from flask import Flask
+from sqlalchemy.orm import Session
 from werkzeug.datastructures import FileStorage
 from werkzeug.exceptions import Forbidden, NotFound
 
@@ -38,6 +39,7 @@ from controllers.service_api.dataset.rag_pipeline.rag_pipeline_workflow import (
 )
 from core.app.entities.app_invoke_entities import InvokeFrom
 from models.account import Account
+from models.dataset import Dataset
 from services.errors.file import FileTooLargeError, UnsupportedFileTypeError
 from services.rag_pipeline.entity.pipeline_service_api_entities import (
     DatasourceNodeRunApiEntity,
@@ -46,6 +48,20 @@ from services.rag_pipeline.entity.pipeline_service_api_entities import (
 from services.rag_pipeline.rag_pipeline import RagPipelineService
 
 
+def _persist_dataset(session: Session, *, tenant_id: str, dataset_id: str) -> Dataset:
+    dataset = Dataset(
+        id=dataset_id,
+        tenant_id=tenant_id,
+        name="Pipeline dataset",
+        created_by="account-1",
+        data_source_type=None,
+        indexing_technique=None,
+    )
+    session.add(dataset)
+    session.commit()
+    return dataset
+
+
 class TestDatasourceNodeRunPayload:
     """Test suite for DatasourceNodeRunPayload Pydantic model."""
 
@@ -550,13 +566,15 @@ class TestPipelineRunApiPost:
     )
     @patch("controllers.service_api.dataset.rag_pipeline.rag_pipeline_workflow.RagPipelineService")
     @patch("controllers.service_api.dataset.rag_pipeline.rag_pipeline_workflow.service_api_ns")
-    def test_post_success_streaming(self, mock_ns, mock_svc_cls, mock_current_user, mock_gen_svc, mock_helper, app):
+    @pytest.mark.parametrize("sqlite_session", [(Dataset,)], indirect=True)
+    def test_post_success_streaming(
+        self, mock_ns, mock_svc_cls, mock_current_user, mock_gen_svc, mock_helper, app, sqlite_session: Session
+    ):
         """Test successful pipeline run with streaming response."""
         tenant_id = str(uuid.uuid4())
         dataset_id = str(uuid.uuid4())
 
-        session = Mock()
-        session.scalar.return_value = Mock()
+        _persist_dataset(sqlite_session, tenant_id=tenant_id, dataset_id=dataset_id)
 
         mock_ns.payload = {
             "inputs": {"key": "val"},
@@ -577,33 +595,33 @@ class TestPipelineRunApiPost:
 
         with app.test_request_context("/datasets/test/pipeline/run", method="POST"):
             api = PipelineRunApi()
-            response = api.post.__wrapped__(api, session, tenant_id=tenant_id, dataset_id=dataset_id)
+            response = api.post.__wrapped__(api, sqlite_session, tenant_id=tenant_id, dataset_id=dataset_id)
 
         assert response == {"result": "ok"}
-        mock_svc_cls.assert_called_once_with(session)
+        mock_svc_cls.assert_called_once_with(sqlite_session)
         mock_gen_svc.generate.assert_called_once()
 
-    def test_post_not_found(self, app: Flask):
+    @pytest.mark.parametrize("sqlite_session", [(Dataset,)], indirect=True)
+    def test_post_not_found(self, app: Flask, sqlite_session: Session):
         """Test NotFound when dataset check fails."""
-        session = Mock()
-        session.scalar.return_value = None
-
         with app.test_request_context("/datasets/test/pipeline/run", method="POST"):
             api = PipelineRunApi()
             with pytest.raises(NotFound):
                 api.post.__wrapped__(
                     api,
-                    session,
+                    sqlite_session,
                     tenant_id=str(uuid.uuid4()),
                     dataset_id=str(uuid.uuid4()),
                 )
 
     @patch("controllers.service_api.dataset.rag_pipeline.rag_pipeline_workflow.current_user", new="not_account")
     @patch("controllers.service_api.dataset.rag_pipeline.rag_pipeline_workflow.service_api_ns")
-    def test_post_forbidden_non_account_user(self, mock_ns, app: Flask):
+    @pytest.mark.parametrize("sqlite_session", [(Dataset,)], indirect=True)
+    def test_post_forbidden_non_account_user(self, mock_ns, app: Flask, sqlite_session: Session):
         """Test Forbidden when current_user is not an Account."""
-        session = Mock()
-        session.scalar.return_value = Mock()
+        tenant_id = str(uuid.uuid4())
+        dataset_id = str(uuid.uuid4())
+        _persist_dataset(sqlite_session, tenant_id=tenant_id, dataset_id=dataset_id)
         mock_ns.payload = {
             "inputs": {},
             "datasource_type": "online_document",
@@ -618,9 +636,9 @@ class TestPipelineRunApiPost:
             with pytest.raises(Forbidden):
                 api.post.__wrapped__(
                     api,
-                    session,
-                    tenant_id=str(uuid.uuid4()),
-                    dataset_id=str(uuid.uuid4()),
+                    sqlite_session,
+                    tenant_id=tenant_id,
+                    dataset_id=dataset_id,
                 )
 
 

api/tests/unit_tests/controllers/service_api/test_wraps.py

@@ -3,10 +3,13 @@ Unit tests for Service API wraps (authentication decorators)
 """
 
 import uuid
+from types import SimpleNamespace
 from unittest.mock import MagicMock, Mock, patch
 
 import pytest
 from flask import Flask
+from sqlalchemy import select
+from sqlalchemy.orm import Session
 from werkzeug.exceptions import Forbidden, NotFound, Unauthorized
 
 from controllers.service_api.wraps import (
@@ -21,12 +24,11 @@ from controllers.service_api.wraps import (
     validate_dataset_token,
 )
 from enums.cloud_plan import CloudPlan
-from models.account import TenantStatus
-from models.model import ApiToken
-from tests.unit_tests.conftest import (
-    setup_mock_dataset_owner_execute_result,
-    setup_mock_tenant_owner_execute_result,
-)
+from models import Account, Tenant, TenantAccountJoin
+from models.account import TenantAccountRole
+from models.dataset import Dataset, RateLimitLog
+from models.enums import ApiTokenType
+from models.model import ApiToken, App, AppMode, IconType
 
 
 def _configure_current_app_mock(mock_current_app):
@@ -34,6 +36,51 @@ def _configure_current_app_mock(mock_current_app):
     mock_current_app._get_current_object = Mock(return_value=Mock())
 
 
+def _session_proxy(session: Session) -> MagicMock:
+    """Emulate Flask-SQLAlchemy's callable scoped-session proxy around a test session."""
+    proxy = MagicMock(wraps=session)
+    proxy.return_value = session
+    return proxy
+
+
+def _api_token(*, tenant_id: str, app_id: str | None = None, token_type: ApiTokenType) -> ApiToken:
+    return ApiToken(
+        id=str(uuid.uuid4()),
+        tenant_id=tenant_id,
+        app_id=app_id,
+        type=token_type,
+        token="test_token",
+    )
+
+
+def _persist_workspace(session: Session) -> tuple[Tenant, Account, TenantAccountJoin]:
+    tenant = Tenant(name="Workspace")
+    account = Account(name="Owner", email=f"owner-{uuid.uuid4()}@example.com")
+    membership = TenantAccountJoin(
+        tenant_id=tenant.id,
+        account_id=account.id,
+        current=True,
+        role=TenantAccountRole.OWNER,
+    )
+    session.add_all([tenant, account, membership])
+    session.commit()
+    return tenant, account, membership
+
+
+def _app_model(*, tenant_id: str, enable_api: bool = True) -> App:
+    return App(
+        id=str(uuid.uuid4()),
+        tenant_id=tenant_id,
+        name="Service API App",
+        mode=AppMode.CHAT,
+        icon_type=IconType.EMOJI,
+        icon="chat",
+        icon_background="#FFFFFF",
+        enable_site=False,
+        enable_api=enable_api,
+    )
+
+
 class TestValidateAndGetApiToken:
     """Test suite for validate_and_get_api_token function"""
 
@@ -70,21 +117,24 @@ class TestValidateAndGetApiToken:
     def test_valid_token_returns_api_token(self, mock_fetch_token, mock_cache_cls, mock_record_usage, app: Flask):
         """Test that valid token returns the ApiToken object."""
         # Arrange
-        mock_api_token = Mock(spec=ApiToken)
-        mock_api_token.token = "valid_token_123"
-        mock_api_token.type = "app"
+        api_token = _api_token(
+            tenant_id=str(uuid.uuid4()),
+            app_id=str(uuid.uuid4()),
+            token_type=ApiTokenType.APP,
+        )
+        api_token.token = "valid_token_123"
 
         mock_cache_instance = Mock()
         mock_cache_instance.get.return_value = None  # Cache miss
         mock_cache_cls.get = mock_cache_instance.get
-        mock_fetch_token.return_value = mock_api_token
+        mock_fetch_token.return_value = api_token
 
         # Act
         with app.test_request_context("/", method="GET", headers={"Authorization": "Bearer valid_token_123"}):
             result = validate_and_get_api_token("app")
 
         # Assert
-        assert result == mock_api_token
+        assert result == api_token
 
     @patch("controllers.service_api.wraps.record_token_usage")
     @patch("controllers.service_api.wraps.ApiTokenCache")
@@ -117,116 +167,124 @@ class TestValidateAppToken:
         return app
 
     @patch("controllers.service_api.wraps.user_logged_in")
-    @patch("controllers.service_api.wraps.db")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
     @patch("controllers.service_api.wraps.current_app")
+    @pytest.mark.parametrize(
+        "sqlite_session",
+        [(App, ApiToken, Tenant, Account, TenantAccountJoin)],
+        indirect=True,
+    )
     def test_valid_app_token_allows_access(
-        self, mock_current_app, mock_validate_token, mock_db, mock_user_logged_in, app
+        self,
+        mock_current_app,
+        mock_validate_token,
+        mock_user_logged_in,
+        app: Flask,
+        sqlite_session: Session,
     ):
         """Test that valid app token allows access to decorated view."""
         # Arrange
         _configure_current_app_mock(mock_current_app)
 
-        mock_api_token = Mock()
-        mock_api_token.app_id = str(uuid.uuid4())
-        mock_api_token.tenant_id = str(uuid.uuid4())
-        mock_validate_token.return_value = mock_api_token
-
-        mock_app = Mock()
-        mock_app.id = mock_api_token.app_id
-        mock_app.status = "normal"
-        mock_app.enable_api = True
-        mock_app.tenant_id = mock_api_token.tenant_id
-
-        mock_tenant = Mock()
-        mock_tenant.status = TenantStatus.NORMAL
-        mock_tenant.id = mock_api_token.tenant_id
-
-        mock_account = Mock()
-        mock_account.id = str(uuid.uuid4())
-
-        # Use side_effect to return app first, then tenant via session.get()
-        mock_db.session.get.side_effect = [mock_app, mock_tenant]
-
-        # Mock the tenant owner execute result (execute(select(...)).one_or_none())
-        setup_mock_tenant_owner_execute_result(mock_db, mock_tenant, mock_account)
+        tenant, account, _ = _persist_workspace(sqlite_session)
+        app_model = _app_model(tenant_id=tenant.id)
+        api_token = _api_token(tenant_id=tenant.id, app_id=app_model.id, token_type=ApiTokenType.APP)
+        sqlite_session.add_all([app_model, api_token])
+        sqlite_session.commit()
+        mock_validate_token.return_value = api_token
 
         @validate_app_token
         def protected_view(app_model):
             return {"success": True, "app_id": app_model.id}
 
         # Act
-        with app.test_request_context("/", method="GET", headers={"Authorization": "Bearer test_token"}):
+        with (
+            app.test_request_context("/", method="GET", headers={"Authorization": "Bearer test_token"}),
+            patch("controllers.service_api.wraps.db.session", _session_proxy(sqlite_session)),
+        ):
             result = protected_view()
 
         # Assert
         assert result["success"] is True
-        assert result["app_id"] == mock_app.id
+        assert result["app_id"] == app_model.id
+        assert account.current_tenant_id == tenant.id
 
-    @patch("controllers.service_api.wraps.db")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
-    def test_app_not_found_raises_forbidden(self, mock_validate_token, mock_db, app: Flask):
+    @pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
+    def test_app_not_found_raises_forbidden(self, mock_validate_token, app: Flask, sqlite_session: Session):
         """Test that Forbidden is raised when app no longer exists."""
         # Arrange
-        mock_api_token = Mock()
-        mock_api_token.app_id = str(uuid.uuid4())
-        mock_validate_token.return_value = mock_api_token
-
-        mock_db.session.get.return_value = None
+        api_token = _api_token(
+            tenant_id=str(uuid.uuid4()),
+            app_id=str(uuid.uuid4()),
+            token_type=ApiTokenType.APP,
+        )
+        mock_validate_token.return_value = api_token
 
         @validate_app_token
         def protected_view(**kwargs):
             return {"success": True}
 
         # Act & Assert
-        with app.test_request_context("/", method="GET"):
+        with (
+            app.test_request_context("/", method="GET"),
+            patch("controllers.service_api.wraps.db.session", sqlite_session),
+        ):
             with pytest.raises(Forbidden) as exc_info:
                 protected_view()
             assert "no longer exists" in str(exc_info.value)
 
-    @patch("controllers.service_api.wraps.db")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
-    def test_app_status_abnormal_raises_forbidden(self, mock_validate_token, mock_db, app: Flask):
+    @pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
+    def test_app_status_abnormal_raises_forbidden(self, mock_validate_token, app: Flask, sqlite_session: Session):
         """Test that Forbidden is raised when app status is abnormal."""
         # Arrange
-        mock_api_token = Mock()
-        mock_api_token.app_id = str(uuid.uuid4())
-        mock_validate_token.return_value = mock_api_token
-
-        mock_app = Mock()
-        mock_app.status = "abnormal"
-        mock_db.session.get.return_value = mock_app
+        app_model = _app_model(tenant_id=str(uuid.uuid4()))
+        sqlite_session.add(app_model)
+        sqlite_session.commit()
+        app_model.status = "abnormal"
+        mock_validate_token.return_value = _api_token(
+            tenant_id=app_model.tenant_id,
+            app_id=app_model.id,
+            token_type=ApiTokenType.APP,
+        )
 
         @validate_app_token
         def protected_view(**kwargs):
             return {"success": True}
 
         # Act & Assert
-        with app.test_request_context("/", method="GET"):
+        with (
+            app.test_request_context("/", method="GET"),
+            patch("controllers.service_api.wraps.db.session", sqlite_session),
+        ):
             with pytest.raises(Forbidden) as exc_info:
                 protected_view()
             assert "status is abnormal" in str(exc_info.value)
 
-    @patch("controllers.service_api.wraps.db")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
-    def test_app_api_disabled_raises_forbidden(self, mock_validate_token, mock_db, app: Flask):
+    @pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
+    def test_app_api_disabled_raises_forbidden(self, mock_validate_token, app: Flask, sqlite_session: Session):
         """Test that Forbidden is raised when app API is disabled."""
         # Arrange
-        mock_api_token = Mock()
-        mock_api_token.app_id = str(uuid.uuid4())
-        mock_validate_token.return_value = mock_api_token
-
-        mock_app = Mock()
-        mock_app.status = "normal"
-        mock_app.enable_api = False
-        mock_db.session.get.return_value = mock_app
+        app_model = _app_model(tenant_id=str(uuid.uuid4()), enable_api=False)
+        sqlite_session.add(app_model)
+        sqlite_session.commit()
+        mock_validate_token.return_value = _api_token(
+            tenant_id=app_model.tenant_id,
+            app_id=app_model.id,
+            token_type=ApiTokenType.APP,
+        )
 
         @validate_app_token
         def protected_view(**kwargs):
             return {"success": True}
 
         # Act & Assert
-        with app.test_request_context("/", method="GET"):
+        with (
+            app.test_request_context("/", method="GET"),
+            patch("controllers.service_api.wraps.db.session", sqlite_session),
+        ):
             with pytest.raises(Forbidden) as exc_info:
                 protected_view()
             assert "API service has been disabled" in str(exc_info.value)
@@ -468,26 +526,35 @@ class TestCloudEditionBillingRateLimitCheck:
 
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
     @patch("controllers.service_api.wraps.FeatureService.get_knowledge_rate_limit")
-    @patch("controllers.service_api.wraps.db")
-    @patch("controllers.service_api.wraps.sessionmaker")
+    @pytest.mark.parametrize("sqlite_session", [(RateLimitLog,)], indirect=True)
     def test_rejects_over_rate_limit(
-        self, mock_sessionmaker, mock_db, mock_get_rate_limit, mock_validate_token, app: Flask
+        self,
+        mock_get_rate_limit,
+        mock_validate_token,
+        app: Flask,
+        sqlite_session: Session,
     ):
         """Test that Forbidden is raised when over rate limit."""
         # Arrange
-        mock_validate_token.return_value = Mock(tenant_id="tenant123")
+        tenant_id = str(uuid.uuid4())
+        mock_validate_token.return_value = _api_token(
+            tenant_id=tenant_id,
+            token_type=ApiTokenType.DATASET,
+        )
 
         mock_rate_limit = Mock()
         mock_rate_limit.enabled = True
         mock_rate_limit.limit = 10
         mock_rate_limit.subscription_plan = "pro"
         mock_get_rate_limit.return_value = mock_rate_limit
-        rate_limit_log_session = MagicMock()
-        session_factory = MagicMock()
-        session_factory.begin.return_value.__enter__.return_value = rate_limit_log_session
-        mock_sessionmaker.return_value = session_factory
 
-        with patch("controllers.service_api.wraps.redis_client") as mock_redis:
+        with (
+            patch("controllers.service_api.wraps.redis_client") as mock_redis,
+            patch(
+                "controllers.service_api.wraps.db",
+                SimpleNamespace(engine=sqlite_session.get_bind()),
+            ),
+        ):
             mock_redis.zcard.return_value = 15  # Over limit
 
             @cloud_edition_billing_rate_limit_check("knowledge", "dataset")
@@ -499,9 +566,12 @@ class TestCloudEditionBillingRateLimitCheck:
                 with pytest.raises(Forbidden) as exc_info:
                     knowledge_request()
                 assert "rate limit" in str(exc_info.value)
-            mock_sessionmaker.assert_called_once_with(bind=mock_db.engine, expire_on_commit=False)
-            rate_limit_log_session.add.assert_called_once()
-            mock_db.session.commit.assert_not_called()
+
+        persisted_logs = sqlite_session.scalars(select(RateLimitLog)).all()
+        assert len(persisted_logs) == 1
+        assert persisted_logs[0].tenant_id == tenant_id
+        assert persisted_logs[0].subscription_plan == "pro"
+        assert persisted_logs[0].operation == "knowledge"
 
 
 class TestValidateDatasetToken:
@@ -515,65 +585,62 @@ class TestValidateDatasetToken:
         return app
 
     @patch("controllers.service_api.wraps.user_logged_in")
-    @patch("controllers.service_api.wraps.db")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
     @patch("controllers.service_api.wraps.current_app")
-    def test_valid_dataset_token(self, mock_current_app, mock_validate_token, mock_db, mock_user_logged_in, app: Flask):
+    @pytest.mark.parametrize(
+        "sqlite_session",
+        [(Tenant, Account, TenantAccountJoin)],
+        indirect=True,
+    )
+    def test_valid_dataset_token(
+        self,
+        mock_current_app,
+        mock_validate_token,
+        mock_user_logged_in,
+        app: Flask,
+        sqlite_session: Session,
+    ):
         """Test that valid dataset token allows access."""
         # Arrange
         _configure_current_app_mock(mock_current_app)
 
-        tenant_id = str(uuid.uuid4())
-        mock_api_token = Mock()
-        mock_api_token.tenant_id = tenant_id
-        mock_validate_token.return_value = mock_api_token
-
-        mock_tenant = Mock()
-        mock_tenant.id = tenant_id
-        mock_tenant.status = TenantStatus.NORMAL
-
-        mock_ta = Mock()
-        mock_ta.account_id = str(uuid.uuid4())
-
-        mock_account = Mock()
-        mock_account.id = mock_ta.account_id
-        mock_account.current_tenant = mock_tenant
-
-        # Mock the tenant account join query (execute(select(...)).one_or_none())
-        setup_mock_dataset_owner_execute_result(mock_db, mock_tenant, mock_ta)
-
-        # Mock the account lookup via session.get()
-        mock_db.session.get.return_value = mock_account
+        tenant, account, _ = _persist_workspace(sqlite_session)
+        api_token = _api_token(tenant_id=tenant.id, token_type=ApiTokenType.DATASET)
+        mock_validate_token.return_value = api_token
 
         @validate_dataset_token
         def protected_view(tenant_id):
             return {"success": True, "tenant_id": tenant_id}
 
         # Act
-        with app.test_request_context("/", method="GET", headers={"Authorization": "Bearer test_token"}):
+        with (
+            app.test_request_context("/", method="GET", headers={"Authorization": "Bearer test_token"}),
+            patch("controllers.service_api.wraps.db.session", _session_proxy(sqlite_session)),
+        ):
             result = protected_view()
 
         # Assert
         assert result["success"] is True
-        assert result["tenant_id"] == tenant_id
+        assert result["tenant_id"] == tenant.id
+        assert account.current_tenant_id == tenant.id
 
-    @patch("controllers.service_api.wraps.db")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
-    def test_dataset_not_found_raises_not_found(self, mock_validate_token, mock_db, app: Flask):
+    @pytest.mark.parametrize("sqlite_session", [(Dataset,)], indirect=True)
+    def test_dataset_not_found_raises_not_found(self, mock_validate_token, app: Flask, sqlite_session: Session):
         """Test that NotFound is raised when dataset doesn't exist."""
         # Arrange
-        mock_api_token = Mock()
-        mock_api_token.tenant_id = str(uuid.uuid4())
-        mock_validate_token.return_value = mock_api_token
-
-        mock_db.session.scalar.return_value = None
+        api_token = _api_token(tenant_id=str(uuid.uuid4()), token_type=ApiTokenType.DATASET)
+        mock_validate_token.return_value = api_token
 
         @validate_dataset_token
         def protected_view(dataset_id=None, **kwargs):
             return {"success": True}
 
         # Act & Assert
-        with app.test_request_context("/", method="GET"):
+        with (
+            app.test_request_context("/", method="GET"),
+            patch("controllers.service_api.wraps.db.session", sqlite_session),
+        ):
             with pytest.raises(NotFound) as exc_info:
                 protected_view(dataset_id=str(uuid.uuid4()))
             assert "Dataset not found" in str(exc_info.value)

api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py

@@ -7,6 +7,7 @@ from types import SimpleNamespace
 from typing import Any
 
 import pytest
+from dify_agent.layers.config import DifyConfigSkillConfig
 from dify_agent.layers.dify_core_tools import DifyCoreToolConfig, DifyCoreToolsLayerConfig
 from dify_agent.layers.dify_plugin import DifyPluginToolConfig, DifyPluginToolsLayerConfig
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
@@ -29,6 +30,14 @@ from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
 from models.agent_config_entities import AgentSoulConfig
 
 
+@pytest.fixture(autouse=True)
+def _no_runtime_agent_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.app.apps.agent_app.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [],
+    )
+
+
 def _exec_ctx() -> DifyExecutionContextLayerConfig:
     return DifyExecutionContextLayerConfig(
         tenant_id="tenant-1",
@@ -514,6 +523,33 @@ class TestAgentAppConfigLayer:
             "mentioned_file_names": [],
         }
 
+    def test_config_layer_includes_bound_workspace_skills(self, monkeypatch: pytest.MonkeyPatch):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.load_runtime_agent_skill_configs",
+            lambda *, tenant_id, agent_id: [
+                DifyConfigSkillConfig(
+                    name="workspace-skill",
+                    description="Bound workspace skill.",
+                    size=123,
+                    mime_type="application/zip",
+                )
+            ],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = "Use [§skill:workspace-skill:Workspace Skill§]."
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            dify_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        config = next(layer for layer in result.request.composition.layers if layer.name == DIFY_CONFIG_LAYER_ID)
+        assert [skill.name for skill in config.config.skills] == ["workspace-skill"]
+        assert config.config.mentioned_skill_names == ["workspace-skill"]
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use workspace-skill."
+
     @pytest.mark.parametrize(
         ("system_prompt", "expected_prefix"),
         [

api/tests/unit_tests/core/app/apps/workflow/test_generate_task_pipeline_core.py

@@ -1,11 +1,11 @@
 from __future__ import annotations
 
 import logging
-from contextlib import contextmanager
 from types import SimpleNamespace
-from unittest.mock import MagicMock
 
 import pytest
+from sqlalchemy import select
+from sqlalchemy.orm import Session
 
 from core.app.app_config.entities import AppAdditionalFeatures, WorkflowUIBasedAppConfig
 from core.app.apps.workflow.generate_task_pipeline import WorkflowAppGenerateTaskPipeline
@@ -54,6 +54,7 @@ from graphon.runtime import GraphRuntimeState, VariablePool
 from libs.datetime_utils import naive_utc_now
 from models.enums import CreatorUserRole
 from models.model import AppMode, EndUser
+from models.workflow import WorkflowAppLog
 from tests.workflow_test_utils import build_test_variable_pool
 
 
@@ -193,7 +194,7 @@ class TestWorkflowGenerateTaskPipeline:
 
         assert isinstance(responses[0], ValueError)
 
-    def test_handle_workflow_started_event_sets_run_id(self, monkeypatch: pytest.MonkeyPatch):
+    def test_handle_workflow_started_event_sets_run_id(self, monkeypatch: pytest.MonkeyPatch, sqlite_engine):
         pipeline = _make_pipeline()
         pipeline._graph_runtime_state = GraphRuntimeState(
             variable_pool=build_test_variable_pool(variables=build_system_variables(workflow_execution_id="run-id")),
@@ -201,11 +202,10 @@ class TestWorkflowGenerateTaskPipeline:
         )
         pipeline._workflow_response_converter.workflow_start_to_stream_response = lambda **kwargs: "started"
 
-        @contextmanager
-        def _fake_session():
-            yield SimpleNamespace()
-
-        monkeypatch.setattr(pipeline, "_database_session", _fake_session)
+        monkeypatch.setattr(
+            "core.app.apps.workflow.generate_task_pipeline.db",
+            SimpleNamespace(engine=sqlite_engine),
+        )
         monkeypatch.setattr(pipeline, "_save_workflow_app_log", lambda **kwargs: None)
 
         responses = list(pipeline._handle_workflow_started_event(QueueWorkflowStartedEvent()))
@@ -339,19 +339,18 @@ class TestWorkflowGenerateTaskPipeline:
 
         assert responses == ["finish"]
 
-    def test_save_workflow_app_log_created_from(self):
+    @pytest.mark.parametrize("sqlite_session", [(WorkflowAppLog,)], indirect=True)
+    def test_save_workflow_app_log_created_from(self, sqlite_session: Session):
         pipeline = _make_pipeline()
         pipeline._application_generate_entity.invoke_from = InvokeFrom.SERVICE_API
         pipeline._user_id = "user"
-        added: list[object] = []
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id")
+        sqlite_session.flush()
 
-        class _Session:
-            def add(self, item):
-                added.append(item)
-
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-
-        assert added
+        saved_log = sqlite_session.scalar(select(WorkflowAppLog))
+        assert saved_log is not None
+        assert saved_log.workflow_run_id == "run-id"
+        assert saved_log.created_from == "service-api"
 
     def test_iteration_loop_and_human_input_handlers(self):
         pipeline = _make_pipeline()
@@ -674,35 +673,29 @@ class TestWorkflowGenerateTaskPipeline:
         assert "Fails to get audio trunk, task_id: task" in caplog.messages
         assert any(isinstance(item, MessageAudioEndStreamResponse) for item in responses)
 
-    def test_database_session_rolls_back_on_error(self, monkeypatch: pytest.MonkeyPatch):
+    @pytest.mark.parametrize("sqlite_session", [(WorkflowAppLog,)], indirect=True)
+    def test_database_session_rolls_back_on_error(
+        self, monkeypatch: pytest.MonkeyPatch, sqlite_engine, sqlite_session: Session
+    ):
         pipeline = _make_pipeline()
-        calls = {"enter": 0, "exit_exc": None}
+        pipeline._application_generate_entity.invoke_from = InvokeFrom.SERVICE_API
+        pipeline._user_id = "user"
+        monkeypatch.setattr(
+            "core.app.apps.workflow.generate_task_pipeline.db",
+            SimpleNamespace(engine=sqlite_engine),
+        )
 
-        class _BeginContext:
-            def __enter__(self):
-                calls["enter"] += 1
-                return MagicMock()
-
-            def __exit__(self, exc_type, exc, tb):
-                calls["exit_exc"] = exc_type
-                return False
-
-        class _Sessionmaker:
-            def __init__(self, *args, **kwargs):
-                pass
-
-            def begin(self):
-                return _BeginContext()
-
-        monkeypatch.setattr("core.app.apps.workflow.generate_task_pipeline.sessionmaker", _Sessionmaker)
-        monkeypatch.setattr("core.app.apps.workflow.generate_task_pipeline.db", SimpleNamespace(engine=object()))
-
-        with pytest.raises(RuntimeError, match="db error"):
-            with pipeline._database_session():
+        def persist_then_fail() -> None:
+            with pipeline._database_session() as session:
+                pipeline._save_workflow_app_log(session=session, workflow_run_id="run-id")
+                session.flush()
                 raise RuntimeError("db error")
 
-        assert calls["enter"] == 1
-        assert calls["exit_exc"] is RuntimeError
+        with pytest.raises(RuntimeError, match="db error"):
+            persist_then_fail()
+
+        sqlite_session.expire_all()
+        assert sqlite_session.scalar(select(WorkflowAppLog)) is None
 
     def test_node_retry_and_started_handlers_cover_none_and_value(self):
         pipeline = _make_pipeline()
@@ -862,31 +855,30 @@ class TestWorkflowGenerateTaskPipeline:
         pipeline._handle_workflow_failed_and_stop_events = lambda event, **kwargs: iter(["stopped"])
         assert list(pipeline._process_stream_response()) == ["stopped"]
 
-    def test_save_workflow_app_log_covers_invoke_from_variants(self):
+    @pytest.mark.parametrize("sqlite_session", [(WorkflowAppLog,)], indirect=True)
+    def test_save_workflow_app_log_covers_invoke_from_variants(self, sqlite_session: Session):
         pipeline = _make_pipeline()
         pipeline._user_id = "user-id"
-        added: list[object] = []
-
-        class _Session:
-            def add(self, item):
-                added.append(item)
 
         pipeline._application_generate_entity.invoke_from = InvokeFrom.EXPLORE
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-        assert added[-1].created_from == "installed-app"
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id")
 
         pipeline._application_generate_entity.invoke_from = InvokeFrom.WEB_APP
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-        assert added[-1].created_from == "web-app"
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id-2")
+        sqlite_session.flush()
+        saved_logs = sqlite_session.scalars(select(WorkflowAppLog).order_by(WorkflowAppLog.workflow_run_id)).all()
+        assert [log.created_from for log in saved_logs] == ["installed-app", "web-app"]
 
-        count_before = len(added)
+        count_before = len(saved_logs)
         pipeline._application_generate_entity.invoke_from = InvokeFrom.DEBUGGER
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-        assert len(added) == count_before
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id-3")
+        sqlite_session.flush()
+        assert len(sqlite_session.scalars(select(WorkflowAppLog)).all()) == count_before
 
         pipeline._application_generate_entity.invoke_from = InvokeFrom.WEB_APP
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id=None)
-        assert len(added) == count_before
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id=None)
+        sqlite_session.flush()
+        assert len(sqlite_session.scalars(select(WorkflowAppLog)).all()) == count_before
 
     def test_save_output_for_event_writes_draft_variables(self):
         pipeline = _make_pipeline()

api/tests/unit_tests/core/app/layers/test_trigger_post_layer.py

@@ -1,9 +1,13 @@
 import logging
+from collections.abc import Iterator
+from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
 import pytest
+from sqlalchemy import Engine, event
+from sqlalchemy.orm import Session, sessionmaker
 
 from core.app.layers.trigger_post_layer import TriggerPostLayer
 from core.workflow.system_variables import build_system_variables
@@ -13,19 +17,63 @@ from graphon.graph_events import (
     GraphRunSucceededEvent,
 )
 from graphon.runtime import VariablePool
-from models.enums import WorkflowTriggerStatus
+from models.enums import AppTriggerType, CreatorUserRole, WorkflowTriggerStatus
+from models.trigger import WorkflowTriggerLog
+
+
+@dataclass(frozen=True)
+class TriggerDatabase:
+    session: Session
+    statements: list[str]
+
+
+@pytest.fixture(autouse=True)
+def trigger_database(monkeypatch: pytest.MonkeyPatch, sqlite_engine: Engine) -> Iterator[TriggerDatabase]:
+    """Create the trigger-log table and bind layer-owned sessions to SQLite."""
+    WorkflowTriggerLog.metadata.create_all(sqlite_engine, tables=[WorkflowTriggerLog.__table__])
+    sqlite_session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr("core.db.session_factory._session_maker", sqlite_session_maker)
+    statements: list[str] = []
+
+    def record_statement(_connection, _cursor, statement, _parameters, _context, _executemany) -> None:
+        statements.append(statement)
+
+    event.listen(sqlite_engine, "before_cursor_execute", record_statement)
+    with sqlite_session_maker() as session:
+        try:
+            yield TriggerDatabase(session=session, statements=statements)
+        finally:
+            event.remove(sqlite_engine, "before_cursor_execute", record_statement)
+
+
+def _persist_trigger_log(database: TriggerDatabase, *, trigger_log_id: str = "log-1") -> WorkflowTriggerLog:
+    trigger_log = WorkflowTriggerLog(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        workflow_run_id=None,
+        root_node_id=None,
+        trigger_metadata="{}",
+        trigger_type=AppTriggerType.TRIGGER_WEBHOOK,
+        trigger_data="{}",
+        inputs="{}",
+        outputs=None,
+        status=WorkflowTriggerStatus.RUNNING,
+        error=None,
+        queue_name="workflow",
+        celery_task_id=None,
+        created_by_role=CreatorUserRole.ACCOUNT,
+        created_by="account-1",
+    )
+    trigger_log.id = trigger_log_id
+    database.session.add(trigger_log)
+    database.session.commit()
+    return trigger_log
 
 
 class TestTriggerPostLayer:
-    def test_on_event_updates_trigger_log(self):
-        trigger_log = SimpleNamespace(
-            status=None,
-            workflow_run_id=None,
-            outputs=None,
-            elapsed_time=None,
-            total_tokens=None,
-            finished_at=None,
-        )
+    def test_on_event_updates_trigger_log(self, trigger_database: TriggerDatabase):
+        trigger_log = _persist_trigger_log(trigger_database)
         runtime_state = SimpleNamespace(
             outputs={"answer": "ok"},
             variable_pool=VariablePool.from_bootstrap(
@@ -35,19 +83,10 @@ class TestTriggerPostLayer:
         )
 
         with (
-            patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
-            patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
             patch("core.app.layers.trigger_post_layer.datetime") as mock_datetime,
         ):
             mock_datetime.now.return_value = datetime(2026, 2, 20, tzinfo=UTC)
 
-            session = Mock()
-            mock_session_factory.create_session.return_value.__enter__.return_value = session
-
-            repo = Mock()
-            repo.get_by_id.return_value = trigger_log
-            mock_repo_cls.return_value = repo
-
             layer = TriggerPostLayer(
                 cfs_plan_scheduler_entity=Mock(),
                 start_time=datetime(2026, 2, 20, tzinfo=UTC) - timedelta(seconds=10),
@@ -57,25 +96,18 @@ class TestTriggerPostLayer:
 
             layer.on_event(GraphRunSucceededEvent())
 
-        assert trigger_log.status == WorkflowTriggerStatus.SUCCEEDED
-        assert trigger_log.workflow_run_id == "run-1"
-        assert trigger_log.outputs is not None
-        assert trigger_log.elapsed_time is not None
-        assert trigger_log.total_tokens == 12
-        assert trigger_log.finished_at is not None
-        repo.update.assert_called_once_with(trigger_log)
-        session.commit.assert_called_once()
+        trigger_database.session.expire_all()
+        persisted_log = trigger_database.session.get(WorkflowTriggerLog, trigger_log.id)
+        assert persisted_log is not None
+        assert persisted_log.status == WorkflowTriggerStatus.SUCCEEDED
+        assert persisted_log.workflow_run_id == "run-1"
+        assert persisted_log.outputs == '{"answer":"ok"}'
+        assert persisted_log.elapsed_time == 10
+        assert persisted_log.total_tokens == 12
+        assert persisted_log.finished_at is not None
 
-    def test_on_event_updates_trigger_log_for_aborted_event(self):
-        trigger_log = SimpleNamespace(
-            status=None,
-            workflow_run_id=None,
-            outputs=None,
-            error=None,
-            elapsed_time=None,
-            total_tokens=None,
-            finished_at=None,
-        )
+    def test_on_event_updates_trigger_log_for_aborted_event(self, trigger_database: TriggerDatabase):
+        trigger_log = _persist_trigger_log(trigger_database)
         runtime_state = SimpleNamespace(
             outputs={"partial": "ok"},
             variable_pool=VariablePool.from_bootstrap(
@@ -85,19 +117,10 @@ class TestTriggerPostLayer:
         )
 
         with (
-            patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
-            patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
             patch("core.app.layers.trigger_post_layer.datetime") as mock_datetime,
         ):
             mock_datetime.now.return_value = datetime(2026, 2, 20, tzinfo=UTC)
 
-            session = Mock()
-            mock_session_factory.create_session.return_value.__enter__.return_value = session
-
-            repo = Mock()
-            repo.get_by_id.return_value = trigger_log
-            mock_repo_cls.return_value = repo
-
             layer = TriggerPostLayer(
                 cfs_plan_scheduler_entity=Mock(),
                 start_time=datetime(2026, 2, 20, tzinfo=UTC) - timedelta(seconds=10),
@@ -107,17 +130,22 @@ class TestTriggerPostLayer:
 
             layer.on_event(GraphRunAbortedEvent(reason="timeout"))
 
-        assert trigger_log.status == WorkflowTriggerStatus.FAILED
-        assert trigger_log.workflow_run_id == "run-1"
-        assert trigger_log.outputs is not None
-        assert trigger_log.error == "timeout"
-        assert trigger_log.elapsed_time is not None
-        assert trigger_log.total_tokens == 7
-        assert trigger_log.finished_at is not None
-        repo.update.assert_called_once_with(trigger_log)
-        session.commit.assert_called_once()
+        trigger_database.session.expire_all()
+        persisted_log = trigger_database.session.get(WorkflowTriggerLog, trigger_log.id)
+        assert persisted_log is not None
+        assert persisted_log.status == WorkflowTriggerStatus.FAILED
+        assert persisted_log.workflow_run_id == "run-1"
+        assert persisted_log.outputs == '{"partial":"ok"}'
+        assert persisted_log.error == "timeout"
+        assert persisted_log.elapsed_time == 10
+        assert persisted_log.total_tokens == 7
+        assert persisted_log.finished_at is not None
 
-    def test_on_event_handles_missing_trigger_log(self, caplog: pytest.LogCaptureFixture):
+    def test_on_event_handles_missing_trigger_log(
+        self,
+        caplog: pytest.LogCaptureFixture,
+        trigger_database: TriggerDatabase,
+    ):
         runtime_state = SimpleNamespace(
             outputs={},
             variable_pool=VariablePool.from_bootstrap(
@@ -126,31 +154,20 @@ class TestTriggerPostLayer:
             total_tokens=0,
         )
 
-        with (
-            patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
-            patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
-        ):
-            session = Mock()
-            mock_session_factory.create_session.return_value.__enter__.return_value = session
+        layer = TriggerPostLayer(
+            cfs_plan_scheduler_entity=Mock(),
+            start_time=datetime(2026, 2, 20, tzinfo=UTC),
+            trigger_log_id="missing",
+        )
+        layer.initialize(runtime_state, Mock())
 
-            repo = Mock()
-            repo.get_by_id.return_value = None
-            mock_repo_cls.return_value = repo
-
-            layer = TriggerPostLayer(
-                cfs_plan_scheduler_entity=Mock(),
-                start_time=datetime(2026, 2, 20, tzinfo=UTC),
-                trigger_log_id="missing",
-            )
-            layer.initialize(runtime_state, Mock())
-
-            with caplog.at_level(logging.ERROR, logger="core.app.layers.trigger_post_layer"):
-                layer.on_event(GraphRunFailedEvent(error="boom"))
+        with caplog.at_level(logging.ERROR, logger="core.app.layers.trigger_post_layer"):
+            layer.on_event(GraphRunFailedEvent(error="boom"))
 
         assert any(record.levelno == logging.ERROR for record in caplog.records)
-        session.commit.assert_not_called()
+        assert trigger_database.session.get(WorkflowTriggerLog, "missing") is None
 
-    def test_on_event_ignores_non_status_events(self):
+    def test_on_event_ignores_non_status_events(self, trigger_database: TriggerDatabase):
         runtime_state = SimpleNamespace(
             outputs={},
             variable_pool=VariablePool.from_bootstrap(
@@ -159,14 +176,14 @@ class TestTriggerPostLayer:
             total_tokens=0,
         )
 
-        with patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory:
-            layer = TriggerPostLayer(
-                cfs_plan_scheduler_entity=Mock(),
-                start_time=datetime(2026, 2, 20, tzinfo=UTC),
-                trigger_log_id="log-1",
-            )
-            layer.initialize(runtime_state, Mock())
+        layer = TriggerPostLayer(
+            cfs_plan_scheduler_entity=Mock(),
+            start_time=datetime(2026, 2, 20, tzinfo=UTC),
+            trigger_log_id="log-1",
+        )
+        layer.initialize(runtime_state, Mock())
 
-            layer.on_event(Mock())
+        trigger_database.statements.clear()
+        layer.on_event(Mock())
 
-        mock_session_factory.create_session.assert_not_called()
+        assert trigger_database.statements == []

api/tests/unit_tests/core/datasource/test_datasource_manager.py

@@ -1,10 +1,13 @@
 import types
-from collections.abc import Generator
+from collections.abc import Generator, Iterator
 
 import pytest
 from pytest_mock import MockerFixture
+from sqlalchemy.engine import Engine
+from sqlalchemy.orm import Session, sessionmaker
 
 from contexts.wrapper import RecyclableContextVar
+from core.datasource import datasource_manager as datasource_manager_module
 from core.datasource.datasource_manager import DatasourceManager
 from core.datasource.entities.datasource_entities import DatasourceMessage, DatasourceProviderType
 from core.datasource.errors import DatasourceProviderNotFoundError
@@ -12,6 +15,34 @@ from core.workflow.file_reference import parse_file_reference
 from graphon.enums import WorkflowNodeExecutionStatus
 from graphon.file import File, FileTransferMethod, FileType
 from graphon.node_events import StreamChunkEvent, StreamCompletedEvent
+from models.base import TypeBase
+from models.tools import ToolFile
+
+
+@pytest.fixture
+def tool_file_session(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[Session]:
+    """Bind datasource-owned lookups to a SQLite ToolFile table."""
+    TypeBase.metadata.create_all(sqlite_engine, tables=[TypeBase.metadata.tables[ToolFile.__tablename__]])
+    session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr(datasource_manager_module.session_factory, "create_session", session_maker)
+    with session_maker() as session:
+        yield session
+
+
+def _persist_tool_file(session: Session, *, file_id: str, tenant_id: str) -> ToolFile:
+    tool_file = ToolFile(
+        user_id="user-1",
+        tenant_id=tenant_id,
+        conversation_id=None,
+        file_key="files/image.png",
+        mimetype="image/png",
+        name="image.png",
+        size=10,
+    )
+    tool_file.id = file_id
+    session.add(tool_file)
+    session.commit()
+    return tool_file
 
 
 def _gen_messages_text_only(text: str) -> Generator[DatasourceMessage, None, None]:
@@ -373,7 +404,8 @@ def test_stream_node_events_emits_events_online_document(mocker: MockerFixture):
     assert events[-1].node_run_result.status == WorkflowNodeExecutionStatus.SUCCEEDED
 
 
-def test_stream_node_events_builds_file_and_variables_from_messages(mocker: MockerFixture):
+def test_stream_node_events_builds_file_and_variables_from_messages(mocker: MockerFixture, tool_file_session: Session):
+    _persist_tool_file(tool_file_session, file_id="tool_file_1", tenant_id="t1")
     mocker.patch.object(DatasourceManager, "stream_online_results", return_value=_gen_messages_text_only("ignored"))
 
     def _transformed(**_kwargs):
@@ -418,19 +450,6 @@ def test_stream_node_events_builds_file_and_variables_from_messages(mocker: Mock
         side_effect=_transformed,
     )
 
-    fake_tool_file = types.SimpleNamespace(mimetype="image/png")
-
-    class _Session:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *exc):
-            return False
-
-        def scalar(self, _stmt):
-            return fake_tool_file
-
-    mocker.patch("core.datasource.datasource_manager.session_factory.create_session", return_value=_Session())
     mocker.patch("core.datasource.datasource_manager.get_file_type_by_mime_type", return_value=FileType.IMAGE)
     built = File(
         file_type=FileType.IMAGE,
@@ -481,7 +500,8 @@ def test_stream_node_events_builds_file_and_variables_from_messages(mocker: Mock
     assert events[-1].node_run_result.outputs["x"] == 1
 
 
-def test_stream_node_events_raises_when_toolfile_missing(mocker: MockerFixture):
+def test_stream_node_events_raises_when_toolfile_missing(mocker: MockerFixture, tool_file_session: Session):
+    _persist_tool_file(tool_file_session, file_id="missing", tenant_id="other-tenant")
     mocker.patch.object(DatasourceManager, "stream_online_results", return_value=_gen_messages_text_only("ignored"))
 
     def _transformed(**_kwargs):
@@ -496,18 +516,6 @@ def test_stream_node_events_raises_when_toolfile_missing(mocker: MockerFixture):
         side_effect=_transformed,
     )
 
-    class _Session:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *exc):
-            return False
-
-        def scalar(self, _stmt):
-            return None
-
-    mocker.patch("core.datasource.datasource_manager.session_factory.create_session", return_value=_Session())
-
     with pytest.raises(ValueError, match="ToolFile not found for file_id=missing, tenant_id=t1"):
         list(
             DatasourceManager.stream_node_events(

api/tests/unit_tests/core/datasource/test_notion_provider.py

@@ -14,18 +14,64 @@ Tests follow the Arrange-Act-Assert pattern for clarity.
 """
 
 import json
+from collections.abc import Iterator
+from dataclasses import dataclass
 from typing import Any
 from unittest.mock import Mock, patch
+from uuid import uuid4
 
 import httpx
 import pytest
+from sqlalchemy.engine import Engine
+from sqlalchemy.orm import Session
 
 from core.datasource.entities.datasource_entities import DatasourceProviderType
 from core.datasource.online_document.online_document_provider import (
     OnlineDocumentDatasourcePluginProviderController,
 )
+from core.rag.extractor import notion_extractor as notion_extractor_module
 from core.rag.extractor.notion_extractor import NotionExtractor
 from core.rag.models.document import Document
+from models.base import TypeBase
+from models.dataset import Document as DocumentModel
+from models.enums import DataSourceType, DocumentCreatedFrom
+
+
+@dataclass(frozen=True)
+class _Database:
+    """Expose the real SQLite session used by the extractor update."""
+
+    session: Session
+
+
+@pytest.fixture
+def database(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[_Database]:
+    """Bind a real session for Notion document metadata persistence."""
+
+    TypeBase.metadata.create_all(sqlite_engine, tables=[DocumentModel.__table__])
+    with Session(sqlite_engine, expire_on_commit=False) as session:
+        database = _Database(session)
+        monkeypatch.setattr(notion_extractor_module, "db", database)
+        yield database
+
+
+@pytest.fixture
+def persisted_document(database: _Database) -> DocumentModel:
+    document = DocumentModel(
+        id=str(uuid4()),
+        tenant_id=str(uuid4()),
+        dataset_id=str(uuid4()),
+        position=1,
+        data_source_type=DataSourceType.NOTION_IMPORT,
+        data_source_info=json.dumps({"last_edited_time": "2024-01-01T00:00:00.000Z"}),
+        batch="batch",
+        name="Notion page",
+        created_from=DocumentCreatedFrom.WEB,
+        created_by=str(uuid4()),
+    )
+    database.session.add(document)
+    database.session.commit()
+    return document
 
 
 class TestNotionExtractorAuthentication:
@@ -763,9 +809,14 @@ class TestNotionExtractorLastEditedTime:
         call_args = mock_request.call_args
         assert "databases/database-789" in call_args[0][1]
 
-    @patch("core.rag.extractor.notion_extractor.db")
     @patch("httpx.request")
-    def test_update_last_edited_time(self, mock_request, mock_db, extractor_page, mock_document_model):
+    def test_update_last_edited_time(
+        self,
+        mock_request: Mock,
+        extractor_page: NotionExtractor,
+        database: _Database,
+        persisted_document: DocumentModel,
+    ):
         """Test updating document model with last edited time."""
         # Arrange
         mock_response = Mock()
@@ -777,11 +828,11 @@ class TestNotionExtractorLastEditedTime:
         mock_request.return_value = mock_response
 
         # Act
-        extractor_page.update_last_edited_time(mock_document_model)
+        extractor_page.update_last_edited_time(persisted_document)
 
         # Assert
-        assert mock_document_model.data_source_info_dict["last_edited_time"] == "2024-11-27T18:00:00.000Z"
-        mock_db.session.commit.assert_called_once()
+        database.session.expire(persisted_document)
+        assert persisted_document.data_source_info_dict["last_edited_time"] == "2024-11-27T18:00:00.000Z"
 
     def test_update_last_edited_time_no_document(self, extractor_page):
         """Test update_last_edited_time with None document model."""
@@ -807,9 +858,10 @@ class TestNotionExtractorIntegration:
         mock_doc.data_source_info_dict = {"last_edited_time": "2024-01-01T00:00:00.000Z"}
         return mock_doc
 
-    @patch("core.rag.extractor.notion_extractor.db")
     @patch("httpx.request")
-    def test_extract_page_complete_workflow(self, mock_request, mock_db, mock_document_model):
+    def test_extract_page_complete_workflow(
+        self, mock_request: Mock, database: _Database, persisted_document: DocumentModel
+    ):
         """Test complete page extraction workflow."""
         # Arrange
         extractor = NotionExtractor(
@@ -818,7 +870,7 @@ class TestNotionExtractorIntegration:
             notion_page_type="page",
             tenant_id="tenant-789",
             notion_access_token="test-token",
-            document_model=mock_document_model,
+            document_model=persisted_document,
         )
 
         # Mock last edited time request
@@ -869,11 +921,18 @@ class TestNotionExtractorIntegration:
         assert isinstance(documents[0], Document)
         assert "# Test Page" in documents[0].page_content
         assert "Test content" in documents[0].page_content
+        database.session.expire(persisted_document)
+        assert persisted_document.data_source_info_dict["last_edited_time"] == "2024-11-27T20:00:00.000Z"
 
-    @patch("core.rag.extractor.notion_extractor.db")
     @patch("httpx.post")
     @patch("httpx.request")
-    def test_extract_database_complete_workflow(self, mock_request, mock_post, mock_db, mock_document_model):
+    def test_extract_database_complete_workflow(
+        self,
+        mock_request: Mock,
+        mock_post: Mock,
+        database: _Database,
+        persisted_document: DocumentModel,
+    ):
         """Test complete database extraction workflow."""
         # Arrange
         extractor = NotionExtractor(
@@ -882,7 +941,7 @@ class TestNotionExtractorIntegration:
             notion_page_type="database",
             tenant_id="tenant-789",
             notion_access_token="test-token",
-            document_model=mock_document_model,
+            document_model=persisted_document,
         )
 
         # Mock last edited time request
@@ -921,6 +980,8 @@ class TestNotionExtractorIntegration:
         assert isinstance(documents[0], Document)
         assert "Name:Item 1" in documents[0].page_content
         assert "Status:Active" in documents[0].page_content
+        database.session.expire(persisted_document)
+        assert persisted_document.data_source_info_dict["last_edited_time"] == "2024-11-27T20:00:00.000Z"
 
     def test_extract_invalid_page_type(self):
         """Test extract with invalid page type."""

api/tests/unit_tests/core/rag/extractor/test_excel_extractor.py

@@ -2,9 +2,21 @@ from types import SimpleNamespace
 
 import pandas as pd
 import pytest
+from sqlalchemy import Engine, select
+from sqlalchemy.orm import Session, sessionmaker
 
 import core.rag.extractor.excel_extractor as excel_module
 from core.rag.extractor.excel_extractor import ExcelExtractor
+from models.base import TypeBase
+from models.model import UploadFile
+
+
+@pytest.fixture
+def database_session_maker(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> sessionmaker[Session]:
+    TypeBase.metadata.create_all(sqlite_engine, tables=[UploadFile.__table__])
+    session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr(excel_module.session_factory, "create_session", session_maker)
+    return session_maker
 
 
 class _FakeCell:
@@ -58,82 +70,22 @@ class _FakeImage:
         return self._raw_data
 
 
-class _FieldExpression:
-    def __eq__(self, other):
-        return ("eq", other)
-
-    def in_(self, values):
-        return ("in", tuple(values))
-
-
-class _SelectStub:
-    def where(self, *args, **kwargs):
-        return self
-
-
-class _FakeUploadFile:
-    tenant_id = _FieldExpression()
-    key = _FieldExpression()
-    _i = 0
-
-    def __init__(self, **kwargs):
-        type(self)._i += 1
-        self.id = f"u{self._i}"
-        self.key = kwargs["key"]
-
-
-class _PersistentSession:
-    def __init__(self, persisted):
-        self._persisted = persisted
-        self.added = []
-        self.commit_count = 0
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, exc_type, exc, tb):
-        return False
-
-    def scalars(self, _stmt):
-        return SimpleNamespace(all=lambda: list(self._persisted.values()))
-
-    def add_all(self, objects) -> None:
-        self.added.extend(objects)
-
-    def commit(self) -> None:
-        self.commit_count += 1
-        for upload_file in self.added:
-            self._persisted[upload_file.key] = upload_file
-        self.added.clear()
-
-
-class _PersistentSessionFactory:
-    def __init__(self):
-        self.persisted = {}
-        self.sessions = []
-
-    def create_session(self):
-        session = _PersistentSession(self.persisted)
-        self.sessions.append(session)
-        return session
-
-
 def _patch_image_persistence(monkeypatch: pytest.MonkeyPatch):
     saves: list[tuple[str, bytes]] = []
-    session_factory = _PersistentSessionFactory()
 
     def save(key: str, data: bytes) -> None:
         saves.append((key, data))
 
-    _FakeUploadFile._i = 0
-    monkeypatch.setattr(excel_module, "storage", SimpleNamespace(save=save))
-    monkeypatch.setattr(excel_module, "session_factory", session_factory)
-    monkeypatch.setattr(excel_module, "select", lambda *args, **kwargs: _SelectStub())
-    monkeypatch.setattr(excel_module, "UploadFile", _FakeUploadFile)
+    monkeypatch.setattr(excel_module.storage, "save", save)
     monkeypatch.setattr(excel_module.dify_config, "FILES_URL", "http://files.local", raising=False)
     monkeypatch.setattr(excel_module.dify_config, "STORAGE_TYPE", "local", raising=False)
 
-    return saves, session_factory
+    return saves
+
+
+def _get_upload_files(session_maker: sessionmaker[Session]) -> list[UploadFile]:
+    with session_maker() as session:
+        return list(session.scalars(select(UploadFile)).all())
 
 
 class TestExcelExtractor:
@@ -160,7 +112,11 @@ class TestExcelExtractor:
         assert docs[1].page_content == '"Name":"";"Link":"123"'
         assert all(doc.metadata["source"] == "/tmp/sample.xlsx" for doc in docs)
 
-    def test_extract_xlsx_turns_embedded_images_into_markdown_links(self, monkeypatch: pytest.MonkeyPatch):
+    def test_extract_xlsx_turns_embedded_images_into_markdown_links(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        database_session_maker: sessionmaker[Session],
+    ):
         image_bytes = b"\x89PNG\r\n\x1a\nexcel-image"
         sheet = _FakeSheet(
             header_rows=[("Question", "Answer", "Image")],
@@ -175,7 +131,7 @@ class TestExcelExtractor:
         )
         workbook = _FakeWorkbook({"Data": sheet})
         monkeypatch.setattr(excel_module, "load_workbook", lambda *args, **kwargs: workbook)
-        saves, session_factory = _patch_image_persistence(monkeypatch)
+        saves = _patch_image_persistence(monkeypatch)
 
         extractor = ExcelExtractor(
             "/tmp/sample.xlsx",
@@ -184,23 +140,30 @@ class TestExcelExtractor:
             source_file_id="source-file-1",
         )
         docs = extractor.extract()
+        upload_files = _get_upload_files(database_session_maker)
 
         assert workbook.closed is True
         assert len(docs) == 2
+        assert len(upload_files) == 1
         assert docs[0].page_content == (
             '"Question":"Q1";"Answer":"A1";'
-            '"Image":"![image](http://files.local/files/u1/file-preview) '
-            '![image](http://files.local/files/u1/file-preview)"'
+            f'"Image":"![image](http://files.local/files/{upload_files[0].id}/file-preview) '
+            f'![image](http://files.local/files/{upload_files[0].id}/file-preview)"'
         )
         assert docs[1].page_content == '"Question":"Q2";"Answer":"A2";"Image":""'
         assert len(saves) == 1
         assert saves[0][0].startswith("image_files/tenant-1/source-file-1/")
         assert saves[0][0].endswith(".png")
         assert saves[0][1] == image_bytes
-        assert len(session_factory.persisted) == 1
-        assert [session.commit_count for session in session_factory.sessions] == [1]
+        assert upload_files[0].tenant_id == "tenant-1"
+        assert upload_files[0].key == saves[0][0]
+        assert upload_files[0].used is True
 
-    def test_extract_xlsx_keeps_rows_with_only_embedded_images(self, monkeypatch: pytest.MonkeyPatch):
+    def test_extract_xlsx_keeps_rows_with_only_embedded_images(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        database_session_maker: sessionmaker[Session],
+    ):
         image_bytes = b"\x89PNG\r\n\x1a\nimage-only-row"
         sheet = _FakeSheet(
             header_rows=[("Question", "Answer", "Image")],
@@ -212,7 +175,7 @@ class TestExcelExtractor:
         )
         workbook = _FakeWorkbook({"Data": sheet})
         monkeypatch.setattr(excel_module, "load_workbook", lambda *args, **kwargs: workbook)
-        saves, session_factory = _patch_image_persistence(monkeypatch)
+        saves = _patch_image_persistence(monkeypatch)
 
         extractor = ExcelExtractor(
             "/tmp/sample.xlsx",
@@ -221,17 +184,21 @@ class TestExcelExtractor:
             source_file_id="source-file-1",
         )
         docs = extractor.extract()
+        upload_files = _get_upload_files(database_session_maker)
 
         assert workbook.closed is True
         assert len(docs) == 1
+        assert len(upload_files) == 1
         assert docs[0].page_content == (
-            '"Question":"";"Answer":"";"Image":"![image](http://files.local/files/u1/file-preview)"'
+            f'"Question":"";"Answer":"";"Image":"![image](http://files.local/files/{upload_files[0].id}/file-preview)"'
         )
         assert len(saves) == 1
-        assert len(session_factory.persisted) == 1
-        assert [session.commit_count for session in session_factory.sessions] == [1]
 
-    def test_extract_xlsx_reuses_existing_embedded_image_uploads_on_retry(self, monkeypatch: pytest.MonkeyPatch):
+    def test_extract_xlsx_reuses_existing_embedded_image_uploads_on_retry(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        database_session_maker: sessionmaker[Session],
+    ):
         image_bytes = b"\x89PNG\r\n\x1a\nretry-safe-image"
         workbooks = [
             _FakeWorkbook(
@@ -254,7 +221,7 @@ class TestExcelExtractor:
             ),
         ]
         monkeypatch.setattr(excel_module, "load_workbook", lambda *args, **kwargs: workbooks.pop(0))
-        saves, session_factory = _patch_image_persistence(monkeypatch)
+        saves = _patch_image_persistence(monkeypatch)
 
         extractor = ExcelExtractor(
             "/tmp/sample.xlsx",
@@ -264,16 +231,17 @@ class TestExcelExtractor:
         )
         first_docs = extractor.extract()
         second_docs = extractor.extract()
+        upload_files = _get_upload_files(database_session_maker)
+        assert len(upload_files) == 1
 
         expected_page_content = (
-            '"Question":"Q1";"Answer":"A1";"Image":"![image](http://files.local/files/u1/file-preview)"'
+            '"Question":"Q1";"Answer":"A1";'
+            f'"Image":"![image](http://files.local/files/{upload_files[0].id}/file-preview)"'
         )
 
         assert first_docs[0].page_content == expected_page_content
         assert second_docs[0].page_content == expected_page_content
         assert len(saves) == 1
-        assert len(session_factory.persisted) == 1
-        assert [session.commit_count for session in session_factory.sessions] == [1, 0]
 
     def test_extract_xls_path(self, monkeypatch: pytest.MonkeyPatch):
         class FakeExcelFile:

api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py

@@ -5,6 +5,7 @@ from typing import cast
 
 import pytest
 from agenton.compositor import CompositorSessionSnapshot
+from dify_agent.layers.config import DifyConfigSkillConfig
 from dify_agent.layers.dify_core_tools import DifyCoreToolConfig, DifyCoreToolsLayerConfig
 from dify_agent.layers.dify_plugin import DifyPluginToolConfig, DifyPluginToolsLayerConfig
 from dify_agent.protocol import DIFY_AGENT_HISTORY_LAYER_ID, DIFY_AGENT_MODEL_LAYER_ID
@@ -40,6 +41,14 @@ from models.agent_config_entities import (
 )
 
 
+@pytest.fixture(autouse=True)
+def _no_runtime_agent_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [],
+    )
+
+
 class FakeCredentialsProvider:
     def fetch(self, provider_name: str, model_name: str) -> dict[str, object]:
         assert provider_name == "openai"
@@ -1420,6 +1429,30 @@ def test_build_config_layer_config_includes_soul_context_and_mentions():
     assert warnings == []
 
 
+def test_build_config_layer_config_includes_runtime_agent_skills():
+    from core.workflow.nodes.agent_v2.runtime_request_builder import build_config_layer_config
+
+    soul = AgentSoulConfig(
+        prompt={"system_prompt": "Use [§skill:workspace-skill:Workspace Skill§]."},
+        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
+    )
+    config, warnings = build_config_layer_config(
+        soul,
+        runtime_config_skills=[
+            DifyConfigSkillConfig(
+                name="workspace-skill",
+                description="Bound workspace skill.",
+                size=123,
+                mime_type="application/zip",
+            )
+        ],
+    )
+
+    assert [skill.name for skill in config.skills] == ["workspace-skill"]
+    assert config.mentioned_skill_names == ["workspace-skill"]
+    assert warnings == []
+
+
 def test_build_config_layer_config_returns_empty_config_for_empty_agent_soul():
     from core.workflow.nodes.agent_v2.runtime_request_builder import build_config_layer_config
 
@@ -1505,6 +1538,33 @@ def test_workflow_run_request_contains_config_layer():
     assert any(spec.name == DIFY_CONFIG_LAYER_ID and spec.type == "dify.config" for spec in specs)
 
 
+def test_workflow_run_request_includes_bound_workspace_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [
+            DifyConfigSkillConfig(
+                name="workspace-skill",
+                description="Bound workspace skill.",
+                size=123,
+                mime_type="application/zip",
+            )
+        ],
+    )
+    context = _context()
+    context.snapshot.config_snapshot = AgentSoulConfig(
+        prompt={"system_prompt": "Use [§skill:workspace-skill:Workspace Skill§]."},
+        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
+    )
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    config = next(layer for layer in result.request.composition.layers if layer.name == DIFY_CONFIG_LAYER_ID)
+    assert [skill.name for skill in config.config.skills] == ["workspace-skill"]
+    assert config.config.mentioned_skill_names == ["workspace-skill"]
+    soul_prompt = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+    assert soul_prompt.config.prefix == "Use workspace-skill."
+
+
 def test_workflow_runtime_expands_config_mentions_in_agent_soul_prompt():
     context = _context()
     context.snapshot.config_snapshot = _soul_with_config_assets()

api/tests/unit_tests/libs/test_helper.py

@@ -2,7 +2,7 @@ from datetime import datetime
 
 import pytest
 
-from libs.helper import OptionalTimestampField, email, escape_like_pattern, extract_tenant_id
+from libs.helper import OptionalTimestampField, alphanumeric, email, escape_like_pattern, extract_tenant_id
 from models.account import Account
 from models.model import EndUser
 
@@ -153,3 +153,47 @@ class TestEmailValidator:
     def test_invalid_email_rejected(self):
         with pytest.raises(ValueError, match="not a valid email"):
             email("not-an-email")
+
+
+class TestAlphanumericValidator:
+    """Tests for the alphanumeric() validator — regression for #39666."""
+
+    def test_valid_alphanumeric_accepted(self):
+        assert alphanumeric("tool_name") == "tool_name"
+        assert alphanumeric("Tool123") == "Tool123"
+        assert alphanumeric("_underscore_start") == "_underscore_start"
+        assert alphanumeric("a") == "a"
+
+    def test_trailing_newline_rejected(self):
+        # re.match with $ accepts a trailing \n in Python; re.fullmatch does not.
+        # This was the pre-fix behaviour: alphanumeric("tool\n") returned "tool\n".
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool_name\n")
+
+    def test_trailing_carriage_return_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool_name\r")
+
+    def test_trailing_crlf_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool_name\r\n")
+
+    def test_leading_newline_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("\ntool_name")
+
+    def test_embedded_whitespace_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool name")
+
+    def test_empty_string_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("")
+
+    def test_special_characters_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool-name")
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool.name")
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool/name")

api/tests/unit_tests/services/agent/test_skill_package_service.py

@@ -13,7 +13,7 @@ from services.agent import skill_package_service as skill_package_service_module
 from services.agent.skill_package_service import NormalizedSkillPackage, SkillPackageError, SkillPackageService
 
 _SKILL_MD = """---
-name: PDF Toolkit
+name: pdf-toolkit
 description: Tools for working with PDF files.
 ---
 
@@ -43,7 +43,7 @@ def _archive_members(content: bytes) -> list[str]:
 def test_valid_skill_normalizes_manifest():
     manifest = _normalize({"SKILL.md": _SKILL_MD.encode(), "scripts/run.py": b"print('hi')\n"}).manifest
 
-    assert manifest.name == "PDF Toolkit"
+    assert manifest.name == "pdf-toolkit"
     assert manifest.description == "Tools for working with PDF files."
     assert manifest.entry_path == "SKILL.md"
     assert set(manifest.files) == {"SKILL.md", "scripts/run.py"}
@@ -51,10 +51,10 @@ def test_valid_skill_normalizes_manifest():
     assert len(manifest.hash) == 64
 
 
-def test_name_falls_back_to_heading_without_frontmatter():
-    manifest = _normalize({"SKILL.md": b"# Heading Name\n\nbody"}).manifest
-    assert manifest.name == "Heading Name"
-    assert manifest.description == ""
+def test_name_and_description_are_required_in_frontmatter():
+    with pytest.raises(SkillPackageError) as exc_info:
+        _normalize({"SKILL.md": b"# heading-name\n\nbody"})
+    assert exc_info.value.code == "missing_skill_name"
 
 
 def test_shallowest_skill_md_preferred_during_normalization():
@@ -155,7 +155,18 @@ def test_validate_and_normalize_strips_deeper_selected_skill_root():
         ({"README.md": b"x"}, "skill.zip", "missing_skill_md"),
         ({"SKILL.md": _SKILL_MD.encode()}, "skill.tar", "unsupported_extension"),
         ({"SKILL.md": b""}, "skill.zip", "empty_skill_md"),
-        ({"SKILL.md": b"no name here"}, "skill.zip", "missing_skill_name"),
+        ({"SKILL.md": b"---\ndescription: valid\n---\n# no name here"}, "skill.zip", "missing_skill_name"),
+        ({"SKILL.md": b"---\nname: pdf-toolkit\n---\n# no description"}, "skill.zip", "missing_skill_description"),
+        (
+            {"SKILL.md": b"---\nname: PDF Toolkit\ndescription: valid\n---\n# invalid name"},
+            "skill.zip",
+            "invalid_skill_name",
+        ),
+        (
+            {"SKILL.md": f"---\nname: pdf-toolkit\ndescription: {'x' * 1025}\n---\n# long".encode()},
+            "skill.zip",
+            "invalid_skill_description",
+        ),
         ({"SKILL.md": b"\xff\xfenot utf8"}, "skill.zip", "skill_md_not_utf8"),
     ],
 )
@@ -224,10 +235,10 @@ def test_bad_frontmatter_yaml_rejected():
     assert exc_info.value.code == "invalid_frontmatter"
 
 
-def test_unterminated_frontmatter_falls_back_to_heading():
-    # leading '---' with no closing fence -> no frontmatter, use the heading
-    manifest = _normalize({"SKILL.md": b"---\n# Heading Wins\nbody"}).manifest
-    assert manifest.name == "Heading Wins"
+def test_unterminated_frontmatter_rejected():
+    with pytest.raises(SkillPackageError) as exc_info:
+        _normalize({"SKILL.md": b"---\n# heading-wins\nbody"})
+    assert exc_info.value.code == "missing_skill_name"
 
 
 def test_validate_and_normalize_rejects_files_outside_selected_skill_root():

api/tests/unit_tests/services/agent/test_skill_standardize_service.py

@@ -20,7 +20,7 @@ _AGENT_ID = "22222222-2222-2222-2222-222222222222"
 _USER_ID = "33333333-3333-3333-3333-333333333333"
 
 _SKILL_MD = b"""---
-name: PDF Toolkit
+name: pdf-toolkit
 description: Work with PDFs.
 ---
 
@@ -121,7 +121,7 @@ def test_standardize_creates_drive_owned_toolfiles_and_commits_archive_manifest(
     assert skill_row.is_skill is True
     assert skill_row.skill_metadata is not None
     skill_metadata = DriveSkillMetadata.model_validate_json(skill_row.skill_metadata)
-    assert skill_metadata.name == "PDF Toolkit"
+    assert skill_metadata.name == "pdf-toolkit"
     assert skill_metadata.manifest_files == ["SKILL.md", "scripts/run.py"]
     assert archive_row.file_kind == AgentDriveFileKind.TOOL_FILE
     assert archive_row.file_id == archive_tool_file.id
@@ -132,7 +132,7 @@ def test_standardize_creates_drive_owned_toolfiles_and_commits_archive_manifest(
     # The returned upload response carries only the drive-derived fields the UI needs.
     skill = result["skill"]
     assert skill["path"] == "pdf-toolkit"
-    assert skill["name"] == "PDF Toolkit"
+    assert skill["name"] == "pdf-toolkit"
     assert skill["archive_key"] == "pdf-toolkit/.DIFY-SKILL-FULL.zip"
     assert skill["skill_md_key"] == "pdf-toolkit/SKILL.md"
     assert result["manifest"]["entry_path"] == "SKILL.md"

api/tests/unit_tests/services/plugin/test_plugin_auto_upgrade_service.py

@@ -1,89 +1,105 @@
 import logging
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
+from uuid import uuid4
 
 import pytest
+from sqlalchemy import select
+from sqlalchemy.orm import Session
 
 from models.account import (
     TenantPluginAutoUpgradeCategory,
     TenantPluginAutoUpgradeMode,
+    TenantPluginAutoUpgradeStrategy,
     TenantPluginAutoUpgradeStrategySetting,
 )
+from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
 
 MODULE = "services.plugin.plugin_auto_upgrade_service"
 PLUGIN_CATEGORY = TenantPluginAutoUpgradeCategory.TOOL
+STRATEGY_MODELS = (TenantPluginAutoUpgradeStrategy,)
 
 
-def _patched_session():
-    """Return a mock SQLAlchemy session for service calls."""
-    session = MagicMock()
-    return session
+def _strategy(
+    tenant_id: str,
+    *,
+    category: TenantPluginAutoUpgradeCategory = PLUGIN_CATEGORY,
+    setting: TenantPluginAutoUpgradeStrategySetting = TenantPluginAutoUpgradeStrategySetting.FIX_ONLY,
+    mode: TenantPluginAutoUpgradeMode = TenantPluginAutoUpgradeMode.EXCLUDE,
+    exclude: list[str] | None = None,
+    include: list[str] | None = None,
+    upgrade_time: int = 0,
+) -> TenantPluginAutoUpgradeStrategy:
+    return TenantPluginAutoUpgradeStrategy(
+        tenant_id=tenant_id,
+        category=category,
+        strategy_setting=setting,
+        upgrade_time_of_day=upgrade_time,
+        upgrade_mode=mode,
+        exclude_plugins=exclude or [],
+        include_plugins=include or [],
+    )
 
 
 class TestGetStrategy:
-    def test_returns_strategy_when_found(self):
-        session = _patched_session()
-        strategy = MagicMock()
-        session.scalar.return_value = strategy
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_returns_strategy_when_found(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        strategy = _strategy(tenant_id)
+        sqlite_session.add(strategy)
+        sqlite_session.commit()
 
-        from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-        result = PluginAutoUpgradeService.get_strategy("t1", PLUGIN_CATEGORY, session=session)
+        result = PluginAutoUpgradeService.get_strategy(tenant_id, PLUGIN_CATEGORY, session=sqlite_session)
 
         assert result is strategy
 
-    def test_returns_none_when_not_found(self):
-        session = _patched_session()
-        session.scalar.return_value = None
-
-        from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-        result = PluginAutoUpgradeService.get_strategy("t1", PLUGIN_CATEGORY, session=session)
-
-        assert result is None
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_returns_none_when_not_found(self, sqlite_session: Session) -> None:
+        assert PluginAutoUpgradeService.get_strategy(str(uuid4()), PLUGIN_CATEGORY, session=sqlite_session) is None
 
 
 class TestChangeStrategy:
-    def test_creates_new_strategy(self):
-        session = _patched_session()
-        session.scalar.return_value = None
-
-        with patch(f"{MODULE}.select"), patch(f"{MODULE}.TenantPluginAutoUpgradeStrategy") as strat_cls:
-            strat_cls.return_value = MagicMock()
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-            result = PluginAutoUpgradeService.change_strategy(
-                "t1",
-                TenantPluginAutoUpgradeStrategySetting.FIX_ONLY,
-                3,
-                TenantPluginAutoUpgradeMode.ALL,
-                [],
-                [],
-                category=PLUGIN_CATEGORY,
-                session=session,
-            )
-
-        assert result is True
-        session.add.assert_called_once()
-
-    def test_updates_existing_strategy(self):
-        session = _patched_session()
-        existing = MagicMock()
-        session.scalar.return_value = existing
-
-        from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_creates_new_strategy(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
 
         result = PluginAutoUpgradeService.change_strategy(
-            "t1",
+            tenant_id,
+            TenantPluginAutoUpgradeStrategySetting.FIX_ONLY,
+            3,
+            TenantPluginAutoUpgradeMode.ALL,
+            [],
+            [],
+            category=PLUGIN_CATEGORY,
+            session=sqlite_session,
+        )
+
+        strategy = sqlite_session.scalar(select(TenantPluginAutoUpgradeStrategy))
+        assert result is True
+        assert strategy is not None
+        assert strategy.tenant_id == tenant_id
+        assert strategy.upgrade_time_of_day == 3
+        assert strategy.upgrade_mode == TenantPluginAutoUpgradeMode.ALL
+
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_updates_existing_strategy(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        existing = _strategy(tenant_id)
+        sqlite_session.add(existing)
+        sqlite_session.commit()
+
+        result = PluginAutoUpgradeService.change_strategy(
+            tenant_id,
             TenantPluginAutoUpgradeStrategySetting.LATEST,
             5,
             TenantPluginAutoUpgradeMode.PARTIAL,
             ["p1"],
             ["p2"],
             category=PLUGIN_CATEGORY,
-            session=session,
+            session=sqlite_session,
         )
 
+        sqlite_session.refresh(existing)
         assert result is True
         assert existing.strategy_setting == TenantPluginAutoUpgradeStrategySetting.LATEST
         assert existing.upgrade_time_of_day == 5
@@ -93,157 +109,115 @@ class TestChangeStrategy:
 
 
 class TestExcludePlugin:
-    def test_creates_default_strategy_when_none_exists(self):
-        session = _patched_session()
-        session.scalar.return_value = None
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_creates_default_strategy_when_none_exists(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
 
-        with (
-            patch(f"{MODULE}.select"),
-            patch(f"{MODULE}.TenantPluginAutoUpgradeStrategy"),
-        ):
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-            result = PluginAutoUpgradeService.exclude_plugin(
-                "t1",
-                "plugin-1",
-                PLUGIN_CATEGORY,
-                session=session,
-            )
+        result = PluginAutoUpgradeService.exclude_plugin(tenant_id, "plugin-1", PLUGIN_CATEGORY, session=sqlite_session)
 
+        strategy = sqlite_session.scalar(select(TenantPluginAutoUpgradeStrategy))
         assert result is True
-        session.add.assert_called_once()
+        assert strategy is not None
+        assert strategy.exclude_plugins == ["plugin-1"]
 
-    def test_appends_to_exclude_list_in_exclude_mode(self):
-        session = _patched_session()
-        existing = MagicMock()
-        existing.upgrade_mode = TenantPluginAutoUpgradeMode.EXCLUDE
-        existing.exclude_plugins = ["p-existing"]
-        session.scalar.return_value = existing
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_appends_to_exclude_list_in_exclude_mode(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        existing = _strategy(tenant_id, exclude=["p-existing"])
+        sqlite_session.add(existing)
+        sqlite_session.commit()
 
-        with patch(f"{MODULE}.select"), patch(f"{MODULE}.TenantPluginAutoUpgradeStrategy") as strat_cls:
-            strat_cls.UpgradeMode.EXCLUDE = "exclude"
-            strat_cls.UpgradeMode.PARTIAL = "partial"
-            strat_cls.UpgradeMode.ALL = "all"
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
+        PluginAutoUpgradeService.exclude_plugin(tenant_id, "p-new", PLUGIN_CATEGORY, session=sqlite_session)
 
-            result = PluginAutoUpgradeService.exclude_plugin("t1", "p-new", PLUGIN_CATEGORY, session=session)
-
-        assert result is True
+        sqlite_session.refresh(existing)
         assert existing.exclude_plugins == ["p-existing", "p-new"]
 
-    def test_removes_from_include_list_in_partial_mode(self):
-        session = _patched_session()
-        existing = MagicMock()
-        existing.upgrade_mode = TenantPluginAutoUpgradeMode.PARTIAL
-        existing.include_plugins = ["p1", "p2"]
-        session.scalar.return_value = existing
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_removes_from_include_list_in_partial_mode(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        existing = _strategy(tenant_id, mode=TenantPluginAutoUpgradeMode.PARTIAL, include=["p1", "p2"])
+        sqlite_session.add(existing)
+        sqlite_session.commit()
 
-        with patch(f"{MODULE}.select"), patch(f"{MODULE}.TenantPluginAutoUpgradeStrategy") as strat_cls:
-            strat_cls.UpgradeMode.EXCLUDE = "exclude"
-            strat_cls.UpgradeMode.PARTIAL = "partial"
-            strat_cls.UpgradeMode.ALL = "all"
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
+        PluginAutoUpgradeService.exclude_plugin(tenant_id, "p1", PLUGIN_CATEGORY, session=sqlite_session)
 
-            result = PluginAutoUpgradeService.exclude_plugin("t1", "p1", PLUGIN_CATEGORY, session=session)
-
-        assert result is True
+        sqlite_session.refresh(existing)
         assert existing.include_plugins == ["p2"]
 
-    def test_switches_to_exclude_mode_from_all(self):
-        session = _patched_session()
-        existing = MagicMock()
-        existing.upgrade_mode = TenantPluginAutoUpgradeMode.ALL
-        session.scalar.return_value = existing
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_switches_to_exclude_mode_from_all(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        existing = _strategy(tenant_id, mode=TenantPluginAutoUpgradeMode.ALL)
+        sqlite_session.add(existing)
+        sqlite_session.commit()
 
-        with patch(f"{MODULE}.select"), patch(f"{MODULE}.TenantPluginAutoUpgradeStrategy") as strat_cls:
-            strat_cls.UpgradeMode.EXCLUDE = "exclude"
-            strat_cls.UpgradeMode.PARTIAL = "partial"
-            strat_cls.UpgradeMode.ALL = "all"
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
+        PluginAutoUpgradeService.exclude_plugin(tenant_id, "p1", PLUGIN_CATEGORY, session=sqlite_session)
 
-            result = PluginAutoUpgradeService.exclude_plugin("t1", "p1", PLUGIN_CATEGORY, session=session)
-
-        assert result is True
+        sqlite_session.refresh(existing)
         assert existing.upgrade_mode == TenantPluginAutoUpgradeMode.EXCLUDE
         assert existing.exclude_plugins == ["p1"]
 
-    def test_no_duplicate_in_exclude_list(self):
-        session = _patched_session()
-        existing = MagicMock()
-        existing.upgrade_mode = TenantPluginAutoUpgradeMode.EXCLUDE
-        existing.exclude_plugins = ["p1"]
-        session.scalar.return_value = existing
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_no_duplicate_in_exclude_list(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        existing = _strategy(tenant_id, exclude=["p1"])
+        sqlite_session.add(existing)
+        sqlite_session.commit()
 
-        with patch(f"{MODULE}.select"), patch(f"{MODULE}.TenantPluginAutoUpgradeStrategy") as strat_cls:
-            strat_cls.UpgradeMode.EXCLUDE = "exclude"
-            strat_cls.UpgradeMode.PARTIAL = "partial"
-            strat_cls.UpgradeMode.ALL = "all"
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-            PluginAutoUpgradeService.exclude_plugin("t1", "p1", PLUGIN_CATEGORY, session=session)
+        PluginAutoUpgradeService.exclude_plugin(tenant_id, "p1", PLUGIN_CATEGORY, session=sqlite_session)
 
+        sqlite_session.refresh(existing)
         assert existing.exclude_plugins == ["p1"]
 
 
 class TestBackfillStrategyCategories:
-    def test_creates_default_missing_categories_without_fetching_daemon(self):
-        session = _patched_session()
-        tool_strategy = SimpleNamespace(
-            category=TenantPluginAutoUpgradeCategory.TOOL,
-            strategy_setting=TenantPluginAutoUpgradeStrategySetting.FIX_ONLY,
-            upgrade_time_of_day=0,
-            upgrade_mode=TenantPluginAutoUpgradeMode.EXCLUDE,
-            exclude_plugins=[],
-            include_plugins=[],
-        )
-        session.scalars.return_value.all.return_value = [tool_strategy]
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_creates_default_missing_categories_without_fetching_daemon(self, sqlite_session: Session) -> None:
+        tenant_id = str(uuid4())
+        tool_strategy = _strategy(tenant_id)
+        sqlite_session.add(tool_strategy)
+        sqlite_session.commit()
         installer = MagicMock()
 
         with patch(f"{MODULE}.PluginInstaller", return_value=installer):
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-            result = PluginAutoUpgradeService.backfill_strategy_categories("t1", session=session)
-            expected_time = PluginAutoUpgradeService.default_upgrade_time_of_day("t1")
+            result = PluginAutoUpgradeService.backfill_strategy_categories(tenant_id, session=sqlite_session)
+            expected_time = PluginAutoUpgradeService.default_upgrade_time_of_day(tenant_id)
 
+        strategies = list(sqlite_session.scalars(select(TenantPluginAutoUpgradeStrategy)).all())
         assert result.created_count == len(TenantPluginAutoUpgradeCategory) - 1
         assert result.normalized is False
         installer.list_plugins.assert_not_called()
+        assert len(strategies) == len(TenantPluginAutoUpgradeCategory)
         assert tool_strategy.upgrade_time_of_day == expected_time
-        created_strategies = [call.args[0] for call in session.add.call_args_list]
         model_strategy = next(
-            strategy for strategy in created_strategies if strategy.category == TenantPluginAutoUpgradeCategory.MODEL
+            strategy for strategy in strategies if strategy.category == TenantPluginAutoUpgradeCategory.MODEL
         )
         assert model_strategy.strategy_setting == TenantPluginAutoUpgradeStrategySetting.LATEST
         assert model_strategy.upgrade_time_of_day == expected_time
 
-    def test_default_upgrade_time_is_aligned_to_fifteen_minutes(self):
-        from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-        default_time = PluginAutoUpgradeService.default_upgrade_time_of_day("t1")
-
+    def test_default_upgrade_time_is_aligned_to_fifteen_minutes(self) -> None:
+        default_time = PluginAutoUpgradeService.default_upgrade_time_of_day(str(uuid4()))
         assert default_time % (15 * 60) == 0
         assert 0 <= default_time < 24 * 60 * 60
 
-    def test_creates_missing_categories_and_splits_known_plugins(self, caplog: pytest.LogCaptureFixture):
-        session = _patched_session()
-        tool_strategy = SimpleNamespace(
-            category=TenantPluginAutoUpgradeCategory.TOOL,
-            strategy_setting=TenantPluginAutoUpgradeStrategySetting.FIX_ONLY,
-            upgrade_time_of_day=0,
-            upgrade_mode=TenantPluginAutoUpgradeMode.EXCLUDE,
-            exclude_plugins=["tool-plugin", "model-plugin", "unknown-plugin"],
-            include_plugins=["model-plugin", "tool-plugin"],
+    @pytest.mark.parametrize("sqlite_session", [STRATEGY_MODELS], indirect=True)
+    def test_creates_missing_categories_and_splits_known_plugins(
+        self, sqlite_session: Session, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        tenant_id = str(uuid4())
+        tool_strategy = _strategy(
+            tenant_id,
+            exclude=["tool-plugin", "model-plugin", "unknown-plugin"],
+            include=["model-plugin", "tool-plugin"],
         )
-        model_strategy = SimpleNamespace(
+        model_strategy = _strategy(
+            tenant_id,
             category=TenantPluginAutoUpgradeCategory.MODEL,
-            strategy_setting=TenantPluginAutoUpgradeStrategySetting.FIX_ONLY,
-            upgrade_time_of_day=0,
-            upgrade_mode=TenantPluginAutoUpgradeMode.EXCLUDE,
-            exclude_plugins=["tool-plugin", "model-plugin", "unknown-plugin"],
-            include_plugins=["model-plugin", "tool-plugin"],
+            exclude=["tool-plugin", "model-plugin", "unknown-plugin"],
+            include=["model-plugin", "tool-plugin"],
         )
-        session.scalars.return_value.all.return_value = [tool_strategy, model_strategy]
-
+        sqlite_session.add_all([tool_strategy, model_strategy])
+        sqlite_session.commit()
         installed_plugins = [
             SimpleNamespace(
                 plugin_id="tool-plugin",
@@ -261,18 +235,17 @@ class TestBackfillStrategyCategories:
             patch(f"{MODULE}.PluginInstaller", return_value=installer),
             caplog.at_level(logging.WARNING, logger=MODULE),
         ):
-            from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-
-            result = PluginAutoUpgradeService.backfill_strategy_categories("t1", session=session)
+            result = PluginAutoUpgradeService.backfill_strategy_categories(tenant_id, session=sqlite_session)
 
+        strategies = list(sqlite_session.scalars(select(TenantPluginAutoUpgradeStrategy)).all())
         assert result.created_count == len(TenantPluginAutoUpgradeCategory) - 2
         assert result.normalized is True
-        assert session.add.call_count == len(TenantPluginAutoUpgradeCategory) - 2
+        assert len(strategies) == len(TenantPluginAutoUpgradeCategory)
         assert tool_strategy.exclude_plugins == ["tool-plugin"]
         assert tool_strategy.include_plugins == ["tool-plugin"]
         assert model_strategy.exclude_plugins == ["model-plugin"]
         assert model_strategy.include_plugins == ["model-plugin"]
         assert (
             "Skipped unknown plugin IDs while backfilling plugin auto-upgrade strategies: "
-            "tenant_id=t1, field=exclude_plugins, plugin_ids=['unknown-plugin']" in caplog.messages
+            f"tenant_id={tenant_id}, field=exclude_plugins, plugin_ids=['unknown-plugin']" in caplog.messages
         )

api/tests/unit_tests/services/plugin/test_plugin_service.py

@@ -7,28 +7,19 @@ import pytest
 import zstandard
 from pydantic import TypeAdapter
 from redis import RedisError
+from sqlalchemy.orm import Session
 
+from core.helper.model_provider_cache import ProviderCredentialsCacheType
 from core.plugin.entities.plugin import PluginCategory, PluginInstallationSource
 from core.plugin.entities.plugin_daemon import PluginInstallTask, PluginInstallTaskStatus, PluginModelProviderEntity
 from graphon.model_runtime.entities.common_entities import I18nObject
 from graphon.model_runtime.entities.provider_entities import ConfigurateMethod, ProviderEntity
+from models.provider import Provider, ProviderCredential, ProviderType, TenantPreferredModelProvider
 
 MODULE = "core.plugin.plugin_service"
-
-
-class _FakeSession:
-    def __init__(self) -> None:
-        self.execute = Mock()
-        self.scalars = Mock(return_value=SimpleNamespace(all=Mock(return_value=[])))
-
-    def __enter__(self) -> "_FakeSession":
-        return self
-
-    def __exit__(self, exc_type, exc, traceback) -> None:
-        return None
-
-    def begin(self) -> "_FakeSession":
-        return self
+TENANT_ID = "11111111-1111-1111-1111-111111111111"
+OTHER_TENANT_ID = "22222222-2222-2222-2222-222222222222"
+USER_ID = "33333333-3333-3333-3333-333333333333"
 
 
 def _build_provider_entity(provider: str = "openai") -> ProviderEntity:
@@ -1166,19 +1157,72 @@ class TestPluginModelProviderCacheInvalidation:
         assert result is True
         invalidate_cache.assert_called_once_with("tenant-1")
 
-    def test_uninstall_existing_plugin_invalidates_cache_after_credential_cleanup(self) -> None:
+    @pytest.mark.parametrize(
+        "sqlite_session", [(Provider, ProviderCredential, TenantPreferredModelProvider)], indirect=True
+    )
+    def test_uninstall_existing_plugin_invalidates_cache_after_credential_cleanup(
+        self, sqlite_session: Session
+    ) -> None:
         """Successful uninstall with plugin metadata also invalidates the mutated tenant provider cache."""
+        plugin_id = "langgenius/openai"
+        provider_name = f"{plugin_id}/openai"
         plugin = SimpleNamespace(
             installation_id="installation-1",
-            plugin_id="langgenius/openai",
+            plugin_id=plugin_id,
             plugin_unique_identifier="langgenius/openai:1.0.0",
         )
-        session = _FakeSession()
+        credential = ProviderCredential(
+            tenant_id=TENANT_ID,
+            provider_name=provider_name,
+            credential_name="Target credential",
+            encrypted_config="{}",
+            user_id=USER_ID,
+        )
+        other_credential = ProviderCredential(
+            tenant_id=OTHER_TENANT_ID,
+            provider_name=provider_name,
+            credential_name="Other credential",
+            encrypted_config="{}",
+            user_id=USER_ID,
+        )
+        sqlite_session.add_all([credential, other_credential])
+        sqlite_session.flush()
+        provider = Provider(
+            tenant_id=TENANT_ID,
+            provider_name=provider_name,
+            provider_type=ProviderType.CUSTOM,
+            credential_id=credential.id,
+        )
+        other_provider = Provider(
+            tenant_id=OTHER_TENANT_ID,
+            provider_name=provider_name,
+            provider_type=ProviderType.CUSTOM,
+            credential_id=other_credential.id,
+        )
+        preferred_provider = TenantPreferredModelProvider(
+            tenant_id=TENANT_ID,
+            provider_name=provider_name,
+            preferred_provider_type=ProviderType.CUSTOM,
+        )
+        other_preferred_provider = TenantPreferredModelProvider(
+            tenant_id=OTHER_TENANT_ID,
+            provider_name=provider_name,
+            preferred_provider_type=ProviderType.CUSTOM,
+        )
+        sqlite_session.add_all([provider, other_provider, preferred_provider, other_preferred_provider])
+        sqlite_session.commit()
+        credential_id = credential.id
+        other_credential_id = other_credential.id
+        provider_id = provider.id
+        other_provider_id = other_provider.id
+        preferred_provider_id = preferred_provider.id
+        other_preferred_provider_id = other_preferred_provider.id
+
         with (
-            patch(f"{MODULE}.db", SimpleNamespace(engine=object())),
+            patch(f"{MODULE}.db", SimpleNamespace(engine=sqlite_session.get_bind())),
             patch(f"{MODULE}.dify_config") as mock_config,
             patch(f"{MODULE}.PluginInstaller") as installer_cls,
-            patch(f"{MODULE}.Session", return_value=session),
+            patch(f"{MODULE}.ProviderCredentialsCache") as credentials_cache,
             patch(f"{MODULE}.PluginService.invalidate_plugin_model_providers_cache") as invalidate_cache,
         ):
             mock_config.ENTERPRISE_ENABLED = False
@@ -1188,8 +1232,26 @@ class TestPluginModelProviderCacheInvalidation:
 
             from core.plugin.plugin_service import PluginService
 
-            result = PluginService.uninstall("tenant-1", "installation-1")
+            result = PluginService.uninstall(TENANT_ID, "installation-1")
 
         assert result is True
-        installer.uninstall.assert_called_once_with("tenant-1", "installation-1")
-        invalidate_cache.assert_called_once_with("tenant-1")
+        installer.uninstall.assert_called_once_with(TENANT_ID, "installation-1")
+        invalidate_cache.assert_called_once_with(TENANT_ID)
+        credentials_cache.assert_called_once_with(
+            tenant_id=TENANT_ID,
+            identity_id=provider_id,
+            cache_type=ProviderCredentialsCacheType.PROVIDER,
+        )
+        credentials_cache.return_value.delete.assert_called_once_with()
+
+        sqlite_session.expunge_all()
+        assert sqlite_session.get(ProviderCredential, credential_id) is None
+        persisted_provider = sqlite_session.get(Provider, provider_id)
+        assert persisted_provider is not None
+        assert persisted_provider.credential_id is None
+        assert sqlite_session.get(TenantPreferredModelProvider, preferred_provider_id) is None
+        assert sqlite_session.get(ProviderCredential, other_credential_id) is not None
+        persisted_other_provider = sqlite_session.get(Provider, other_provider_id)
+        assert persisted_other_provider is not None
+        assert persisted_other_provider.credential_id == other_credential_id
+        assert sqlite_session.get(TenantPreferredModelProvider, other_preferred_provider_id) is not None

api/tests/unit_tests/services/plugin/test_plugin_service_installation.py

@@ -8,6 +8,7 @@ verification, marketplace upgrade flows, and uninstall with credential cleanup.
 from __future__ import annotations
 
 from collections.abc import Iterator
+from typing import cast
 from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
@@ -19,7 +20,6 @@ from sqlalchemy.orm import Session
 from core.plugin.entities.plugin import PluginInstallationSource
 from core.plugin.entities.plugin_daemon import PluginVerification
 from core.plugin.plugin_service import PluginService
-from enums.deployment_edition import DeploymentEdition
 from models import ProviderType
 from models.engine import db
 from models.provider import Provider, ProviderCredential, TenantPreferredModelProvider
@@ -27,20 +27,16 @@ from services.errors.plugin import PluginInstallationForbiddenError
 from services.feature_service import (
     PluginInstallationPermissionModel,
     PluginInstallationScope,
-    SystemFeatureModel,
 )
 
 
-def _make_features(
+def _make_permission(
     restrict_to_marketplace: bool = False,
     scope: PluginInstallationScope = PluginInstallationScope.ALL,
-) -> SystemFeatureModel:
-    return SystemFeatureModel(
-        deployment_edition=DeploymentEdition.COMMUNITY,
-        plugin_installation_permission=PluginInstallationPermissionModel(
-            restrict_to_marketplace_only=restrict_to_marketplace,
-            plugin_installation_scope=scope,
-        ),
+) -> PluginInstallationPermissionModel:
+    return PluginInstallationPermissionModel(
+        restrict_to_marketplace_only=restrict_to_marketplace,
+        plugin_installation_scope=scope,
     )
 
 
@@ -119,22 +115,31 @@ class TestFetchLatestPluginVersion:
 class TestCheckMarketplaceOnlyPermission:
     @patch("core.plugin.plugin_service.FeatureService")
     def test_raises_when_restricted(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(restrict_to_marketplace=True)
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(restrict_to_marketplace=True)
 
         with pytest.raises(PluginInstallationForbiddenError):
             PluginService._check_marketplace_only_permission()
 
     @patch("core.plugin.plugin_service.FeatureService")
     def test_passes_when_not_restricted(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(restrict_to_marketplace=False)
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(restrict_to_marketplace=False)
 
         PluginService._check_marketplace_only_permission()  # should not raise
 
+    @patch("core.plugin.plugin_service.FeatureService")
+    def test_raises_when_scope_denies_all(self, mock_fs):
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(scope=PluginInstallationScope.NONE)
+
+        with pytest.raises(PluginInstallationForbiddenError, match="not allowed"):
+            PluginService._check_marketplace_only_permission()
+
 
 class TestCheckPluginInstallationScope:
     @patch("core.plugin.plugin_service.FeatureService")
     def test_official_only_allows_langgenius(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(scope=PluginInstallationScope.OFFICIAL_ONLY)
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(
+            scope=PluginInstallationScope.OFFICIAL_ONLY
+        )
         verification = MagicMock()
         verification.authorized_category = PluginVerification.AuthorizedCategory.Langgenius
 
@@ -142,14 +147,16 @@ class TestCheckPluginInstallationScope:
 
     @patch("core.plugin.plugin_service.FeatureService")
     def test_official_only_rejects_third_party(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(scope=PluginInstallationScope.OFFICIAL_ONLY)
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(
+            scope=PluginInstallationScope.OFFICIAL_ONLY
+        )
 
         with pytest.raises(PluginInstallationForbiddenError):
             PluginService._check_plugin_installation_scope(None)
 
     @patch("core.plugin.plugin_service.FeatureService")
     def test_official_and_partners_allows_partner(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(
             scope=PluginInstallationScope.OFFICIAL_AND_SPECIFIC_PARTNERS
         )
         verification = MagicMock()
@@ -159,7 +166,7 @@ class TestCheckPluginInstallationScope:
 
     @patch("core.plugin.plugin_service.FeatureService")
     def test_official_and_partners_rejects_none(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(
             scope=PluginInstallationScope.OFFICIAL_AND_SPECIFIC_PARTNERS
         )
 
@@ -168,7 +175,7 @@ class TestCheckPluginInstallationScope:
 
     @patch("core.plugin.plugin_service.FeatureService")
     def test_none_scope_always_raises(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(scope=PluginInstallationScope.NONE)
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(scope=PluginInstallationScope.NONE)
         verification = MagicMock()
         verification.authorized_category = PluginVerification.AuthorizedCategory.Langgenius
 
@@ -177,10 +184,19 @@ class TestCheckPluginInstallationScope:
 
     @patch("core.plugin.plugin_service.FeatureService")
     def test_all_scope_passes_any(self, mock_fs):
-        mock_fs.get_system_features.return_value = _make_features(scope=PluginInstallationScope.ALL)
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission(scope=PluginInstallationScope.ALL)
 
         PluginService._check_plugin_installation_scope(None)  # should not raise
 
+    @patch("core.plugin.plugin_service.FeatureService")
+    def test_unknown_scope_always_raises(self, mock_fs):
+        permission = _make_permission()
+        permission.plugin_installation_scope = cast(PluginInstallationScope, "unknown-scope")
+        mock_fs.get_plugin_installation_permission.return_value = permission
+
+        with pytest.raises(PluginInstallationForbiddenError, match="policy is invalid"):
+            PluginService._check_plugin_installation_scope(None)
+
 
 class TestGetPluginIconUrl:
     @patch("core.plugin.plugin_service.dify_config")
@@ -248,7 +264,7 @@ class TestUpgradePluginWithMarketplace:
     @patch("core.plugin.plugin_service.dify_config")
     def test_skips_download_when_already_installed(self, mock_config, mock_installer_cls, mock_fs, mock_marketplace):
         mock_config.MARKETPLACE_ENABLED = True
-        mock_fs.get_system_features.return_value = _make_features()
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission()
         installer = mock_installer_cls.return_value
         installer.fetch_plugin_manifest.return_value = MagicMock()
         installer.upgrade_plugin.return_value = MagicMock()
@@ -264,7 +280,7 @@ class TestUpgradePluginWithMarketplace:
     @patch("core.plugin.plugin_service.dify_config")
     def test_downloads_when_not_installed(self, mock_config, mock_installer_cls, mock_fs, mock_download):
         mock_config.MARKETPLACE_ENABLED = True
-        mock_fs.get_system_features.return_value = _make_features()
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission()
         installer = mock_installer_cls.return_value
         installer.fetch_plugin_manifest.side_effect = RuntimeError("not found")
         mock_download.return_value = b"pkg-bytes"
@@ -283,7 +299,7 @@ class TestUpgradePluginWithGithub:
     @patch("core.plugin.plugin_service.FeatureService")
     @patch("core.plugin.plugin_service.PluginInstaller")
     def test_checks_marketplace_permission_and_delegates(self, mock_installer_cls: MagicMock, mock_fs: MagicMock):
-        mock_fs.get_system_features.return_value = _make_features()
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission()
         installer = mock_installer_cls.return_value
         installer.upgrade_plugin.return_value = MagicMock()
 
@@ -298,7 +314,7 @@ class TestUploadPkg:
     @patch("core.plugin.plugin_service.FeatureService")
     @patch("core.plugin.plugin_service.PluginInstaller")
     def test_runs_permission_and_scope_checks(self, mock_installer_cls: MagicMock, mock_fs: MagicMock):
-        mock_fs.get_system_features.return_value = _make_features()
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission()
         upload_resp = MagicMock()
         upload_resp.verification = None
         mock_installer_cls.return_value.upload_pkg.return_value = upload_resp
@@ -322,7 +338,7 @@ class TestInstallFromMarketplacePkg:
     @patch("core.plugin.plugin_service.dify_config")
     def test_downloads_when_not_cached(self, mock_config, mock_installer_cls, mock_fs, mock_download):
         mock_config.MARKETPLACE_ENABLED = True
-        mock_fs.get_system_features.return_value = _make_features()
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission()
         installer = mock_installer_cls.return_value
         installer.fetch_plugin_manifest.side_effect = RuntimeError("not found")
         mock_download.return_value = b"pkg"
@@ -344,7 +360,7 @@ class TestInstallFromMarketplacePkg:
     @patch("core.plugin.plugin_service.dify_config")
     def test_uses_cached_when_already_downloaded(self, mock_config, mock_installer_cls: MagicMock, mock_fs: MagicMock):
         mock_config.MARKETPLACE_ENABLED = True
-        mock_fs.get_system_features.return_value = _make_features()
+        mock_fs.get_plugin_installation_permission.return_value = _make_permission()
         installer = mock_installer_cls.return_value
         installer.fetch_plugin_manifest.return_value = MagicMock()
         decode_resp = MagicMock()

api/tests/unit_tests/services/retention/workflow_run/test_restore_archived_workflow_run.py

@@ -10,14 +10,19 @@ import io
 import json
 import logging
 import zipfile
+from collections.abc import Iterator
+from dataclasses import dataclass
 from datetime import datetime
-from unittest.mock import Mock, create_autospec, patch
+from unittest.mock import Mock, patch
 
 import pytest
 from pydantic import ValidationError
-from sqlalchemy import Column, Integer, MetaData, String, Table
+from sqlalchemy import Column, Engine, Integer, MetaData, String, Table, delete, event, func, select
+from sqlalchemy.dialects.sqlite import insert as sqlite_insert
+from sqlalchemy.orm import Session, sessionmaker
 
 from libs.archive_storage import ArchiveStorageNotConfiguredError
+from models.enums import CreatorUserRole
 from models.trigger import WorkflowTriggerLog
 from models.workflow import (
     WorkflowAppLog,
@@ -28,6 +33,7 @@ from models.workflow import (
     WorkflowPauseReason,
     WorkflowRun,
 )
+from services.retention.workflow_run import restore_archived_workflow_run as restore_module
 from services.retention.workflow_run.restore_archived_workflow_run import (
     SCHEMA_MAPPERS,
     TABLE_MODELS,
@@ -36,24 +42,49 @@ from services.retention.workflow_run.restore_archived_workflow_run import (
 )
 
 
+@dataclass(frozen=True)
+class Database:
+    """Explicit SQLite engine, caller session, and real service-owned session factory."""
+
+    engine: Engine
+    session: Session
+    session_maker: sessionmaker[Session]
+
+
+@pytest.fixture
+def database(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[Database]:
+    WorkflowRun.metadata.create_all(
+        sqlite_engine,
+        tables=[WorkflowRun.__table__, WorkflowAppLog.__table__, WorkflowArchiveLog.__table__],
+    )
+    session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    with session_maker() as session:
+        database = Database(engine=sqlite_engine, session=session, session_maker=session_maker)
+        monkeypatch.setattr(restore_module, "db", database)
+        # Production constructs PostgreSQL's equivalent statement; SQLite's
+        # dialect keeps the conflict behavior executable in these tests.
+        monkeypatch.setattr(restore_module, "pg_insert", sqlite_insert)
+        yield database
+
+
 class WorkflowRunRestoreTestDataFactory:
     """
-    Factory for creating test data and mock objects.
+    Factory for creating persisted-model-compatible test data.
 
     Provides reusable methods to create consistent mock objects for testing
     workflow run restore operations.
     """
 
     @staticmethod
-    def create_workflow_run_mock(
+    def create_workflow_run(
         run_id: str = "run-123",
         tenant_id: str = "tenant-123",
         app_id: str = "app-123",
         created_at: datetime | None = None,
         **kwargs,
-    ) -> Mock:
+    ) -> WorkflowRun:
         """
-        Create a mock WorkflowRun object.
+        Create a concrete WorkflowRun object.
 
         Args:
             run_id: Unique identifier for the workflow run
@@ -63,27 +94,44 @@ class WorkflowRunRestoreTestDataFactory:
             **kwargs: Additional attributes to set on the mock
 
         Returns:
-            Mock WorkflowRun object with specified attributes
+            WorkflowRun object with specified attributes
         """
-        run = create_autospec(WorkflowRun, instance=True)
-        run.id = run_id
-        run.tenant_id = tenant_id
-        run.app_id = app_id
-        run.created_at = created_at or datetime(2024, 1, 1, 12, 0, 0)
-        for key, value in kwargs.items():
-            setattr(run, key, value)
+        attrs = {
+            "id": run_id,
+            "tenant_id": tenant_id,
+            "app_id": app_id,
+            "workflow_id": "workflow-123",
+            "type": "workflow",
+            "triggered_from": "app-run",
+            "version": "1",
+            "graph": None,
+            "inputs": None,
+            "status": "succeeded",
+            "outputs": "{}",
+            "error": None,
+            "elapsed_time": 0,
+            "total_tokens": 0,
+            "total_steps": 0,
+            "created_by_role": CreatorUserRole.ACCOUNT,
+            "created_by": "user-123",
+            "created_at": created_at or datetime(2024, 1, 1, 12, 0, 0),
+            "finished_at": None,
+            "exceptions_count": 0,
+        }
+        attrs.update(kwargs)
+        run = WorkflowRun(**attrs)
         return run
 
     @staticmethod
-    def create_workflow_archive_log_mock(
+    def create_workflow_archive_log(
         run_id: str = "run-123",
         tenant_id: str = "tenant-123",
         app_id: str = "app-123",
         created_at: datetime | None = None,
         **kwargs,
-    ) -> Mock:
+    ) -> WorkflowArchiveLog:
         """
-        Create a mock WorkflowArchiveLog object.
+        Create a concrete WorkflowArchiveLog object.
 
         Args:
             run_id: Unique identifier for the workflow run
@@ -93,16 +141,32 @@ class WorkflowRunRestoreTestDataFactory:
             **kwargs: Additional attributes to set on the mock
 
         Returns:
-            Mock WorkflowArchiveLog object with specified attributes
+            WorkflowArchiveLog object with specified attributes
         """
-        archive_log = create_autospec(WorkflowArchiveLog, instance=True)
-        archive_log.workflow_run_id = run_id
-        archive_log.tenant_id = tenant_id
-        archive_log.app_id = app_id
-        archive_log.run_created_at = created_at or datetime(2024, 1, 1, 12, 0, 0)
-        for key, value in kwargs.items():
-            setattr(archive_log, key, value)
-        return archive_log
+        attrs = {
+            "tenant_id": tenant_id,
+            "app_id": app_id,
+            "workflow_id": "workflow-123",
+            "workflow_run_id": run_id,
+            "created_by_role": CreatorUserRole.ACCOUNT,
+            "created_by": "user-123",
+            "log_id": None,
+            "log_created_at": None,
+            "log_created_from": None,
+            "run_version": "1",
+            "run_status": "succeeded",
+            "run_triggered_from": "app-run",
+            "run_error": None,
+            "run_elapsed_time": 0,
+            "run_total_tokens": 0,
+            "run_total_steps": 0,
+            "run_created_at": created_at or datetime(2024, 1, 1, 12, 0, 0),
+            "run_finished_at": None,
+            "run_exceptions_count": 0,
+            "trigger_metadata": None,
+        }
+        attrs.update(kwargs)
+        return WorkflowArchiveLog(**attrs)
 
     @staticmethod
     def create_archive_zip_mock(
@@ -137,7 +201,7 @@ class WorkflowRunRestoreTestDataFactory:
                         "app_id": "app-123",
                         "workflow_id": "workflow-123",
                         "type": "workflow",
-                        "triggered_from": "app",
+                        "triggered_from": "app-run",
                         "version": "1",
                         "status": "succeeded",
                         "created_by_role": "account",
@@ -151,7 +215,7 @@ class WorkflowRunRestoreTestDataFactory:
                         "app_id": "app-123",
                         "workflow_id": "workflow-123",
                         "workflow_run_id": "run-123",
-                        "created_from": "app",
+                        "created_from": "service-api",
                         "created_by_role": "account",
                         "created_by": "user-123",
                     },
@@ -161,7 +225,7 @@ class WorkflowRunRestoreTestDataFactory:
                         "app_id": "app-123",
                         "workflow_id": "workflow-123",
                         "workflow_run_id": "run-123",
-                        "created_from": "app",
+                        "created_from": "service-api",
                         "created_by_role": "account",
                         "created_by": "user-123",
                     },
@@ -225,14 +289,10 @@ class TestGetWorkflowRunRepo:
     """Tests for WorkflowRunRestore._get_workflow_run_repo method."""
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.DifyAPIRepositoryFactory")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.db")
-    def test_first_call_creates_repo(self, mock_db, mock_sessionmaker, mock_factory):
+    def test_first_call_creates_repo(self, mock_factory, database: Database):
         """First call should create and cache repository."""
         restore = WorkflowRunRestore()
 
-        mock_session = Mock()
-        mock_sessionmaker.return_value = mock_session
         mock_repo = Mock()
         mock_factory.create_api_workflow_run_repository.return_value = mock_repo
 
@@ -240,8 +300,9 @@ class TestGetWorkflowRunRepo:
 
         assert result is mock_repo
         assert restore.workflow_run_repo is mock_repo
-        mock_sessionmaker.assert_called_once_with(bind=mock_db.engine, expire_on_commit=False)
-        mock_factory.create_api_workflow_run_repository.assert_called_once_with(mock_session)
+        session_maker = mock_factory.create_api_workflow_run_repository.call_args.args[0]
+        assert isinstance(session_maker, sessionmaker)
+        assert session_maker.kw["bind"] is database.engine
 
     def test_cached_repo_returned(self):
         """Subsequent calls should return cached repository."""
@@ -492,47 +553,27 @@ class TestGetModelColumnInfo:
 class TestRestoreTableRecords:
     """Tests for WorkflowRunRestore._restore_table_records method."""
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.TABLE_MODELS")
-    def test_unknown_table_returns_zero(self, mock_table_models, caplog: pytest.LogCaptureFixture):
+    def test_unknown_table_returns_zero(self, database: Database, caplog: pytest.LogCaptureFixture):
         """Should return 0 for unknown table."""
         restore = WorkflowRunRestore()
-        mock_table_models.get.return_value = None
-
-        mock_session = Mock()
         records = [{"id": "test"}]
         caplog.set_level(logging.WARNING, logger="services.retention.workflow_run.restore_archived_workflow_run")
 
-        result = restore._restore_table_records(mock_session, "unknown_table", records, schema_version="1.0")
+        result = restore._restore_table_records(database.session, "unknown_table", records, schema_version="1.0")
 
         assert result == 0
         assert "Unknown table: unknown_table" in caplog.messages
 
-    def test_empty_records_returns_zero(self):
+    def test_empty_records_returns_zero(self, database: Database):
         """Should return 0 for empty records list."""
         restore = WorkflowRunRestore()
-        mock_session = Mock()
-
-        result = restore._restore_table_records(mock_session, "workflow_runs", [], schema_version="1.0")
+        result = restore._restore_table_records(database.session, "workflow_runs", [], schema_version="1.0")
         assert result == 0
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.pg_insert")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.cast")
-    def test_successful_restore(self, mock_cast, mock_pg_insert):
+    def test_successful_restore(self, database: Database):
         """Should successfully restore records."""
         restore = WorkflowRunRestore()
 
-        # Mock session and execution
-        mock_session = Mock()
-        mock_result = Mock()
-        mock_result.rowcount = 2
-        mock_session.execute.return_value = mock_result
-        mock_cast.return_value = mock_result
-
-        # Mock insert statement
-        mock_stmt = Mock()
-        mock_stmt.on_conflict_do_nothing.return_value = mock_stmt
-        mock_pg_insert.return_value = mock_stmt
-
         records = [
             {
                 "id": "test1",
@@ -540,7 +581,7 @@ class TestRestoreTableRecords:
                 "app_id": "app-123",
                 "workflow_id": "workflow-123",
                 "type": "workflow",
-                "triggered_from": "app",
+                "triggered_from": "app-run",
                 "version": "1",
                 "status": "succeeded",
                 "created_by_role": "account",
@@ -552,7 +593,7 @@ class TestRestoreTableRecords:
                 "app_id": "app-123",
                 "workflow_id": "workflow-123",
                 "type": "workflow",
-                "triggered_from": "app",
+                "triggered_from": "app-run",
                 "version": "1",
                 "status": "succeeded",
                 "created_by_role": "account",
@@ -560,38 +601,20 @@ class TestRestoreTableRecords:
             },
         ]
 
-        result = restore._restore_table_records(mock_session, "workflow_runs", records, schema_version="1.0")
+        result = restore._restore_table_records(database.session, "workflow_runs", records, schema_version="1.0")
 
         assert result == 2
-        mock_session.execute.assert_called_once()
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 2
+        assert restore._restore_table_records(database.session, "workflow_runs", records, schema_version="1.0") == 0
 
-    def test_missing_required_columns_raises_error(self):
+    def test_missing_required_columns_raises_error(self, database: Database):
         """Should raise ValueError for missing required columns."""
         restore = WorkflowRunRestore()
 
-        mock_session = Mock()
-        # Use a dedicated mock model to isolate required-column validation behavior.
-        mock_model = Mock()
+        records = [{"id": "test"}]
 
-        # Mock a required column
-        required_column = Mock()
-        required_column.key = "required_field"
-        required_column.nullable = False
-        required_column.default = None
-        required_column.server_default = None
-        required_column.autoincrement = False
-        required_column.type = Mock()
-
-        # Mock the __table__ attribute properly
-        mock_table = Mock()
-        mock_table.columns = [required_column]
-        mock_model.__table__ = mock_table
-
-        records = [{"name": "test"}]  # Missing required 'required_field'
-
-        with patch.dict(TABLE_MODELS, {"test_table": mock_model}):
-            with pytest.raises(ValueError, match="Missing required columns for test_table"):
-                restore._restore_table_records(mock_session, "test_table", records, schema_version="1.0")
+        with pytest.raises(ValueError, match="Missing required columns for workflow_runs"):
+            restore._restore_table_records(database.session, "workflow_runs", records, schema_version="1.0")
 
 
 # ---------------------------------------------------------------------------
@@ -603,38 +626,38 @@ class TestRestoreFromRun:
     """Tests for WorkflowRunRestore._restore_from_run method."""
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_archive_storage_not_configured(self, mock_get_storage):
+    def test_archive_storage_not_configured(self, mock_get_storage, database: Database):
         """Should handle ArchiveStorageNotConfiguredError."""
         restore = WorkflowRunRestore()
         mock_get_storage.side_effect = ArchiveStorageNotConfiguredError("Storage not configured")
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
         with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-            result = restore._restore_from_run(run, session_maker=lambda: Mock())
+            result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is False
         assert "Storage not configured" in result.error
         assert result.elapsed_time > 0
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_archive_bundle_not_found(self, mock_get_storage):
+    def test_archive_bundle_not_found(self, mock_get_storage, database: Database):
         """Should handle FileNotFoundError when archive bundle is missing."""
         restore = WorkflowRunRestore()
         mock_storage = Mock()
         mock_storage.get_object.side_effect = FileNotFoundError("Bundle not found")
         mock_get_storage.return_value = mock_storage
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
         with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-            result = restore._restore_from_run(run, session_maker=lambda: Mock())
+            result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is False
         assert "Archive bundle not found" in result.error
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_dry_run_mode(self, mock_get_storage):
+    def test_dry_run_mode(self, mock_get_storage, database: Database):
         """Should handle dry run mode correctly."""
         restore = WorkflowRunRestore(dry_run=True)
 
@@ -644,23 +667,16 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
-        # Create a proper mock session with context manager support
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        result = restore._restore_from_run(run, session_maker=lambda: mock_session)
+        result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is True
         assert result.restored_counts["workflow_runs"] == 1
         assert result.restored_counts["workflow_app_logs"] == 2
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.pg_insert")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.cast")
-    def test_successful_restore(self, mock_cast, mock_pg_insert, mock_get_storage):
+    def test_successful_restore(self, mock_get_storage, database: Database):
         """Should successfully restore from archive."""
         restore = WorkflowRunRestore()
 
@@ -670,53 +686,57 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        # Mock session with context manager support
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        def session_maker():
-            return mock_session
-
-        # Mock database execution to return integer counts
-        mock_result_workflow_runs = Mock()
-        mock_result_workflow_runs.rowcount = 1
-        mock_result_app_logs = Mock()
-        mock_result_app_logs.rowcount = 2
-
-        # Configure session.execute to return different results based on the table
-        def mock_execute(stmt):
-            if "workflow_runs" in str(stmt):
-                return mock_result_workflow_runs
-            else:
-                return mock_result_app_logs
-
-        mock_session.execute.side_effect = mock_execute
-        mock_cast.return_value = mock_result_workflow_runs
-
-        # Mock insert statement
-        mock_stmt = Mock()
-        mock_stmt.on_conflict_do_nothing.return_value = mock_stmt
-        mock_pg_insert.return_value = mock_stmt
-
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
 
         # Mock repository methods
         with patch.object(restore, "_get_workflow_run_repo") as mock_get_repo:
             mock_repo = Mock()
+            mock_repo.delete_archive_log_by_run_id.side_effect = lambda session, run_id: session.execute(
+                delete(WorkflowArchiveLog).where(WorkflowArchiveLog.workflow_run_id == run_id)
+            )
             mock_get_repo.return_value = mock_repo
 
             with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                result = restore._restore_from_run(run, session_maker=session_maker)
+                result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is True
         assert result.restored_counts["workflow_runs"] == 1
-        assert result.restored_counts["workflow_app_logs"] >= 1  # Just check it's restored
-        mock_session.commit.assert_called_once()
-        mock_repo.delete_archive_log_by_run_id.assert_called_once_with(mock_session, run.id)
+        assert result.restored_counts["workflow_app_logs"] == 2
+        database.session.expire_all()
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 1
+        assert database.session.scalar(select(func.count(WorkflowAppLog.id))) == 2
+        assert database.session.scalar(select(func.count(WorkflowArchiveLog.id))) == 0
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_invalid_archive_bundle(self, mock_get_storage):
+    def test_insert_failure_rolls_back_all_tables(self, mock_get_storage, database: Database):
+        """A later table failure must roll back earlier restored rows."""
+        restore = WorkflowRunRestore()
+        mock_storage = Mock()
+        mock_storage.get_object.return_value = WorkflowRunRestoreTestDataFactory.create_archive_zip_mock()
+        mock_get_storage.return_value = mock_storage
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
+
+        def fail_app_log_insert(_connection, _cursor, statement, _parameters, _context, _executemany):
+            if statement.startswith("INSERT INTO workflow_app_logs"):
+                raise RuntimeError("forced app-log insert failure")
+
+        event.listen(database.engine, "before_cursor_execute", fail_app_log_insert)
+        try:
+            with patch("services.retention.workflow_run.restore_archived_workflow_run.click"):
+                result = restore._restore_from_run(run, session_maker=database.session_maker)
+        finally:
+            event.remove(database.engine, "before_cursor_execute", fail_app_log_insert)
+
+        assert result.success is False
+        assert result.error == "forced app-log insert failure"
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 0
+        assert database.session.scalar(select(func.count(WorkflowAppLog.id))) == 0
+
+    @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
+    def test_invalid_archive_bundle(self, mock_get_storage, database: Database):
         """Should handle invalid archive bundle."""
         restore = WorkflowRunRestore()
 
@@ -725,22 +745,17 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = b"invalid zip data"
         mock_get_storage.return_value = mock_storage
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
-
-        # Create proper mock session
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
         with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-            result = restore._restore_from_run(run, session_maker=lambda: mock_session)
+            result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is False
         # The error message comes from zipfile.BadZipFile which says "File is not a zip file"
         assert "File is not a zip file" in result.error
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_workflow_archive_log_input(self, mock_get_storage):
+    def test_workflow_archive_log_input(self, mock_get_storage, database: Database):
         """Should handle WorkflowArchiveLog input correctly."""
         restore = WorkflowRunRestore(dry_run=True)
 
@@ -750,14 +765,11 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
 
-        # Create proper mock session
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        result = restore._restore_from_run(archive_log, session_maker=lambda: mock_session)
+        result = restore._restore_from_run(archive_log, session_maker=database.session_maker)
 
         assert result.success is True
         assert result.run_id == archive_log.workflow_run_id
@@ -772,39 +784,29 @@ class TestRestoreFromRun:
 class TestRestoreBatch:
     """Tests for WorkflowRunRestore.restore_batch method."""
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    def test_empty_tenant_ids_returns_empty(self, mock_sessionmaker):
+    def test_empty_tenant_ids_returns_empty(self, database: Database):
         """Should return empty list when tenant_ids is empty list."""
         restore = WorkflowRunRestore()
 
-        # Mock db.engine to avoid SQLAlchemy issues
-        with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-            mock_db.engine = Mock()
-            result = restore.restore_batch(
-                tenant_ids=[],
-                start_date=datetime(2024, 1, 1),
-                end_date=datetime(2024, 1, 2),
-            )
+        result = restore.restore_batch(
+            tenant_ids=[],
+            start_date=datetime(2024, 1, 1),
+            end_date=datetime(2024, 1, 2),
+        )
 
         assert result == []
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.ThreadPoolExecutor")
-    def test_successful_batch_restore(self, mock_executor):
+    def test_successful_batch_restore(self, mock_executor, database: Database):
         """Should successfully restore batch of workflow runs."""
         restore = WorkflowRunRestore(workers=2)
 
-        # Mock session that supports context manager protocol
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        # Mock session factory that returns context manager sessions
-        mock_session_factory = Mock(return_value=mock_session)
-
         # Mock repository and archive logs
         mock_repo = Mock()
-        archive_log1 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock("run-1")
-        archive_log2 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock("run-2")
+        archive_log1 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log("run-1")
+        archive_log2 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log("run-2")
+        database.session.add_all([archive_log1, archive_log2])
+        database.session.commit()
         mock_repo.get_archived_logs_by_time_range.return_value = [archive_log1, archive_log2]
 
         # Mock restore results
@@ -821,38 +823,25 @@ class TestRestoreBatch:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", side_effect=[result1, result2]):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock sessionmaker and db.engine to avoid SQLAlchemy issues
-                    with patch(
-                        "services.retention.workflow_run.restore_archived_workflow_run.sessionmaker"
-                    ) as mock_sessionmaker:
-                        mock_sessionmaker.return_value = mock_session_factory
-                        with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                            mock_db.engine = Mock()
-                            results = restore.restore_batch(
-                                tenant_ids=["tenant-1"],
-                                start_date=datetime(2024, 1, 1),
-                                end_date=datetime(2024, 1, 2),
-                            )
+                    results = restore.restore_batch(
+                        tenant_ids=["tenant-1"],
+                        start_date=datetime(2024, 1, 1),
+                        end_date=datetime(2024, 1, 2),
+                    )
 
         assert len(results) == 2
         assert results[0].run_id == "run-1"
         assert results[1].run_id == "run-2"
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.ThreadPoolExecutor")
-    def test_dry_run_batch_restore(self, mock_executor):
+    def test_dry_run_batch_restore(self, mock_executor, database: Database):
         """Should handle dry run mode for batch restore."""
         restore = WorkflowRunRestore(dry_run=True)
 
-        # Mock session that supports context manager protocol
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        # Mock session factory that returns context manager sessions
-        mock_session_factory = Mock(return_value=mock_session)
-
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_logs_by_time_range.return_value = [archive_log]
 
         result = RestoreResult(run_id="run-1", tenant_id="tenant-1", success=True, restored_counts={"workflow_runs": 1})
@@ -867,18 +856,11 @@ class TestRestoreBatch:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", return_value=result):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock sessionmaker and db.engine to avoid SQLAlchemy issues
-                    with patch(
-                        "services.retention.workflow_run.restore_archived_workflow_run.sessionmaker"
-                    ) as mock_sessionmaker:
-                        mock_sessionmaker.return_value = mock_session_factory
-                        with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                            mock_db.engine = Mock()
-                            results = restore.restore_batch(
-                                tenant_ids=["tenant-1"],
-                                start_date=datetime(2024, 1, 1),
-                                end_date=datetime(2024, 1, 2),
-                            )
+                    results = restore.restore_batch(
+                        tenant_ids=["tenant-1"],
+                        start_date=datetime(2024, 1, 1),
+                        end_date=datetime(2024, 1, 2),
+                    )
 
         assert len(results) == 1
         assert results[0].success is True
@@ -907,16 +889,14 @@ class TestRestoreByRunId:
         assert "not found" in result.error
         assert result.run_id == "nonexistent-run"
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    def test_successful_restore_by_id(self, mock_sessionmaker):
+    def test_successful_restore_by_id(self, database: Database):
         """Should successfully restore by run ID."""
         restore = WorkflowRunRestore()
 
-        mock_session = Mock()
-        mock_sessionmaker.return_value = mock_session
-
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_log_by_run_id.return_value = archive_log
 
         result = RestoreResult(run_id="run-1", tenant_id="tenant-1", success=True, restored_counts={})
@@ -924,24 +904,19 @@ class TestRestoreByRunId:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", return_value=result):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock db.engine to avoid SQLAlchemy issues
-                    with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                        mock_db.engine = Mock()
-                        actual_result = restore.restore_by_run_id("run-1")
+                    actual_result = restore.restore_by_run_id("run-1")
 
         assert actual_result.success is True
         assert actual_result.run_id == "run-1"
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    def test_dry_run_restore_by_id(self, mock_sessionmaker):
+    def test_dry_run_restore_by_id(self, database: Database):
         """Should handle dry run mode for restore by ID."""
         restore = WorkflowRunRestore(dry_run=True)
 
-        mock_session = Mock()
-        mock_sessionmaker.return_value = mock_session
-
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_log_by_run_id.return_value = archive_log
 
         result = RestoreResult(run_id="run-1", tenant_id="tenant-1", success=True, restored_counts={"workflow_runs": 1})
@@ -949,10 +924,7 @@ class TestRestoreByRunId:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", return_value=result):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock db.engine to avoid SQLAlchemy issues
-                    with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                        mock_db.engine = Mock()
-                        actual_result = restore.restore_by_run_id("run-1")
+                    actual_result = restore.restore_by_run_id("run-1")
 
         assert actual_result.success is True
         assert actual_result.run_id == "run-1"
@@ -1038,8 +1010,7 @@ class TestIntegration:
     """Integration tests combining multiple components."""
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.ThreadPoolExecutor")
-    def test_full_restore_flow(self, mock_executor, mock_get_storage):
+    def test_full_restore_flow(self, mock_get_storage, database: Database):
         """Test complete restore flow with all components."""
         restore = WorkflowRunRestore(workers=1)
 
@@ -1059,7 +1030,7 @@ class TestIntegration:
                     "app_id": "app-123",
                     "workflow_id": "workflow-123",
                     "type": "workflow",
-                    "triggered_from": "app",
+                    "triggered_from": "app-run",
                     "version": "1",
                     "status": "succeeded",
                     "created_by_role": "account",
@@ -1072,48 +1043,20 @@ class TestIntegration:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        # Mock session that supports context manager protocol
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        # Mock session factory that returns context manager sessions
-        mock_session_factory = Mock(return_value=mock_session)
-
-        mock_result = Mock()
-        mock_result.rowcount = 1
-        mock_session.execute.return_value = mock_result
-
         # Mock repository
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_log_by_run_id.return_value = archive_log
-
-        # Mock ThreadPoolExecutor (not actually used in restore_by_run_id but needed for patch)
-        mock_executor_instance = Mock()
-        mock_executor_instance.__enter__ = Mock(return_value=mock_executor_instance)
-        mock_executor_instance.__exit__ = Mock(return_value=None)
-        mock_executor_instance.map = Mock(return_value=[])
-        mock_executor.return_value = mock_executor_instance
+        mock_repo.delete_archive_log_by_run_id.side_effect = lambda session, run_id: session.execute(
+            delete(WorkflowArchiveLog).where(WorkflowArchiveLog.workflow_run_id == run_id)
+        )
 
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
-            with patch("services.retention.workflow_run.restore_archived_workflow_run.pg_insert") as mock_insert:
-                mock_stmt = Mock()
-                mock_stmt.on_conflict_do_nothing.return_value = mock_stmt
-                mock_insert.return_value = mock_stmt
-
-                with patch("services.retention.workflow_run.restore_archived_workflow_run.cast") as mock_cast:
-                    mock_cast.return_value = mock_result
-
-                    with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                        # Mock sessionmaker and db.engine to avoid SQLAlchemy issues
-                        with patch(
-                            "services.retention.workflow_run.restore_archived_workflow_run.sessionmaker"
-                        ) as mock_sessionmaker:
-                            mock_sessionmaker.return_value = mock_session_factory
-                            with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                                mock_db.engine = Mock()
-                                result = restore.restore_by_run_id("run-123")
+            with patch("services.retention.workflow_run.restore_archived_workflow_run.click"):
+                result = restore.restore_by_run_id("run-123")
 
         assert result.success is True
         assert result.restored_counts.get("workflow_runs") == 1
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 1

api/tests/unit_tests/services/test_agent_config_service.py

@@ -63,6 +63,7 @@ def _target(
 ) -> AgentConfigTarget:
     agent_soul = soul or _soul()
     return AgentConfigTarget(
+        tenant_id=TENANT,
         agent_id=AGENT,
         version_id=version_id,
         kind=kind,
@@ -508,7 +509,9 @@ def test_manifest_uses_items_shape_without_download_urls() -> None:
         ),
     )
 
-    manifest = AgentConfigService._manifest_for_target(target)
+    with patch(f"{MODULE}.SkillManagementService") as skill_management_service:
+        skill_management_service.return_value.list_runtime_agent_skills.return_value = []
+        manifest = AgentConfigService._manifest_for_target(target)
 
     assert manifest == {
         "agent_id": AGENT,
@@ -557,7 +560,9 @@ def test_manifest_preserves_missing_config_assets_and_pull_rejects_them() -> Non
     target = _target(kind=AgentConfigVersionKind.DRAFT, writable=False, soul=soul)
     service = AgentConfigService()
 
-    manifest = service._manifest_for_target(target)
+    with patch(f"{MODULE}.SkillManagementService") as skill_management_service:
+        skill_management_service.return_value.list_runtime_agent_skills.return_value = []
+        manifest = service._manifest_for_target(target)
 
     assert manifest["skills"]["items"][0]["is_missing"] is True  # type: ignore[index]
     assert manifest["files"]["items"][0]["is_missing"] is True  # type: ignore[index]
@@ -606,6 +611,44 @@ def test_config_asset_refs_require_file_id_unless_marked_missing() -> None:
         )
 
 
+def test_manifest_appends_published_workspace_skills() -> None:
+    target = _target(
+        kind=AgentConfigVersionKind.DRAFT,
+        writable=False,
+        soul=_soul(
+            config_skills=[
+                AgentConfigSkillRefConfig(name="alpha", description="Alpha skill", file_id="tool-file-1")
+            ]
+        ),
+    )
+
+    with patch(f"{MODULE}.SkillManagementService") as skill_management_service:
+        skill_management_service.return_value.list_runtime_agent_skills.return_value = [
+            {
+                "id": "workspace-skill-id",
+                "name": "beta",
+                "file_id": "tool-file-2",
+                "description": "Beta workspace skill",
+                "size": 123,
+                "hash": "sha256:beta",
+                "mime_type": "application/zip",
+            },
+            {
+                "id": "duplicate",
+                "name": "alpha",
+                "file_id": "tool-file-ignored",
+                "description": "Duplicate workspace skill",
+                "size": 456,
+                "hash": "sha256:ignored",
+                "mime_type": "application/zip",
+            },
+        ]
+        manifest = AgentConfigService._manifest_for_target(target)
+
+    assert [item["name"] for item in manifest["skills"]["items"]] == ["alpha", "beta"]
+    assert manifest["skills"]["items"][1]["file_id"] == "tool-file-2"
+
+
 def test_preview_skill_file_returns_text_preview() -> None:
     service = AgentConfigService()
     target = _target(

api/tests/unit_tests/services/test_feature_service_plugin_installation_permission.py

@@ -0,0 +1,92 @@
+import logging
+
+import pytest
+
+from enums.deployment_edition import DeploymentEdition
+from services import feature_service as feature_service_module
+from services.feature_service import FeatureService, PluginInstallationScope, SystemFeatureModel
+
+
+def test_get_plugin_installation_permission_defaults_to_all_for_non_enterprise(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(feature_service_module.dify_config, "ENTERPRISE_ENABLED", False)
+
+    permission = FeatureService.get_plugin_installation_permission()
+
+    assert permission.plugin_installation_scope is PluginInstallationScope.ALL
+    assert permission.restrict_to_marketplace_only is False
+
+
+def test_get_plugin_installation_permission_parses_enterprise_policy(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(feature_service_module.dify_config, "ENTERPRISE_ENABLED", True)
+    monkeypatch.setattr(
+        feature_service_module.EnterpriseService,
+        "get_info",
+        staticmethod(
+            lambda: {
+                "PluginInstallationPermission": {
+                    "pluginInstallationScope": "official_only",
+                    "restrictToMarketplaceOnly": True,
+                }
+            }
+        ),
+    )
+
+    permission = FeatureService.get_plugin_installation_permission()
+
+    assert permission.plugin_installation_scope is PluginInstallationScope.OFFICIAL_ONLY
+    assert permission.restrict_to_marketplace_only is True
+
+
+@pytest.mark.parametrize(
+    "invalid_permission",
+    [
+        {
+            "pluginInstallationScope": "unknown-scope",
+            "restrictToMarketplaceOnly": False,
+        },
+        {
+            "pluginInstallationScope": "all",
+            "restrictToMarketplaceOnly": "false",
+        },
+    ],
+    ids=["unknown_scope", "non_boolean_marketplace_restriction"],
+)
+def test_invalid_enterprise_policy_denies_all_plugin_installations(
+    caplog: pytest.LogCaptureFixture,
+    invalid_permission: dict[str, object],
+) -> None:
+    with caplog.at_level(logging.ERROR, logger="services.feature_service"):
+        permission = FeatureService._resolve_plugin_installation_permission(
+            {"PluginInstallationPermission": invalid_permission}
+        )
+
+    assert permission.plugin_installation_scope is PluginInstallationScope.NONE
+    assert permission.restrict_to_marketplace_only is True
+    assert "denying all plugin installations" in caplog.text
+
+
+def test_system_features_exposes_only_validated_plugin_installation_policy(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(
+        feature_service_module.EnterpriseService,
+        "get_info",
+        staticmethod(
+            lambda: {
+                "PluginInstallationPermission": {
+                    "pluginInstallationScope": "unknown-scope",
+                    "restrictToMarketplaceOnly": False,
+                }
+            }
+        ),
+    )
+    features = SystemFeatureModel(deployment_edition=DeploymentEdition.ENTERPRISE)
+
+    FeatureService._fulfill_params_from_enterprise(features)
+
+    assert features.plugin_installation_permission.plugin_installation_scope is PluginInstallationScope.NONE
+    assert features.plugin_installation_permission.restrict_to_marketplace_only is True

api/tests/unit_tests/services/test_file_service.py

@@ -1,6 +1,8 @@
 import base64
 import hashlib
 import os
+from collections.abc import Iterator
+from datetime import UTC, datetime
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -9,6 +11,8 @@ from sqlalchemy.orm import Session, sessionmaker
 from werkzeug.exceptions import NotFound
 
 from configs import dify_config
+from extensions.storage.storage_type import StorageType
+from models.base import TypeBase
 from models.enums import CreatorUserRole
 from models.model import Account, EndUser, UploadFile
 from services.errors.file import BlockedFileExtensionError, FileTooLargeError, UnsupportedFileTypeError
@@ -17,31 +21,54 @@ from services.file_service import FileService
 
 class TestFileService:
     @pytest.fixture
-    def mock_db_session(self):
-        session = MagicMock(spec=Session)
-        # Mock context manager behavior
-        session.__enter__.return_value = session
-        return session
+    def sqlite_session_maker(self, sqlite_engine: Engine) -> sessionmaker[Session]:
+        TypeBase.metadata.create_all(sqlite_engine, tables=[TypeBase.metadata.tables[UploadFile.__tablename__]])
+        return sessionmaker(bind=sqlite_engine, expire_on_commit=False)
 
     @pytest.fixture
-    def mock_session_maker(self, mock_db_session):
-        maker = MagicMock(spec=sessionmaker)
-        maker.return_value = mock_db_session
-        return maker
+    def db_session(self, sqlite_session_maker: sessionmaker[Session]) -> Iterator[Session]:
+        with sqlite_session_maker() as session:
+            yield session
 
     @pytest.fixture
-    def file_service(self, mock_session_maker):
-        return FileService(session_factory=mock_session_maker)
+    def file_service(self, sqlite_session_maker: sessionmaker[Session]) -> FileService:
+        return FileService(session_factory=sqlite_session_maker)
 
-    def test_init_with_engine(self):
-        engine = MagicMock(spec=Engine)
-        service = FileService(session_factory=engine)
+    @staticmethod
+    def _persist_upload_file(
+        session: Session,
+        *,
+        file_id: str = "file_id",
+        tenant_id: str = "tenant_id",
+        extension: str = "txt",
+        mime_type: str = "text/plain",
+        key: str = "key",
+    ) -> UploadFile:
+        upload_file = UploadFile(
+            tenant_id=tenant_id,
+            storage_type=StorageType.LOCAL,
+            key=key,
+            name=f"test.{extension}",
+            size=10,
+            extension=extension,
+            mime_type=mime_type,
+            created_by_role=CreatorUserRole.ACCOUNT,
+            created_by="user_id",
+            created_at=datetime(2024, 1, 1, tzinfo=UTC),
+            used=False,
+        )
+        upload_file.id = file_id
+        session.add(upload_file)
+        session.commit()
+        return upload_file
+
+    def test_init_with_engine(self, sqlite_engine: Engine):
+        service = FileService(session_factory=sqlite_engine)
         assert isinstance(service._session_maker, sessionmaker)
 
-    def test_init_with_sessionmaker(self):
-        maker = MagicMock(spec=sessionmaker)
-        service = FileService(session_factory=maker)
-        assert service._session_maker == maker
+    def test_init_with_sessionmaker(self, sqlite_session_maker: sessionmaker[Session]):
+        service = FileService(session_factory=sqlite_session_maker)
+        assert service._session_maker == sqlite_session_maker
 
     def test_init_invalid_factory(self):
         with pytest.raises(AssertionError, match="must be a sessionmaker or an Engine."):
@@ -52,11 +79,11 @@ class TestFileService:
     @patch("services.file_service.extract_tenant_id")
     @patch("services.file_service.file_helpers.get_signed_file_url")
     def test_upload_file_success(
-        self, mock_get_url, mock_tenant_id, mock_now, mock_storage, file_service: FileService, mock_db_session
+        self, mock_get_url, mock_tenant_id, mock_now, mock_storage, file_service: FileService, db_session: Session
     ):
         # Setup
         mock_tenant_id.return_value = "tenant_id"
-        mock_now.return_value = "2024-01-01"
+        mock_now.return_value = datetime(2024, 1, 1, tzinfo=UTC)
         mock_get_url.return_value = "http://signed-url"
 
         user = MagicMock(spec=Account)
@@ -81,8 +108,9 @@ class TestFileService:
         assert result.source_url == "http://signed-url"
 
         mock_storage.save.assert_called_once()
-        mock_db_session.add.assert_called_once_with(result)
-        mock_db_session.commit.assert_called_once()
+        persisted = db_session.get(UploadFile, result.id)
+        assert persisted is not None
+        assert persisted.hash == result.hash
 
     def test_upload_file_uses_explicit_resource_tenant(self, file_service: FileService):
         user = MagicMock(spec=Account)
@@ -109,7 +137,7 @@ class TestFileService:
         with pytest.raises(ValueError, match="Filename contains invalid characters"):
             file_service.upload_file(filename="invalid/file.txt", content=b"", mimetype="text/plain", user=MagicMock())
 
-    def test_upload_file_long_filename(self, file_service: FileService, mock_db_session):
+    def test_upload_file_long_filename(self, file_service: FileService, db_session: Session):
         # Setup
         long_name = "a" * 210 + ".txt"
         user = MagicMock(spec=Account)
@@ -124,6 +152,7 @@ class TestFileService:
             result = file_service.upload_file(filename=long_name, content=b"test", mimetype="text/plain", user=user)
             assert len(result.name) <= 205  # 200 + . + extension
             assert result.name.endswith(".txt")
+            assert db_session.get(UploadFile, result.id) is not None
 
     def test_upload_file_blocked_extension(self, file_service):
         with patch.object(dify_config, "inner_UPLOAD_FILE_EXTENSION_BLACKLIST", "exe"):
@@ -145,7 +174,7 @@ class TestFileService:
             with pytest.raises(FileTooLargeError):
                 file_service.upload_file(filename="test.jpg", content=content, mimetype="image/jpeg", user=MagicMock())
 
-    def test_upload_file_end_user(self, file_service: FileService, mock_db_session):
+    def test_upload_file_end_user(self, file_service: FileService, db_session: Session):
         user = MagicMock(spec=EndUser)
         user.id = "end_user_id"
 
@@ -157,6 +186,7 @@ class TestFileService:
             mock_tenant.return_value = "tenant"
             result = file_service.upload_file(filename="test.txt", content=b"test", mimetype="text/plain", user=user)
             assert result.created_by_role == CreatorUserRole.END_USER
+            assert db_session.get(UploadFile, result.id) is not None
 
     def test_is_file_size_within_limit(self):
         with (
@@ -181,12 +211,8 @@ class TestFileService:
             assert FileService.is_file_size_within_limit(extension="txt", file_size=5 * 1024 * 1024) is True
             assert FileService.is_file_size_within_limit(extension="pdf", file_size=6 * 1024 * 1024) is False
 
-    def test_get_file_base64_success(self, file_service: FileService, mock_db_session):
-        # Setup
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.key = "test_key"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_file_base64_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session, key="test_key")
 
         with patch("services.file_service.storage") as mock_storage:
             mock_storage.load_once.return_value = b"test content"
@@ -198,16 +224,17 @@ class TestFileService:
             assert result == base64.b64encode(b"test content").decode()
             mock_storage.load_once.assert_called_once_with("test_key")
 
-    def test_get_file_base64_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_get_file_base64_not_found(self, file_service: FileService):
         with pytest.raises(NotFound, match="File not found"):
             file_service.get_file_base64("non_existent")
 
-    def test_get_file_presigned_url_success(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.key = "upload_files/tenant_id/icon.png"
-        upload_file.mime_type = "image/png"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_file_presigned_url_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(
+            db_session,
+            extension="png",
+            mime_type="image/png",
+            key="upload_files/tenant_id/icon.png",
+        )
 
         with (
             patch.object(dify_config, "FILES_ACCESS_TIMEOUT", 300),
@@ -224,13 +251,11 @@ class TestFileService:
             content_type="image/png",
         )
 
-    def test_get_file_presigned_url_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
-
+    def test_get_file_presigned_url_not_found(self, file_service: FileService):
         with pytest.raises(NotFound, match="File not found"):
             file_service.get_file_presigned_url(file_id="file_id", tenant_id="tenant_id")
 
-    def test_upload_text_success(self, file_service: FileService, mock_db_session):
+    def test_upload_text_success(self, file_service: FileService, db_session: Session):
         # Setup
         text = "sample text"
         text_name = "test.txt"
@@ -249,21 +274,17 @@ class TestFileService:
             assert result.used is True
             assert result.extension == "txt"
             mock_storage.save.assert_called_once()
-            mock_db_session.add.assert_called_once()
-            mock_db_session.commit.assert_called_once()
+            assert db_session.get(UploadFile, result.id) is not None
 
-    def test_upload_text_long_name(self, file_service: FileService, mock_db_session):
+    def test_upload_text_long_name(self, file_service: FileService, db_session: Session):
         long_name = "a" * 210
         with patch("services.file_service.storage"):
             result = file_service.upload_text("text", long_name, "user", "tenant")
             assert len(result.name) == 200
+            assert db_session.get(UploadFile, result.id) is not None
 
-    def test_get_file_preview_success(self, file_service: FileService, mock_db_session):
-        # Setup
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.extension = "pdf"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_file_preview_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session, extension="pdf", mime_type="application/pdf")
 
         with patch("services.file_service.ExtractProcessor.load_from_upload_file") as mock_extract:
             mock_extract.return_value = "Extracted text content"
@@ -274,27 +295,17 @@ class TestFileService:
             # Assert
             assert result == "Extracted text content"
 
-    def test_get_file_preview_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_get_file_preview_not_found(self, file_service: FileService):
         with pytest.raises(NotFound, match="File not found"):
             file_service.get_file_preview("non_existent", "tenant_id")
 
-    def test_get_file_preview_unsupported_type(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.extension = "exe"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_file_preview_unsupported_type(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session, extension="exe", mime_type="application/octet-stream")
         with pytest.raises(UnsupportedFileTypeError):
             file_service.get_file_preview("file_id", "tenant_id")
 
-    def test_get_image_preview_success(self, file_service: FileService, mock_db_session):
-        # Setup
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.extension = "jpg"
-        upload_file.mime_type = "image/jpeg"
-        upload_file.key = "key"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_image_preview_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session, extension="jpg", mime_type="image/jpeg")
 
         with (
             patch("services.file_service.file_helpers.verify_image_signature") as mock_verify,
@@ -316,28 +327,21 @@ class TestFileService:
             with pytest.raises(NotFound, match="File not found or signature is invalid"):
                 file_service.get_image_preview("file_id", "ts", "nonce", "sign")
 
-    def test_get_image_preview_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_get_image_preview_not_found(self, file_service: FileService):
         with patch("services.file_service.file_helpers.verify_image_signature") as mock_verify:
             mock_verify.return_value = True
             with pytest.raises(NotFound, match="File not found or signature is invalid"):
                 file_service.get_image_preview("file_id", "ts", "nonce", "sign")
 
-    def test_get_image_preview_unsupported_type(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.extension = "txt"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_image_preview_unsupported_type(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session)
         with patch("services.file_service.file_helpers.verify_image_signature") as mock_verify:
             mock_verify.return_value = True
             with pytest.raises(UnsupportedFileTypeError):
                 file_service.get_image_preview("file_id", "ts", "nonce", "sign")
 
-    def test_get_file_generator_by_file_id_success(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.key = "key"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_file_generator_by_file_id_success(self, file_service: FileService, db_session: Session):
+        upload_file = self._persist_upload_file(db_session)
 
         with (
             patch("services.file_service.file_helpers.verify_file_signature") as mock_verify,
@@ -348,7 +352,8 @@ class TestFileService:
 
             gen, file = file_service.get_file_generator_by_file_id("file_id", "ts", "nonce", "sign")
             assert list(gen) == [b"chunk"]
-            assert file == upload_file
+            assert file.id == upload_file.id
+            assert file.key == upload_file.key
 
     def test_get_file_generator_by_file_id_invalid_sig(self, file_service):
         with patch("services.file_service.file_helpers.verify_file_signature") as mock_verify:
@@ -356,20 +361,14 @@ class TestFileService:
             with pytest.raises(NotFound, match="File not found or signature is invalid"):
                 file_service.get_file_generator_by_file_id("file_id", "ts", "nonce", "sign")
 
-    def test_get_file_generator_by_file_id_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_get_file_generator_by_file_id_not_found(self, file_service: FileService):
         with patch("services.file_service.file_helpers.verify_file_signature") as mock_verify:
             mock_verify.return_value = True
             with pytest.raises(NotFound, match="File not found or signature is invalid"):
                 file_service.get_file_generator_by_file_id("file_id", "ts", "nonce", "sign")
 
-    def test_get_public_image_preview_success(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.extension = "png"
-        upload_file.mime_type = "image/png"
-        upload_file.key = "key"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_public_image_preview_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session, extension="png", mime_type="image/png")
 
         with patch("services.file_service.storage") as mock_storage:
             mock_storage.load.return_value = b"image content"
@@ -377,66 +376,56 @@ class TestFileService:
             assert gen == b"image content"
             assert mime == "image/png"
 
-    def test_get_public_image_preview_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_get_public_image_preview_not_found(self, file_service: FileService):
         with pytest.raises(NotFound, match="File not found or signature is invalid"):
             file_service.get_public_image_preview("file_id")
 
-    def test_get_public_image_preview_unsupported_type(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.extension = "txt"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_public_image_preview_unsupported_type(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session)
         with pytest.raises(UnsupportedFileTypeError):
             file_service.get_public_image_preview("file_id")
 
-    def test_get_file_content_success(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.key = "key"
-        mock_db_session.scalar.return_value = upload_file
+    def test_get_file_content_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session)
 
         with patch("services.file_service.storage") as mock_storage:
             mock_storage.load.return_value = b"hello world"
             result = file_service.get_file_content("file_id")
             assert result == "hello world"
 
-    def test_get_file_content_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_get_file_content_not_found(self, file_service: FileService):
         with pytest.raises(NotFound, match="File not found"):
             file_service.get_file_content("file_id")
 
-    def test_delete_file_success(self, file_service: FileService, mock_db_session):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "file_id"
-        upload_file.key = "key"
-        # For session.scalar(select(...))
-        mock_db_session.scalar.return_value = upload_file
+    def test_delete_file_success(self, file_service: FileService, db_session: Session):
+        self._persist_upload_file(db_session)
 
         with patch("services.file_service.storage") as mock_storage:
             file_service.delete_file("file_id")
             mock_storage.delete.assert_called_once_with("key")
-            mock_db_session.delete.assert_called_once_with(upload_file)
+            db_session.expire_all()
+            assert db_session.get(UploadFile, "file_id") is None
 
-    def test_delete_file_not_found(self, file_service: FileService, mock_db_session):
-        mock_db_session.scalar.return_value = None
+    def test_delete_file_not_found(self, file_service: FileService):
         file_service.delete_file("file_id")
         # Should return without doing anything
 
-    def test_get_upload_files_by_ids_empty(self):
-        session = MagicMock()
-        result = FileService.get_upload_files_by_ids("tenant_id", [], session=session)
+    def test_get_upload_files_by_ids_empty(self, db_session: Session):
+        result = FileService.get_upload_files_by_ids("tenant_id", [], session=db_session)
         assert result == {}
 
-    def test_get_upload_files_by_ids(self):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.id = "550e8400-e29b-41d4-a716-446655440000"
-        upload_file.tenant_id = "tenant_id"
-        session = MagicMock()
-        session.scalars().all.return_value = [upload_file]
+    def test_get_upload_files_by_ids(self, db_session: Session):
+        upload_file = self._persist_upload_file(db_session, file_id="550e8400-e29b-41d4-a716-446655440000")
+        self._persist_upload_file(
+            db_session,
+            file_id="550e8400-e29b-41d4-a716-446655440001",
+            tenant_id="other-tenant",
+        )
 
         result = FileService.get_upload_files_by_ids(
-            "tenant_id", ["550e8400-e29b-41d4-a716-446655440000"], session=session
+            "tenant_id",
+            ["550e8400-e29b-41d4-a716-446655440000", "550e8400-e29b-41d4-a716-446655440001"],
+            session=db_session,
         )
         assert result["550e8400-e29b-41d4-a716-446655440000"] == upload_file
 
@@ -453,10 +442,8 @@ class TestFileService:
         used.add("a (1).txt")
         assert FileService._dedupe_zip_entry_name("a.txt", used) == "a (2).txt"
 
-    def test_build_upload_files_zip_tempfile(self):
-        upload_file = MagicMock(spec=UploadFile)
-        upload_file.name = "test.txt"
-        upload_file.key = "key"
+    def test_build_upload_files_zip_tempfile(self, db_session: Session):
+        upload_file = self._persist_upload_file(db_session)
 
         with (
             patch("services.file_service.storage") as mock_storage,

api/tests/unit_tests/services/test_human_input_service.py

@@ -1,6 +1,5 @@
 import dataclasses
 import logging
-from collections.abc import Iterator
 from datetime import datetime, timedelta
 from unittest.mock import MagicMock
 
@@ -42,14 +41,13 @@ from services.human_input_service import (
 
 
 @pytest.fixture
-def sqlite_session_factory(sqlite_engine: Engine) -> Iterator[tuple[sessionmaker[Session], Session]]:
-    factory = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
-    with factory() as session:
-        yield factory, session
+def unbound_session_factory() -> sessionmaker[Session]:
+    """Supply the required constructor dependency without enabling database access."""
+    return sessionmaker()
 
 
-def _persist_app(sqlite_session: Session, mode: AppMode) -> App:
-    app = App(
+def _make_app(mode: AppMode) -> App:
+    return App(
         id="app-id",
         tenant_id="tenant-id",
         name="Test App",
@@ -60,9 +58,6 @@ def _persist_app(sqlite_session: Session, mode: AppMode) -> App:
         enable_api=True,
         max_active_requests=0,
     )
-    sqlite_session.add(app)
-    sqlite_session.commit()
-    return app
 
 
 @pytest.fixture
@@ -97,14 +92,11 @@ def sample_form_record():
     )
 
 
-@pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
 def test_enqueue_resume_dispatches_task_for_workflow(
     mocker: MockerFixture,
-    sqlite_session_factory,
-    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
 ):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+    service = HumanInputService(sqlite_session_factory)
 
     workflow_run = MagicMock()
     workflow_run.app_id = "app-id"
@@ -116,7 +108,8 @@ def test_enqueue_resume_dispatches_task_for_workflow(
         return_value=workflow_run_repo,
     )
 
-    _persist_app(sqlite_session, AppMode.WORKFLOW)
+    with sqlite_session_factory.begin() as arrange_session:
+        arrange_session.add(_make_app(AppMode.WORKFLOW))
 
     resume_task = mocker.patch("services.human_input_service.resume_app_execution")
 
@@ -128,10 +121,9 @@ def test_enqueue_resume_dispatches_task_for_workflow(
 
 
 def test_ensure_form_active_respects_global_timeout(
-    monkeypatch, sample_form_record: HumanInputFormRecord, sqlite_session_factory
+    monkeypatch, sample_form_record: HumanInputFormRecord, unbound_session_factory
 ):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+    service = HumanInputService(unbound_session_factory)
     expired_record = dataclasses.replace(
         sample_form_record,
         created_at=naive_utc_now() - timedelta(hours=2),
@@ -143,14 +135,11 @@ def test_ensure_form_active_respects_global_timeout(
         service.ensure_form_active(Form(expired_record))
 
 
-@pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
 def test_enqueue_resume_dispatches_task_for_advanced_chat(
     mocker: MockerFixture,
-    sqlite_session_factory,
-    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
 ):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+    service = HumanInputService(sqlite_session_factory)
 
     workflow_run = MagicMock()
     workflow_run.app_id = "app-id"
@@ -162,7 +151,8 @@ def test_enqueue_resume_dispatches_task_for_advanced_chat(
         return_value=workflow_run_repo,
     )
 
-    _persist_app(sqlite_session, AppMode.ADVANCED_CHAT)
+    with sqlite_session_factory.begin() as arrange_session:
+        arrange_session.add(_make_app(AppMode.ADVANCED_CHAT))
 
     resume_task = mocker.patch("services.human_input_service.resume_app_execution")
 
@@ -173,14 +163,11 @@ def test_enqueue_resume_dispatches_task_for_advanced_chat(
     assert call_kwargs["kwargs"]["payload"]["workflow_run_id"] == "workflow-run-id"
 
 
-@pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
 def test_enqueue_resume_skips_unsupported_app_mode(
     mocker: MockerFixture,
-    sqlite_session_factory,
-    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
 ):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+    service = HumanInputService(sqlite_session_factory)
 
     workflow_run = MagicMock()
     workflow_run.app_id = "app-id"
@@ -192,7 +179,8 @@ def test_enqueue_resume_skips_unsupported_app_mode(
         return_value=workflow_run_repo,
     )
 
-    _persist_app(sqlite_session, AppMode.COMPLETION)
+    with sqlite_session_factory.begin() as arrange_session:
+        arrange_session.add(_make_app(AppMode.COMPLETION))
 
     resume_task = mocker.patch("services.human_input_service.resume_app_execution")
 
@@ -202,14 +190,13 @@ def test_enqueue_resume_skips_unsupported_app_mode(
 
 
 def test_get_form_definition_by_token_for_console_uses_repository(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory
+    sample_form_record: HumanInputFormRecord, unbound_session_factory
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     console_record = dataclasses.replace(sample_form_record, recipient_type=RecipientType.CONSOLE)
     repo.get_by_token.return_value = console_record
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     form = service.get_form_definition_by_token_for_console("token")
 
     repo.get_by_token.assert_called_once_with("token")
@@ -245,9 +232,8 @@ def _build_resumption_context_state(*, options: list[str], workflow_run_id: str)
 
 
 def test_resolve_form_inputs_uses_runtime_select_options(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ):
-    session_factory, _ = sqlite_session_factory
     configured_input = SelectInputConfig(
         output_variable_name="decision",
         option_source=StringListSource(
@@ -272,7 +258,7 @@ def test_resolve_form_inputs_uses_runtime_select_options(
         "services.human_input_service.DifyAPIRepositoryFactory.create_api_workflow_run_repository",
         return_value=workflow_run_repo,
     )
-    service = HumanInputService(session_factory)
+    service = HumanInputService(unbound_session_factory)
 
     resolved_inputs = service.resolve_form_inputs(Form(record))
 
@@ -284,13 +270,12 @@ def test_resolve_form_inputs_uses_runtime_select_options(
 
 
 def test_submit_form_by_token_calls_repository_and_enqueue(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
     repo.mark_submitted.return_value = sample_form_record
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     enqueue_spy = mocker.patch.object(service, "enqueue_resume")
 
     service.submit_form_by_token(
@@ -313,11 +298,10 @@ def test_submit_form_by_token_calls_repository_and_enqueue(
 
 
 def test_submit_form_by_token_enqueues_agent_app_resume_for_conversation_form(
-    sample_form_record, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record, unbound_session_factory, mocker: MockerFixture
 ):
     # ENG-635: a conversation-owned (Agent v2 chat) form routes to the chat
     # resume, not the workflow resume.
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     conversation_record = dataclasses.replace(
         sample_form_record,
@@ -326,7 +310,7 @@ def test_submit_form_by_token_enqueues_agent_app_resume_for_conversation_form(
     )
     repo.get_by_token.return_value = conversation_record
     repo.mark_submitted.return_value = conversation_record
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     workflow_enqueue_spy = mocker.patch.object(service, "enqueue_resume")
     chat_enqueue_spy = mocker.patch.object(service, "enqueue_agent_app_resume")
 
@@ -343,9 +327,8 @@ def test_submit_form_by_token_enqueues_agent_app_resume_for_conversation_form(
 
 
 def test_submit_form_by_token_skips_enqueue_for_delivery_test(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     test_record = dataclasses.replace(
         sample_form_record,
@@ -354,7 +337,7 @@ def test_submit_form_by_token_skips_enqueue_for_delivery_test(
     )
     repo.get_by_token.return_value = test_record
     repo.mark_submitted.return_value = test_record
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     enqueue_spy = mocker.patch.object(service, "enqueue_resume")
 
     service.submit_form_by_token(
@@ -368,13 +351,12 @@ def test_submit_form_by_token_skips_enqueue_for_delivery_test(
 
 
 def test_submit_form_by_token_passes_submission_user_id(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
     repo.mark_submitted.return_value = sample_form_record
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     enqueue_spy = mocker.patch.object(service, "enqueue_resume")
 
     service.submit_form_by_token(
@@ -391,11 +373,10 @@ def test_submit_form_by_token_passes_submission_user_id(
     enqueue_spy.assert_called_once_with(sample_form_record.workflow_run_id)
 
 
-def test_submit_form_by_token_invalid_action(sample_form_record: HumanInputFormRecord, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
+def test_submit_form_by_token_invalid_action(sample_form_record: HumanInputFormRecord, unbound_session_factory):
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record)
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
 
     with pytest.raises(InvalidFormDataError) as exc_info:
         service.submit_form_by_token(
@@ -409,8 +390,7 @@ def test_submit_form_by_token_invalid_action(sample_form_record: HumanInputFormR
     repo.mark_submitted.assert_not_called()
 
 
-def test_submit_form_by_token_missing_inputs(sample_form_record: HumanInputFormRecord, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
+def test_submit_form_by_token_missing_inputs(sample_form_record: HumanInputFormRecord, unbound_session_factory):
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
 
     definition_with_input = FormDefinition(
@@ -422,7 +402,7 @@ def test_submit_form_by_token_missing_inputs(sample_form_record: HumanInputFormR
     )
     form_with_input = dataclasses.replace(sample_form_record, definition=definition_with_input)
     repo.get_by_token.return_value = form_with_input
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
 
     with pytest.raises(InvalidFormDataError) as exc_info:
         service.submit_form_by_token(
@@ -436,42 +416,6 @@ def test_submit_form_by_token_missing_inputs(sample_form_record: HumanInputFormR
     repo.mark_submitted.assert_not_called()
 
 
-def test_validate_human_input_submission_accepts_select_file_and_file_list(sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
-    definition = FormDefinition.model_validate(
-        {
-            "form_content": "Pick one and upload files",
-            "inputs": [
-                {
-                    "type": "select",
-                    "output_variable_name": "decision",
-                    "option_source": {
-                        "type": "constant",
-                        "value": ["approve", "reject"],
-                    },
-                },
-                {
-                    "type": "file",
-                    "output_variable_name": "attachment",
-                    "allowed_file_types": ["document"],
-                    "allowed_file_upload_methods": ["remote_url"],
-                },
-                {
-                    "type": "file-list",
-                    "output_variable_name": "attachments",
-                    "allowed_file_types": ["document"],
-                    "allowed_file_upload_methods": ["remote_url"],
-                    "number_limits": 3,
-                },
-            ],
-            "user_actions": [{"id": "submit", "title": "Submit"}],
-            "rendered_content": "<p>Pick one and upload files</p>",
-            "expiration_time": naive_utc_now() + timedelta(hours=1),
-        }
-    )
-
-
 @pytest.mark.parametrize(
     ("input_definition", "submitted_value", "expected_message"),
     [
@@ -522,12 +466,11 @@ def test_validate_human_input_submission_accepts_select_file_and_file_list(sqlit
 )
 def test_validate_human_input_submission_rejects_invalid_select_and_file_payloads(
     sample_form_record,
-    sqlite_session_factory,
+    unbound_session_factory,
     input_definition,
     submitted_value,
     expected_message,
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition.model_validate(
         {
@@ -539,7 +482,7 @@ def test_validate_human_input_submission_rejects_invalid_select_and_file_payload
         }
     )
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record, definition=definition)
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
 
     with pytest.raises(InvalidFormDataError) as exc_info:
         service.submit_form_by_token(
@@ -569,7 +512,7 @@ def test_form_properties(sample_form_record: HumanInputFormRecord):
 
 def test_form_submitted_error_init():
     error = FormSubmittedError(form_id="test-form")
-    assert "form_id=test-form" in error.description
+    assert error.description == "This form has already been submitted by another user, form_id=test-form"
     assert error.code == 412
 
 
@@ -580,61 +523,55 @@ def test_human_input_service_init_with_engine(sqlite_engine: Engine):
     assert service._session_factory.kw["bind"] is sqlite_engine
 
 
-def test_get_form_by_token_none(sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
+def test_get_form_by_token_none(unbound_session_factory):
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = None
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     assert service.get_form_by_token("invalid") is None
 
 
-def test_get_form_definition_by_token_mismatch(sample_form_record: HumanInputFormRecord, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
+def test_get_form_definition_by_token_mismatch(sample_form_record: HumanInputFormRecord, unbound_session_factory):
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     # RecipientType mismatch
     assert service.get_form_definition_by_token(RecipientType.CONSOLE, "token") is None
 
 
-def test_get_form_definition_by_token_success(sample_form_record: HumanInputFormRecord, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
+def test_get_form_definition_by_token_success(sample_form_record: HumanInputFormRecord, unbound_session_factory):
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     form = service.get_form_definition_by_token(RecipientType.STANDALONE_WEB_APP, "token")
     assert form is not None
     assert form.id == sample_form_record.form_id
 
 
 def test_get_form_definition_by_token_for_console_mismatch(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory
+    sample_form_record: HumanInputFormRecord, unbound_session_factory
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record  # is STANDALONE_WEB_APP
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     assert service.get_form_definition_by_token_for_console("token") is None
 
 
-def test_submit_form_by_token_delivery_not_enabled(sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
+def test_submit_form_by_token_delivery_not_enabled(unbound_session_factory):
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = None
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     with pytest.raises(human_input_service_module.WebAppDeliveryNotEnabledError):
         service.submit_form_by_token(RecipientType.STANDALONE_WEB_APP, "token", "action", {})
 
 
 def test_submit_form_by_token_no_workflow_run_id(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ):
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     repo.get_by_token.return_value = sample_form_record
 
@@ -642,16 +579,15 @@ def test_submit_form_by_token_no_workflow_run_id(
     result_record = dataclasses.replace(sample_form_record, workflow_run_id=None)
     repo.mark_submitted.return_value = result_record
 
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     enqueue_spy = mocker.patch.object(service, "enqueue_resume")
 
     service.submit_form_by_token(RecipientType.STANDALONE_WEB_APP, "token", "submit", {})
     enqueue_spy.assert_not_called()
 
 
-def test_ensure_form_active_errors(sample_form_record: HumanInputFormRecord, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+def test_ensure_form_active_errors(sample_form_record: HumanInputFormRecord, unbound_session_factory):
+    service = HumanInputService(unbound_session_factory)
 
     # Submitted
     submitted_record = dataclasses.replace(sample_form_record, submitted_at=naive_utc_now())
@@ -671,18 +607,16 @@ def test_ensure_form_active_errors(sample_form_record: HumanInputFormRecord, sql
         service.ensure_form_active(Form(expired_time_record))
 
 
-def test_ensure_not_submitted_raises(sample_form_record: HumanInputFormRecord, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+def test_ensure_not_submitted_raises(sample_form_record: HumanInputFormRecord, unbound_session_factory):
+    service = HumanInputService(unbound_session_factory)
     submitted_record = dataclasses.replace(sample_form_record, submitted_at=naive_utc_now())
 
     with pytest.raises(human_input_service_module.FormSubmittedError):
         service._ensure_not_submitted(Form(submitted_record))
 
 
-def test_enqueue_resume_workflow_not_found(mocker: MockerFixture, sqlite_session_factory):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+def test_enqueue_resume_workflow_not_found(mocker: MockerFixture, unbound_session_factory):
+    service = HumanInputService(unbound_session_factory)
 
     workflow_run_repo = MagicMock()
     workflow_run_repo.get_workflow_run_by_id_without_tenant.return_value = None
@@ -696,15 +630,12 @@ def test_enqueue_resume_workflow_not_found(mocker: MockerFixture, sqlite_session
     assert "WorkflowRun not found" in str(excinfo.value)
 
 
-@pytest.mark.parametrize("sqlite_session", [(App,)], indirect=True)
 def test_enqueue_resume_app_not_found(
     mocker,
-    sqlite_session_factory,
-    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
     caplog: pytest.LogCaptureFixture,
 ):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+    service = HumanInputService(sqlite_session_factory)
 
     workflow_run = MagicMock()
     workflow_run.app_id = "app-id"
@@ -715,26 +646,31 @@ def test_enqueue_resume_app_not_found(
         "services.human_input_service.DifyAPIRepositoryFactory.create_api_workflow_run_repository",
         return_value=workflow_run_repo,
     )
+    resume_task = mocker.patch("services.human_input_service.resume_app_execution")
 
     with caplog.at_level(logging.ERROR, logger="services.human_input_service"):
         service.enqueue_resume("workflow-run-id")
-        assert any(r.levelno >= logging.ERROR for r in caplog.records)
+
+    assert (
+        "services.human_input_service",
+        logging.ERROR,
+        "App not found for WorkflowRun, workflow_run_id=workflow-run-id, app_id=app-id",
+    ) in caplog.record_tuples
+    resume_task.apply_async.assert_not_called()
 
 
 def test_is_globally_expired_zero_timeout(
-    monkeypatch: pytest.MonkeyPatch, sample_form_record: HumanInputFormRecord, sqlite_session_factory
+    monkeypatch: pytest.MonkeyPatch, sample_form_record: HumanInputFormRecord, unbound_session_factory
 ):
-    session_factory, _ = sqlite_session_factory
-    service = HumanInputService(session_factory)
+    service = HumanInputService(unbound_session_factory)
 
     monkeypatch.setattr(human_input_service_module.dify_config, "HUMAN_INPUT_GLOBAL_TIMEOUT_SECONDS", 0)
     assert service._is_globally_expired(Form(sample_form_record)) is False
 
 
 def test_submit_form_by_token_normalizes_select_and_files(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ) -> None:
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
         form_content="hello",
@@ -753,7 +689,7 @@ def test_submit_form_by_token_normalizes_select_and_files(
     form_with_inputs = dataclasses.replace(sample_form_record, definition=definition)
     repo.get_by_token.return_value = form_with_inputs
     repo.mark_submitted.return_value = form_with_inputs
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
 
     single_file = File(
         file_id="file-1",
@@ -815,9 +751,8 @@ def test_submit_form_by_token_normalizes_select_and_files(
 
 
 def test_submit_form_by_token_invalid_select_value(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory
+    sample_form_record: HumanInputFormRecord, unbound_session_factory
 ) -> None:
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
         form_content="hello",
@@ -832,7 +767,7 @@ def test_submit_form_by_token_invalid_select_value(
         expiration_time=sample_form_record.expiration_time,
     )
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record, definition=definition)
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
 
     with pytest.raises(InvalidFormDataError, match="Invalid value for select input 'decision'"):
         service.submit_form_by_token(
@@ -844,9 +779,8 @@ def test_submit_form_by_token_invalid_select_value(
 
 
 def test_submit_form_by_token_invalid_file_list_item(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory
+    sample_form_record: HumanInputFormRecord, unbound_session_factory
 ) -> None:
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
         form_content="hello",
@@ -856,7 +790,7 @@ def test_submit_form_by_token_invalid_file_list_item(
         expiration_time=sample_form_record.expiration_time,
     )
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record, definition=definition)
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
 
     with pytest.raises(
         InvalidFormDataError,
@@ -871,9 +805,8 @@ def test_submit_form_by_token_invalid_file_list_item(
 
 
 def test_submit_form_by_token_rejects_cross_tenant_file(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ) -> None:
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
         form_content="hello",
@@ -883,7 +816,7 @@ def test_submit_form_by_token_rejects_cross_tenant_file(
         expiration_time=sample_form_record.expiration_time,
     )
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record, definition=definition)
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     mocker.patch("services.human_input_service.build_from_mapping", side_effect=ValueError("Invalid upload file"))
 
     with pytest.raises(InvalidFormDataError, match="Invalid value for file input 'attachment'"):
@@ -904,9 +837,8 @@ def test_submit_form_by_token_rejects_cross_tenant_file(
 
 
 def test_submit_form_by_token_rejects_cross_tenant_file_list(
-    sample_form_record: HumanInputFormRecord, sqlite_session_factory, mocker: MockerFixture
+    sample_form_record: HumanInputFormRecord, unbound_session_factory, mocker: MockerFixture
 ) -> None:
-    session_factory, _ = sqlite_session_factory
     repo = MagicMock(spec=HumanInputFormSubmissionRepository)
     definition = FormDefinition(
         form_content="hello",
@@ -916,7 +848,7 @@ def test_submit_form_by_token_rejects_cross_tenant_file_list(
         expiration_time=sample_form_record.expiration_time,
     )
     repo.get_by_token.return_value = dataclasses.replace(sample_form_record, definition=definition)
-    service = HumanInputService(session_factory, form_repository=repo)
+    service = HumanInputService(unbound_session_factory, form_repository=repo)
     mocker.patch("services.human_input_service.build_from_mappings", side_effect=ValueError("Invalid upload file"))
 
     with pytest.raises(

api/tests/unit_tests/services/test_oauth_server_service.py

@@ -1,16 +1,20 @@
-"""Testcontainers integration tests for OAuthServerService."""
+"""Unit tests for OAuthServerService with SQLite-backed database access."""
 
 from __future__ import annotations
 
 import uuid
+from collections.abc import Iterator
 from typing import cast
 from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
+from flask import Flask
+from sqlalchemy import Engine
 from sqlalchemy.orm import Session
 from werkzeug.exceptions import BadRequest
 
+from models.engine import db
 from models.model import OAuthProviderApp
 from services.oauth_server import (
     OAUTH_ACCESS_TOKEN_EXPIRES_IN,
@@ -23,10 +27,24 @@ from services.oauth_server import (
 )
 
 
-class TestOAuthServerServiceGetProviderApp:
-    """DB-backed tests for get_oauth_provider_app."""
+@pytest.fixture
+def oauth_db() -> Iterator[Session]:
+    """Provide the production database extension with an isolated SQLite provider table."""
+    app = Flask(__name__)
+    app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///:memory:"
+    db.init_app(app)
 
-    def _create_oauth_provider_app(self, db_session_with_containers: Session, *, client_id: str) -> OAuthProviderApp:
+    with app.app_context():
+        OAuthProviderApp.__table__.create(db.engine)
+        with Session(db.engine, expire_on_commit=False) as session:
+            yield session
+
+
+class TestOAuthServerServiceGetProviderApp:
+    """Verify provider lookup against a real SQLAlchemy database."""
+
+    def test_get_oauth_provider_app_returns_app_when_exists(self, oauth_db: Session) -> None:
+        client_id = f"client-{uuid4()}"
         app = OAuthProviderApp(
             app_icon="icon.png",
             client_id=client_id,
@@ -35,35 +53,30 @@ class TestOAuthServerServiceGetProviderApp:
             redirect_uris=["https://example.com/callback"],
             scope="read",
         )
-        db_session_with_containers.add(app)
-        db_session_with_containers.commit()
-        return app
-
-    def test_get_oauth_provider_app_returns_app_when_exists(self, db_session_with_containers: Session):
-        client_id = f"client-{uuid4()}"
-        created = self._create_oauth_provider_app(db_session_with_containers, client_id=client_id)
+        oauth_db.add(app)
+        oauth_db.commit()
 
         result = OAuthServerService.get_oauth_provider_app(client_id)
 
         assert result is not None
         assert result.client_id == client_id
-        assert result.id == created.id
+        assert result.id == app.id
 
-    def test_get_oauth_provider_app_returns_none_when_not_exists(self, db_session_with_containers: Session):
+    def test_get_oauth_provider_app_returns_none_when_not_exists(self, oauth_db: Session) -> None:
         result = OAuthServerService.get_oauth_provider_app(f"nonexistent-{uuid4()}")
 
         assert result is None
 
 
 class TestOAuthServerServiceTokenOperations:
-    """Redis-backed tests for token sign/validate operations."""
+    """Verify Redis-backed token signing and validation branches."""
 
     @pytest.fixture
     def mock_redis(self):
         with patch("services.oauth_server.redis_client") as mock:
             yield mock
 
-    def test_sign_authorization_code_stores_and_returns_code(self, mock_redis):
+    def test_sign_authorization_code_stores_and_returns_code(self, mock_redis) -> None:
         deterministic_uuid = uuid.UUID("00000000-0000-0000-0000-000000000111")
         with patch("services.oauth_server.uuid.uuid4", return_value=deterministic_uuid):
             code = OAuthServerService.sign_oauth_authorization_code("client-1", "user-1")
@@ -75,7 +88,7 @@ class TestOAuthServerServiceTokenOperations:
             ex=600,
         )
 
-    def test_sign_access_token_raises_bad_request_for_invalid_code(self, mock_redis):
+    def test_sign_access_token_raises_bad_request_for_invalid_code(self, mock_redis) -> None:
         mock_redis.get.return_value = None
 
         with pytest.raises(BadRequest, match="invalid code"):
@@ -85,14 +98,13 @@ class TestOAuthServerServiceTokenOperations:
                 client_id="client-1",
             )
 
-    def test_sign_access_token_issues_tokens_for_valid_code(self, mock_redis):
+    def test_sign_access_token_issues_tokens_for_valid_code(self, mock_redis) -> None:
         token_uuids = [
             uuid.UUID("00000000-0000-0000-0000-000000000201"),
             uuid.UUID("00000000-0000-0000-0000-000000000202"),
         ]
         with patch("services.oauth_server.uuid.uuid4", side_effect=token_uuids):
             mock_redis.get.return_value = b"user-1"
-
             access_token, refresh_token = OAuthServerService.sign_oauth_access_token(
                 grant_type=OAuthGrantType.AUTHORIZATION_CODE,
                 code="code-1",
@@ -114,7 +126,7 @@ class TestOAuthServerServiceTokenOperations:
             ex=OAUTH_REFRESH_TOKEN_EXPIRES_IN,
         )
 
-    def test_sign_access_token_raises_bad_request_for_invalid_refresh_token(self, mock_redis):
+    def test_sign_access_token_raises_bad_request_for_invalid_refresh_token(self, mock_redis) -> None:
         mock_redis.get.return_value = None
 
         with pytest.raises(BadRequest, match="invalid refresh token"):
@@ -124,11 +136,10 @@ class TestOAuthServerServiceTokenOperations:
                 client_id="client-1",
             )
 
-    def test_sign_access_token_issues_new_token_for_valid_refresh(self, mock_redis):
+    def test_sign_access_token_issues_new_token_for_valid_refresh(self, mock_redis) -> None:
         deterministic_uuid = uuid.UUID("00000000-0000-0000-0000-000000000301")
         with patch("services.oauth_server.uuid.uuid4", return_value=deterministic_uuid):
             mock_redis.get.return_value = b"user-1"
-
             access_token, returned_refresh = OAuthServerService.sign_oauth_access_token(
                 grant_type=OAuthGrantType.REFRESH_TOKEN,
                 refresh_token="refresh-1",
@@ -138,14 +149,14 @@ class TestOAuthServerServiceTokenOperations:
         assert access_token == str(deterministic_uuid)
         assert returned_refresh == "refresh-1"
 
-    def test_sign_access_token_returns_none_for_unknown_grant_type(self, mock_redis):
+    def test_sign_access_token_returns_none_for_unknown_grant_type(self, mock_redis) -> None:
         grant_type = cast(OAuthGrantType, "invalid-grant-type")
 
         result = OAuthServerService.sign_oauth_access_token(grant_type=grant_type, client_id="client-1")
 
         assert result is None
 
-    def test_sign_refresh_token_stores_with_expected_expiry(self, mock_redis):
+    def test_sign_refresh_token_stores_with_expected_expiry(self, mock_redis) -> None:
         deterministic_uuid = uuid.UUID("00000000-0000-0000-0000-000000000401")
         with patch("services.oauth_server.uuid.uuid4", return_value=deterministic_uuid):
             refresh_token = OAuthServerService._sign_oauth_refresh_token("client-2", "user-2")
@@ -157,22 +168,21 @@ class TestOAuthServerServiceTokenOperations:
             ex=OAUTH_REFRESH_TOKEN_EXPIRES_IN,
         )
 
-    def test_validate_access_token_returns_none_when_not_found(self, mock_redis, db_session_with_containers: Session):
+    def test_validate_access_token_returns_none_when_not_found(self, mock_redis, sqlite_engine: Engine) -> None:
         mock_redis.get.return_value = None
-        session = MagicMock()
 
-        result = OAuthServerService.validate_oauth_access_token("client-1", "missing-token", db_session_with_containers)
+        with Session(sqlite_engine) as session:
+            result = OAuthServerService.validate_oauth_access_token("client-1", "missing-token", session)
 
         assert result is None
 
-    def test_validate_access_token_loads_user_when_exists(self, mock_redis, db_session_with_containers: Session):
+    def test_validate_access_token_loads_user_when_exists(self, mock_redis, sqlite_engine: Engine) -> None:
         mock_redis.get.return_value = b"user-88"
         expected_user = MagicMock()
 
-        with patch("services.oauth_server.AccountService.load_user", return_value=expected_user) as mock_load:
-            result = OAuthServerService.validate_oauth_access_token(
-                "client-1", "access-token", db_session_with_containers
-            )
+        with Session(sqlite_engine) as session:
+            with patch("services.oauth_server.AccountService.load_user", return_value=expected_user) as mock_load:
+                result = OAuthServerService.validate_oauth_access_token("client-1", "access-token", session)
+                mock_load.assert_called_once_with("user-88", session)
 
         assert result is expected_user
-        mock_load.assert_called_once_with("user-88", db_session_with_containers)

api/tests/unit_tests/services/test_workflow_app_service_metadata.py

@@ -0,0 +1,88 @@
+"""Unit tests for workflow app log views and trigger metadata helpers."""
+
+import json
+import uuid
+from unittest.mock import patch
+
+import pytest
+
+from models.enums import AppTriggerType, CreatorUserRole
+from models.workflow import WorkflowAppLog, WorkflowAppLogCreatedFrom
+from services.workflow_app_service import LogView, WorkflowAppService
+
+
+class TestLogView:
+    def test_details_and_proxy_attributes(self) -> None:
+        log = WorkflowAppLog(
+            tenant_id="tenant-1",
+            app_id="app-1",
+            workflow_id="workflow-1",
+            workflow_run_id="run-1",
+            created_from=WorkflowAppLogCreatedFrom.WEB_APP,
+            created_by_role=CreatorUserRole.ACCOUNT,
+            created_by="account-1",
+        )
+        log.id = "log-1"
+
+        view = LogView(log=log, details={"trigger_metadata": {"type": "plugin"}})
+
+        assert view.details == {"trigger_metadata": {"type": "plugin"}}
+        assert view.id == "log-1"
+
+
+class TestHandleTriggerMetadata:
+    def test_returns_empty_dict_when_metadata_missing(self) -> None:
+        assert WorkflowAppService().handle_trigger_metadata("tenant-1", None) == {}
+
+    def test_enriches_plugin_icons(self) -> None:
+        metadata = {
+            "type": AppTriggerType.TRIGGER_PLUGIN.value,
+            "icon_filename": "light.png",
+            "icon_dark_filename": "dark.png",
+        }
+        with patch(
+            "services.workflow_app_service.PluginService.get_plugin_icon_url",
+            side_effect=["https://cdn/light.png", "https://cdn/dark.png"],
+        ) as mock_icon:
+            result = WorkflowAppService().handle_trigger_metadata("tenant-1", json.dumps(metadata))
+
+        assert result["icon"] == "https://cdn/light.png"
+        assert result["icon_dark"] == "https://cdn/dark.png"
+        assert mock_icon.call_count == 2
+
+    def test_non_plugin_metadata_without_icon_lookup(self) -> None:
+        metadata = {"type": AppTriggerType.TRIGGER_WEBHOOK.value}
+        with patch("services.workflow_app_service.PluginService.get_plugin_icon_url") as mock_icon:
+            result = WorkflowAppService().handle_trigger_metadata("tenant-1", json.dumps(metadata))
+
+        assert result["type"] == AppTriggerType.TRIGGER_WEBHOOK.value
+        mock_icon.assert_not_called()
+
+
+class TestSafeJsonLoads:
+    @pytest.mark.parametrize(
+        ("value", "expected"),
+        [
+            (None, None),
+            ("", None),
+            ('{"k":"v"}', {"k": "v"}),
+            ("not-json", None),
+            ({"raw": True}, {"raw": True}),
+        ],
+    )
+    def test_handles_various_inputs(self, value, expected) -> None:
+        assert WorkflowAppService._safe_json_loads(value) == expected
+
+
+class TestSafeParseUuid:
+    def test_returns_none_for_short_or_invalid_values(self) -> None:
+        assert WorkflowAppService._safe_parse_uuid("short") is None
+        assert WorkflowAppService._safe_parse_uuid("x" * 40) is None
+
+    def test_returns_uuid_for_valid_string(self) -> None:
+        raw = str(uuid.uuid4())
+
+        result = WorkflowAppService._safe_parse_uuid(raw)
+
+        assert result is not None
+        assert str(result) == raw

api/tests/unit_tests/services/test_workflow_run_service_pause.py

@@ -1,178 +1,57 @@
-"""Comprehensive unit tests for WorkflowRunService class.
+"""Tests for the session lifecycle owned by ``WorkflowRunService``."""
 
-This test suite covers all pause state management operations including:
-- Retrieving pause state for workflow runs
-- Saving pause state with file uploads
-- Marking paused workflows as resumed
-- Error handling and edge cases
-- Database transaction management
-- Repository-based approach testing
-"""
-
-from datetime import datetime
-from unittest.mock import MagicMock, create_autospec, patch
+from unittest.mock import create_autospec, patch
 
 import pytest
-from sqlalchemy import Engine
+from sqlalchemy import Engine, text
 from sqlalchemy.orm import Session, sessionmaker
 
-from graphon.enums import WorkflowExecutionStatus
-from models.workflow import WorkflowPause
 from repositories.api_workflow_run_repository import APIWorkflowRunRepository
-from repositories.sqlalchemy_api_workflow_run_repository import _PrivateWorkflowPauseEntity
-from services.workflow_run_service import (
-    WorkflowRunService,
-)
+from services.workflow_run_service import WorkflowRunService
 
 
-class TestDataFactory:
-    """Factory class for creating test data objects."""
-
-    @staticmethod
-    def create_workflow_run_mock(
-        id: str = "workflow-run-123",
-        tenant_id: str = "tenant-456",
-        app_id: str = "app-789",
-        workflow_id: str = "workflow-101",
-        status: str | WorkflowExecutionStatus = "paused",
-        **kwargs,
-    ) -> MagicMock:
-        """Create a mock WorkflowRun object."""
-        mock_run = MagicMock()
-        mock_run.id = id
-        mock_run.tenant_id = tenant_id
-        mock_run.app_id = app_id
-        mock_run.workflow_id = workflow_id
-        mock_run.status = status
-
-        for key, value in kwargs.items():
-            setattr(mock_run, key, value)
-
-        return mock_run
-
-    @staticmethod
-    def create_workflow_pause_mock(
-        id: str = "pause-123",
-        tenant_id: str = "tenant-456",
-        app_id: str = "app-789",
-        workflow_id: str = "workflow-101",
-        workflow_execution_id: str = "workflow-execution-123",
-        state_file_id: str = "file-456",
-        resumed_at: datetime | None = None,
-        **kwargs,
-    ) -> MagicMock:
-        """Create a mock WorkflowPauseModel object."""
-        mock_pause = MagicMock(spec=WorkflowPause)
-        mock_pause.id = id
-        mock_pause.tenant_id = tenant_id
-        mock_pause.app_id = app_id
-        mock_pause.workflow_id = workflow_id
-        mock_pause.workflow_execution_id = workflow_execution_id
-        mock_pause.state_file_id = state_file_id
-        mock_pause.resumed_at = resumed_at
-
-        for key, value in kwargs.items():
-            setattr(mock_pause, key, value)
-
-        return mock_pause
-
-    @staticmethod
-    def create_pause_entity_mock(
-        pause_model: MagicMock | None = None,
-    ) -> _PrivateWorkflowPauseEntity:
-        """Create a mock _PrivateWorkflowPauseEntity object."""
-        if pause_model is None:
-            pause_model = TestDataFactory.create_workflow_pause_mock()
-
-        return _PrivateWorkflowPauseEntity(pause_model=pause_model, reason_models=[], human_input_form=[])
+@pytest.fixture
+def sqlite_session_factory(sqlite_engine: Engine) -> sessionmaker[Session]:
+    """Return a real factory whose sessions are bound to the isolated SQLite engine."""
+    return sessionmaker(bind=sqlite_engine, expire_on_commit=False)
 
 
-class TestWorkflowRunService:
-    """Comprehensive unit tests for WorkflowRunService class."""
+@pytest.fixture
+def workflow_run_repository():
+    """Keep the repository boundary mocked while exercising real session construction."""
+    return create_autospec(APIWorkflowRunRepository)
 
-    @pytest.fixture
-    def mock_session_factory(self):
-        """Create a mock session factory with proper session management."""
-        mock_session = create_autospec(Session)
 
-        # Create a mock context manager for the session
-        mock_session_cm = MagicMock()
-        mock_session_cm.__enter__ = MagicMock(return_value=mock_session)
-        mock_session_cm.__exit__ = MagicMock(return_value=None)
+def test_init_with_session_factory(
+    sqlite_session_factory: sessionmaker[Session], workflow_run_repository: APIWorkflowRunRepository
+) -> None:
+    with patch("services.workflow_run_service.DifyAPIRepositoryFactory", autospec=True) as repository_factory:
+        repository_factory.create_api_workflow_run_repository.return_value = workflow_run_repository
 
-        # Create a mock context manager for the transaction
-        mock_transaction_cm = MagicMock()
-        mock_transaction_cm.__enter__ = MagicMock(return_value=mock_session)
-        mock_transaction_cm.__exit__ = MagicMock(return_value=None)
+        service = WorkflowRunService(sqlite_session_factory)
 
-        mock_session.begin = MagicMock(return_value=mock_transaction_cm)
+    assert service._session_factory is sqlite_session_factory
+    repository_factory.create_api_workflow_run_repository.assert_called_once_with(sqlite_session_factory)
+    with service._session_factory() as session:
+        assert session.scalar(text("SELECT 1")) == 1
 
-        # Create mock factory that returns the context manager
-        mock_factory = MagicMock(spec=sessionmaker)
-        mock_factory.return_value = mock_session_cm
 
-        return mock_factory, mock_session
+def test_init_with_engine_creates_bound_session_factory(
+    sqlite_engine: Engine, workflow_run_repository: APIWorkflowRunRepository
+) -> None:
+    with patch("services.workflow_run_service.DifyAPIRepositoryFactory", autospec=True) as repository_factory:
+        repository_factory.create_api_workflow_run_repository.return_value = workflow_run_repository
 
-    @pytest.fixture
-    def mock_workflow_run_repository(self):
-        """Create a mock APIWorkflowRunRepository."""
-        mock_repo = create_autospec(APIWorkflowRunRepository)
-        return mock_repo
+        service = WorkflowRunService(sqlite_engine)
 
-    @pytest.fixture
-    def workflow_run_service(self, mock_session_factory, mock_workflow_run_repository):
-        """Create WorkflowRunService instance with mocked dependencies."""
-        session_factory, _ = mock_session_factory
+    assert service._session_factory.kw["bind"] is sqlite_engine
+    assert service._session_factory.kw["expire_on_commit"] is False
+    repository_factory.create_api_workflow_run_repository.assert_called_once_with(service._session_factory)
+    with service._session_factory() as session:
+        assert session.scalar(text("SELECT 1")) == 1
 
-        with patch("services.workflow_run_service.DifyAPIRepositoryFactory", autospec=True) as mock_factory:
-            mock_factory.create_api_workflow_run_repository.return_value = mock_workflow_run_repository
-            service = WorkflowRunService(session_factory)
-            return service
 
-    @pytest.fixture
-    def workflow_run_service_with_engine(self, mock_session_factory, mock_workflow_run_repository):
-        """Create WorkflowRunService instance with Engine input."""
-        mock_engine = create_autospec(Engine)
-        session_factory, _ = mock_session_factory
+def test_init_with_default_repository_dependencies(sqlite_session_factory: sessionmaker[Session]) -> None:
+    service = WorkflowRunService(sqlite_session_factory)
 
-        with patch("services.workflow_run_service.DifyAPIRepositoryFactory", autospec=True) as mock_factory:
-            mock_factory.create_api_workflow_run_repository.return_value = mock_workflow_run_repository
-            service = WorkflowRunService(mock_engine)
-            return service
-
-    # ==================== Initialization Tests ====================
-
-    def test_init_with_session_factory(self, mock_session_factory, mock_workflow_run_repository):
-        """Test WorkflowRunService initialization with session_factory."""
-        session_factory, _ = mock_session_factory
-
-        with patch("services.workflow_run_service.DifyAPIRepositoryFactory", autospec=True) as mock_factory:
-            mock_factory.create_api_workflow_run_repository.return_value = mock_workflow_run_repository
-            service = WorkflowRunService(session_factory)
-
-            assert service._session_factory == session_factory
-            mock_factory.create_api_workflow_run_repository.assert_called_once_with(session_factory)
-
-    def test_init_with_engine(self, mock_session_factory, mock_workflow_run_repository):
-        """Test WorkflowRunService initialization with Engine (should convert to sessionmaker)."""
-        mock_engine = create_autospec(Engine)
-        session_factory, _ = mock_session_factory
-
-        with patch("services.workflow_run_service.DifyAPIRepositoryFactory", autospec=True) as mock_factory:
-            mock_factory.create_api_workflow_run_repository.return_value = mock_workflow_run_repository
-            with patch(
-                "services.workflow_run_service.sessionmaker", return_value=session_factory, autospec=True
-            ) as mock_sessionmaker:
-                service = WorkflowRunService(mock_engine)
-
-                mock_sessionmaker.assert_called_once_with(bind=mock_engine, expire_on_commit=False)
-                assert service._session_factory == session_factory
-                mock_factory.create_api_workflow_run_repository.assert_called_once_with(session_factory)
-
-    def test_init_with_default_dependencies(self, mock_session_factory):
-        """Test WorkflowRunService initialization with default dependencies."""
-        session_factory, _ = mock_session_factory
-
-        service = WorkflowRunService(session_factory)
-
-        assert service._session_factory == session_factory
+    assert service._session_factory is sqlite_session_factory

docker/.env.example

@@ -157,9 +157,6 @@ ENABLE_WEBSITE_JINAREADER=true
 ENABLE_WEBSITE_FIRECRAWL=true
 ENABLE_WEBSITE_WATERCRAWL=true
 NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=false
-# Enable preview features still in development (currently the /create and
-# /refine slash commands in the "Go to Anything" command palette).
-NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW=true
 NEXT_PUBLIC_ENABLE_AGENT_V2=true
 EXPERIMENTAL_ENABLE_VINEXT=false
 

packages/contracts/generated/api/console/agent/zod.gen.ts

@@ -997,11 +997,15 @@ export const zSandboxListResponse = z.object({
  * Validated metadata extracted from a Skill package.
  */
 export const zSkillManifest = z.object({
-  description: z.string(),
+  description: z.string().min(1).max(1024),
   entry_path: z.string(),
   files: z.array(z.string()),
   hash: z.string(),
-  name: z.string(),
+  name: z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
   size: z.int(),
 })
 

packages/contracts/generated/api/console/apps/zod.gen.ts

@@ -1373,11 +1373,15 @@ export const zAgentLogMetaResponse = z.object({
  * Validated metadata extracted from a Skill package.
  */
 export const zSkillManifest = z.object({
-  description: z.string(),
+  description: z.string().min(1).max(1024),
   entry_path: z.string(),
   files: z.array(z.string()),
   hash: z.string(),
-  name: z.string(),
+  name: z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
   size: z.int(),
 })
 

packages/contracts/generated/api/console/tag-bindings/types.gen.ts

@@ -20,7 +20,7 @@ export type TagBindingRemovePayload = {
   type: TagType
 }
 
-export type TagType = 'app' | 'knowledge' | 'snippet'
+export type TagType = 'app' | 'knowledge' | 'skill' | 'snippet'
 
 export type PostTagBindingsData = {
   body: TagBindingPayload

packages/contracts/generated/api/console/tag-bindings/zod.gen.ts

@@ -14,7 +14,7 @@ export const zSimpleResultResponse = z.object({
  *
  * Tag type
  */
-export const zTagType = z.enum(['app', 'knowledge', 'snippet'])
+export const zTagType = z.enum(['app', 'knowledge', 'skill', 'snippet'])
 
 /**
  * TagBindingPayload

packages/contracts/generated/api/console/tags/types.gen.ts

@@ -22,14 +22,14 @@ export type TagUpdateRequestPayload = {
   name: string
 }
 
-export type TagType = 'app' | 'knowledge' | 'snippet'
+export type TagType = 'app' | 'knowledge' | 'skill' | 'snippet'
 
 export type GetTagsData = {
   body?: never
   path?: never
   query?: {
     keyword?: string
-    type?: '' | 'app' | 'knowledge' | 'snippet'
+    type?: '' | 'app' | 'knowledge' | 'skill' | 'snippet'
   }
   url: '/tags'
 }

packages/contracts/generated/api/console/tags/zod.gen.ts

@@ -29,7 +29,7 @@ export const zTagUpdateRequestPayload = z.object({
  *
  * Tag type
  */
-export const zTagType = z.enum(['app', 'knowledge', 'snippet'])
+export const zTagType = z.enum(['app', 'knowledge', 'skill', 'snippet'])
 
 /**
  * TagBasePayload
@@ -41,7 +41,7 @@ export const zTagBasePayload = z.object({
 
 export const zGetTagsQuery = z.object({
   keyword: z.string().optional(),
-  type: z.enum(['', 'app', 'knowledge', 'snippet']).optional().default(''),
+  type: z.enum(['', 'app', 'knowledge', 'skill', 'snippet']).optional().default(''),
 })
 
 /**

packages/contracts/generated/api/console/workspaces/types.gen.ts

@@ -32,6 +32,16 @@ export type AgentProviderListResponse = Array<{
   [key: string]: unknown
 }>
 
+export type AgentSkillBindingsResponse = {
+  agent_id: string
+  data?: Array<AgentSkillBindingItemResponse>
+  skill_ids?: Array<string>
+}
+
+export type AgentSkillBindingsPayload = {
+  skill_ids?: Array<string>
+}
+
 export type SnippetPaginationResponse = {
   data: Array<SnippetListItemResponse>
   has_more: boolean
@@ -635,6 +645,194 @@ export type WorkspaceAccessMatrix = {
   pagination?: Pagination | null
 }
 
+export type SkillListResponse = {
+  data?: Array<SkillResponse>
+  has_more?: boolean
+  limit?: number
+  page?: number
+  total?: number
+}
+
+export type SkillCreatePayload = {
+  description?: string
+  display_name?: string | null
+  icon?: string
+  name?: string | null
+  tags?: Array<string>
+}
+
+export type SkillDetailResponse = {
+  created_at: number
+  created_by?: string | null
+  created_by_name?: string | null
+  description: string
+  display_name: string
+  files?: Array<SkillFileResponse>
+  icon: string
+  id: string
+  latest_published_version_id?: string | null
+  name: string
+  name_manually_edited?: boolean
+  reference_count?: number
+  tags?: Array<string>
+  updated_at: number
+  updated_by?: string | null
+  updated_by_name?: string | null
+  visibility: string
+}
+
+export type SkillFileUploadResponse = {
+  hash: string
+  id: string
+  mime_type: string
+  name: string
+  size: number
+}
+
+export type SkillTagListResponse = {
+  data?: Array<SkillTagResponse>
+}
+
+export type SkillDeletePayload = {
+  confirmation_name?: string | null
+}
+
+export type SkillDeleteResponse = {
+  deleted: boolean
+  id: string
+}
+
+export type SkillMetadataPayload = {
+  display_name?: string | null
+  expected_updated_at?: number | null
+  icon?: string | null
+  tags?: Array<string> | null
+}
+
+export type SkillResponse = {
+  created_at: number
+  created_by?: string | null
+  created_by_name?: string | null
+  description: string
+  display_name: string
+  icon: string
+  id: string
+  latest_published_version_id?: string | null
+  name: string
+  name_manually_edited?: boolean
+  reference_count?: number
+  tags?: Array<string>
+  updated_at: number
+  updated_by?: string | null
+  updated_by_name?: string | null
+  visibility: string
+}
+
+export type SkillAssistModelPayload = {
+  model: string
+  model_settings?: { [key: string]: unknown } | null
+  plugin_id?: string | null
+  provider: string
+}
+
+export type SkillAssistAttachmentPayload = {
+  mime_type?: string | null
+  name: string
+  size?: number | null
+  tool_file_id: string
+}
+
+export type SkillAssistMessagePayload = {
+  attachments?: Array<SkillAssistAttachmentPayload>
+  message: string
+  model?: SkillAssistModelPayload | null
+  target_path?: string | null
+}
+
+export type SkillDraftFileOperationPayload = {
+  content?: string | null
+  expected_updated_at?: number | null
+  hash?: string | null
+  mime_type?: string | null
+  operation: SkillDraftFileOperation
+  path: string
+  size?: number | null
+  target_path?: string | null
+  tool_file_id?: string | null
+}
+
+export type SkillDraftTreePayload = {
+  expected_updated_at?: number | null
+  files?: Array<SkillDraftTreeItemPayload>
+}
+
+export type SkillFilePreviewResponse = {
+  content: string
+  hash: string
+  mime_type: string
+  path: string
+  size: number
+}
+
+export type SkillPublishPayload = {
+  publish_note?: string
+  version_name?: string | null
+}
+
+export type SkillVersionResponse = {
+  archive_size: number
+  created_at: number
+  hash_code: string
+  id: string
+  is_latest?: boolean
+  publish_note: string
+  published_by?: string | null
+  published_by_name?: string | null
+  skill_id: string
+  version_name: string
+  version_number: number
+}
+
+export type SkillReferenceListResponse = {
+  data?: Array<SkillReferenceResponse>
+}
+
+export type SkillRestorePayload = {
+  publish_note?: string
+  version_id: string
+  version_name?: string | null
+}
+
+export type SkillVersionListResponse = {
+  data?: Array<SkillVersionResponse>
+}
+
+export type SkillVersionDeleteResponse = {
+  deleted: boolean
+  id: string
+  latest_published_version_id?: string | null
+}
+
+export type SkillVersionDetailResponse = {
+  archive_size: number
+  created_at: number
+  files?: Array<SkillFileResponse>
+  hash_code: string
+  id: string
+  is_latest?: boolean
+  publish_note: string
+  published_by?: string | null
+  published_by_name?: string | null
+  skill_id: string
+  version_name: string
+  version_number: number
+}
+
+export type SkillVersionUpdatePayload = {
+  publish_note?: string
+  version_name?: string | null
+}
+
 export type ToolLabelListResponse = Array<ToolLabel>
 
 export type ApiToolProviderAddPayload = {
@@ -1042,6 +1240,21 @@ export type WorkspaceCustomConfigResponse = {
   replace_webapp_logo?: string | null
 }
 
+export type AgentSkillBindingItemResponse = {
+  description: string
+  display_name: string
+  file_count: number
+  icon: string
+  id: string
+  latest_published_at?: number | null
+  latest_published_version_id?: string | null
+  name: string
+  priority: number
+  status: string
+  tags?: Array<string>
+  updated_at: number
+}
+
 export type SnippetListItemResponse = {
   author_name: string | null
   created_at: number
@@ -1502,6 +1715,60 @@ export type AccessPolicyRole = {
   role_tag?: string
 }
 
+export type SkillFileResponse = {
+  content?: string | null
+  hash?: string | null
+  id?: string | null
+  kind: string
+  mime_type?: string | null
+  path: string
+  size?: number | null
+  storage?: string | null
+  tool_file_id?: string | null
+}
+
+export type SkillTagResponse = {
+  count: number
+  tag: string
+}
+
+export type SkillDraftFileOperation =
+  | 'delete'
+  | 'mkdir'
+  | 'rename'
+  | 'upsert_text'
+  | 'upsert_tool_file'
+
+export type SkillDraftTreeItemPayload = {
+  content?: string | null
+  hash?: string | null
+  kind?: SkillFileKind
+  mime_type?: string | null
+  path: string
+  size?: number | null
+  storage?: SkillFileStorage | null
+  tool_file_id?: string | null
+}
+
+export type SkillReferenceResponse = {
+  agent_id: string
+  agent_icon?: string | null
+  agent_icon_background?: string | null
+  agent_icon_type?: string | null
+  app_id?: string | null
+  display_name: string
+  name: string
+  node_id?: string | null
+  node_name?: string | null
+  type: string
+  workflow_icon?: string | null
+  workflow_icon_background?: string | null
+  workflow_icon_type?: string | null
+  workflow_id?: string | null
+  workflow_name?: string | null
+  workflow_version?: string | null
+}
+
 export type ToolLabel = {
   icon: string
   label: I18nObject
@@ -1978,6 +2245,10 @@ export type PermissionCatalogItem = {
   name: string
 }
 
+export type SkillFileKind = 'directory' | 'file'
+
+export type SkillFileStorage = 'text' | 'tool_file'
+
 export type ToolParameter = {
   auto_generate?: PluginParameterAutoGenerate | null
   default?:
@@ -2473,6 +2744,38 @@ export type GetWorkspacesCurrentAgentProvidersResponses = {
 export type GetWorkspacesCurrentAgentProvidersResponse =
   GetWorkspacesCurrentAgentProvidersResponses[keyof GetWorkspacesCurrentAgentProvidersResponses]
 
+export type GetWorkspacesCurrentAgentsByAgentIdSkillsData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/workspaces/current/agents/{agent_id}/skills'
+}
+
+export type GetWorkspacesCurrentAgentsByAgentIdSkillsResponses = {
+  200: AgentSkillBindingsResponse
+}
+
+export type GetWorkspacesCurrentAgentsByAgentIdSkillsResponse =
+  GetWorkspacesCurrentAgentsByAgentIdSkillsResponses[keyof GetWorkspacesCurrentAgentsByAgentIdSkillsResponses]
+
+export type PutWorkspacesCurrentAgentsByAgentIdSkillsData = {
+  body: AgentSkillBindingsPayload
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/workspaces/current/agents/{agent_id}/skills'
+}
+
+export type PutWorkspacesCurrentAgentsByAgentIdSkillsResponses = {
+  200: AgentSkillBindingsResponse
+}
+
+export type PutWorkspacesCurrentAgentsByAgentIdSkillsResponse =
+  PutWorkspacesCurrentAgentsByAgentIdSkillsResponses[keyof PutWorkspacesCurrentAgentsByAgentIdSkillsResponses]
+
 export type GetWorkspacesCurrentCustomizedSnippetsData = {
   body?: never
   path?: never
@@ -4625,6 +4928,369 @@ export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses = {
 export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse =
   GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses[keyof GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses]
 
+export type GetWorkspacesCurrentSkillsData = {
+  body?: never
+  path?: never
+  query?: {
+    keyword?: string
+    limit?: number
+    page?: number
+    tag?: Array<string>
+  }
+  url: '/workspaces/current/skills'
+}
+
+export type GetWorkspacesCurrentSkillsResponses = {
+  200: SkillListResponse
+}
+
+export type GetWorkspacesCurrentSkillsResponse =
+  GetWorkspacesCurrentSkillsResponses[keyof GetWorkspacesCurrentSkillsResponses]
+
+export type PostWorkspacesCurrentSkillsData = {
+  body: SkillCreatePayload
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills'
+}
+
+export type PostWorkspacesCurrentSkillsResponses = {
+  201: SkillDetailResponse
+}
+
+export type PostWorkspacesCurrentSkillsResponse =
+  PostWorkspacesCurrentSkillsResponses[keyof PostWorkspacesCurrentSkillsResponses]
+
+export type PostWorkspacesCurrentSkillsFilesUploadData = {
+  body: {
+    file: Blob | File
+  }
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills/files/upload'
+}
+
+export type PostWorkspacesCurrentSkillsFilesUploadResponses = {
+  201: SkillFileUploadResponse
+}
+
+export type PostWorkspacesCurrentSkillsFilesUploadResponse =
+  PostWorkspacesCurrentSkillsFilesUploadResponses[keyof PostWorkspacesCurrentSkillsFilesUploadResponses]
+
+export type PostWorkspacesCurrentSkillsImportData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills/import'
+}
+
+export type PostWorkspacesCurrentSkillsImportResponses = {
+  201: SkillDetailResponse
+}
+
+export type PostWorkspacesCurrentSkillsImportResponse =
+  PostWorkspacesCurrentSkillsImportResponses[keyof PostWorkspacesCurrentSkillsImportResponses]
+
+export type GetWorkspacesCurrentSkillsTagsData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills/tags'
+}
+
+export type GetWorkspacesCurrentSkillsTagsResponses = {
+  200: SkillTagListResponse
+}
+
+export type GetWorkspacesCurrentSkillsTagsResponse =
+  GetWorkspacesCurrentSkillsTagsResponses[keyof GetWorkspacesCurrentSkillsTagsResponses]
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdData = {
+  body: SkillDeletePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}'
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdResponses = {
+  200: SkillDeleteResponse
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdResponse =
+  DeleteWorkspacesCurrentSkillsBySkillIdResponses[keyof DeleteWorkspacesCurrentSkillsBySkillIdResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdResponses = {
+  200: SkillDetailResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdResponse =
+  GetWorkspacesCurrentSkillsBySkillIdResponses[keyof GetWorkspacesCurrentSkillsBySkillIdResponses]
+
+export type PatchWorkspacesCurrentSkillsBySkillIdData = {
+  body: SkillMetadataPayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}'
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdResponses = {
+  200: SkillResponse
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdResponse =
+  PatchWorkspacesCurrentSkillsBySkillIdResponses[keyof PatchWorkspacesCurrentSkillsBySkillIdResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdAssistMessagesData = {
+  body: SkillAssistMessagePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/assist/messages'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponses = {
+  200: {
+    [key: string]: unknown
+  }
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponse =
+  PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponses[keyof PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdDuplicateData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/duplicate'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdDuplicateResponses = {
+  201: SkillDetailResponse
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdDuplicateResponse =
+  PostWorkspacesCurrentSkillsBySkillIdDuplicateResponses[keyof PostWorkspacesCurrentSkillsBySkillIdDuplicateResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdExportData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/export'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdExportResponses = {
+  200: {
+    [key: string]: unknown
+  }
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdExportResponse =
+  GetWorkspacesCurrentSkillsBySkillIdExportResponses[keyof GetWorkspacesCurrentSkillsBySkillIdExportResponses]
+
+export type PatchWorkspacesCurrentSkillsBySkillIdFilesData = {
+  body: SkillDraftFileOperationPayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/files'
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdFilesResponses = {
+  200: SkillDetailResponse
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdFilesResponse =
+  PatchWorkspacesCurrentSkillsBySkillIdFilesResponses[keyof PatchWorkspacesCurrentSkillsBySkillIdFilesResponses]
+
+export type PutWorkspacesCurrentSkillsBySkillIdFilesData = {
+  body: SkillDraftTreePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/files'
+}
+
+export type PutWorkspacesCurrentSkillsBySkillIdFilesResponses = {
+  200: SkillDetailResponse
+}
+
+export type PutWorkspacesCurrentSkillsBySkillIdFilesResponse =
+  PutWorkspacesCurrentSkillsBySkillIdFilesResponses[keyof PutWorkspacesCurrentSkillsBySkillIdFilesResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesContentData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query: {
+    download?: string
+    path: string
+    version_id?: string
+  }
+  url: '/workspaces/current/skills/{skill_id}/files/content'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesContentResponses = {
+  200: BinaryFileResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesContentResponse =
+  GetWorkspacesCurrentSkillsBySkillIdFilesContentResponses[keyof GetWorkspacesCurrentSkillsBySkillIdFilesContentResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesPreviewData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query: {
+    path: string
+    version_id?: string
+  }
+  url: '/workspaces/current/skills/{skill_id}/files/preview'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponses = {
+  200: SkillFilePreviewResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponse =
+  GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponses[keyof GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdPublishData = {
+  body: SkillPublishPayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/publish'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdPublishResponses = {
+  200: SkillVersionResponse
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdPublishResponse =
+  PostWorkspacesCurrentSkillsBySkillIdPublishResponses[keyof PostWorkspacesCurrentSkillsBySkillIdPublishResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdReferencesData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/references'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdReferencesResponses = {
+  200: SkillReferenceListResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdReferencesResponse =
+  GetWorkspacesCurrentSkillsBySkillIdReferencesResponses[keyof GetWorkspacesCurrentSkillsBySkillIdReferencesResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdRestoreData = {
+  body: SkillRestorePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/restore'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdRestoreResponses = {
+  200: SkillVersionResponse
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdRestoreResponse =
+  PostWorkspacesCurrentSkillsBySkillIdRestoreResponses[keyof PostWorkspacesCurrentSkillsBySkillIdRestoreResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsResponses = {
+  200: SkillVersionListResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsResponse =
+  GetWorkspacesCurrentSkillsBySkillIdVersionsResponses[keyof GetWorkspacesCurrentSkillsBySkillIdVersionsResponses]
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdData = {
+  body?: never
+  path: {
+    skill_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions/{version_id}'
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses = {
+  200: SkillVersionDeleteResponse
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses[keyof DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdData = {
+  body?: never
+  path: {
+    skill_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions/{version_id}'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses = {
+  200: SkillVersionDetailResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses[keyof GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses]
+
+export type PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdData = {
+  body: SkillVersionUpdatePayload
+  path: {
+    skill_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions/{version_id}'
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses = {
+  200: SkillVersionResponse
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses[keyof PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses]
+
 export type GetWorkspacesCurrentToolLabelsData = {
   body?: never
   path?: never

packages/contracts/generated/api/console/workspaces/zod.gen.ts

@@ -12,6 +12,13 @@ export const zAgentProviderResponse = z.record(z.string(), z.unknown())
  */
 export const zAgentProviderListResponse = z.array(z.record(z.string(), z.unknown()))
 
+/**
+ * AgentSkillBindingsPayload
+ */
+export const zAgentSkillBindingsPayload = z.object({
+  skill_ids: z.array(z.string()).optional(),
+})
+
 /**
  * SnippetImportPayload
  *
@@ -436,6 +443,155 @@ export const zReplaceBindingsRequest = z.object({
   role_ids: z.array(z.string()).optional(),
 })
 
+/**
+ * SkillCreatePayload
+ */
+export const zSkillCreatePayload = z.object({
+  description: z.string().optional().default(''),
+  display_name: z.string().nullish(),
+  icon: z.string().optional().default('📄'),
+  name: z.string().nullish(),
+  tags: z.array(z.string()).optional(),
+})
+
+/**
+ * SkillFileUploadResponse
+ */
+export const zSkillFileUploadResponse = z.object({
+  hash: z.string(),
+  id: z.string(),
+  mime_type: z.string(),
+  name: z.string(),
+  size: z.int(),
+})
+
+/**
+ * SkillDeletePayload
+ */
+export const zSkillDeletePayload = z.object({
+  confirmation_name: z.string().nullish(),
+})
+
+/**
+ * SkillDeleteResponse
+ */
+export const zSkillDeleteResponse = z.object({
+  deleted: z.boolean(),
+  id: z.string(),
+})
+
+/**
+ * SkillMetadataPayload
+ */
+export const zSkillMetadataPayload = z.object({
+  display_name: z.string().nullish(),
+  expected_updated_at: z.int().nullish(),
+  icon: z.string().nullish(),
+  tags: z.array(z.string()).nullish(),
+})
+
+/**
+ * SkillResponse
+ */
+export const zSkillResponse = z.object({
+  created_at: z.int(),
+  created_by: z.string().nullish(),
+  created_by_name: z.string().nullish(),
+  description: z.string(),
+  display_name: z.string(),
+  icon: z.string(),
+  id: z.string(),
+  latest_published_version_id: z.string().nullish(),
+  name: z.string(),
+  name_manually_edited: z.boolean().optional().default(false),
+  reference_count: z.int().optional().default(0),
+  tags: z.array(z.string()).optional(),
+  updated_at: z.int(),
+  updated_by: z.string().nullish(),
+  updated_by_name: z.string().nullish(),
+  visibility: z.string(),
+})
+
+/**
+ * SkillListResponse
+ */
+export const zSkillListResponse = z.object({
+  data: z.array(zSkillResponse).optional(),
+  has_more: z.boolean().optional().default(false),
+  limit: z.int().optional().default(20),
+  page: z.int().optional().default(1),
+  total: z.int().optional().default(0),
+})
+
+/**
+ * SkillFilePreviewResponse
+ */
+export const zSkillFilePreviewResponse = z.object({
+  content: z.string(),
+  hash: z.string(),
+  mime_type: z.string(),
+  path: z.string(),
+  size: z.int(),
+})
+
+/**
+ * SkillPublishPayload
+ */
+export const zSkillPublishPayload = z.object({
+  publish_note: z.string().max(1024).optional().default(''),
+  version_name: z.string().max(128).nullish(),
+})
+
+/**
+ * SkillVersionResponse
+ */
+export const zSkillVersionResponse = z.object({
+  archive_size: z.int(),
+  created_at: z.int(),
+  hash_code: z.string(),
+  id: z.string(),
+  is_latest: z.boolean().optional().default(false),
+  publish_note: z.string(),
+  published_by: z.string().nullish(),
+  published_by_name: z.string().nullish(),
+  skill_id: z.string(),
+  version_name: z.string(),
+  version_number: z.int(),
+})
+
+/**
+ * SkillRestorePayload
+ */
+export const zSkillRestorePayload = z.object({
+  publish_note: z.string().max(1024).optional().default(''),
+  version_id: z.string(),
+  version_name: z.string().max(128).nullish(),
+})
+
+/**
+ * SkillVersionListResponse
+ */
+export const zSkillVersionListResponse = z.object({
+  data: z.array(zSkillVersionResponse).optional(),
+})
+
+/**
+ * SkillVersionDeleteResponse
+ */
+export const zSkillVersionDeleteResponse = z.object({
+  deleted: z.boolean(),
+  id: z.string(),
+  latest_published_version_id: z.string().nullish(),
+})
+
+/**
+ * SkillVersionUpdatePayload
+ */
+export const zSkillVersionUpdatePayload = z.object({
+  publish_note: z.string().max(1024).optional().default(''),
+  version_name: z.string().max(128).nullish(),
+})
+
 /**
  * ApiToolProviderDeletePayload
  */
@@ -656,6 +812,33 @@ export const zSwitchWorkspaceResponse = z.object({
   result: z.string(),
 })
 
+/**
+ * AgentSkillBindingItemResponse
+ */
+export const zAgentSkillBindingItemResponse = z.object({
+  description: z.string(),
+  display_name: z.string(),
+  file_count: z.int(),
+  icon: z.string(),
+  id: z.string(),
+  latest_published_at: z.int().nullish(),
+  latest_published_version_id: z.string().nullish(),
+  name: z.string(),
+  priority: z.int(),
+  status: z.string(),
+  tags: z.array(z.string()).optional(),
+  updated_at: z.int(),
+})
+
+/**
+ * AgentSkillBindingsResponse
+ */
+export const zAgentSkillBindingsResponse = z.object({
+  agent_id: z.string(),
+  data: z.array(zAgentSkillBindingItemResponse).optional(),
+  skill_ids: z.array(z.string()).optional(),
+})
+
 /**
  * IconInfo
  *
@@ -1244,6 +1427,164 @@ export const zWorkspaceAccessMatrix = z.object({
   pagination: zPagination.nullish(),
 })
 
+/**
+ * SkillFileResponse
+ */
+export const zSkillFileResponse = z.object({
+  content: z.string().nullish(),
+  hash: z.string().nullish(),
+  id: z.string().nullish(),
+  kind: z.string(),
+  mime_type: z.string().nullish(),
+  path: z.string(),
+  size: z.int().nullish(),
+  storage: z.string().nullish(),
+  tool_file_id: z.string().nullish(),
+})
+
+/**
+ * SkillDetailResponse
+ */
+export const zSkillDetailResponse = z.object({
+  created_at: z.int(),
+  created_by: z.string().nullish(),
+  created_by_name: z.string().nullish(),
+  description: z.string(),
+  display_name: z.string(),
+  files: z.array(zSkillFileResponse).optional(),
+  icon: z.string(),
+  id: z.string(),
+  latest_published_version_id: z.string().nullish(),
+  name: z.string(),
+  name_manually_edited: z.boolean().optional().default(false),
+  reference_count: z.int().optional().default(0),
+  tags: z.array(z.string()).optional(),
+  updated_at: z.int(),
+  updated_by: z.string().nullish(),
+  updated_by_name: z.string().nullish(),
+  visibility: z.string(),
+})
+
+/**
+ * SkillVersionDetailResponse
+ */
+export const zSkillVersionDetailResponse = z.object({
+  archive_size: z.int(),
+  created_at: z.int(),
+  files: z.array(zSkillFileResponse).optional(),
+  hash_code: z.string(),
+  id: z.string(),
+  is_latest: z.boolean().optional().default(false),
+  publish_note: z.string(),
+  published_by: z.string().nullish(),
+  published_by_name: z.string().nullish(),
+  skill_id: z.string(),
+  version_name: z.string(),
+  version_number: z.int(),
+})
+
+/**
+ * SkillTagResponse
+ */
+export const zSkillTagResponse = z.object({
+  count: z.int(),
+  tag: z.string(),
+})
+
+/**
+ * SkillTagListResponse
+ */
+export const zSkillTagListResponse = z.object({
+  data: z.array(zSkillTagResponse).optional(),
+})
+
+/**
+ * SkillAssistAttachmentPayload
+ */
+export const zSkillAssistAttachmentPayload = z.object({
+  mime_type: z.string().min(1).max(255).nullish(),
+  name: z.string().min(1).max(255),
+  size: z.int().gte(0).nullish(),
+  tool_file_id: z.string().min(1),
+})
+
+/**
+ * SkillAssistModelPayload
+ */
+export const zSkillAssistModelPayload = z.object({
+  model: z.string().min(1).max(255),
+  model_settings: z.record(z.string(), z.unknown()).nullish(),
+  plugin_id: z.string().min(1).max(255).nullish(),
+  provider: z.string().min(1).max(255),
+})
+
+/**
+ * SkillAssistMessagePayload
+ *
+ * One user message and optional uploaded context for the read-only Skill Authoring assistant.
+ */
+export const zSkillAssistMessagePayload = z.object({
+  attachments: z.array(zSkillAssistAttachmentPayload).max(10).optional(),
+  message: z.string().min(1).max(8000),
+  model: zSkillAssistModelPayload.nullish(),
+  target_path: z.string().nullish(),
+})
+
+/**
+ * SkillDraftFileOperation
+ */
+export const zSkillDraftFileOperation = z.enum([
+  'delete',
+  'mkdir',
+  'rename',
+  'upsert_text',
+  'upsert_tool_file',
+])
+
+/**
+ * SkillDraftFileOperationPayload
+ */
+export const zSkillDraftFileOperationPayload = z.object({
+  content: z.string().nullish(),
+  expected_updated_at: z.int().nullish(),
+  hash: z.string().nullish(),
+  mime_type: z.string().nullish(),
+  operation: zSkillDraftFileOperation,
+  path: z.string(),
+  size: z.int().gte(0).nullish(),
+  target_path: z.string().nullish(),
+  tool_file_id: z.string().nullish(),
+})
+
+/**
+ * SkillReferenceResponse
+ */
+export const zSkillReferenceResponse = z.object({
+  agent_id: z.string(),
+  agent_icon: z.string().nullish(),
+  agent_icon_background: z.string().nullish(),
+  agent_icon_type: z.string().nullish(),
+  app_id: z.string().nullish(),
+  display_name: z.string(),
+  name: z.string(),
+  node_id: z.string().nullish(),
+  node_name: z.string().nullish(),
+  type: z.string(),
+  workflow_icon: z.string().nullish(),
+  workflow_icon_background: z.string().nullish(),
+  workflow_icon_type: z.string().nullish(),
+  workflow_id: z.string().nullish(),
+  workflow_name: z.string().nullish(),
+  workflow_version: z.string().nullish(),
+})
+
+/**
+ * SkillReferenceListResponse
+ */
+export const zSkillReferenceListResponse = z.object({
+  data: z.array(zSkillReferenceResponse).optional(),
+})
+
 /**
  * ToolEmojiIcon
  */
@@ -2096,6 +2437,42 @@ export const zPermissionCatalogResponse = z.object({
   groups: z.array(zPermissionCatalogGroup).optional(),
 })
 
+/**
+ * SkillFileKind
+ *
+ * Draft file entry kind.
+ */
+export const zSkillFileKind = z.enum(['directory', 'file'])
+
+/**
+ * SkillFileStorage
+ *
+ * How a draft file's content is stored.
+ */
+export const zSkillFileStorage = z.enum(['text', 'tool_file'])
+
+/**
+ * SkillDraftTreeItemPayload
+ */
+export const zSkillDraftTreeItemPayload = z.object({
+  content: z.string().nullish(),
+  hash: z.string().nullish(),
+  kind: zSkillFileKind.optional().default('file'),
+  mime_type: z.string().nullish(),
+  path: z.string(),
+  size: z.int().gte(0).nullish(),
+  storage: zSkillFileStorage.nullish(),
+  tool_file_id: z.string().nullish(),
+})
+
+/**
+ * SkillDraftTreePayload
+ */
+export const zSkillDraftTreePayload = z.object({
+  expected_updated_at: z.int().nullish(),
+  files: z.array(zSkillDraftTreeItemPayload).optional(),
+})
+
 /**
  * Option
  */
@@ -3421,6 +3798,26 @@ export const zGetWorkspacesCurrentAgentProviderByProviderNameResponse = zAgentPr
  */
 export const zGetWorkspacesCurrentAgentProvidersResponse = zAgentProviderListResponse
 
+export const zGetWorkspacesCurrentAgentsByAgentIdSkillsPath = z.object({
+  agent_id: z.string(),
+})
+
+/**
+ * Agent Skill bindings
+ */
+export const zGetWorkspacesCurrentAgentsByAgentIdSkillsResponse = zAgentSkillBindingsResponse
+
+export const zPutWorkspacesCurrentAgentsByAgentIdSkillsBody = zAgentSkillBindingsPayload
+
+export const zPutWorkspacesCurrentAgentsByAgentIdSkillsPath = z.object({
+  agent_id: z.string(),
+})
+
+/**
+ * Agent Skill bindings replaced
+ */
+export const zPutWorkspacesCurrentAgentsByAgentIdSkillsResponse = zAgentSkillBindingsResponse
+
 export const zGetWorkspacesCurrentCustomizedSnippetsQuery = z.object({
   creators: z.array(z.string()).optional(),
   is_published: z.boolean().optional(),
@@ -4694,6 +5091,234 @@ export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdR
  */
 export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse = zWorkspaceAccessMatrix
 
+export const zGetWorkspacesCurrentSkillsQuery = z.object({
+  keyword: z.string().optional(),
+  limit: z.int().gte(1).lte(100).optional().default(20),
+  page: z.int().gte(1).lte(99999).optional().default(1),
+  tag: z.array(z.string()).optional(),
+})
+
+/**
+ * Workspace skills
+ */
+export const zGetWorkspacesCurrentSkillsResponse = zSkillListResponse
+
+export const zPostWorkspacesCurrentSkillsBody = zSkillCreatePayload
+
+/**
+ * Skill created
+ */
+export const zPostWorkspacesCurrentSkillsResponse = zSkillDetailResponse
+
+export const zPostWorkspacesCurrentSkillsFilesUploadBody = z.object({
+  file: z.custom<Blob | File>((value) => value instanceof Blob || value instanceof File),
+})
+
+/**
+ * Skill draft file uploaded
+ */
+export const zPostWorkspacesCurrentSkillsFilesUploadResponse = zSkillFileUploadResponse
+
+/**
+ * Skill imported
+ */
+export const zPostWorkspacesCurrentSkillsImportResponse = zSkillDetailResponse
+
+/**
+ * Workspace Skill tags
+ */
+export const zGetWorkspacesCurrentSkillsTagsResponse = zSkillTagListResponse
+
+export const zDeleteWorkspacesCurrentSkillsBySkillIdBody = zSkillDeletePayload
+
+export const zDeleteWorkspacesCurrentSkillsBySkillIdPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill deleted
+ */
+export const zDeleteWorkspacesCurrentSkillsBySkillIdResponse = zSkillDeleteResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill detail
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdResponse = zSkillDetailResponse
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdBody = zSkillMetadataPayload
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill updated
+ */
+export const zPatchWorkspacesCurrentSkillsBySkillIdResponse = zSkillResponse
+
+export const zPostWorkspacesCurrentSkillsBySkillIdAssistMessagesBody = zSkillAssistMessagePayload
+
+export const zPostWorkspacesCurrentSkillsBySkillIdAssistMessagesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill Authoring assistant event stream
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponse = z.record(
+  z.string(),
+  z.unknown(),
+)
+
+export const zPostWorkspacesCurrentSkillsBySkillIdDuplicatePath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill duplicated
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdDuplicateResponse = zSkillDetailResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdExportPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Published Skill zip archive
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdExportResponse = z.record(z.string(), z.unknown())
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdFilesBody = zSkillDraftFileOperationPayload
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdFilesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Draft file operation applied
+ */
+export const zPatchWorkspacesCurrentSkillsBySkillIdFilesResponse = zSkillDetailResponse
+
+export const zPutWorkspacesCurrentSkillsBySkillIdFilesBody = zSkillDraftTreePayload
+
+export const zPutWorkspacesCurrentSkillsBySkillIdFilesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Draft files replaced
+ */
+export const zPutWorkspacesCurrentSkillsBySkillIdFilesResponse = zSkillDetailResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesContentPath = z.object({
+  skill_id: z.string(),
+})
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesContentQuery = z.object({
+  download: z.string().optional(),
+  path: z.string(),
+  version_id: z.string().optional(),
+})
+
+/**
+ * Skill file content
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesContentResponse = zBinaryFileResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewPath = z.object({
+  skill_id: z.string(),
+})
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewQuery = z.object({
+  path: z.string(),
+  version_id: z.string().optional(),
+})
+
+/**
+ * Skill file text preview
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponse = zSkillFilePreviewResponse
+
+export const zPostWorkspacesCurrentSkillsBySkillIdPublishBody = zSkillPublishPayload
+
+export const zPostWorkspacesCurrentSkillsBySkillIdPublishPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill published
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdPublishResponse = zSkillVersionResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdReferencesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill references
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdReferencesResponse = zSkillReferenceListResponse
+
+export const zPostWorkspacesCurrentSkillsBySkillIdRestoreBody = zSkillRestorePayload
+
+export const zPostWorkspacesCurrentSkillsBySkillIdRestorePath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill version restored
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdRestoreResponse = zSkillVersionResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill versions
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsResponse = zSkillVersionListResponse
+
+export const zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath = z.object({
+  skill_id: z.string(),
+  version_id: z.string(),
+})
+
+/**
+ * Skill version deleted
+ */
+export const zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  zSkillVersionDeleteResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath = z.object({
+  skill_id: z.string(),
+  version_id: z.string(),
+})
+
+/**
+ * Skill version detail
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  zSkillVersionDetailResponse
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdBody =
+  zSkillVersionUpdatePayload
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath = z.object({
+  skill_id: z.string(),
+  version_id: z.string(),
+})
+
+/**
+ * Skill version updated
+ */
+export const zPatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  zSkillVersionResponse
+
 /**
  * Tool labels retrieved successfully
  */

packages/contracts/non-json-openapi-responses.md

@@ -18,6 +18,7 @@ The current Flask-RESTX generator still emits these response entries under `appl
 | service | GET    | `/files/{file_id}/preview`                                              | Original file MIME type, optionally attachment | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/plugin/icon`                                       | Plugin asset MIME type                         | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/plugin/asset`                                      | `application/octet-stream`                     | `BinaryFileResponse`  |
+| console | GET    | `/workspaces/current/skills/{skill_id}/files/content`                   | Skill file MIME type, optionally attachment    | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/tool-provider/builtin/{provider}/icon`             | Tool icon MIME type                            | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/trigger-provider/{provider}/icon`                  | Trigger icon response                          | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/{tenant_id}/model-providers/{provider}/{icon_type}/{lang}` | Model provider icon MIME type                  | `BinaryFileResponse`  |

web/app/(commonLayout)/skills/[skillId]/page.tsx

@@ -0,0 +1,5 @@
+import SkillDetailPage from '@/features/skills/detail-page'
+
+export default function Page() {
+  return <SkillDetailPage />
+}

web/app/(commonLayout)/skills/page.tsx

@@ -0,0 +1,5 @@
+import SkillsPage from '@/features/skills/page'
+
+export default function Page() {
+  return <SkillsPage />
+}

web/app/components/app/log/__tests__/archived-logs-notice.spec.tsx

@@ -1,4 +1,5 @@
-import { fireEvent, screen } from '@testing-library/react'
+import { screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
 import { createMockProviderContextValue } from '@/__mocks__/provider-context'
 import { defaultPlan } from '@/app/components/billing/config'
 import { Plan } from '@/app/components/billing/type'
@@ -67,11 +68,16 @@ describe('ArchivedLogsNotice', () => {
     )
   })
 
-  it('should show notice for paid workspace managers', () => {
+  it('should show an accessible notice for paid workspace managers', async () => {
+    const user = userEvent.setup()
     renderNotice()
 
-    expect(screen.getByText('appLog.archives.notice.description')).toBeInTheDocument()
-    fireEvent.click(screen.getByRole('button', { name: 'appLog.archives.notice.action' }))
+    const notice = screen.getByRole('status')
+    expect(notice).toHaveAttribute('aria-live', 'polite')
+    expect(notice).toHaveAttribute('aria-atomic', 'true')
+    expect(within(notice).getByText('appLog.archives.notice.description')).toBeInTheDocument()
+
+    await user.click(within(notice).getByRole('button', { name: 'appLog.archives.notice.action' }))
     expect(setShowAccountSettingModal).toHaveBeenCalledWith({
       payload: ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES,
     })

web/app/components/app/log/__tests__/filter.spec.tsx

@@ -1,9 +1,37 @@
 import type { QueryParam } from '../index'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, render, screen, within } from '@testing-library/react'
 import Filter, { TIME_PERIOD_MAPPING } from '../filter'
 
 let mockAnnotationsCountLoading = false
 let mockAnnotationsCountData: { count: number } | null = { count: 10 }
+const mockRuntime = vi.hoisted(() => ({
+  deploymentEdition: 'CLOUD',
+  enableBilling: true,
+  isFetchedPlan: true,
+  isFetchedPlanInfo: true,
+  planType: 'professional',
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useSuspenseQuery: () => ({ data: mockRuntime.deploymentEdition }),
+  }
+})
+
+vi.mock('@/context/provider-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/provider-context')>()
+  return {
+    ...actual,
+    useProviderContext: () => ({
+      enableBilling: mockRuntime.enableBilling,
+      isFetchedPlan: mockRuntime.isFetchedPlan,
+      isFetchedPlanInfo: mockRuntime.isFetchedPlanInfo,
+      plan: { type: mockRuntime.planType },
+    }),
+  }
+})
 
 vi.mock('@/service/use-log', () => ({
   useAnnotationsCount: () => ({
@@ -12,28 +40,43 @@ vi.mock('@/service/use-log', () => ({
   }),
 }))
 
-vi.mock('@/app/components/base/chip', () => ({
-  default: ({
-    items,
-    value,
-    onSelect,
-    onClear,
-  }: {
-    items: Array<{ value: string; name: string }>
-    value?: string
-    onSelect: (item: { value: string; name: string }) => void
-    onClear: () => void
-  }) => {
-    const currentItem = items.find((item) => item.value === value) ?? items[0]
-    return (
-      <div>
-        <div>{currentItem?.name}</div>
-        <button onClick={() => onSelect(items.at(-1)!)}>{`select-${items.at(-1)?.value}`}</button>
-        <button onClick={onClear}>clear-chip</button>
-      </div>
-    )
-  },
-}))
+vi.mock('@/app/components/base/chip', async () => {
+  const { useState } = await import('react')
+
+  return {
+    default: function MockChip({
+      items,
+      value,
+      onSelect,
+      onClear,
+    }: {
+      items: Array<{ value: string; name: string }>
+      value?: string
+      onSelect: (item: { value: string; name: string }) => void
+      onClear: () => void
+    }) {
+      const [isOpen, setIsOpen] = useState(false)
+      const currentItem = items.find((item) => item.value === value) ?? items[0]
+      return (
+        <div>
+          <div>{currentItem?.name}</div>
+          <button aria-label={`open-options-${items[0]?.value}`} onClick={() => setIsOpen(true)}>
+            open-chip
+          </button>
+          {isOpen && (
+            <ul aria-label={`options-${items[0]?.value}`}>
+              {items.map((item) => (
+                <li key={item.value}>{item.name}</li>
+              ))}
+            </ul>
+          )}
+          <button onClick={() => onSelect(items.at(-1)!)}>{`select-${items.at(-1)?.value}`}</button>
+          <button onClick={onClear}>clear-chip</button>
+        </div>
+      )
+    },
+  }
+})
 
 vi.mock('@/app/components/base/sort', () => ({
   default: ({ onSelect }: { onSelect: (value: string) => void }) => (
@@ -59,6 +102,11 @@ describe('Filter', () => {
     vi.clearAllMocks()
     mockAnnotationsCountLoading = false
     mockAnnotationsCountData = { count: 10 }
+    mockRuntime.deploymentEdition = 'CLOUD'
+    mockRuntime.enableBilling = true
+    mockRuntime.isFetchedPlan = true
+    mockRuntime.isFetchedPlanInfo = true
+    mockRuntime.planType = 'professional'
   })
 
   describe('Rendering', () => {
@@ -124,6 +172,77 @@ describe('Filter', () => {
   })
 
   describe('User Interactions', () => {
+    it('should only show supported periods for Cloud sandbox workspaces', () => {
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem').map((item) => item.textContent)).toEqual([
+        expect.stringMatching(/(?:^|\.)filter\.period\.today(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last7days(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last30days(?=$|:)/),
+      ])
+    })
+
+    it('should only show supported periods while the Cloud plan is pending', () => {
+      mockRuntime.isFetchedPlan = false
+      mockRuntime.isFetchedPlanInfo = false
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem').map((item) => item.textContent)).toEqual([
+        expect.stringMatching(/(?:^|\.)filter\.period\.today(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last7days(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last30days(?=$|:)/),
+      ])
+    })
+
+    it('should keep all periods when Cloud billing is known to be disabled', () => {
+      mockRuntime.enableBilling = false
+      mockRuntime.isFetchedPlan = false
+      mockRuntime.isFetchedPlanInfo = true
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem')).toHaveLength(9)
+    })
+
+    it('should keep all periods for sandbox workspaces outside Cloud', () => {
+      mockRuntime.deploymentEdition = 'COMMUNITY'
+      mockRuntime.planType = 'sandbox'
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem')).toHaveLength(9)
+    })
+
+    it('should reset the Cloud sandbox period to today when cleared', () => {
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getAllByText('clear-chip')[0]!)
+
+      expect(mockSetQueryParams).toHaveBeenCalledWith({
+        ...defaultQueryParams,
+        period: '1',
+      })
+    })
+
     it('should update keyword when typing in search input', () => {
       render(<Filter {...defaultProps} />)
 

web/app/components/app/log/__tests__/index.spec.tsx

@@ -1,5 +1,8 @@
 /* oxlint-disable typescript/no-explicit-any */
+import type { CloudSandboxPlanState } from '../cloud-sandbox-retention'
 import { fireEvent, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import dayjs from 'dayjs'
 import { APP_PAGE_LIMIT } from '@/config'
 import { AppModeEnum } from '@/types/app'
 import Logs from '../index'
@@ -11,11 +14,27 @@ vi.mock('@/context/i18n', () => ({
 const mockReplace = vi.fn()
 const mockUseChatConversations = vi.fn()
 const mockUseCompletionConversations = vi.fn()
+const mockPlanState = vi.hoisted(() => ({
+  value: 'unrestricted' as CloudSandboxPlanState,
+}))
+const mockDebouncedPeriod = vi.hoisted(() => ({
+  value: null as string | null,
+}))
 
 let mockSearchParams = new URLSearchParams()
 vi.mock('ahooks', async () => {
   return {
-    useDebounce: <T,>(value: T) => value,
+    useDebounce: <T,>(value: T) => {
+      if (
+        mockDebouncedPeriod.value === null ||
+        typeof value !== 'object' ||
+        value === null ||
+        !('period' in value)
+      )
+        return value
+
+      return { ...value, period: mockDebouncedPeriod.value }
+    },
   }
 })
 
@@ -33,28 +52,19 @@ vi.mock('@/next/navigation', () => ({
 vi.mock('@/service/use-log', () => ({
   useChatConversations: (...args: unknown[]) => mockUseChatConversations(...args),
   useCompletionConversations: (...args: unknown[]) => mockUseCompletionConversations(...args),
+  useAnnotationsCount: () => ({
+    data: { count: 0 },
+    isLoading: false,
+  }),
 }))
 
-vi.mock('../filter', () => ({
-  TIME_PERIOD_MAPPING: {
-    2: { value: 7 },
-    9: { value: 0 },
-  },
-  default: ({ setQueryParams }: { setQueryParams: (next: Record<string, string>) => void }) => (
-    <button
-      onClick={() =>
-        setQueryParams({
-          period: '9',
-          annotation_status: 'all',
-          sort_by: '-created_at',
-          keyword: 'hello',
-        })
-      }
-    >
-      filter-controls
-    </button>
-  ),
-}))
+vi.mock('../cloud-sandbox-retention', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../cloud-sandbox-retention')>()
+  return {
+    ...actual,
+    useCloudSandboxPlanStatus: () => mockPlanState.value,
+  }
+})
 
 vi.mock('../list', () => ({
   default: ({ logs }: { logs: { total?: number } }) => (
@@ -69,6 +79,10 @@ vi.mock('../empty-element', () => ({
   default: () => <div>empty-logs</div>,
 }))
 
+vi.mock('../retention-upgrade-notice', () => ({
+  RetentionUpgradeNotice: () => <div>retention-upgrade-notice</div>,
+}))
+
 vi.mock('@/app/components/base/loading', () => ({
   default: () => <div>loading-logs</div>,
 }))
@@ -85,6 +99,8 @@ describe('Logs', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockSearchParams = new URLSearchParams()
+    mockPlanState.value = 'unrestricted'
+    mockDebouncedPeriod.value = null
     mockUseChatConversations.mockReturnValue({
       data: undefined,
       refetch: vi.fn(),
@@ -117,6 +133,7 @@ describe('Logs', () => {
     expect(
       screen.getByRole('link', { name: /(?:^|\.)operation\.learnMore(?=$|:)/ }),
     ).toHaveAttribute('href', 'https://docs.example.com/use-dify/monitor/logs')
+    expect(screen.getByText('retention-upgrade-notice')).toBeInTheDocument()
     expect(screen.getByText('loading-logs')).toBeInTheDocument()
   })
 
@@ -166,4 +183,101 @@ describe('Logs', () => {
 
     expect(mockReplace).toHaveBeenCalledWith('/apps/app-1/logs?page=2', { scroll: false })
   })
+
+  it('should query the last 30 days when a Sandbox user selects the longest period', async () => {
+    const user = userEvent.setup()
+    mockPlanState.value = 'sandbox'
+    mockUseChatConversations.mockReturnValue({
+      data: { total: 0 },
+      refetch: vi.fn(),
+    })
+
+    render(
+      <Logs
+        appDetail={
+          {
+            id: 'app-sandbox-last-30-days',
+            mode: AppModeEnum.CHAT,
+          } as any
+        }
+      />,
+    )
+
+    await user.click(screen.getByRole('combobox', { name: /appLog\.filter\.period\.last7days/ }))
+    await user.click(await screen.findByText(/appLog\.filter\.period\.last30days/))
+
+    expect(
+      screen.getByRole('combobox', { name: /appLog\.filter\.period\.last30days/ }),
+    ).toBeInTheDocument()
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          start: dayjs().subtract(30, 'day').startOf('day').format('YYYY-MM-DD HH:mm'),
+          end: dayjs().endOf('day').format('YYYY-MM-DD HH:mm'),
+        }),
+      }),
+    )
+  })
+
+  it('should use a valid period for the real Chip and request when a cached period settles to Sandbox', async () => {
+    const user = userEvent.setup()
+    const appDetail = {
+      id: 'app-period-transition',
+      mode: AppModeEnum.CHAT,
+    } as any
+    mockUseChatConversations.mockReturnValue({
+      data: { total: 0 },
+      refetch: vi.fn(),
+    })
+
+    const unrestrictedRender = render(<Logs appDetail={appDetail} />)
+
+    await user.click(screen.getByRole('combobox', { name: /appLog\.filter\.period\.last7days/ }))
+    await user.click(await screen.findByText(/appLog\.filter\.period\.allTime/))
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.not.objectContaining({
+          start: expect.anything(),
+          end: expect.anything(),
+        }),
+      }),
+    )
+    unrestrictedRender.unmount()
+
+    mockPlanState.value = 'pending'
+    mockDebouncedPeriod.value = '9'
+    const pendingRender = render(<Logs appDetail={appDetail} />)
+
+    expect(
+      screen.getByRole('combobox', { name: /appLog\.filter\.period\.today/ }),
+    ).toBeInTheDocument()
+    expect(
+      screen.getByRole('button', {
+        name: /common\.operation\.clear appLog\.filter\.period\.today/,
+      }),
+    ).toBeInTheDocument()
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          start: dayjs().startOf('day').format('YYYY-MM-DD HH:mm'),
+          end: expect.any(String),
+        }),
+      }),
+    )
+
+    mockPlanState.value = 'sandbox'
+    pendingRender.rerender(<Logs appDetail={appDetail} />)
+
+    expect(
+      screen.getByRole('combobox', { name: /appLog\.filter\.period\.today/ }),
+    ).toBeInTheDocument()
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          start: dayjs().startOf('day').format('YYYY-MM-DD HH:mm'),
+          end: expect.any(String),
+        }),
+      }),
+    )
+  })
 })

web/app/components/app/log/__tests__/retention-upgrade-notice.spec.tsx

@@ -0,0 +1,117 @@
+import type { DeploymentEdition } from '@dify/contracts/api/console/system-features/types.gen'
+import { screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { createMockProviderContextValue } from '@/__mocks__/provider-context'
+import { defaultPlan } from '@/app/components/billing/config'
+import { Plan } from '@/app/components/billing/type'
+import { useModalContext } from '@/context/modal-context'
+import { useProviderContext } from '@/context/provider-context'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { render } from '@/test/console/render'
+import { RetentionUpgradeNotice } from '../retention-upgrade-notice'
+
+vi.mock('@/context/provider-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/provider-context')>()
+  return {
+    ...actual,
+    useProviderContext: vi.fn(),
+  }
+})
+
+vi.mock('@/context/modal-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/modal-context')>()
+  return {
+    ...actual,
+    useModalContext: vi.fn(),
+  }
+})
+
+const mockUseProviderContext = vi.mocked(useProviderContext)
+const mockUseModalContext = vi.mocked(useModalContext)
+
+describe('RetentionUpgradeNotice', () => {
+  const setShowPricingModal = vi.fn()
+
+  function mockProvider({
+    enableBilling = true,
+    isFetchedPlan = true,
+    isFetchedPlanInfo = true,
+    planType = Plan.sandbox,
+  }: {
+    enableBilling?: boolean
+    isFetchedPlan?: boolean
+    isFetchedPlanInfo?: boolean
+    planType?: Plan
+  } = {}) {
+    mockUseProviderContext.mockReturnValue(
+      createMockProviderContextValue({
+        enableBilling,
+        isFetchedPlan,
+        isFetchedPlanInfo,
+        plan: {
+          ...defaultPlan,
+          type: planType,
+        },
+      }),
+    )
+  }
+
+  function renderNotice(deploymentEdition: DeploymentEdition = 'CLOUD') {
+    const { wrapper } = createConsoleQueryWrapper({
+      systemFeatures: { deployment_edition: deploymentEdition },
+    })
+    return render(<RetentionUpgradeNotice />, { wrapper })
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockProvider()
+    mockUseModalContext.mockReturnValue({
+      setShowPricingModal,
+    } as unknown as ReturnType<typeof useModalContext>)
+  })
+
+  it('should show accessible upgrade guidance for Cloud sandbox workspaces', async () => {
+    const user = userEvent.setup()
+    renderNotice()
+
+    const notice = screen.getByRole('status')
+    expect(notice).toHaveAttribute('aria-live', 'polite')
+    expect(notice).toHaveAttribute('aria-atomic', 'true')
+    expect(within(notice).getByText('appLog.retention.upgradeTip.description')).toBeInTheDocument()
+
+    await user.click(
+      within(notice).getByRole('button', { name: 'billing.upgradeBtn.encourageShort' }),
+    )
+    expect(setShowPricingModal).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    {
+      name: 'paid Cloud workspaces',
+      provider: { planType: Plan.professional },
+      deploymentEdition: 'CLOUD',
+    },
+    {
+      name: 'self-hosted sandbox workspaces',
+      provider: { planType: Plan.sandbox },
+      deploymentEdition: 'COMMUNITY',
+    },
+    {
+      name: 'workspaces without billing',
+      provider: { enableBilling: false },
+      deploymentEdition: 'CLOUD',
+    },
+    {
+      name: 'workspaces before plan loading completes',
+      provider: { isFetchedPlan: false, isFetchedPlanInfo: false },
+      deploymentEdition: 'CLOUD',
+    },
+  ] as const)('should not show guidance for $name', ({ provider, deploymentEdition }) => {
+    mockProvider(provider)
+
+    renderNotice(deploymentEdition)
+
+    expect(screen.queryByRole('status')).not.toBeInTheDocument()
+  })
+})

web/app/components/app/log/archived-logs-notice.tsx

@@ -1,5 +1,6 @@
 'use client'
 
+import { Button } from '@langgenius/dify-ui/button'
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
@@ -31,16 +32,27 @@ export function ArchivedLogsNotice() {
     return null
 
   return (
-    <div className="mb-3 flex items-start gap-2 rounded-lg border border-util-colors-warning-warning-200 bg-util-colors-warning-warning-50 px-3 py-2">
-      <span
-        aria-hidden
-        className="mt-0.5 i-ri-information-line size-4 shrink-0 text-util-colors-warning-warning-600"
+    <div
+      role="status"
+      aria-live="polite"
+      aria-atomic="true"
+      className="relative mb-3 shrink-0 overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg-blur shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]"
+    >
+      <div
+        aria-hidden="true"
+        className="absolute -inset-px bg-linear-to-r from-components-badge-status-light-normal-halo to-background-gradient-mask-transparent opacity-40"
       />
-      <div className="min-w-0 flex-1 system-xs-regular text-util-colors-warning-warning-700">
-        {t(($) => $['archives.notice.description'], { ns: 'appLog' })}
-        <button
-          type="button"
-          className="ml-1 system-xs-semibold text-util-colors-warning-warning-700 underline underline-offset-2 hover:text-text-primary"
+      <div className="relative flex items-center gap-3 px-3 py-2">
+        <span
+          aria-hidden="true"
+          className="i-ri-information-2-fill size-5 shrink-0 text-text-accent"
+        />
+        <p className="min-w-0 flex-1 system-sm-semibold wrap-break-word text-text-primary">
+          {t(($) => $['archives.notice.description'], { ns: 'appLog' })}
+        </p>
+        <Button
+          variant="primary"
+          className="shrink-0"
           onClick={() =>
             setShowAccountSettingModal({
               payload: ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES,
@@ -48,7 +60,7 @@ export function ArchivedLogsNotice() {
           }
         >
           {t(($) => $['archives.notice.action'], { ns: 'appLog' })}
-        </button>
+        </Button>
       </div>
     </div>
   )

web/app/components/app/log/cloud-sandbox-retention.ts

@@ -0,0 +1,54 @@
+'use client'
+
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { Plan } from '@/app/components/billing/type'
+import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
+
+export const CLOUD_SANDBOX_TIME_PERIOD_KEYS = new Set(['1', '2', '3'])
+export const CLOUD_SANDBOX_CLEARED_TIME_PERIOD = '1'
+
+const CLOUD_SANDBOX_LONGEST_TIME_PERIOD = '3'
+const CLOUD_SANDBOX_LONGEST_TIME_PERIOD_OPTION = {
+  value: 30,
+  name: 'last30days',
+} as const
+
+export type CloudSandboxPlanState = 'pending' | 'sandbox' | 'unrestricted'
+
+export function isLogTimePeriodRestricted(planState: CloudSandboxPlanState) {
+  return planState !== 'unrestricted'
+}
+
+export function resolveLogTimePeriod(period: string, planState: CloudSandboxPlanState) {
+  if (!isLogTimePeriodRestricted(planState) || CLOUD_SANDBOX_TIME_PERIOD_KEYS.has(period))
+    return period
+
+  return CLOUD_SANDBOX_CLEARED_TIME_PERIOD
+}
+
+export function resolveLogTimePeriodOption<T extends { value: number; name: string }>(
+  period: string,
+  option: T,
+  planState: CloudSandboxPlanState,
+) {
+  if (isLogTimePeriodRestricted(planState) && period === CLOUD_SANDBOX_LONGEST_TIME_PERIOD)
+    return CLOUD_SANDBOX_LONGEST_TIME_PERIOD_OPTION
+
+  return option
+}
+
+export function useCloudSandboxPlanStatus(): CloudSandboxPlanState {
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
+  const { enableBilling, isFetchedPlan, isFetchedPlanInfo, plan } = useProviderContext()
+
+  if (deploymentEdition !== 'CLOUD') return 'unrestricted'
+  if (!isFetchedPlanInfo) return 'pending'
+  if (!enableBilling) return 'unrestricted'
+  if (!isFetchedPlan) return 'pending'
+
+  return plan.type === Plan.sandbox ? 'sandbox' : 'unrestricted'
+}

web/app/components/app/log/filter.tsx

@@ -11,6 +11,13 @@ import Chip from '@/app/components/base/chip'
 import Input from '@/app/components/base/input'
 import Sort from '@/app/components/base/sort'
 import { useAnnotationsCount } from '@/service/use-log'
+import {
+  CLOUD_SANDBOX_CLEARED_TIME_PERIOD,
+  CLOUD_SANDBOX_TIME_PERIOD_KEYS,
+  isLogTimePeriodRestricted,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from './cloud-sandbox-retention'
 
 dayjs.extend(quarterOfYear)
 
@@ -45,6 +52,12 @@ const Filter: FC<IFilterProps> = ({
 }: IFilterProps) => {
   const { data, isLoading } = useAnnotationsCount(appId)
   const { t } = useTranslation()
+  const planState = useCloudSandboxPlanStatus()
+  const isTimePeriodRestricted = isLogTimePeriodRestricted(planState)
+  const timePeriodEntries = Object.entries(TIME_PERIOD_MAPPING)
+    .filter(([key]) => !isTimePeriodRestricted || CLOUD_SANDBOX_TIME_PERIOD_KEYS.has(key))
+    .map(([key, option]) => [key, resolveLogTimePeriodOption(key, option, planState)] as const)
+
   if (isLoading || !data) return null
   return (
     <div className="mb-2 flex flex-row flex-wrap items-center gap-2">
@@ -56,8 +69,13 @@ const Filter: FC<IFilterProps> = ({
         onSelect={(item) => {
           setQueryParams({ ...queryParams, period: item.value })
         }}
-        onClear={() => setQueryParams({ ...queryParams, period: '9' })}
-        items={Object.entries(TIME_PERIOD_MAPPING).map(([k, v]) => ({
+        onClear={() =>
+          setQueryParams({
+            ...queryParams,
+            period: isTimePeriodRestricted ? CLOUD_SANDBOX_CLEARED_TIME_PERIOD : '9',
+          })
+        }
+        items={timePeriodEntries.map(([k, v]) => ({
           value: k,
           name: t(($) => $[`filter.period.${v.name}`], { ns: 'appLog' }),
         }))}

web/app/components/app/log/index.tsx

@@ -15,9 +15,15 @@ import { usePathname, useRouter, useSearchParams } from '@/next/navigation'
 import { useChatConversations, useCompletionConversations } from '@/service/use-log'
 import { AppModeEnum } from '@/types/app'
 import PageTitle from '../log-annotation/page-title'
+import {
+  resolveLogTimePeriod,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from './cloud-sandbox-retention'
 import EmptyElement from './empty-element'
 import Filter, { TIME_PERIOD_MAPPING } from './filter'
 import List from './list'
+import { RetentionUpgradeNotice } from './retention-upgrade-notice'
 
 type ILogsProps = {
   appDetail: App
@@ -57,6 +63,7 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
     return pageParam - 1
   }, [searchParams])
   const cachedState = logsStateCache.get(appDetail.id)
+  const cloudSandboxPlanState = useCloudSandboxPlanStatus()
   const [queryParams, setQueryParams] = useState<QueryParam>(
     cachedState?.queryParams ?? defaultQueryParams,
   )
@@ -64,7 +71,15 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
     () => cachedState?.currPage ?? getPageFromParams(),
   )
   const [limit, setLimit] = React.useState<number>(cachedState?.limit ?? APP_PAGE_LIMIT)
+  const effectivePeriod = resolveLogTimePeriod(queryParams.period, cloudSandboxPlanState)
+  const effectiveQueryParams = { ...queryParams, period: effectivePeriod }
   const debouncedQueryParams = useDebounce(queryParams, { wait: 500 })
+  const requestQueryParams = { ...debouncedQueryParams, period: effectivePeriod }
+  const requestTimePeriod = resolveLogTimePeriodOption(
+    requestQueryParams.period,
+    TIME_PERIOD_MAPPING[requestQueryParams.period]!,
+    cloudSandboxPlanState,
+  )
 
   useEffect(() => {
     const pageFromParams = getPageFromParams()
@@ -85,17 +100,17 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
   const query = {
     page: currPage + 1,
     limit,
-    ...(debouncedQueryParams.period !== '9'
+    ...(requestQueryParams.period !== '9'
       ? {
           start: dayjs()
-            .subtract(TIME_PERIOD_MAPPING[debouncedQueryParams.period]!.value, 'day')
+            .subtract(requestTimePeriod.value, 'day')
             .startOf('day')
             .format('YYYY-MM-DD HH:mm'),
           end: dayjs().endOf('day').format('YYYY-MM-DD HH:mm'),
         }
       : {}),
-    ...(isChatMode ? { sort_by: debouncedQueryParams.sort_by } : {}),
-    ...omit(debouncedQueryParams, ['period']),
+    ...(isChatMode ? { sort_by: requestQueryParams.sort_by } : {}),
+    ...omit(requestQueryParams, ['period']),
   }
 
   // When the details are obtained, proceed to the next request
@@ -143,9 +158,10 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
         <Filter
           isChatMode={isChatMode}
           appId={appDetail.id}
-          queryParams={queryParams}
+          queryParams={effectiveQueryParams}
           setQueryParams={handleQueryParamsChange}
         />
+        <RetentionUpgradeNotice />
         {total === undefined ? (
           <Loading type="app" />
         ) : total > 0 ? (

web/app/components/app/log/retention-upgrade-notice.tsx

@@ -0,0 +1,43 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import UpgradeBtn from '@/app/components/billing/upgrade-btn'
+import { useCloudSandboxPlanStatus } from './cloud-sandbox-retention'
+
+export function RetentionUpgradeNotice() {
+  const { t } = useTranslation()
+  const planState = useCloudSandboxPlanStatus()
+
+  if (planState !== 'sandbox') return null
+
+  return (
+    <div
+      role="status"
+      aria-live="polite"
+      aria-atomic="true"
+      className="relative mb-3 shrink-0 overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg-blur shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]"
+    >
+      <div
+        aria-hidden="true"
+        className="absolute -inset-px bg-linear-to-r from-components-badge-status-light-normal-halo to-background-gradient-mask-transparent opacity-40"
+      />
+      <div className="relative flex items-center gap-3 px-3 py-2">
+        <span
+          aria-hidden="true"
+          className="flex size-8 shrink-0 items-center justify-center rounded-lg bg-components-button-primary-bg"
+        >
+          <span className="i-ri-file-list-3-fill size-4 text-components-button-primary-text" />
+        </span>
+        <p className="min-w-0 flex-1 system-sm-medium wrap-break-word text-text-primary">
+          {t(($) => $['retention.upgradeTip.description'], { ns: 'appLog' })}
+        </p>
+        <UpgradeBtn
+          isShort
+          size="custom"
+          className="h-8! shrink-0 rounded-lg! px-2"
+          loc="logs-retention"
+        />
+      </div>
+    </div>
+  )
+}

web/app/components/app/workflow-log/__tests__/filter.spec.tsx

@@ -17,6 +17,35 @@ import Filter, { TIME_PERIOD_MAPPING } from '../filter'
 // Mocks
 // ============================================================================
 
+const mockRuntime = vi.hoisted(() => ({
+  deploymentEdition: 'CLOUD',
+  enableBilling: true,
+  isFetchedPlan: true,
+  isFetchedPlanInfo: true,
+  planType: 'professional',
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useSuspenseQuery: () => ({ data: mockRuntime.deploymentEdition }),
+  }
+})
+
+vi.mock('@/context/provider-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/provider-context')>()
+  return {
+    ...actual,
+    useProviderContext: () => ({
+      enableBilling: mockRuntime.enableBilling,
+      isFetchedPlan: mockRuntime.isFetchedPlan,
+      isFetchedPlanInfo: mockRuntime.isFetchedPlanInfo,
+      plan: { type: mockRuntime.planType },
+    }),
+  }
+})
+
 const mockTrackEvent = vi.fn()
 vi.mock('@/app/components/base/amplitude/utils', () => ({
   trackEvent: (...args: unknown[]) => mockTrackEvent(...args),
@@ -41,6 +70,11 @@ describe('Filter', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockRuntime.deploymentEdition = 'CLOUD'
+    mockRuntime.enableBilling = true
+    mockRuntime.isFetchedPlan = true
+    mockRuntime.isFetchedPlanInfo = true
+    mockRuntime.planType = 'professional'
   })
 
   // --------------------------------------------------------------------------
@@ -176,6 +210,69 @@ describe('Filter', () => {
   // Time Period Filter Tests
   // --------------------------------------------------------------------------
   describe('Time Period Filter', () => {
+    it('should only show supported periods for Cloud sandbox workspaces', async () => {
+      const user = userEvent.setup()
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(
+        <Filter queryParams={createDefaultQueryParams()} setQueryParams={defaultSetQueryParams} />,
+      )
+
+      await user.click(screen.getByRole('combobox', { name: 'appLog.filter.period.last7days' }))
+
+      const listbox = await screen.findByRole('listbox')
+      expect(
+        within(listbox)
+          .getAllByRole('option')
+          .map((option) => option.textContent),
+      ).toEqual([
+        'appLog.filter.period.today',
+        'appLog.filter.period.last7days',
+        'appLog.filter.period.last30days',
+      ])
+    })
+
+    it('should keep all periods for sandbox workspaces outside Cloud', async () => {
+      const user = userEvent.setup()
+      mockRuntime.deploymentEdition = 'COMMUNITY'
+      mockRuntime.planType = 'sandbox'
+
+      render(
+        <Filter queryParams={createDefaultQueryParams()} setQueryParams={defaultSetQueryParams} />,
+      )
+
+      await user.click(screen.getByRole('combobox', { name: 'appLog.filter.period.last7days' }))
+
+      const listbox = await screen.findByRole('listbox')
+      expect(within(listbox).getAllByRole('option')).toHaveLength(9)
+    })
+
+    it('should reset the Cloud sandbox period to today when cleared', async () => {
+      const user = userEvent.setup()
+      const setQueryParams = vi.fn()
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(
+        <Filter
+          queryParams={createDefaultQueryParams({ period: '3' })}
+          setQueryParams={setQueryParams}
+        />,
+      )
+
+      await user.click(
+        screen.getByRole('button', {
+          name: /common\.operation\.clear appLog\.filter\.period\.last30days/,
+        }),
+      )
+
+      expect(setQueryParams).toHaveBeenCalledWith({
+        status: 'all',
+        period: '1',
+      })
+    })
+
     it('should display current period value', () => {
       render(
         <Filter

web/app/components/app/workflow-log/__tests__/index.spec.tsx

@@ -15,11 +15,13 @@ import type { UseQueryResult } from '@tanstack/react-query'
  * - trigger-by-display.spec.tsx
  */
 import type { MockedFunction } from 'vitest'
+import type { CloudSandboxPlanState } from '../../log/cloud-sandbox-retention'
 import type { ILogsProps } from '../index'
 import type { WorkflowAppLogDetail, WorkflowLogsResponse, WorkflowRunDetail } from '@/models/log'
 import type { App, AppIconType, AppModeEnum } from '@/types/app'
 import { screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import dayjs from 'dayjs'
 import { APP_PAGE_LIMIT } from '@/config'
 import { WorkflowRunTriggeredFrom } from '@/models/log'
 import * as useLogModule from '@/service/use-log'
@@ -31,10 +33,35 @@ import Logs from '../index'
 // Mocks
 // ============================================================================
 
+const mockPlanState = vi.hoisted(() => ({
+  value: 'unrestricted' as CloudSandboxPlanState,
+}))
+const mockDebouncedPeriod = vi.hoisted(() => ({
+  value: null as string | null,
+}))
+
 vi.mock('@/service/use-log')
 
+vi.mock('../../log/cloud-sandbox-retention', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../log/cloud-sandbox-retention')>()
+  return {
+    ...actual,
+    useCloudSandboxPlanStatus: () => mockPlanState.value,
+  }
+})
+
 vi.mock('ahooks', () => ({
-  useDebounce: <T,>(value: T) => value,
+  useDebounce: <T,>(value: T) => {
+    if (
+      mockDebouncedPeriod.value === null ||
+      typeof value !== 'object' ||
+      value === null ||
+      !('period' in value)
+    )
+      return value
+
+    return { ...value, period: mockDebouncedPeriod.value }
+  },
   useDebounceFn: (fn: (value: string) => void) => ({ run: fn }),
   useBoolean: (initial: boolean) => {
     const setters = {
@@ -58,6 +85,10 @@ vi.mock('@/next/link', () => ({
   ),
 }))
 
+vi.mock('../../log/retention-upgrade-notice', () => ({
+  RetentionUpgradeNotice: () => <div>retention-upgrade-notice</div>,
+}))
+
 // Mock the Run component to avoid complex dependencies
 vi.mock('@/app/components/workflow/run', () => ({
   default: ({ runDetailUrl, tracingListUrl }: { runDetailUrl: string; tracingListUrl: string }) => (
@@ -237,6 +268,8 @@ describe('Logs Container', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockPlanState.value = 'unrestricted'
+    mockDebouncedPeriod.value = null
   })
 
   // --------------------------------------------------------------------------
@@ -272,6 +305,7 @@ describe('Logs Container', () => {
 
       // Assert
       expect(screen.getByPlaceholderText('common.operation.search')).toBeInTheDocument()
+      expect(screen.getByText('retention-upgrade-notice')).toBeInTheDocument()
     })
   })
 
@@ -444,6 +478,76 @@ describe('Logs Container', () => {
       })
     })
 
+    it('should query the last 30 days when a Sandbox user selects the longest period', async () => {
+      const user = userEvent.setup()
+      mockPlanState.value = 'sandbox'
+      mockedUseWorkflowLogs.mockReturnValue(
+        createMockQueryResult<WorkflowLogsResponse>({
+          data: createMockLogsResponse([], 0),
+        }),
+      )
+
+      renderWithQueryClient(<Logs {...defaultProps} />)
+
+      await user.click(screen.getByText('appLog.filter.period.last7days'))
+      await user.click(await screen.findByText('appLog.filter.period.last30days'))
+
+      expect(
+        screen.getByRole('combobox', { name: 'appLog.filter.period.last30days' }),
+      ).toBeInTheDocument()
+      const params = getMockCallParams()?.params
+      expect(
+        dayjs(String(params?.created_at__before)).diff(String(params?.created_at__after), 'day'),
+      ).toBe(30)
+    })
+
+    it('should use a valid period for the real Chip and request when plan state settles to Sandbox', async () => {
+      const user = userEvent.setup()
+      mockedUseWorkflowLogs.mockReturnValue(
+        createMockQueryResult<WorkflowLogsResponse>({
+          data: createMockLogsResponse([], 0),
+        }),
+      )
+      const rendered = renderWithQueryClient(<Logs {...defaultProps} />)
+
+      await user.click(screen.getByText('appLog.filter.period.last7days'))
+      await user.click(await screen.findByText('appLog.filter.period.allTime'))
+      expect(getMockCallParams()?.params).not.toHaveProperty('created_at__after')
+      expect(getMockCallParams()?.params).not.toHaveProperty('created_at__before')
+
+      mockPlanState.value = 'pending'
+      mockDebouncedPeriod.value = '9'
+      rendered.rerender(<Logs {...defaultProps} />)
+
+      expect(
+        screen.getByRole('combobox', { name: 'appLog.filter.period.today' }),
+      ).toBeInTheDocument()
+      expect(
+        screen.getByRole('button', {
+          name: /common\.operation\.clear appLog\.filter\.period\.today/,
+        }),
+      ).toBeInTheDocument()
+      expect(getMockCallParams()?.params).toEqual(
+        expect.objectContaining({
+          created_at__after: expect.any(String),
+          created_at__before: expect.any(String),
+        }),
+      )
+
+      mockPlanState.value = 'sandbox'
+      rendered.rerender(<Logs {...defaultProps} />)
+
+      expect(
+        screen.getByRole('combobox', { name: 'appLog.filter.period.today' }),
+      ).toBeInTheDocument()
+      expect(getMockCallParams()?.params).toEqual(
+        expect.objectContaining({
+          created_at__after: expect.any(String),
+          created_at__before: expect.any(String),
+        }),
+      )
+    })
+
     it('should update query when typing keyword', async () => {
       // Arrange
       const user = userEvent.setup()

web/app/components/app/workflow-log/filter.tsx

@@ -10,6 +10,13 @@ import { useTranslation } from 'react-i18next'
 import { trackEvent } from '@/app/components/base/amplitude/utils'
 import Chip from '@/app/components/base/chip'
 import Input from '@/app/components/base/input'
+import {
+  CLOUD_SANDBOX_CLEARED_TIME_PERIOD,
+  CLOUD_SANDBOX_TIME_PERIOD_KEYS,
+  isLogTimePeriodRestricted,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from '../log/cloud-sandbox-retention'
 
 dayjs.extend(quarterOfYear)
 
@@ -36,6 +43,12 @@ type IFilterProps = {
 
 const Filter: FC<IFilterProps> = ({ queryParams, setQueryParams }: IFilterProps) => {
   const { t } = useTranslation()
+  const planState = useCloudSandboxPlanStatus()
+  const isTimePeriodRestricted = isLogTimePeriodRestricted(planState)
+  const timePeriodEntries = Object.entries(TIME_PERIOD_MAPPING)
+    .filter(([key]) => !isTimePeriodRestricted || CLOUD_SANDBOX_TIME_PERIOD_KEYS.has(key))
+    .map(([key, option]) => [key, resolveLogTimePeriodOption(key, option, planState)] as const)
+
   return (
     <div className="mb-2 flex flex-row flex-wrap gap-2">
       <Chip
@@ -63,8 +76,13 @@ const Filter: FC<IFilterProps> = ({ queryParams, setQueryParams }: IFilterProps)
         onSelect={(item) => {
           setQueryParams({ ...queryParams, period: item.value })
         }}
-        onClear={() => setQueryParams({ ...queryParams, period: '9' })}
-        items={Object.entries(TIME_PERIOD_MAPPING).map(([k, v]) => ({
+        onClear={() =>
+          setQueryParams({
+            ...queryParams,
+            period: isTimePeriodRestricted ? CLOUD_SANDBOX_CLEARED_TIME_PERIOD : '9',
+          })
+        }
+        items={timePeriodEntries.map(([k, v]) => ({
           value: k,
           name: t(($) => $[`filter.period.${v.name}`], { ns: 'appLog' }),
         }))}

web/app/components/app/workflow-log/index.tsx

@@ -19,6 +19,12 @@ import { useWorkflowLogs } from '@/service/use-log'
 import PageTitle from '../log-annotation/page-title'
 import { ArchivedLogsNotice } from '../log/archived-logs-notice'
 import { shouldShowArchivedLogsNotice } from '../log/archived-logs-notice-utils'
+import {
+  resolveLogTimePeriod,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from '../log/cloud-sandbox-retention'
+import { RetentionUpgradeNotice } from '../log/retention-upgrade-notice'
 import Filter, { TIME_PERIOD_MAPPING } from './filter'
 import List from './list'
 
@@ -43,26 +49,35 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
   })
   const [queryParams, setQueryParams] = useState<QueryParam>({ status: 'all', period: '2' })
   const [currPage, setCurrPage] = React.useState<number>(0)
+  const cloudSandboxPlanState = useCloudSandboxPlanStatus()
+  const effectivePeriod = resolveLogTimePeriod(queryParams.period, cloudSandboxPlanState)
+  const effectiveQueryParams = { ...queryParams, period: effectivePeriod }
   const debouncedQueryParams = useDebounce(queryParams, { wait: 500 })
+  const requestQueryParams = { ...debouncedQueryParams, period: effectivePeriod }
+  const requestTimePeriod = resolveLogTimePeriodOption(
+    requestQueryParams.period,
+    TIME_PERIOD_MAPPING[requestQueryParams.period]!,
+    cloudSandboxPlanState,
+  )
   const [limit, setLimit] = React.useState<number>(APP_PAGE_LIMIT)
 
   const query = {
     page: currPage + 1,
     detail: true,
     limit,
-    ...(debouncedQueryParams.status !== 'all' ? { status: debouncedQueryParams.status } : {}),
-    ...(debouncedQueryParams.keyword ? { keyword: debouncedQueryParams.keyword } : {}),
-    ...(debouncedQueryParams.period !== '9'
+    ...(requestQueryParams.status !== 'all' ? { status: requestQueryParams.status } : {}),
+    ...(requestQueryParams.keyword ? { keyword: requestQueryParams.keyword } : {}),
+    ...(requestQueryParams.period !== '9'
       ? {
           created_at__after: dayjs()
-            .subtract(TIME_PERIOD_MAPPING[debouncedQueryParams.period]!.value, 'day')
+            .subtract(requestTimePeriod.value, 'day')
             .startOf('day')
             .tz(timezone)
             .format('YYYY-MM-DDTHH:mm:ssZ'),
           created_at__before: dayjs().endOf('day').tz(timezone).format('YYYY-MM-DDTHH:mm:ssZ'),
         }
       : {}),
-    ...omit(debouncedQueryParams, ['period', 'status']),
+    ...omit(requestQueryParams, ['period', 'status']),
   }
 
   const { data: workflowLogs, refetch: mutate } = useWorkflowLogs({
@@ -72,7 +87,7 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
   const total = workflowLogs?.total
   const totalPages = total ? Math.max(Math.ceil(total / limit), 1) : 1
   const showArchivedLogsNotice = shouldShowArchivedLogsNotice(
-    queryParams.period,
+    effectiveQueryParams.period,
     TIME_PERIOD_MAPPING,
   )
 
@@ -83,7 +98,8 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
         description={t(($) => $.workflowSubtitle, { ns: 'appLog' })}
       />
       <div className="flex max-h-[calc(100%-16px)] flex-1 flex-col py-4">
-        <Filter queryParams={queryParams} setQueryParams={setQueryParams} />
+        <Filter queryParams={effectiveQueryParams} setQueryParams={setQueryParams} />
+        <RetentionUpgradeNotice />
         {showArchivedLogsNotice && <ArchivedLogsNotice />}
         {/* workflow log */}
         {total === undefined ? (

web/app/components/base/chat/chat/answer/__tests__/agent-roster-response-content.spec.tsx

@@ -91,9 +91,12 @@ describe('AgentRosterResponseContent', () => {
     await user.click(processToggle)
 
     expect(processToggle).toHaveAttribute('aria-expanded', 'true')
-    await waitFor(() => {
-      expect(screen.getByText('history answer')).toBeInTheDocument()
-    })
+    await waitFor(
+      () => {
+        expect(screen.getByText('history answer')).toBeInTheDocument()
+      },
+      { timeout: 5000 },
+    )
 
     expect(screen.queryByText('internal thought should not render')).not.toBeInTheDocument()
   })
@@ -122,9 +125,12 @@ describe('AgentRosterResponseContent', () => {
     render(<AgentRosterResponseContent item={item} />)
     await user.click(screen.getByRole('button', { name: 'Thinking' }))
 
-    await waitFor(() => {
-      expect(screen.getByText('const answer = 42').tagName).toBe('CODE')
-    })
+    await waitFor(
+      () => {
+        expect(screen.getByText('const answer = 42').tagName).toBe('CODE')
+      },
+      { timeout: 5000 },
+    )
   })
 
   it('should keep one collapsible thinking timeline while response parts interleave', async () => {

web/app/components/header/account-setting/index.tsx

@@ -211,6 +211,18 @@ export default function AccountSetting({
 
   return (
     <MenuDialog show onClose={handleClose}>
+      <div className="fixed top-6 right-6 z-20 flex shrink-0 flex-col items-center">
+        <Button
+          variant="tertiary"
+          size="large"
+          className="px-2"
+          aria-label={t(($) => $['operation.close'], { ns: 'common' })}
+          onClick={handleClose}
+        >
+          <span className="i-ri-close-line size-5" />
+        </Button>
+        <div className="mt-1 system-2xs-medium-uppercase text-text-tertiary">ESC</div>
+      </div>
       <div className="flex h-screen w-full max-w-full pl-0 sm:pl-[232px]">
         <div className="flex w-[44px] shrink-0 flex-col pr-6 pl-4 sm:w-[224px]">
           <div className="mt-6 mb-8 flex h-[38px] items-center px-3 title-2xl-semi-bold whitespace-nowrap text-text-primary">
@@ -275,18 +287,6 @@ export default function AccountSetting({
                   </div>
                 )}
               </div>
-              <div className="fixed top-6 right-6 flex shrink-0 flex-col items-center">
-                <Button
-                  variant="tertiary"
-                  size="large"
-                  className="px-2"
-                  aria-label={t(($) => $['operation.close'], { ns: 'common' })}
-                  onClick={handleClose}
-                >
-                  <span className="i-ri-close-line size-5" />
-                </Button>
-                <div className="mt-1 system-2xs-medium-uppercase text-text-tertiary">ESC</div>
-              </div>
             </div>
             <div className="max-w-full min-w-0 px-4 pt-6 sm:px-8">
               {activeMenu === ACCOUNT_SETTING_TAB.PROVIDER && (

web/app/components/header/account-setting/model-provider-page/model-parameter-modal/__tests__/index.spec.tsx

@@ -1,416 +1,73 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import type { ReactNode } from 'react'
+import { fireEvent, render, screen } from '@testing-library/react'
 import ModelParameterModal from '../index'
 
-let parameterRules: Array<Record<string, unknown>> | undefined = [
-  {
-    name: 'temperature',
-    label: { en_US: 'Temperature' },
-    type: 'float',
-    default: 0.7,
-    min: 0,
-    max: 1,
-    help: { en_US: 'Control randomness' },
-  },
-]
-let isRulesLoading = false
-let isRulesPending = false
-let currentProvider: Record<string, unknown> | undefined = {
-  provider: 'openai',
-  label: { en_US: 'OpenAI' },
-}
-let currentModel: Record<string, unknown> | undefined = {
-  model: 'gpt-3.5-turbo',
-  status: 'active',
-  model_properties: { mode: 'chat' },
-}
-let activeTextGenerationModelList: Array<Record<string, unknown>> = [
-  {
-    provider: 'openai',
-    models: [
-      {
-        model: 'gpt-3.5-turbo',
-        model_properties: { mode: 'chat' },
-        features: ['vision'],
-      },
-      {
-        model: 'gpt-4.1',
-        model_properties: { mode: 'chat' },
-        features: ['vision', 'tool-call'],
-      },
-    ],
-  },
-]
+const mocks = vi.hoisted(() => ({
+  openIntegrationsSetting: vi.fn(),
+}))
 
-vi.mock('@/context/provider-context', () => ({
-  useProviderContext: () => ({
-    isAPIKeySet: true,
-  }),
+vi.mock('@/app/components/header/account-setting/use-integrations-setting', () => ({
+  useIntegrationsSetting: () => mocks.openIntegrationsSetting,
 }))
 
 vi.mock('@/service/use-common', () => ({
   useModelParameterRules: () => ({
     data: {
-      data: parameterRules,
+      data: [],
     },
-    isLoading: isRulesLoading,
-    isPending: isRulesPending,
+    isLoading: false,
   }),
 }))
 
 vi.mock('../../hooks', () => ({
   useTextGenerationCurrentProviderAndModelAndModelList: () => ({
-    currentProvider,
-    currentModel,
-    activeTextGenerationModelList,
+    activeTextGenerationModelList: [],
+    currentModel: undefined,
+    currentProvider: undefined,
   }),
 }))
 
-vi.mock('../parameter-item', () => ({
-  default: ({
-    parameterRule,
-    onChange,
-    onSwitch,
-    nodesOutputVars,
-    availableNodes,
-  }: {
-    parameterRule: { name: string; label: { en_US: string } }
-    onChange: (v: number) => void
-    onSwitch: (checked: boolean, val: unknown) => void
-    nodesOutputVars?: unknown[]
-    availableNodes?: unknown[]
-  }) => (
-    <div
-      data-testid={`param-${parameterRule.name}`}
-      data-has-nodes-output-vars={!!nodesOutputVars}
-      data-has-available-nodes={!!availableNodes}
-    >
-      {parameterRule.label.en_US}
-      <button onClick={() => onChange(0.9)}>Change</button>
-      <button onClick={() => onSwitch(false, undefined)}>Remove</button>
-      <button onClick={() => onSwitch(true, 'assigned')}>Add</button>
-    </div>
+vi.mock('../../model-selector', () => ({
+  default: ({ onConfigureEmptyState }: { onConfigureEmptyState?: () => void }) => (
+    <button type="button" onClick={onConfigureEmptyState}>
+      configure-empty-model
+    </button>
   ),
 }))
 
-vi.mock('../../model-selector', () => ({
-  default: ({
-    onHide,
-    onSelect,
-  }: {
-    onHide: () => void
-    onSelect: (value: { provider: string; model: string }) => void
-  }) => (
-    <div data-testid="model-selector">
-      <button onClick={() => onSelect({ provider: 'openai', model: 'gpt-4.1' })}>
-        Select GPT-4.1
-      </button>
-      <button onClick={onHide}>hide</button>
-    </div>
-  ),
+vi.mock('@/app/components/base/loading', () => ({
+  default: () => <div>loading</div>,
+}))
+
+vi.mock('../parameter-item', () => ({
+  default: () => <div>parameter-item</div>,
 }))
 
 vi.mock('../presets-parameter', () => ({
-  default: ({
-    onSelect,
-    supportedParameterNames,
-  }: {
-    onSelect: (id: number) => void
-    supportedParameterNames?: string[]
-  }) => {
-    if (supportedParameterNames && !supportedParameterNames.includes('temperature')) return null
-
-    return <button onClick={() => onSelect(1)}>Preset 1</button>
-  },
+  default: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
 }))
 
-vi.mock('../presets-parameter-utils', () => ({
-  getSupportedPresetConfig: (_toneId: number, supportedParameterNames?: string[]) => {
-    if (supportedParameterNames && !supportedParameterNames.includes('temperature')) return {}
-
-    return { temperature: 0.8 }
-  },
-}))
-
-vi.mock('../trigger', () => ({
-  default: () => <button type="button">Open Settings</button>,
-}))
-
-vi.mock('@/config', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@/config')>()
-  return {
-    ...actual,
-    PROVIDER_WITH_PRESET_TONE: ['openai'],
-  }
-})
-
 describe('ModelParameterModal', () => {
-  const openSettings = () =>
-    fireEvent.click(screen.getByRole('button', { name: /modelProvider\.modelSettings/i }))
-  const defaultProps = {
-    isAdvancedMode: false,
-    modelId: 'gpt-3.5-turbo',
-    provider: 'openai',
-    setModel: vi.fn(),
-    completionParams: { temperature: 0.7 },
-    onCompletionParamsChange: vi.fn(),
-    hideDebugWithMultipleModel: false,
-    debugWithMultipleModel: false,
-    onDebugWithMultipleModelChange: vi.fn(),
-    readonly: false,
-  }
-
   beforeEach(() => {
     vi.clearAllMocks()
-    isRulesLoading = false
-    isRulesPending = false
-    parameterRules = [
-      {
-        name: 'temperature',
-        label: { en_US: 'Temperature' },
-        type: 'float',
-        default: 0.7,
-        min: 0,
-        max: 1,
-        help: { en_US: 'Control randomness' },
-      },
-    ]
-    currentProvider = { provider: 'openai', label: { en_US: 'OpenAI' } }
-    currentModel = {
-      model: 'gpt-3.5-turbo',
-      status: 'active',
-      model_properties: { mode: 'chat' },
-    }
-    activeTextGenerationModelList = [
-      {
-        provider: 'openai',
-        models: [
-          {
-            model: 'gpt-3.5-turbo',
-            model_properties: { mode: 'chat' },
-            features: ['vision'],
-          },
-          {
-            model: 'gpt-4.1',
-            model_properties: { mode: 'chat' },
-            features: ['vision', 'tool-call'],
-          },
-        ],
-      },
-    ]
   })
 
-  it('should render trigger and open modal content when trigger is clicked', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-
-    openSettings()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-    expect(screen.getByTestId('param-temperature')).toBeInTheDocument()
-  })
-
-  it('should keep model selection and model settings as separate actions', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-
-    fireEvent.click(screen.getByText('Select GPT-4.1'))
-
-    expect(defaultProps.setModel).toHaveBeenCalledWith({
-      modelId: 'gpt-4.1',
-      provider: 'openai',
-      mode: 'chat',
-      features: ['vision', 'tool-call'],
-    })
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-
-    fireEvent.click(screen.getByRole('button', { name: /modelProvider\.modelSettings/i }))
-
-    expect(screen.getByTestId('param-temperature')).toBeInTheDocument()
-  })
-
-  it('should disable model settings when no model is selected', () => {
-    render(<ModelParameterModal {...defaultProps} provider="" modelId="" />)
-
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: /modelProvider\.modelSettings/i })).toBeDisabled()
-  })
-
-  it('should call onCompletionParamsChange when parameter changes and switch actions happen', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-
-    fireEvent.click(screen.getByText('Change'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({
-      ...defaultProps.completionParams,
-      temperature: 0.9,
-    })
-
-    fireEvent.click(screen.getByText('Remove'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({})
-
-    fireEvent.click(screen.getByText('Add'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({
-      ...defaultProps.completionParams,
-      temperature: 'assigned',
-    })
-  })
-
-  it('should call onCompletionParamsChange when preset is selected', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    fireEvent.click(screen.getByText('Preset 1'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({
-      ...defaultProps.completionParams,
-      temperature: 0.8,
-    })
-  })
-
-  it('should not render preset control when visible parameters do not support preset keys', () => {
-    parameterRules = [
-      {
-        name: 'max_tokens',
-        label: { en_US: 'Max Tokens' },
-        type: 'int',
-        default: 256,
-        min: 1,
-        max: 4096,
-      },
-    ]
-
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-
-    expect(screen.queryByText('Preset 1')).not.toBeInTheDocument()
-  })
-
-  it('should call setModel when model selector picks another model', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    fireEvent.click(screen.getByText('Select GPT-4.1'))
-
-    expect(defaultProps.setModel).toHaveBeenCalledWith({
-      modelId: 'gpt-4.1',
-      provider: 'openai',
-      mode: 'chat',
-      features: ['vision', 'tool-call'],
-    })
-  })
-
-  it('should toggle debug mode when debug footer is clicked', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    fireEvent.click(screen.getByText(/debugAsMultipleModel/i))
-    expect(defaultProps.onDebugWithMultipleModelChange).toHaveBeenCalled()
-  })
-
-  it('should render loading state when parameter rules are loading', () => {
-    isRulesLoading = true
-    isRulesPending = true
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    expect(screen.getByRole('status')).toBeInTheDocument()
-  })
-
-  it('should not render parameter loading when model is not configured and parameter rules query is pending but disabled', () => {
-    isRulesPending = true
-    parameterRules = []
-
-    render(<ModelParameterModal {...defaultProps} provider="" modelId="" />)
-    openSettings()
-
-    expect(screen.queryByRole('status')).not.toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-  })
-
-  it('should not open content when readonly is true', () => {
-    render(<ModelParameterModal {...defaultProps} readonly />)
-    expect(screen.getByRole('button', { name: /modelProvider\.modelSettings/i })).toBeDisabled()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-  })
-
-  it('should render no parameter items when rules are undefined', () => {
-    parameterRules = undefined
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-  })
-
-  it('should pass nodesOutputVars and availableNodes to ParameterItem', () => {
-    const mockNodesOutputVars = [{ nodeId: 'n1', title: 'Node', vars: [] }]
-    const mockAvailableNodes = [{ id: 'n1', data: { title: 'Node', type: 'llm' } }]
-
+  it('opens provider settings from the model selector empty state', () => {
     render(
       <ModelParameterModal
-        {...defaultProps}
-        isInWorkflow
-        nodesOutputVars={mockNodesOutputVars as never}
-        availableNodes={mockAvailableNodes as never}
-      />,
-    )
-
-    openSettings()
-
-    const paramEl = screen.getByTestId('param-temperature')
-    expect(paramEl).toHaveAttribute('data-has-nodes-output-vars', 'true')
-    expect(paramEl).toHaveAttribute('data-has-available-nodes', 'true')
-  })
-
-  it('should support custom triggers, workflow mode, and missing default model values', async () => {
-    render(
-      <ModelParameterModal
-        {...defaultProps}
-        provider=""
+        isAdvancedMode
         modelId=""
-        isInWorkflow
-        renderTrigger={({ open }) => <span>{open ? 'Custom Open' : 'Custom Closed'}</span>}
+        provider=""
+        completionParams={{}}
+        setModel={vi.fn()}
+        onCompletionParamsChange={vi.fn()}
       />,
     )
 
-    fireEvent.click(screen.getByText('Custom Closed'))
+    fireEvent.click(screen.getByText('configure-empty-model'))
 
-    expect(screen.getByText('Custom Open')).toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-
-    fireEvent.click(screen.getByText('hide'))
-
-    await waitFor(() => {
-      expect(screen.queryByTestId('model-selector')).not.toBeInTheDocument()
+    expect(mocks.openIntegrationsSetting).toHaveBeenCalledWith({
+      payload: 'provider',
     })
   })
-
-  it('should append the stop parameter in advanced mode and show the single-model debug label', () => {
-    render(<ModelParameterModal {...defaultProps} isAdvancedMode debugWithMultipleModel />)
-
-    openSettings()
-
-    expect(screen.getByTestId('param-stop')).toBeInTheDocument()
-    expect(screen.getByText(/debugAsSingleModel/i)).toBeInTheDocument()
-  })
-
-  it('should render the empty loading fallback when rules resolve to an empty list', () => {
-    parameterRules = []
-    isRulesLoading = true
-    isRulesPending = true
-
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-
-    expect(screen.getByRole('status')).toBeInTheDocument()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-  })
-
-  it('should support custom trigger placement outside workflow mode', () => {
-    render(
-      <ModelParameterModal
-        {...defaultProps}
-        renderTrigger={({ open }) => <span>{open ? 'Popup Open' : 'Popup Closed'}</span>}
-      />,
-    )
-
-    fireEvent.click(screen.getByText('Popup Closed'))
-
-    expect(screen.getByText('Popup Open')).toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-  })
 })

web/app/components/header/account-setting/model-provider-page/model-parameter-modal/index.tsx

@@ -1,5 +1,5 @@
 import type { FC, ReactNode } from 'react'
-import type { DefaultModel, FormValue, ModelParameterRule } from '../declarations'
+import type { DefaultModel, FormValue, Model, ModelParameterRule } from '../declarations'
 import type { ParameterValue } from './parameter-item'
 import type { TriggerProps } from './types'
 import type { Node, NodeOutPutVar } from '@/app/components/workflow/types'
@@ -7,8 +7,9 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Popover, PopoverClose, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { ArrowNarrowLeft } from '@/app/components/base/icons/src/vender/line/arrows'
 import Loading from '@/app/components/base/loading'
+import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
+import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
 import { PROVIDER_WITH_PRESET_TONE, STOP_PARAMETER_RULE } from '@/config'
 import { useModelParameterRules } from '@/service/use-common'
 import { useTextGenerationCurrentProviderAndModelAndModelList } from '../hooks'
@@ -34,8 +35,10 @@ export type ModelParameterModalProps = {
   debugWithMultipleModel?: boolean
   onDebugWithMultipleModelChange?: () => void
   renderTrigger?: (v: TriggerProps) => ReactNode
+  triggerContainerClassName?: string
   readonly?: boolean
   isInWorkflow?: boolean
+  modelList?: Model[]
   scope?: string
   nodesOutputVars?: NodeOutPutVar[]
   availableNodes?: Node[]
@@ -53,17 +56,25 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
   debugWithMultipleModel,
   onDebugWithMultipleModelChange,
   renderTrigger,
+  triggerContainerClassName,
   readonly,
   isInWorkflow,
+  modelList,
   nodesOutputVars,
   availableNodes,
 }) => {
   const { t } = useTranslation()
   const [open, setOpen] = useState(false)
+  const openIntegrationsSetting = useIntegrationsSetting()
   const { data: parameterRulesData, isLoading } = useModelParameterRules(provider, modelId)
   const isRulesLoading = !!provider && !!modelId && isLoading
   const { currentProvider, currentModel, activeTextGenerationModelList } =
     useTextGenerationCurrentProviderAndModelAndModelList({ provider, model: modelId })
+  const availableTextGenerationModelList = modelList ?? activeTextGenerationModelList
+  const selectedProvider =
+    modelList?.find((modelItem) => modelItem.provider === provider) ?? currentProvider
+  const selectedModel =
+    selectedProvider?.models?.find((modelItem) => modelItem.model === modelId) ?? currentModel
 
   const parameterRules: ModelParameterRule[] = useMemo(() => {
     return parameterRulesData?.data || []
@@ -71,6 +82,7 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
   const supportedPresetParameterNames = useMemo(() => {
     return parameterRules.map((parameterRule) => parameterRule.name)
   }, [parameterRules])
+  const hasSelectedModel = !!provider && !!modelId
 
   const handleParamChange = (key: string, value: ParameterValue) => {
     onCompletionParamsChange({
@@ -80,10 +92,10 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
   }
 
   const handleChangeModel = ({ provider, model }: DefaultModel) => {
-    const targetProvider = activeTextGenerationModelList.find(
+    const targetProvider = availableTextGenerationModelList.find(
       (modelItem) => modelItem.provider === provider,
     )
-    const targetModelItem = targetProvider?.models.find((modelItem) => modelItem.model === model)
+    const targetModelItem = targetProvider?.models?.find((modelItem) => modelItem.model === model)
     setModel({
       modelId: model,
       provider,
@@ -91,6 +103,15 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
       features: targetModelItem?.features || [],
     })
   }
+  const handleOpenModelSettings = () => {
+    if (readonly || !hasSelectedModel) return
+    setOpen(true)
+  }
+  const handleConfigureEmptyState = () => {
+    if (readonly) return
+
+    openIntegrationsSetting({ payload: ACCOUNT_SETTING_TAB.PROVIDER })
+  }
 
   const handleSwitch = (key: string, value: boolean, assignValue: ParameterValue) => {
     if (!value) {
@@ -114,8 +135,6 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
     })
   }
 
-  const hasSelectedModel = !!provider && !!modelId
-
   return (
     <Popover
       open={open}
@@ -133,8 +152,8 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
             >
               {renderTrigger({
                 open,
-                currentProvider,
-                currentModel,
+                currentProvider: selectedProvider,
+                currentModel: selectedModel,
                 providerName: provider,
                 modelId,
               })}
@@ -142,11 +161,16 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
           }
         />
       ) : (
-        <div className="flex h-8 min-w-[296px] items-center gap-px overflow-hidden rounded-lg">
+        <div
+          className={cn(
+            'flex h-8 min-w-[296px] items-center gap-px overflow-hidden rounded-lg',
+            triggerContainerClassName,
+          )}
+        >
           <div className="min-w-0 flex-1">
             <ModelSelector
               defaultModel={provider || modelId ? { provider, model: modelId } : undefined}
-              modelList={activeTextGenerationModelList}
+              modelList={availableTextGenerationModelList}
               readonly={readonly}
               triggerClassName={cn(
                 'h-8! w-full rounded-r-none!',
@@ -154,6 +178,8 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
                   'border border-workflow-block-parma-bg bg-workflow-block-parma-bg hover:bg-workflow-block-parma-bg',
               )}
               onSelect={handleChangeModel}
+              onConfigureEmptyState={handleConfigureEmptyState}
+              onOpenProviderSettings={handleOpenModelSettings}
             />
           </div>
           <PopoverTrigger
@@ -187,8 +213,9 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
             <div className="px-4 pt-2 pb-4">
               <ModelSelector
                 defaultModel={hasSelectedModel ? { provider, model: modelId } : undefined}
-                modelList={activeTextGenerationModelList}
+                modelList={availableTextGenerationModelList}
                 onSelect={handleChangeModel}
+                onOpenProviderSettings={handleOpenModelSettings}
                 onHide={() => setOpen(false)}
               />
             </div>
@@ -249,7 +276,10 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
             {debugWithMultipleModel
               ? t(($) => $.debugAsSingleModel, { ns: 'appDebug' })
               : t(($) => $.debugAsMultipleModel, { ns: 'appDebug' })}
-            <ArrowNarrowLeft className="size-3 rotate-180" />
+            <span
+              aria-hidden
+              className="i-custom-vender-line-arrows-arrow-narrow-left size-3 rotate-180"
+            />
           </div>
         )}
       </PopoverContent>

web/app/components/header/account-setting/model-provider-page/model-selector/index.tsx

@@ -33,6 +33,7 @@ type ModelSelectorProps = {
   hideProviderSettingsFooter?: boolean
   onConfigureEmptyState?: () => void
   onOpenMarketplace?: () => void
+  onOpenProviderSettings?: () => void
   providerSettingsSource?: 'agent'
   showModelMeta?: boolean
   modelPredicate?: ModelSelectorModelPredicate
@@ -52,6 +53,7 @@ function ModelSelector({
   hideProviderSettingsFooter,
   onConfigureEmptyState,
   onOpenMarketplace,
+  onOpenProviderSettings,
   providerSettingsSource,
   showModelMeta,
   modelPredicate,
@@ -180,6 +182,7 @@ function ModelSelector({
           modelSuggestionPredicate={modelSuggestionPredicate}
           onConfigureEmptyState={onConfigureEmptyState ? handleConfigureEmptyState : undefined}
           onOpenMarketplace={onOpenMarketplace}
+          onOpenProviderSettings={onOpenProviderSettings}
           onInputValueChange={setInputValue}
           onHide={handleHide}
         />

web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx

@@ -9,7 +9,6 @@ import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { CreditsCoin } from '@/app/components/base/icons/src/vender/line/financeAndECommerce'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
@@ -57,7 +56,8 @@ function PopupItem({
   const updateModelProviders = useUpdateModelProviders()
   const currentProvider = modelProviders.find((provider) => provider.provider === model.provider)
   const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
-  const canOpenCredentialDropdown = canUseCredential || canCreateCredential || canManageCredential
+  const canOpenCredentialDropdown =
+    !!currentProvider && (canUseCredential || canCreateCredential || canManageCredential)
   const handleOpenModelModal = () => {
     if (!canCreateCredential) return
 
@@ -77,7 +77,8 @@ function PopupItem({
     })
   }
 
-  const state = useCredentialPanelState(currentProvider)
+  // oxlint-disable-next-line eslint-react/use-state -- This domain hook returns credential panel state, not a React useState tuple.
+  const credentialPanelState = useCredentialPanelState(currentProvider)
   const { isChangingPriority, handleChangePriority } = useChangeProviderPriority(currentProvider)
   const groupItems = useMemo(
     () =>
@@ -90,10 +91,11 @@ function PopupItem({
     [model.models, model.provider],
   )
 
-  const isUsingCredits = state.priority === 'credits'
-  const hasCredits = !state.isCreditsExhausted
-  const isApiKeyActive = state.variant === 'api-active' || state.variant === 'api-fallback'
-  const { credentialName } = state
+  const isUsingCredits = credentialPanelState.priority === 'credits'
+  const hasCredits = !credentialPanelState.isCreditsExhausted
+  const isApiKeyActive =
+    credentialPanelState.variant === 'api-active' || credentialPanelState.variant === 'api-fallback'
+  const { credentialName } = credentialPanelState
 
   const handleCloseDropdown = useCallback(() => {
     setDropdownOpen(false)
@@ -129,7 +131,10 @@ function PopupItem({
                 {isUsingCredits ? (
                   hasCredits ? (
                     <>
-                      <CreditsCoin className="size-3" />
+                      <span
+                        aria-hidden
+                        className="i-custom-vender-line-financeandecommerce-credits-coin size-3"
+                      />
                       <span className="ml-1 truncate">
                         {t(($) => $['modelProvider.selector.aiCredits'], { ns: 'common' })}
                       </span>
@@ -161,15 +166,17 @@ function PopupItem({
               </button>
             }
           />
-          <PopoverContent placement="bottom-end">
-            <DropdownContent
-              provider={currentProvider}
-              state={state}
-              isChangingPriority={isChangingPriority}
-              onChangePriority={handleChangePriority}
-              onClose={handleCloseDropdown}
-            />
-          </PopoverContent>
+          {currentProvider && (
+            <PopoverContent placement="bottom-end">
+              <DropdownContent
+                provider={currentProvider}
+                state={credentialPanelState}
+                isChangingPriority={isChangingPriority}
+                onChangePriority={handleChangePriority}
+                onClose={handleCloseDropdown}
+              />
+            </PopoverContent>
+          )}
         </Popover>
       </div>
       {!collapsed &&
@@ -215,7 +222,7 @@ function PopupItem({
                 </ModelName>
               </div>
               {defaultModel?.model === modelItem.model &&
-                defaultModel.provider === currentProvider.provider && (
+                defaultModel.provider === model.provider && (
                   <ComboboxItemIndicator className="shrink-0 text-text-accent">
                     <span
                       className="i-custom-vender-line-general-check size-4"

web/app/components/header/account-setting/model-provider-page/model-selector/popup.tsx

@@ -69,6 +69,7 @@ export type PopupProps = {
   onConfigureEmptyState?: () => void
   onInputValueChange: (value: string) => void
   onOpenMarketplace?: () => void
+  onOpenProviderSettings?: () => void
   onHide: () => void
 }
 function Popup({
@@ -83,6 +84,7 @@ function Popup({
   onConfigureEmptyState,
   onInputValueChange,
   onOpenMarketplace,
+  onOpenProviderSettings,
   onHide,
 }: PopupProps) {
   const { t } = useTranslation()
@@ -255,11 +257,16 @@ function Popup({
 
   const handleOpenSettings = useCallback(() => {
     onHide()
+    if (onOpenProviderSettings) {
+      onOpenProviderSettings()
+      return
+    }
+
     openIntegrationsSetting({
       payload: ACCOUNT_SETTING_TAB.PROVIDER,
       source: providerSettingsSource,
     })
-  }, [onHide, openIntegrationsSetting, providerSettingsSource])
+  }, [onHide, onOpenProviderSettings, openIntegrationsSetting, providerSettingsSource])
   const handleClosePreviewCard = useCallback(() => {
     previewCardHandle.close()
   }, [previewCardHandle])
@@ -272,8 +279,10 @@ function Popup({
   return (
     <ModelSelectorPopupFrame>
       <ModelSelectorSearchHeader inputValue={inputValue} onInputValueChange={onInputValueChange} />
-      {showCreditsExhaustedAlert && <CreditsExhaustedAlert hasApiKeyFallback={hasApiKeyFallback} />}
       <ModelSelectorScrollBody label={t(($) => $['modelProvider.models'], { ns: 'common' })}>
+        {showCreditsExhaustedAlert && (
+          <CreditsExhaustedAlert hasApiKeyFallback={hasApiKeyFallback} />
+        )}
         <ComboboxList className="max-h-none overflow-visible p-0">
           <div className="pb-1">
             {filteredModelList.map((model) => (

web/app/components/main-nav/__tests__/index.spec.tsx

@@ -564,6 +564,10 @@ describe('MainNav', () => {
     expect(screen.getByRole('link', { name: /common.menus.apps/ })).toHaveAttribute('href', '/apps')
     expect(screen.getByRole('link', { name: /Agents/ })).toHaveAttribute('href', '/agents')
     expect(screen.getByRole('link', { name: /Agents common.menus.status/ })).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.mainNav.skills/ })).toHaveAttribute(
+      'href',
+      '/skills',
+    )
     expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toHaveAttribute(
       'href',
       '/datasets',
@@ -584,6 +588,10 @@ describe('MainNav', () => {
     renderMainNav()
 
     expect(screen.queryByRole('link', { name: /Agents/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.mainNav.skills/ })).toHaveAttribute(
+      'href',
+      '/skills',
+    )
   })
 
   it('hides the roster entry when the user lacks agent.manage', () => {
@@ -743,6 +751,7 @@ describe('MainNav', () => {
     expect(screen.getByRole('link', { name: /common.mainNav.home/ })).toHaveAttribute('href', '/')
     expect(screen.getByRole('link', { name: /common.menus.apps/ })).toHaveAttribute('href', '/apps')
     expect(screen.queryByRole('link', { name: /Agents/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.mainNav.skills/ })).not.toBeInTheDocument()
     expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toHaveAttribute(
       'href',
       '/datasets',

web/app/components/main-nav/routes.ts

@@ -32,6 +32,8 @@ export type DetailSidebarVisibilityOptions = Pick<
 const VISIBLE_TO_ALL: MainNavRouteVisibility = () => true
 const CAN_MANAGE_AGENTS: MainNavRouteVisibility = (options) => options.canManageAgents
 const CAN_USE_APP_DEPLOY: MainNavRouteVisibility = (options) => options.canUseAppDeploy
+const NOT_DATASET_OPERATOR: MainNavRouteVisibility = (options) =>
+  !options.isCurrentWorkspaceDatasetOperator
 
 function isPathUnderRoute(pathname: string, route: string) {
   return pathname === route || pathname.startsWith(`${route}/`)
@@ -69,6 +71,15 @@ export const MAIN_NAV_ROUTES = [
     visibility: CAN_MANAGE_AGENTS,
     feature: 'agentV2',
   },
+  {
+    key: 'skills',
+    href: '/skills',
+    labelKey: 'mainNav.skills',
+    active: (path: string) => isPathUnderRoute(path, '/skills'),
+    icon: 'i-ri-box-3-line',
+    activeIcon: 'i-ri-box-3-fill',
+    visibility: NOT_DATASET_OPERATOR,
+  },
   {
     key: 'datasets',
     href: '/datasets',

web/app/components/plugins/install-plugin/hooks/__tests__/use-install-plugin-limit.spec.ts

@@ -4,125 +4,101 @@ import { InstallationScope } from '@/features/system-features/constants'
 import { renderHookWithConsoleQuery as renderHook } from '@/test/console/query-data'
 import { pluginInstallLimit } from '../use-install-plugin-limit'
 
+type PluginInstallCandidate = Parameters<typeof pluginInstallLimit>[0]
+type SystemFeatures = Parameters<typeof pluginInstallLimit>[1]
+
 const basePlugin = {
   from: 'marketplace' as const,
   verification: { authorized_category: 'langgenius' },
+} satisfies PluginInstallCandidate
+
+function makeSystemFeatures(
+  scope: PluginInstallationScope,
+  restrictToMarketplaceOnly = false,
+): SystemFeatures {
+  return {
+    plugin_installation_permission: {
+      restrict_to_marketplace_only: restrictToMarketplaceOnly,
+      plugin_installation_scope: scope,
+    },
+  }
 }
 
 describe('pluginInstallLimit', () => {
   it('should allow all plugins when scope is ALL', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: false,
-        plugin_installation_scope: InstallationScope.ALL,
-      },
-    }
+    const features = makeSystemFeatures(InstallationScope.ALL)
 
-    expect(pluginInstallLimit(basePlugin as never, features as never).canInstall).toBe(true)
+    expect(pluginInstallLimit(basePlugin, features).canInstall).toBe(true)
   })
 
   it('should deny all plugins when scope is NONE', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: false,
-        plugin_installation_scope: InstallationScope.NONE,
-      },
-    }
+    const features = makeSystemFeatures(InstallationScope.NONE)
 
-    expect(pluginInstallLimit(basePlugin as never, features as never).canInstall).toBe(false)
+    expect(pluginInstallLimit(basePlugin, features).canInstall).toBe(false)
   })
 
   it('should allow langgenius plugins when scope is OFFICIAL_ONLY', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: false,
-        plugin_installation_scope: InstallationScope.OFFICIAL_ONLY,
-      },
-    }
+    const features = makeSystemFeatures(InstallationScope.OFFICIAL_ONLY)
 
-    expect(pluginInstallLimit(basePlugin as never, features as never).canInstall).toBe(true)
+    expect(pluginInstallLimit(basePlugin, features).canInstall).toBe(true)
   })
 
   it('should deny non-official plugins when scope is OFFICIAL_ONLY', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: false,
-        plugin_installation_scope: InstallationScope.OFFICIAL_ONLY,
-      },
-    }
-    const plugin = { ...basePlugin, verification: { authorized_category: 'community' } }
+    const features = makeSystemFeatures(InstallationScope.OFFICIAL_ONLY)
+    const plugin = {
+      ...basePlugin,
+      verification: { authorized_category: 'community' as const },
+    } satisfies PluginInstallCandidate
 
-    expect(pluginInstallLimit(plugin as never, features as never).canInstall).toBe(false)
+    expect(pluginInstallLimit(plugin, features).canInstall).toBe(false)
   })
 
   it('should allow partner plugins when scope is OFFICIAL_AND_PARTNER', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: false,
-        plugin_installation_scope: InstallationScope.OFFICIAL_AND_PARTNER,
-      },
-    }
-    const plugin = { ...basePlugin, verification: { authorized_category: 'partner' } }
+    const features = makeSystemFeatures(InstallationScope.OFFICIAL_AND_PARTNER)
+    const plugin = {
+      ...basePlugin,
+      verification: { authorized_category: 'partner' as const },
+    } satisfies PluginInstallCandidate
 
-    expect(pluginInstallLimit(plugin as never, features as never).canInstall).toBe(true)
+    expect(pluginInstallLimit(plugin, features).canInstall).toBe(true)
   })
 
   it('should deny github plugins when restrict_to_marketplace_only is true', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: true,
-        plugin_installation_scope: InstallationScope.ALL,
-      },
-    }
-    const plugin = { ...basePlugin, from: 'github' as const }
+    const features = makeSystemFeatures(InstallationScope.ALL, true)
+    const plugin = { ...basePlugin, from: 'github' as const } satisfies PluginInstallCandidate
 
-    expect(pluginInstallLimit(plugin as never, features as never).canInstall).toBe(false)
+    expect(pluginInstallLimit(plugin, features).canInstall).toBe(false)
   })
 
   it('should deny package plugins when restrict_to_marketplace_only is true', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: true,
-        plugin_installation_scope: InstallationScope.ALL,
-      },
-    }
-    const plugin = { ...basePlugin, from: 'package' as const }
+    const features = makeSystemFeatures(InstallationScope.ALL, true)
+    const plugin = { ...basePlugin, from: 'package' as const } satisfies PluginInstallCandidate
 
-    expect(pluginInstallLimit(plugin as never, features as never).canInstall).toBe(false)
+    expect(pluginInstallLimit(plugin, features).canInstall).toBe(false)
   })
 
   it('should allow marketplace plugins even when restrict_to_marketplace_only is true', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: true,
-        plugin_installation_scope: InstallationScope.ALL,
-      },
-    }
+    const features = makeSystemFeatures(InstallationScope.ALL, true)
 
-    expect(pluginInstallLimit(basePlugin as never, features as never).canInstall).toBe(true)
+    expect(pluginInstallLimit(basePlugin, features).canInstall).toBe(true)
   })
 
   it('should default to langgenius when no verification info', () => {
-    const features = {
-      plugin_installation_permission: {
-        restrict_to_marketplace_only: false,
-        plugin_installation_scope: InstallationScope.OFFICIAL_ONLY,
-      },
-    }
-    const plugin = { from: 'marketplace' as const }
+    const features = makeSystemFeatures(InstallationScope.OFFICIAL_ONLY)
+    const plugin = { from: 'marketplace' as const } satisfies PluginInstallCandidate
 
-    expect(pluginInstallLimit(plugin as never, features as never).canInstall).toBe(true)
+    expect(pluginInstallLimit(plugin, features).canInstall).toBe(true)
   })
 
-  it('should fallback to canInstall true for unrecognized scope', () => {
+  it('should deny installation for an unrecognized runtime scope', () => {
     const features = {
       plugin_installation_permission: {
         restrict_to_marketplace_only: false,
-        plugin_installation_scope: 'unknown-scope' as unknown as PluginInstallationScope,
+        plugin_installation_scope: 'unknown-scope',
       },
-    }
+    } as unknown as SystemFeatures
 
-    expect(pluginInstallLimit(basePlugin as never, features as never).canInstall).toBe(true)
+    expect(pluginInstallLimit(basePlugin, features).canInstall).toBe(false)
   })
 })
 
@@ -132,9 +108,9 @@ describe('usePluginInstallLimit', () => {
     const plugin = {
       from: 'marketplace' as const,
       verification: { authorized_category: 'langgenius' },
-    }
+    } satisfies PluginInstallCandidate
 
-    const { result } = renderHook(() => usePluginInstallLimit(plugin as never))
+    const { result } = renderHook(() => usePluginInstallLimit(plugin))
 
     expect(result.current.canInstall).toBe(true)
   })

web/app/components/plugins/install-plugin/hooks/use-install-plugin-limit.tsx

@@ -1,68 +1,55 @@
 import type { GetSystemFeaturesResponse } from '@dify/contracts/api/console/system-features/types.gen'
-import type { Plugin, PluginManifestInMarket } from '../../types'
+import type {
+  PluginBundleDependencyType,
+  PluginVerification,
+} from '@dify/contracts/api/console/workspaces/types.gen'
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { InstallationScope } from '@/features/system-features/constants'
 
-type PluginProps = (Plugin | PluginManifestInMarket) & {
-  from: 'github' | 'marketplace' | 'package'
+type PluginInstallCandidate = {
+  from: PluginBundleDependencyType
+  verification?: PluginVerification | null
 }
 type PluginInstallLimitResult = {
   canInstall: boolean
 }
 
+function denyUnsupportedInstallationScope(_scope: never): PluginInstallLimitResult {
+  return { canInstall: false }
+}
+
 export function pluginInstallLimit(
-  plugin: PluginProps,
+  plugin: PluginInstallCandidate,
   systemFeatures: Pick<GetSystemFeaturesResponse, 'plugin_installation_permission'>,
 ) {
-  if (systemFeatures.plugin_installation_permission.restrict_to_marketplace_only) {
+  const permission = systemFeatures.plugin_installation_permission
+  if (permission.restrict_to_marketplace_only) {
     if (plugin.from === 'github' || plugin.from === 'package') return { canInstall: false }
   }
 
-  if (
-    systemFeatures.plugin_installation_permission.plugin_installation_scope ===
-    InstallationScope.ALL
-  ) {
-    return {
-      canInstall: true,
-    }
-  }
-  if (
-    systemFeatures.plugin_installation_permission.plugin_installation_scope ===
-    InstallationScope.NONE
-  ) {
-    return {
-      canInstall: false,
-    }
-  }
-  const verification = plugin.verification || {}
-  if (!plugin.verification || !plugin.verification.authorized_category)
-    verification.authorized_category = 'langgenius'
+  const authorizedCategory = plugin.verification?.authorized_category ?? 'langgenius'
+  const scope = permission.plugin_installation_scope
 
-  if (
-    systemFeatures.plugin_installation_permission.plugin_installation_scope ===
-    InstallationScope.OFFICIAL_ONLY
-  ) {
-    return {
-      canInstall: verification.authorized_category === 'langgenius',
-    }
-  }
-  if (
-    systemFeatures.plugin_installation_permission.plugin_installation_scope ===
-    InstallationScope.OFFICIAL_AND_PARTNER
-  ) {
-    return {
-      canInstall:
-        verification.authorized_category === 'langgenius' ||
-        verification.authorized_category === 'partner',
-    }
-  }
-  return {
-    canInstall: true,
+  switch (scope) {
+    case InstallationScope.ALL:
+      return { canInstall: true }
+    case InstallationScope.NONE:
+      return { canInstall: false }
+    case InstallationScope.OFFICIAL_ONLY:
+      return { canInstall: authorizedCategory === 'langgenius' }
+    case InstallationScope.OFFICIAL_AND_PARTNER:
+      return {
+        canInstall: authorizedCategory === 'langgenius' || authorizedCategory === 'partner',
+      }
+    default:
+      return denyUnsupportedInstallationScope(scope)
   }
 }
 
-export default function usePluginInstallLimit(plugin: PluginProps): PluginInstallLimitResult {
+export default function usePluginInstallLimit(
+  plugin: PluginInstallCandidate,
+): PluginInstallLimitResult {
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
 
   return pluginInstallLimit(plugin, systemFeatures)

web/app/components/workflow/panel/debug-and-preview/__tests__/conversation-variable-modal.spec.tsx

@@ -119,8 +119,10 @@ describe('ConversationVariableModal', () => {
     })
 
     expect(screen.getAllByText('session_state')).toHaveLength(2)
-    expect(screen.getByText((content) => content.includes('formatted-100'))).toBeInTheDocument()
-    expect(screen.getByTestId('conversation-code-editor')).toHaveTextContent('{"latest":1}')
+    expect(
+      await screen.findByText((content) => content.includes('formatted-100')),
+    ).toBeInTheDocument()
+    expect(await screen.findByTestId('conversation-code-editor')).toHaveTextContent('{"latest":1}')
 
     await user.click(screen.getByText('summary'))
     expect(screen.getByText('latest text')).toBeInTheDocument()

web/app/install/installForm.spec.tsx

@@ -16,6 +16,10 @@ vi.mock('@/next/navigation', () => ({
   useRouter: () => ({ push: mockPush, replace: mockReplace }),
 }))
 
+vi.mock('@/hooks/use-document-title', () => ({
+  default: vi.fn(),
+}))
+
 vi.mock('@/service/common', () => ({
   fetchSetupStatus: vi.fn(),
   fetchInitValidateStatus: vi.fn(),

web/app/layout.tsx

@@ -27,6 +27,23 @@ export const viewport: Viewport = {
   viewportFit: 'cover',
 }
 
+const resizeObserverErrorFilterScript = `
+(() => {
+  const ignoredMessages = new Set([
+    'ResizeObserver loop completed with undelivered notifications.',
+    'ResizeObserver loop limit exceeded',
+  ]);
+  const ignore = (event) => {
+    const message = event?.message || event?.reason?.message;
+    if (!ignoredMessages.has(message)) return;
+    event.preventDefault();
+    event.stopImmediatePropagation();
+  };
+  window.addEventListener('error', ignore, true);
+  window.addEventListener('unhandledrejection', ignore, true);
+})();
+`
+
 export default async function RootLayout({ children }: { children: React.ReactNode }) {
   const datasetMap = getDatasetMap()
   const queryClient = getQueryClientServer()
@@ -43,6 +60,11 @@ export default async function RootLayout({ children }: { children: React.ReactNo
     <html lang={locale ?? 'en'} className="h-full" suppressHydrationWarning>
       <head>
         <link rel="manifest" href="/manifest.json" />
+        <script
+          nonce={nonce}
+          // oxlint-disable-next-line eslint-react/dom-no-dangerously-set-innerhtml -- Static early listener must run before the dev error overlay registers.
+          dangerouslySetInnerHTML={{ __html: resizeObserverErrorFilterScript }}
+        />
         <meta name="theme-color" content="#1C64F2" />
         <meta name="mobile-web-app-capable" content="yes" />
         <meta name="apple-mobile-web-app-capable" content="yes" />

web/features/agent-v2/agent-detail/configure/components/orchestrate/add-actions.tsx

@@ -8,15 +8,15 @@ import type {
 } from './add-actions-context'
 import { useCallback, useMemo, useState } from 'react'
 import { AgentOrchestrateAddActionsContext } from './add-actions-context'
-import { useAgentOrchestrateReadOnly } from './read-only-context'
+import { useAgentOrchestrateViewingVersion } from './read-only-context'
 
 export function AgentOrchestrateAddActionsProvider({ children }: { children: ReactNode }) {
-  const readOnly = useAgentOrchestrateReadOnly()
+  const isViewingVersion = useAgentOrchestrateViewingVersion()
   const [actions, setActions] = useState<AgentOrchestrateAddActions>({})
 
   const registerAction = useCallback(
     (key: AgentOrchestrateAddActionKey, action: AgentOrchestrateAddAction) => {
-      if (readOnly) return () => undefined
+      if (isViewingVersion) return () => undefined
 
       setActions((currentActions) => {
         if (currentActions[key] === action) return currentActions
@@ -37,15 +37,15 @@ export function AgentOrchestrateAddActionsProvider({ children }: { children: Rea
         })
       }
     },
-    [readOnly],
+    [isViewingVersion],
   )
 
   const value = useMemo(
     () => ({
-      actions: readOnly ? {} : actions,
+      actions: isViewingVersion ? {} : actions,
       registerAction,
     }),
-    [actions, readOnly, registerAction],
+    [actions, isViewingVersion, registerAction],
   )
 
   return (

web/features/agent-v2/agent-detail/configure/components/orchestrate/common/add-button.tsx

@@ -4,7 +4,7 @@ import type { ButtonProps } from '@langgenius/dify-ui/button'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { useTranslation } from 'react-i18next'
-import { useAgentOrchestrateReadOnly } from '../read-only-context'
+import { useAgentOrchestrateViewingVersion } from '../read-only-context'
 
 type ConfigureSectionAddButtonProps = Omit<
   ButtonProps,
@@ -19,9 +19,9 @@ export function ConfigureSectionAddButton({
   ...props
 }: ConfigureSectionAddButtonProps) {
   const { t } = useTranslation('common')
-  const readOnly = useAgentOrchestrateReadOnly()
+  const isViewingVersion = useAgentOrchestrateViewingVersion()
 
-  if (readOnly) return null
+  if (isViewingVersion) return null
 
   return (
     <Button

web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx

@@ -13,7 +13,10 @@ import { agentComposerDraftAtom } from '@/features/agent-v2/agent-composer/store
 import { QueryClientTestProvider } from '@/test/console/query-provider'
 import { createSystemFeaturesFixture } from '@/test/console/system-features'
 import { AgentConfigApiContextProvider } from '../../config-context'
-import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
+import {
+  AgentOrchestrateReadOnlyContext,
+  AgentOrchestrateViewingVersionContext,
+} from '../../read-only-context'
 import { AgentFiles } from '../index'
 
 type ConfigFileQueryOptionsInput = {
@@ -171,10 +174,12 @@ function renderAgentFiles({
   initialDraft = createInitialDraft(),
   apiContext = { agentId: 'agent-1', draftType: 'draft' } satisfies AgentConfigApiContext,
   readOnly = false,
+  viewingVersion = false,
 }: {
   initialDraft?: AgentSoulConfigFormState
   apiContext?: AgentConfigApiContext
   readOnly?: boolean
+  viewingVersion?: boolean
 } = {}) {
   const queryClient = new QueryClient({
     defaultOptions: {
@@ -191,10 +196,12 @@ function renderAgentFiles({
     <QueryClientTestProvider queryClient={queryClient}>
       <AgentConfigApiContextProvider value={apiContext}>
         <AgentComposerProvider initialDraft={initialDraft}>
-          <AgentOrchestrateReadOnlyContext value={readOnly}>
-            <AgentFiles />
-            <ConfigSnapshotProbe />
-          </AgentOrchestrateReadOnlyContext>
+          <AgentOrchestrateViewingVersionContext value={viewingVersion}>
+            <AgentOrchestrateReadOnlyContext value={readOnly}>
+              <AgentFiles />
+              <ConfigSnapshotProbe />
+            </AgentOrchestrateReadOnlyContext>
+          </AgentOrchestrateViewingVersionContext>
         </AgentComposerProvider>
       </AgentConfigApiContextProvider>
     </QueryClientTestProvider>,
@@ -642,8 +649,8 @@ describe('AgentFiles', () => {
     expect(snapshot.config_note).toBe('')
   })
 
-  it('should keep flat config files visible without drive-prefix filtering and disable add in read-only mode', () => {
-    renderAgentFiles({ readOnly: true })
+  it('should keep flat config files visible without drive-prefix filtering and disable add when viewing a version', () => {
+    renderAgentFiles({ readOnly: true, viewingVersion: true })
 
     expect(screen.getByText('diagram.png')).toBeInTheDocument()
     expect(screen.getByText('brief.md')).toBeInTheDocument()
@@ -651,4 +658,12 @@ describe('AgentFiles', () => {
       screen.queryByRole('button', { name: /agentV2\.agentDetail\.configure\.files\.add/i }),
     ).not.toBeInTheDocument()
   })
+
+  it('should keep add action available for build drafts', () => {
+    renderAgentFiles({ readOnly: true })
+
+    expect(
+      screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.files\.add/i }),
+    ).toBeInTheDocument()
+  })
 })