fix: knip

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: yyh <yuanyouhuilyz@gmail.com>
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com>

api/configs/feature/__init__.py

@@ -1497,6 +1497,11 @@ class LoginConfig(BaseSettings):
 
 
 class AccountConfig(BaseSettings):
+    ENABLE_CHANGE_EMAIL: bool = Field(
+        description="whether users can change their email address",
+        default=True,
+    )
+
     ACCOUNT_DELETION_TOKEN_EXPIRY_MINUTES: PositiveInt = Field(
         description="Duration in minutes for which a account deletion token remains valid",
         default=5,

api/controllers/common/wraps.py

@@ -10,6 +10,7 @@ from extensions.ext_database import db
 from libs.login import current_account_with_tenant
 from models.dataset import Dataset
 from models.model import App
+from services.agent.roster_service import AgentRosterService
 from services.enterprise.rbac_service import RBACService
 
 __all__ = ["RBACPermission", "RBACResourceScope", "enforce_rbac_access", "rbac_permission_required"]
@@ -51,7 +52,7 @@ def enforce_rbac_access(
     check_resource_type = None if resource_type == RBACResourceScope.WORKSPACE else resource_type
     resource_id = None
     if resource_required and check_resource_type:
-        resource_id = _extract_resource_id(resource_type, path_args)
+        resource_id = _extract_resource_id(resource_type, tenant_id, path_args)
         if _is_resource_owned_by_current_user(tenant_id, account_id, resource_type, resource_id):
             return
     allowed = RBACService.CheckAccess.check(
@@ -131,11 +132,14 @@ def _is_resource_owned_by_current_user(
     return False
 
 
-def _extract_resource_id(resource_type: RBACResourceScope, path_args: dict[str, object] | None = None) -> str:
+def _extract_resource_id(
+    resource_type: RBACResourceScope, tenant_id: str, path_args: dict[str, object] | None = None
+) -> str:
     """Extract the resource ID from matched path arguments.
 
     Some legacy route classes use neutral names such as ``resource_id`` for
-    app/dataset resources, and Agent App routes use ``agent_id`` as the app id.
+    app/dataset resources, and Agent routes carry ``agent_id``, which is
+    resolved to the App backing that Agent.
     Dataset endpoints behind a rag-pipeline route contain ``pipeline_id``
     instead of ``dataset_id``. In that case we look up the associated
     ``Dataset`` row via ``Dataset.pipeline_id``.
@@ -146,10 +150,19 @@ def _extract_resource_id(resource_type: RBACResourceScope, path_args: dict[str,
     matched_args = {**view_args, **(path_args or {})}
 
     if resource_type == RBACResourceScope.APP:
-        app_id = matched_args.get("app_id") or matched_args.get("agent_id") or matched_args.get("resource_id")
-        if not app_id:
-            raise ValueError("Missing app_id in request path")
-        return str(app_id)
+        app_id = matched_args.get("app_id")
+        if app_id:
+            return str(app_id)
+
+        agent_id = matched_args.get("agent_id")
+        if agent_id:
+            authz_app_id = AgentRosterService(db.session).peek_authz_app_id(tenant_id=tenant_id, agent_id=str(agent_id))
+            return authz_app_id or str(agent_id)
+
+        resource_id = matched_args.get("resource_id")
+        if resource_id:
+            return str(resource_id)
+        raise ValueError("Missing app_id in request path")
 
     if resource_type == RBACResourceScope.DATASET:
         dataset_id = matched_args.get("dataset_id") or matched_args.get("resource_id")

api/controllers/console/agent/composer.py

@@ -230,6 +230,7 @@ class WorkflowAgentComposerSaveToRosterApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user_id
     @with_current_tenant_id
     @with_session
@@ -439,6 +440,7 @@ class SnippetAgentComposerSaveToRosterApi(Resource):
     @rbac_permission_required(
         RBACResourceScope.WORKSPACE, RBACPermission.SNIPPETS_CREATE_AND_MODIFY, resource_required=False
     )
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user_id
     @with_current_tenant_id
     @with_session
@@ -478,6 +480,7 @@ class AgentComposerApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user_id
     @with_current_tenant_id
     @with_session

api/controllers/console/agent/roster.py

@@ -552,6 +552,7 @@ class AgentAppListApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -589,6 +590,7 @@ class AgentAppListApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -630,6 +632,7 @@ class AgentAppApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -655,6 +658,7 @@ class AgentAppApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_tenant_id
     @with_session
     def delete(self, session: Session, tenant_id: str, agent_id: UUID):
@@ -712,6 +716,7 @@ class AgentPublishApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -734,6 +739,7 @@ class AgentBuildDraftCheckoutApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -810,6 +816,7 @@ class AgentBuildDraftApplyApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -832,6 +839,7 @@ class AgentAppCopyApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session
@@ -857,6 +865,7 @@ class AgentApiAccessApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_tenant_id
     @with_session(write=False)
     def get(self, session: Session, tenant_id: str, agent_id: UUID):
@@ -873,6 +882,7 @@ class AgentApiStatusApi(Resource):
     @login_required
     @is_admin_or_owner_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @with_current_tenant_id
     @with_session
@@ -891,6 +901,7 @@ class AgentApiKeyListApi(BaseApiKeyListResource):
     token_prefix = "app-"
 
     @console_ns.response(200, "Agent service API keys", console_ns.models[ApiKeyList.__name__])
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_tenant_id
     @with_session(write=False)
     def get(self, session: Session, tenant_id: str, agent_id: UUID) -> dict[str, object]:
@@ -901,6 +912,7 @@ class AgentApiKeyListApi(BaseApiKeyListResource):
     @console_ns.response(400, "Maximum keys exceeded")
     @with_current_tenant_id
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @with_session
     def post(self, session: Session, tenant_id: str, agent_id: UUID) -> tuple[dict[str, object], int]:
@@ -920,6 +932,7 @@ class AgentApiKeyApi(BaseApiKeyResource):
     @console_ns.response(204, "Agent service API key deleted")
     @with_current_user
     @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
     @with_session
     def delete(
@@ -965,6 +978,7 @@ class AgentLogsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session(write=False)
@@ -1003,6 +1017,7 @@ class AgentLogMessagesApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session(write=False)
@@ -1041,6 +1056,7 @@ class AgentLogSourcesApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session(write=False)
@@ -1061,6 +1077,7 @@ class AgentStatisticsSummaryApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session(write=False)
@@ -1086,6 +1103,7 @@ class AgentRosterVersionsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_tenant_id
     @with_session(write=False)
     def get(self, session: Session, tenant_id: str, agent_id: UUID):
@@ -1101,6 +1119,7 @@ class AgentRosterVersionDetailApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_tenant_id
     @with_session(write=False)
     def get(self, session: Session, tenant_id: str, agent_id: UUID, version_id: UUID):
@@ -1121,6 +1140,7 @@ class AgentRosterVersionRestoreApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.AGENT_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     @with_session

api/controllers/console/apikey.py

@@ -12,6 +12,7 @@ from werkzeug.exceptions import Forbidden
 from configs import dify_config
 from controllers.common.schema import register_response_schema_models
 from controllers.common.session import with_session
+from controllers.console.app.wraps import agent_manage_required_for_agent_app
 from fields.base import ResponseModel
 from libs.helper import dump_response, to_timestamp
 from libs.login import login_required
@@ -194,6 +195,7 @@ class AppApiKeyListResource(BaseApiKeyListResource):
     @console_ns.doc(params={"resource_id": "App ID"})
     @console_ns.response(200, "API keys retrieved successfully", console_ns.models[ApiKeyList.__name__])
     @with_current_tenant_id
+    @agent_manage_required_for_agent_app
     @with_session(write=False)
     def get(self, session: Session, current_tenant_id: str, resource_id: UUID) -> dict[str, object]:
         """Get all API keys for an app"""
@@ -210,6 +212,7 @@ class AppApiKeyListResource(BaseApiKeyListResource):
     @with_current_tenant_id
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @agent_manage_required_for_agent_app
     @with_session
     def post(self, session: Session, current_tenant_id: str, resource_id: UUID) -> tuple[dict[str, object], int]:
         """Create a new API key for an app"""
@@ -233,6 +236,7 @@ class AppApiKeyResource(BaseApiKeyResource):
     @with_current_user
     @with_current_tenant_id
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @agent_manage_required_for_agent_app
     @with_session
     def delete(
         self,

api/controllers/console/app/app.py

@@ -9,7 +9,7 @@ from flask_restx import Resource
 from pydantic import AliasChoices, BaseModel, Field, ValidationInfo, computed_field, field_validator, model_validator
 from sqlalchemy import select
 from sqlalchemy.orm import Session
-from werkzeug.exceptions import BadRequest, NotFound
+from werkzeug.exceptions import BadRequest, Forbidden, NotFound
 
 from configs import dify_config
 from controllers.common.app_access import resolve_app_access_filter
@@ -23,7 +23,7 @@ from controllers.common.schema import (
     register_schema_models,
 )
 from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model, with_session
+from controllers.console.app.wraps import agent_manage_required_for_agent_app, get_app_model, with_session
 from controllers.console.workspace.models import LoadBalancingPayload
 from controllers.console.wraps import (
     RBACPermission,
@@ -75,6 +75,7 @@ from services.entities.knowledge_entities.knowledge_entities import (
     WeightModel,
     WeightVectorSetting,
 )
+from services.errors.account import NoPermissionError
 from services.feature_service import FeatureService
 from tasks.initialize_created_app_rbac_access_task import initialize_created_app_rbac_access_task
 
@@ -827,6 +828,7 @@ class AppApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @agent_manage_required_for_agent_app
     @with_session
     @get_app_model(mode=None)
     def put(self, session: Session, app_model: App):
@@ -861,6 +863,7 @@ class AppApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_DELETE)
+    @agent_manage_required_for_agent_app
     @with_session
     @get_app_model
     def delete(self, session: Session, app_model: App):
@@ -885,6 +888,7 @@ class AppCopyApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_CREATE_AND_MANAGEMENT)
+    @agent_manage_required_for_agent_app
     @with_current_user
     @with_current_tenant_id
     @get_app_model(mode=None)
@@ -896,16 +900,19 @@ class AppCopyApi(Resource):
         with Session(db.engine, expire_on_commit=False) as session:
             import_service = AppDslService(session)
             yaml_content = import_service.export_dsl(app_model=app_model, session=session, include_secret=True)
-            result = import_service.import_app(
-                account=current_user,
-                import_mode=ImportMode.YAML_CONTENT,
-                yaml_content=yaml_content,
-                name=args.name,
-                description=args.description,
-                icon_type=args.icon_type,
-                icon=args.icon,
-                icon_background=args.icon_background,
-            )
+            try:
+                result = import_service.import_app(
+                    account=current_user,
+                    import_mode=ImportMode.YAML_CONTENT,
+                    yaml_content=yaml_content,
+                    name=args.name,
+                    description=args.description,
+                    icon_type=args.icon_type,
+                    icon=args.icon,
+                    icon_background=args.icon_background,
+                )
+            except NoPermissionError as e:
+                raise Forbidden(str(e))
             if result.status == ImportStatus.FAILED:
                 session.rollback()
                 return dump_response(AppImportResponse, result), 400
@@ -959,6 +966,7 @@ class AppExportApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_IMPORT_EXPORT_DSL)
+    @agent_manage_required_for_agent_app
     @get_app_model
     def get(self, app_model: App):
         """Export app"""
@@ -983,6 +991,7 @@ class AppPublishToCreatorsPlatformApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_IMPORT_EXPORT_DSL)
+    @agent_manage_required_for_agent_app
     @with_current_user_id
     @get_app_model(mode=None)
     def post(self, current_user_id: str, app_model: App):
@@ -1013,6 +1022,7 @@ class AppNameApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @agent_manage_required_for_agent_app
     @with_session
     @get_app_model(mode=None)
     def post(self, session: Session, app_model: App):
@@ -1040,6 +1050,7 @@ class AppIconApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_EDIT)
+    @agent_manage_required_for_agent_app
     @with_session
     @get_app_model(mode=None)
     def post(self, session: Session, app_model: App):
@@ -1073,6 +1084,7 @@ class AppSiteStatus(Resource):
     @account_initialization_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @agent_manage_required_for_agent_app
     @with_session
     @get_app_model(mode=None)
     def post(self, session: Session, app_model: App):
@@ -1100,6 +1112,7 @@ class AppApiStatus(Resource):
     @is_admin_or_owner_required
     @account_initialization_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @agent_manage_required_for_agent_app
     @with_session
     @get_app_model(mode=None)
     def post(self, session: Session, app_model: App):

api/controllers/console/app/app_import.py

@@ -1,6 +1,7 @@
 from flask_restx import Resource
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
+from werkzeug.exceptions import Forbidden
 
 from configs import dify_config
 from controllers.common.schema import register_enum_models, register_schema_models
@@ -28,6 +29,7 @@ from services.app_dsl_service import (
 )
 from services.enterprise.enterprise_service import EnterpriseService
 from services.entities.dsl_entities import CheckDependenciesResult, ImportStatus
+from services.errors.account import NoPermissionError
 from services.feature_service import FeatureService
 
 from .. import console_ns
@@ -91,18 +93,21 @@ class AppImportApi(Resource):
             import_service = AppDslService(session)
             # Import app
             account = current_user
-            result = import_service.import_app(
-                account=account,
-                import_mode=args.mode,
-                yaml_content=args.yaml_content,
-                yaml_url=args.yaml_url,
-                name=args.name,
-                description=args.description,
-                icon_type=args.icon_type,
-                icon=args.icon,
-                icon_background=args.icon_background,
-                app_id=args.app_id,
-            )
+            try:
+                result = import_service.import_app(
+                    account=account,
+                    import_mode=args.mode,
+                    yaml_content=args.yaml_content,
+                    yaml_url=args.yaml_url,
+                    name=args.name,
+                    description=args.description,
+                    icon_type=args.icon_type,
+                    icon=args.icon,
+                    icon_background=args.icon_background,
+                    app_id=args.app_id,
+                )
+            except NoPermissionError as e:
+                raise Forbidden(str(e))
             if result.status == ImportStatus.FAILED:
                 session.rollback()
             else:
@@ -157,7 +162,10 @@ class AppImportConfirmApi(Resource):
             import_service = AppDslService(session)
             # Confirm import
             account = current_user
-            result = import_service.confirm_import(import_id=import_id, account=account)
+            try:
+                result = import_service.confirm_import(import_id=import_id, account=account)
+            except NoPermissionError as e:
+                raise Forbidden(str(e))
             if result.status == ImportStatus.FAILED:
                 session.rollback()
             else:

api/controllers/console/app/site.py

@@ -10,7 +10,7 @@ from constants.languages import supported_language
 from controllers.common.schema import register_schema_models
 from controllers.common.session import with_session
 from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model
+from controllers.console.app.wraps import agent_manage_required_for_agent_app, get_app_model
 from controllers.console.wraps import (
     RBACPermission,
     RBACResourceScope,
@@ -93,6 +93,7 @@ class AppSite(Resource):
     @login_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @agent_manage_required_for_agent_app
     @account_initialization_required
     @with_current_user
     @with_session
@@ -145,6 +146,7 @@ class AppSiteAccessTokenReset(Resource):
     @login_required
     @is_admin_or_owner_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @agent_manage_required_for_agent_app
     @account_initialization_required
     @with_current_user
     @with_session

api/controllers/console/app/wraps.py

@@ -12,14 +12,22 @@ from typing import cast, overload
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
+from configs import dify_config
 from controllers.common.session import with_session
+from controllers.common.wraps import RBACPermission, RBACResourceScope, enforce_rbac_access
 from controllers.console.app.error import AppNotFoundError
 from extensions.ext_database import db
 from libs.login import current_account_with_tenant
 from models import App, AppMode, TrialApp
+from models.agent import AgentScope
 from services.recommended_app_service import RecommendedAppService
 
-__all__ = ["get_app_model", "get_app_model_with_trial", "with_session"]
+__all__ = [
+    "agent_manage_required_for_agent_app",
+    "get_app_model",
+    "get_app_model_with_trial",
+    "with_session",
+]
 
 
 def _load_app_model(session: Session, app_id: str) -> App | None:
@@ -48,6 +56,45 @@ def _load_app_model_with_trial(session: Session, app_id: str) -> App | None:
     return app_model
 
 
+def agent_manage_required_for_agent_app[**P, R](view: Callable[P, R]) -> Callable[P, R]:
+    """Gate generic app management routes that target an Agent App.
+
+    A hidden workflow-only backing App only reuses the App runtime and is not
+    part of the general app management plane, so generic routes reject it
+    outright. Managing a roster Agent App mutates the roster Agent behind it
+    (rename/icon sync, archive, API enablement), so it additionally requires
+    workspace ``agent.manage`` on top of the route's existing App permission
+    checks when RBAC is enabled. A no-op for non-agent Apps. Must be placed
+    above ``get_app_model`` so the ``app_id`` path parameter is still present.
+    """
+
+    @wraps(view)
+    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
+        raw_app_id = kwargs.get("app_id") or kwargs.get("resource_id")
+        if raw_app_id is not None:
+            app_model = _load_app_model_from_scoped_session(str(raw_app_id))
+            binding = (
+                app_model.agent_app_binding_with_session(session=db.session(), include_archived=True)
+                if app_model is not None
+                else None
+            )
+            if binding is not None:
+                if binding.scope == AgentScope.WORKFLOW_ONLY:
+                    raise AppNotFoundError()
+                if dify_config.RBAC_ENABLED:
+                    current_user, current_tenant_id = current_account_with_tenant()
+                    enforce_rbac_access(
+                        tenant_id=current_tenant_id,
+                        account_id=current_user.id,
+                        resource_type=RBACResourceScope.WORKSPACE,
+                        scene=RBACPermission.AGENT_MANAGE,
+                        resource_required=False,
+                    )
+        return view(*args, **kwargs)
+
+    return decorated
+
+
 def _get_injected_session(args: tuple[object, ...]) -> Session | None:
     """Return the request session inserted by `with_session`, if this handler has been migrated."""
     if len(args) < 2:

api/core/plugin/impl/base.py

@@ -1,7 +1,7 @@
 import inspect
 import json
 import logging
-from collections.abc import Callable, Generator
+from collections.abc import Callable, Generator, Mapping
 from typing import Any, cast
 from urllib.parse import unquote
 
@@ -23,6 +23,7 @@ from core.plugin.impl.exc import (
     PluginLLMPollingUnsupportedError,
     PluginNotFoundError,
     PluginPermissionDeniedError,
+    PluginRuntimeError,
     PluginUniqueIdentifierError,
 )
 from core.trigger.errors import (
@@ -375,6 +376,18 @@ class BasePluginClient:
                     # type `PluginLLMPollingUnsupportedError`.
                     case PluginLLMPollingUnsupportedError.__name__:
                         raise PluginLLMPollingUnsupportedError(description=error_object.get("message"))
+                    case PluginRuntimeError.__name__:
+                        args = error_object.get("args")
+                        lambda_request_id = args.get("request_id") if isinstance(args, Mapping) else None
+                        if not isinstance(lambda_request_id, str):
+                            lambda_request_id = None
+                        runtime_message = error_object.get("message")
+                        if not isinstance(runtime_message, str):
+                            runtime_message = "Plugin runtime request failed"
+                        raise PluginRuntimeError(
+                            description=runtime_message,
+                            lambda_request_id=lambda_request_id,
+                        )
                     case _:
                         raise PluginInvokeError(description=message)
             case PluginDaemonInternalServerError.__name__:

api/core/plugin/impl/exc.py

@@ -49,6 +49,18 @@ class PluginDaemonBadRequestError(PluginDaemonClientSideError):
     description: str = "Bad Request"
 
 
+class PluginRuntimeError(PluginDaemonInternalError):
+    """A plugin runtime failed before it could return a valid plugin response."""
+
+    lambda_request_id: str | None
+
+    def __init__(self, description: str, lambda_request_id: str | None = None) -> None:
+        self.lambda_request_id = lambda_request_id
+        if lambda_request_id:
+            description = description.replace(f"RequestId: {lambda_request_id} Error: ", "", 1)
+        super().__init__(description)
+
+
 class PluginInvokeError(PluginDaemonClientSideError, ValueError):
     description: str = "Invoke Error"
 

api/core/rbac/entities.py

@@ -61,6 +61,7 @@ class RBACPermission(StrEnum):
     WORKSPACE_ROLE_MANAGE = "workspace_role_manage"
     API_EXTENSION_MANAGE = "api_extension_manage"
     CUSTOMIZATION_MANAGE = "customization_manage"
+    AGENT_MANAGE = "agent_manage"
 
     SNIPPETS_CREATE_AND_MODIFY = "snippets_create_and_modify"
     SNIPPETS_MANAGE = "snippets_management"

api/libs/external_api.py

@@ -9,6 +9,8 @@ from werkzeug.http import HTTP_STATUS_CODES
 
 from configs import dify_config
 from core.errors.error import AppInvokeQuotaExceededError
+from core.plugin.impl.exc import PluginRuntimeError
+from extensions.ext_logging import get_request_id
 from libs.flask_restx_compat import install_swagger_compatibility
 from libs.token import build_force_logout_cookie_headers
 
@@ -100,6 +102,20 @@ def register_external_error_handlers(api: Api, body_formatter: ErrorBodyFormatte
         data = {"code": "too_many_requests", "message": str(e), "status": status_code}
         return _finalize(e, data, status_code), status_code
 
+    def handle_plugin_runtime_error(e: PluginRuntimeError):
+        got_request_exception.send(current_app, exception=e)
+        status_code = 502
+        details = {"request_id": get_request_id()}
+        if e.lambda_request_id:
+            details["lambda_request_id"] = e.lambda_request_id
+        data = {
+            "code": "plugin_runtime_error",
+            "message": e.description,
+            "details": details,
+            "status": status_code,
+        }
+        return _finalize(e, data, status_code), status_code
+
     def handle_general_exception(e: Exception):
         got_request_exception.send(current_app, exception=e)
 
@@ -121,6 +137,7 @@ def register_external_error_handlers(api: Api, body_formatter: ErrorBodyFormatte
     api.errorhandler(HTTPException)(handle_http_exception)
     api.errorhandler(ValueError)(handle_value_error)
     api.errorhandler(AppInvokeQuotaExceededError)(handle_quota_exceeded)
+    api.errorhandler(PluginRuntimeError)(handle_plugin_runtime_error)
     api.errorhandler(Exception)(handle_general_exception)
 
 

api/models/model.py

@@ -56,6 +56,7 @@ from .provider_ids import GenericProviderID
 from .types import EnumText, LongText, StringUUID
 
 if TYPE_CHECKING:
+    from .agent import Agent
     from .workflow import Workflow
 
 
@@ -501,25 +502,42 @@ class App(Base):
         Resolved via ``Agent.app_id`` so the console can open the Composer in
         roster-detail mode from the app id. ``None`` for non-agent apps.
         """
+        agent = self.agent_app_binding_with_session(session=session)
+        return agent.id if agent else None
+
+    def agent_app_binding_with_session(self, *, session: Session, include_archived: bool = False) -> Agent | None:
+        """For an Agent App (mode=agent), the Agent bound to it.
+
+        A roster Agent is bound through ``Agent.app_id``; a workflow-only Agent
+        is bound to its hidden runtime backing App through
+        ``Agent.backing_app_id``. Callers branch on ``Agent.scope`` to tell the
+        public roster Agent App apart from the hidden backing App. Archived
+        Agents are excluded unless ``include_archived`` is set (authorization
+        gates must keep covering an Agent App after its Agent is archived).
+        ``None`` for non-agent apps and unbound agent apps.
+        """
         if self.mode != AppMode.AGENT:
             return None
         from .agent import APP_BACKED_AGENT_SOURCES, Agent, AgentScope, AgentStatus
 
-        agent = session.scalar(
-            select(Agent).where(
-                Agent.tenant_id == self.tenant_id,
-                sa.or_(
-                    sa.and_(
-                        Agent.app_id == self.id,
-                        Agent.scope == AgentScope.ROSTER,
-                        Agent.source.in_(APP_BACKED_AGENT_SOURCES),
-                    ),
-                    Agent.backing_app_id == self.id,
+        conditions = [
+            Agent.tenant_id == self.tenant_id,
+            sa.or_(
+                sa.and_(
+                    Agent.app_id == self.id,
+                    Agent.scope == AgentScope.ROSTER,
+                    Agent.source.in_(APP_BACKED_AGENT_SOURCES),
                 ),
-                Agent.status == AgentStatus.ACTIVE,
-            )
-        )
-        return agent.id if agent else None
+                sa.and_(
+                    Agent.backing_app_id == self.id,
+                    Agent.scope == AgentScope.WORKFLOW_ONLY,
+                ),
+            ),
+        ]
+        if not include_archived:
+            conditions.append(Agent.status == AgentStatus.ACTIVE)
+
+        return session.scalar(select(Agent).where(*conditions).limit(1))
 
     @property
     def api_base_url(self) -> str:

api/openapi/markdown/console-openapi.md

@@ -17318,6 +17318,12 @@ Default model entity.
 | tool_name | string |  | Yes |
 | type | string |  | Yes |
 
+#### DeploymentEdition
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| DeploymentEdition | string |  |  |
+
 #### DismissNotificationPayload
 
 | Name | Type | Description | Required |
@@ -22026,6 +22032,7 @@ Model class for provider system configuration response.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | branding | [BrandingModel](#brandingmodel) |  | Yes |
+| deployment_edition | [DeploymentEdition](#deploymentedition) |  | Yes |
 | enable_app_deploy | boolean |  | Yes |
 | enable_change_email | boolean, <br>**Default:** true |  | Yes |
 | enable_collaboration_mode | boolean, <br>**Default:** true |  | Yes |

api/openapi/markdown/web-openapi.md

@@ -1058,6 +1058,12 @@ Button styles for user actions.
 | auto_generate | boolean | Automatically generate the conversation name. When `true`, the `name` field is ignored. | No |
 | name | string | Conversation name. Required when `auto_generate` is `false`. | No |
 
+#### DeploymentEdition
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| DeploymentEdition | string |  |  |
+
 #### EmailCodeLoginSendPayload
 
 | Name | Type | Description | Required |
@@ -1567,6 +1573,7 @@ Default configuration for form inputs.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | branding | [BrandingModel](#brandingmodel) |  | Yes |
+| deployment_edition | [DeploymentEdition](#deploymentedition) |  | Yes |
 | enable_app_deploy | boolean |  | Yes |
 | enable_change_email | boolean, <br>**Default:** true |  | Yes |
 | enable_collaboration_mode | boolean, <br>**Default:** true |  | Yes |

api/services/agent/roster_service.py

@@ -911,16 +911,14 @@ class AgentRosterService:
             raise AgentNotFoundError()
         return app
 
-    def get_agent_runtime_app_model(self, *, tenant_id: str, agent_id: str) -> App:
-        """Resolve the App that backs an Agent runtime surface.
+    def _get_runtime_resolvable_agent(self, *, tenant_id: str, agent_id: str) -> Agent | None:
+        """Load an Agent that is eligible to resolve to a runtime backing App.
 
-        Roster Agents use their public Agent App. Workflow-only Agents use a
-        hidden Agent App stored in ``backing_app_id`` so console chat/logs can
-        reuse the app runtime without exposing the resource in workspace app
-        lists.
+        Shared by the runtime resolver and the read-only authorization resolver
+        so both agree on what counts as a resolvable Agent.
         """
 
-        agent = self._session.scalar(
+        return self._session.scalar(
             select(Agent)
             .where(
                 Agent.tenant_id == tenant_id,
@@ -938,6 +936,34 @@ class AgentRosterService:
             )
             .limit(1)
         )
+
+    def peek_authz_app_id(self, *, tenant_id: str, agent_id: str) -> str | None:
+        """Resolve the App id whose access policy governs an Agent.
+
+        Roster Agents are governed by their own Agent App, while workflow-only
+        Agents are governed by their parent workflow App: the hidden runtime
+        backing App never receives a resource access policy, so it must not be
+        used for authorization. Stays read-only — unlike
+        :meth:`get_agent_runtime_app_model`, this never materializes the hidden
+        backing App. Returns ``None`` when the Agent does not resolve, leaving
+        the caller to decide how to treat it.
+        """
+
+        agent = self._get_runtime_resolvable_agent(tenant_id=tenant_id, agent_id=agent_id)
+        if agent is None:
+            return None
+        return agent.app_id
+
+    def get_agent_runtime_app_model(self, *, tenant_id: str, agent_id: str) -> App:
+        """Resolve the App that backs an Agent runtime surface.
+
+        Roster Agents use their public Agent App. Workflow-only Agents use a
+        hidden Agent App stored in ``backing_app_id`` so console chat/logs can
+        reuse the app runtime without exposing the resource in workspace app
+        lists.
+        """
+
+        agent = self._get_runtime_resolvable_agent(tenant_id=tenant_id, agent_id=agent_id)
         if agent is None:
             raise AgentNotFoundError()
         should_commit_backing_app = agent.scope == AgentScope.WORKFLOW_ONLY and not agent.backing_app_id

api/services/app_dsl_service.py

@@ -19,6 +19,7 @@ from configs import dify_config
 from constants.dsl_version import CURRENT_APP_DSL_VERSION
 from core.file import remote_fetcher
 from core.plugin.entities.plugin import PluginDependency
+from core.rbac import RBACPermission
 from core.trigger.constants import (
     TRIGGER_PLUGIN_NODE_TYPE,
     TRIGGER_SCHEDULE_NODE_TYPE,
@@ -43,7 +44,9 @@ from services.agent.dsl_service import AgentDslService, AgentPackage
 from services.agent.workflow_publish_service import WorkflowAgentPublishService
 from services.dsl_content import DSL_MAX_SIZE, dsl_content_size
 from services.dsl_version import check_version_compatibility
+from services.enterprise.rbac_service import RBACService
 from services.entities.dsl_entities import CheckDependenciesResult, DslImportWarning, ImportMode, ImportStatus
+from services.errors.account import NoPermissionError
 from services.errors.app import WorkflowNotFoundError
 from services.plugin.dependencies_analysis import DependenciesAnalysisService
 from services.workflow_draft_variable_service import WorkflowDraftVariableService
@@ -301,6 +304,9 @@ class AppDslService:
                 error=f"Invalid YAML format: {str(e)}",
             )
 
+        except NoPermissionError:
+            raise
+
         except Exception as e:
             logger.exception("Failed to import app")
             return Import(
@@ -364,6 +370,9 @@ class AppDslService:
                 warnings=self._warnings,
             )
 
+        except NoPermissionError:
+            raise
+
         except Exception as e:
             logger.exception("Error confirming import")
             return Import(
@@ -395,6 +404,21 @@ class AppDslService:
             leaked_dependencies=leaked_dependencies,
         )
 
+    @staticmethod
+    def _ensure_agent_manage_permission(account: Account) -> None:
+        """Importing an Agent DSL creates a roster Agent, which requires ``agent.manage``."""
+        if not dify_config.RBAC_ENABLED:
+            return
+        if account.current_tenant_id is None:
+            raise ValueError("Current tenant is not set")
+        allowed = RBACService.CheckAccess.check(
+            account.current_tenant_id,
+            account.id,
+            scene=RBACPermission.AGENT_MANAGE,
+        )
+        if not allowed:
+            raise NoPermissionError("Agent management permission is required to import an Agent App")
+
     def _create_or_update_app(
         self,
         *,
@@ -415,6 +439,8 @@ class AppDslService:
         if not app_mode:
             raise ValueError("loss app mode")
         app_mode = AppMode(app_mode)
+        if app_mode == AppMode.AGENT:
+            self._ensure_agent_manage_permission(account)
 
         # Set icon type
         icon_type_value = icon_type or app_data.get("icon_type")

api/services/enterprise/rbac_service.py

@@ -330,6 +330,7 @@ _LEGACY_WORKSPACE_OWNER_KEYS: list[str] = [
     "snippets.management",
     "tool.manage",
     "mcp.manage",
+    "agent.manage",
 ]
 
 _LEGACY_WORKSPACE_ADMIN_KEYS: list[str] = [
@@ -357,6 +358,7 @@ _LEGACY_WORKSPACE_ADMIN_KEYS: list[str] = [
     "snippets.management",
     "tool.manage",
     "mcp.manage",
+    "agent.manage",
 ]
 
 _LEGACY_WORKSPACE_EDITOR_KEYS: list[str] = [
@@ -371,6 +373,7 @@ _LEGACY_WORKSPACE_EDITOR_KEYS: list[str] = [
     "dataset.external.connect",
     "snippets.create_and_modify",
     "tool.manage",
+    "agent.manage",
 ]
 
 _LEGACY_WORKSPACE_NORMAL_KEYS: list[str] = [

api/services/feature_service.py

@@ -75,6 +75,12 @@ class LicenseStatus(StrEnum):
     LOST = "lost"
 
 
+class DeploymentEdition(StrEnum):
+    COMMUNITY = "COMMUNITY"
+    ENTERPRISE = "ENTERPRISE"
+    CLOUD = "CLOUD"
+
+
 class LicenseModel(FeatureResponseModel):
     status: LicenseStatus = LicenseStatus.NONE
     expired_at: str = ""
@@ -162,6 +168,7 @@ class PluginManagerModel(FeatureResponseModel):
 
 
 class SystemFeatureModel(FeatureResponseModel):
+    deployment_edition: DeploymentEdition
     enable_app_deploy: bool = False
     sso_enforced_for_signin: bool = False
     sso_enforced_for_signin_protocol: str = ""
@@ -252,7 +259,7 @@ class FeatureService:
 
     @classmethod
     def get_system_features(cls, is_authenticated: bool = False) -> SystemFeatureModel:
-        system_features = SystemFeatureModel()
+        system_features = SystemFeatureModel(deployment_edition=cls._resolve_deployment_edition())
         system_features.rbac_enabled = dify_config.RBAC_ENABLED
 
         cls._fulfill_system_params_from_env(system_features)
@@ -272,6 +279,14 @@ class FeatureService:
 
         return system_features
 
+    @classmethod
+    def _resolve_deployment_edition(cls) -> DeploymentEdition:
+        if dify_config.EDITION == "CLOUD":
+            return DeploymentEdition.CLOUD
+        if dify_config.ENTERPRISE_ENABLED:
+            return DeploymentEdition.ENTERPRISE
+        return DeploymentEdition.COMMUNITY
+
     @classmethod
     def get_app_dsl_version(cls) -> str:
         return CURRENT_APP_DSL_VERSION
@@ -285,6 +300,7 @@ class FeatureService:
         system_features.is_allow_register = dify_config.ALLOW_REGISTER
         system_features.is_allow_create_workspace = dify_config.ALLOW_CREATE_WORKSPACE
         system_features.is_email_setup = dify_config.MAIL_TYPE is not None and dify_config.MAIL_TYPE != ""
+        system_features.enable_change_email = dify_config.ENABLE_CHANGE_EMAIL
         system_features.enable_trial_app = dify_config.ENABLE_TRIAL_APP
         system_features.enable_explore_banner = dify_config.ENABLE_EXPLORE_BANNER
         system_features.enable_learn_app = dify_config.ENABLE_LEARN_APP

api/tests/test_containers_integration_tests/services/test_feature_service.py

@@ -414,6 +414,7 @@ class TestFeatureService:
             mock_config.ENABLE_EMAIL_PASSWORD_LOGIN = True
             mock_config.ENABLE_SOCIAL_OAUTH_LOGIN = False
             mock_config.ENABLE_COLLABORATION_MODE = False
+            mock_config.ENABLE_CHANGE_EMAIL = True
             mock_config.ALLOW_REGISTER = True
             mock_config.ALLOW_CREATE_WORKSPACE = True
             mock_config.MAIL_TYPE = "smtp"
@@ -616,6 +617,7 @@ class TestFeatureService:
             mock_config.ENABLE_EMAIL_CODE_LOGIN = False
             mock_config.ENABLE_EMAIL_PASSWORD_LOGIN = True
             mock_config.ENABLE_SOCIAL_OAUTH_LOGIN = True
+            mock_config.ENABLE_CHANGE_EMAIL = True
             mock_config.ALLOW_REGISTER = False
             mock_config.ALLOW_CREATE_WORKSPACE = False
             mock_config.MAIL_TYPE = None

api/tests/unit_tests/controllers/console/app/test_agent_manage_guard.py

@@ -0,0 +1,150 @@
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+from werkzeug.exceptions import Forbidden
+
+from controllers.console.app.error import AppNotFoundError
+from controllers.console.app.wraps import agent_manage_required_for_agent_app
+from core.rbac import RBACPermission, RBACResourceScope
+from models.agent import AgentScope
+
+TENANT_ID = "tenant-1"
+ACCOUNT = SimpleNamespace(id="account-1")
+
+
+def _guarded_view():
+    calls: list[dict[str, object]] = []
+
+    @agent_manage_required_for_agent_app
+    def view(*args, **kwargs):
+        calls.append(kwargs)
+        return "ok"
+
+    return view, calls
+
+
+def _app_with_binding(binding):
+    app_model = MagicMock()
+    app_model.agent_app_binding_with_session.return_value = binding
+    return app_model
+
+
+def _patch_guard(app_model, rbac_enabled: bool):
+    mock_db = MagicMock()
+    mock_db.session.scalar.return_value = app_model
+    return (
+        patch("controllers.console.app.wraps.db", mock_db),
+        patch("controllers.console.app.wraps.current_account_with_tenant", return_value=(ACCOUNT, TENANT_ID)),
+        patch("controllers.console.app.wraps.dify_config.RBAC_ENABLED", rbac_enabled),
+    )
+
+
+class TestAgentManageRequiredForAgentApp:
+    def test_non_agent_app_passes_through_without_workspace_check(self):
+        view, calls = _guarded_view()
+        patches = _patch_guard(_app_with_binding(None), rbac_enabled=True)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access") as gate:
+            assert view(app_id="app-1") == "ok"
+
+        gate.assert_not_called()
+        assert calls == [{"app_id": "app-1"}]
+
+    def test_roster_agent_app_requires_agent_manage_when_rbac_enabled(self):
+        view, _ = _guarded_view()
+        binding = SimpleNamespace(scope=AgentScope.ROSTER)
+        patches = _patch_guard(_app_with_binding(binding), rbac_enabled=True)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access") as gate:
+            assert view(app_id="app-1") == "ok"
+
+        gate.assert_called_once_with(
+            tenant_id=TENANT_ID,
+            account_id=ACCOUNT.id,
+            resource_type=RBACResourceScope.WORKSPACE,
+            scene=RBACPermission.AGENT_MANAGE,
+            resource_required=False,
+        )
+
+    def test_roster_agent_app_denied_without_agent_manage(self):
+        view, calls = _guarded_view()
+        binding = SimpleNamespace(scope=AgentScope.ROSTER)
+        patches = _patch_guard(_app_with_binding(binding), rbac_enabled=True)
+
+        with (
+            patches[0],
+            patches[1],
+            patches[2],
+            patch("controllers.console.app.wraps.enforce_rbac_access", side_effect=Forbidden()),
+        ):
+            with pytest.raises(Forbidden):
+                view(app_id="app-1")
+
+        assert calls == []
+
+    def test_roster_agent_app_skips_workspace_check_when_rbac_disabled(self):
+        view, _ = _guarded_view()
+        binding = SimpleNamespace(scope=AgentScope.ROSTER)
+        patches = _patch_guard(_app_with_binding(binding), rbac_enabled=False)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access") as gate:
+            assert view(app_id="app-1") == "ok"
+
+        gate.assert_not_called()
+
+    def test_hidden_backing_app_is_rejected_even_without_rbac(self):
+        """A workflow-only backing App is not part of the general app management plane."""
+        view, calls = _guarded_view()
+        binding = SimpleNamespace(scope=AgentScope.WORKFLOW_ONLY)
+        patches = _patch_guard(_app_with_binding(binding), rbac_enabled=False)
+
+        with patches[0], patches[1], patches[2]:
+            with pytest.raises(AppNotFoundError):
+                view(app_id="app-1")
+
+        assert calls == []
+
+    def test_hidden_backing_app_is_rejected_before_workspace_check(self):
+        view, calls = _guarded_view()
+        binding = SimpleNamespace(scope=AgentScope.WORKFLOW_ONLY)
+        patches = _patch_guard(_app_with_binding(binding), rbac_enabled=True)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access") as gate:
+            with pytest.raises(AppNotFoundError):
+                view(app_id="app-1")
+
+        gate.assert_not_called()
+        assert calls == []
+
+    def test_binding_lookup_covers_archived_agents(self):
+        """An Agent App stays gated after its roster Agent is archived."""
+        view, _ = _guarded_view()
+        app_model = _app_with_binding(SimpleNamespace(scope=AgentScope.ROSTER))
+        patches = _patch_guard(app_model, rbac_enabled=True)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access"):
+            view(app_id="app-1")
+
+        _, call_kwargs = app_model.agent_app_binding_with_session.call_args
+        assert call_kwargs["include_archived"] is True
+
+    def test_resource_id_path_alias_is_resolved(self):
+        view, _ = _guarded_view()
+        binding = SimpleNamespace(scope=AgentScope.ROSTER)
+        patches = _patch_guard(_app_with_binding(binding), rbac_enabled=True)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access") as gate:
+            assert view(resource_id="app-1") == "ok"
+
+        gate.assert_called_once()
+
+    def test_unknown_app_passes_through_for_downstream_handling(self):
+        view, calls = _guarded_view()
+        patches = _patch_guard(None, rbac_enabled=True)
+
+        with patches[0], patches[1], patches[2], patch("controllers.console.app.wraps.enforce_rbac_access") as gate:
+            assert view(app_id="app-1") == "ok"
+
+        gate.assert_not_called()
+        assert calls == [{"app_id": "app-1"}]

api/tests/unit_tests/controllers/console/app/test_app_import_api.py

@@ -19,7 +19,7 @@ from models.engine import db
 from models.model import App, AppMode
 from services.app_dsl_service import ImportStatus
 from services.entities.dsl_entities import CheckDependenciesResult
-from services.feature_service import SystemFeatureModel, WebAppAuthModel
+from services.feature_service import DeploymentEdition, SystemFeatureModel, WebAppAuthModel
 
 
 def _unwrap(func):
@@ -47,7 +47,10 @@ class _Result:
 
 
 def _install_features(monkeypatch: pytest.MonkeyPatch, enabled: bool) -> None:
-    features = SystemFeatureModel(webapp_auth=WebAppAuthModel(enabled=enabled))
+    features = SystemFeatureModel(
+        deployment_edition=DeploymentEdition.COMMUNITY,
+        webapp_auth=WebAppAuthModel(enabled=enabled),
+    )
     monkeypatch.setattr(app_import_module.FeatureService, "get_system_features", lambda: features)
 
 

api/tests/unit_tests/controllers/console/auth/test_email_register.py

@@ -11,7 +11,7 @@ from controllers.console.auth.email_register import (
     EmailRegisterResetApi,
     EmailRegisterSendEmailApi,
 )
-from services.feature_service import SystemFeatureModel
+from services.feature_service import DeploymentEdition, SystemFeatureModel
 
 
 class TestEmailRegisterSendEmailApi:
@@ -34,7 +34,11 @@ class TestEmailRegisterSendEmailApi:
         mock_account = MagicMock()
         mock_get_account.return_value = mock_account
 
-        feature_flags = SystemFeatureModel(enable_email_password_login=True, is_allow_register=True)
+        feature_flags = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+            is_allow_register=True,
+        )
         with (
             patch("controllers.console.auth.email_register.dify_config.BILLING_ENABLED", True),
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
@@ -75,7 +79,11 @@ class TestEmailRegisterCheckApi:
         mock_get_data.return_value = {"email": "User@Example.com", "code": "4321"}
         mock_generate_token.return_value = (None, "new-token")
 
-        feature_flags = SystemFeatureModel(enable_email_password_login=True, is_allow_register=True)
+        feature_flags = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+            is_allow_register=True,
+        )
         with (
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
             patch("controllers.console.wraps.FeatureService.get_system_features", return_value=feature_flags),
@@ -123,7 +131,11 @@ class TestEmailRegisterResetApi:
         mock_login.return_value = token_pair
         mock_get_account.return_value = None
 
-        feature_flags = SystemFeatureModel(enable_email_password_login=True, is_allow_register=True)
+        feature_flags = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+            is_allow_register=True,
+        )
         with (
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
             patch("controllers.console.wraps.FeatureService.get_system_features", return_value=feature_flags),
@@ -171,7 +183,11 @@ class TestEmailRegisterResetApi:
         mock_login.return_value = token_pair
         mock_get_account.return_value = None
 
-        feature_flags = SystemFeatureModel(enable_email_password_login=True, is_allow_register=True)
+        feature_flags = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+            is_allow_register=True,
+        )
         with (
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
             patch("controllers.console.wraps.FeatureService.get_system_features", return_value=feature_flags),
@@ -224,7 +240,11 @@ class TestEmailRegisterResetApi:
         mock_login.return_value = token_pair
         mock_get_account.return_value = None
 
-        feature_flags = SystemFeatureModel(enable_email_password_login=True, is_allow_register=True)
+        feature_flags = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+            is_allow_register=True,
+        )
         with (
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
             patch("controllers.console.wraps.FeatureService.get_system_features", return_value=feature_flags),

api/tests/unit_tests/controllers/console/auth/test_forgot_password.py

@@ -15,7 +15,7 @@ from controllers.console.auth.forgot_password import (
 )
 from models.account import Account
 from models.engine import db
-from services.feature_service import SystemFeatureModel
+from services.feature_service import DeploymentEdition, SystemFeatureModel
 
 
 @pytest.fixture
@@ -46,8 +46,15 @@ class TestForgotPasswordSendEmailApi:
         mock_get_account.return_value = mock_account
         mock_send_email.return_value = "token-123"
 
-        wraps_features = SystemFeatureModel(enable_email_password_login=True, is_allow_register=True)
-        controller_features = SystemFeatureModel(is_allow_register=True)
+        wraps_features = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+            is_allow_register=True,
+        )
+        controller_features = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            is_allow_register=True,
+        )
         with (
             patch(
                 "controllers.console.auth.forgot_password.FeatureService.get_system_features",
@@ -95,7 +102,10 @@ class TestForgotPasswordCheckApi:
         mock_get_data.return_value = {"email": "Admin@Example.com", "code": "4321"}
         mock_generate_token.return_value = (None, "new-token")
 
-        wraps_features = SystemFeatureModel(enable_email_password_login=True)
+        wraps_features = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+        )
         with (
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
             patch("controllers.console.wraps.FeatureService.get_system_features", return_value=wraps_features),
@@ -138,7 +148,10 @@ class TestForgotPasswordResetApi:
         db.session.commit()
         mock_get_account.return_value = account
 
-        wraps_features = SystemFeatureModel(enable_email_password_login=True)
+        wraps_features = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+        )
         with (
             patch("controllers.console.wraps.dify_config.EDITION", "CLOUD"),
             patch("controllers.console.wraps.FeatureService.get_system_features", return_value=wraps_features),

api/tests/unit_tests/controllers/console/auth/test_password_reset.py

@@ -24,7 +24,7 @@ from controllers.console.auth.forgot_password import (
 )
 from controllers.console.error import AccountNotFound, EmailSendIpLimitError
 from models.account import Account, Tenant, TenantAccountJoin
-from services.feature_service import SystemFeatureModel
+from services.feature_service import DeploymentEdition, SystemFeatureModel
 
 SQLITE_MODELS = (Account, Tenant, TenantAccountJoin)
 
@@ -48,7 +48,10 @@ def enable_password_login_wrappers(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr("controllers.console.wraps.dify_config.EDITION", "CLOUD")
     monkeypatch.setattr(
         "controllers.console.wraps.FeatureService.get_system_features",
-        lambda: SystemFeatureModel(enable_email_password_login=True),
+        lambda: SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_email_password_login=True,
+        ),
     )
 
 

api/tests/unit_tests/controllers/console/test_feature.py

@@ -3,7 +3,7 @@ from inspect import unwrap
 from pytest_mock import MockerFixture
 
 from models import Account
-from services.feature_service import FeatureModel, LimitationModel, SystemFeatureModel
+from services.feature_service import DeploymentEdition, FeatureModel, LimitationModel, SystemFeatureModel
 
 
 def make_account() -> Account:
@@ -94,7 +94,11 @@ class TestSystemFeatureApi:
             "controllers.console.feature.current_account_with_tenant_optional",
             return_value=(account, "tenant-123"),
         )
-        system_features = SystemFeatureModel(is_allow_register=True, enable_learn_app=True)
+        system_features = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            is_allow_register=True,
+            enable_learn_app=True,
+        )
         get_system_features = mocker.patch(
             "controllers.console.feature.FeatureService.get_system_features",
             return_value=system_features,
@@ -119,7 +123,10 @@ class TestSystemFeatureApi:
             "controllers.console.feature.current_account_with_tenant_optional",
             return_value=(None, None),
         )
-        system_features = SystemFeatureModel(is_allow_register=False)
+        system_features = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            is_allow_register=False,
+        )
         get_system_features = mocker.patch(
             "controllers.console.feature.FeatureService.get_system_features",
             return_value=system_features,

api/tests/unit_tests/controllers/console/test_wraps.py

@@ -201,7 +201,7 @@ class TestRbacPermissionRequired:
         ):
             assert protected_view(app_id="app-123") == "ok"
 
-        mock_extract.assert_called_once_with("app", {"app_id": "app-123"})
+        mock_extract.assert_called_once_with(RBACResourceScope.APP, "tenant-1", {"app_id": "app-123"})
         mock_owned.assert_called_once_with("tenant-1", "account-1", "app", "app-123")
         mock_check.assert_called_once_with(
             "tenant-1",
@@ -307,7 +307,7 @@ class TestRbacPermissionRequired:
         with app.test_request_context("/"):
             request.view_args = {"app_id": "view-app"}
 
-            assert _extract_resource_id("app", {"app_id": "path-app"}) == "path-app"
+            assert _extract_resource_id("app", "tenant-1", {"app_id": "path-app"}) == "path-app"
 
     def test_extract_resource_id_falls_back_to_request_view_args(self):
         app = Flask(__name__)
@@ -315,22 +315,59 @@ class TestRbacPermissionRequired:
         with app.test_request_context("/"):
             request.view_args = {"app_id": "view-app"}
 
-            assert _extract_resource_id("app") == "view-app"
+            assert _extract_resource_id("app", "tenant-1") == "view-app"
 
     def test_extract_resource_id_supports_legacy_route_aliases(self):
         app = Flask(__name__)
 
         with app.test_request_context("/apps/app-1/api-keys"):
             request.view_args = {"resource_id": "app-1"}
-            assert _extract_resource_id(RBACResourceScope.APP) == "app-1"
-
-        with app.test_request_context("/agent/agent-1/features"):
-            request.view_args = {"agent_id": "agent-1"}
-            assert _extract_resource_id(RBACResourceScope.APP) == "agent-1"
+            assert _extract_resource_id(RBACResourceScope.APP, "tenant-1") == "app-1"
 
         with app.test_request_context("/datasets/dataset-1/api-keys"):
             request.view_args = {"resource_id": "dataset-1"}
-            assert _extract_resource_id(RBACResourceScope.DATASET) == "dataset-1"
+            assert _extract_resource_id(RBACResourceScope.DATASET, "tenant-1") == "dataset-1"
+
+    def test_extract_resource_id_resolves_agent_to_its_authz_app(self):
+        app = Flask(__name__)
+
+        with (
+            app.test_request_context("/agent/agent-1/chat-messages"),
+            patch("controllers.common.wraps.AgentRosterService") as mock_service,
+        ):
+            request.view_args = {"agent_id": "agent-1"}
+            mock_service.return_value.peek_authz_app_id.return_value = "parent-app-1"
+
+            assert _extract_resource_id(RBACResourceScope.APP, "tenant-1") == "parent-app-1"
+
+    def test_extract_resource_id_scopes_agent_resolution_to_the_calling_tenant(self):
+        """The tenant must reach the resolver, or an Agent id from any tenant resolves."""
+        app = Flask(__name__)
+
+        with (
+            app.test_request_context("/agent/agent-1/chat-messages"),
+            patch("controllers.common.wraps.AgentRosterService") as mock_service,
+        ):
+            request.view_args = {"agent_id": "agent-1"}
+            mock_service.return_value.peek_authz_app_id.return_value = "parent-app-1"
+
+            _extract_resource_id(RBACResourceScope.APP, "tenant-9")
+
+            mock_service.return_value.peek_authz_app_id.assert_called_once_with(
+                tenant_id="tenant-9", agent_id="agent-1"
+            )
+
+    def test_extract_resource_id_keeps_agent_id_when_the_agent_does_not_resolve(self):
+        app = Flask(__name__)
+
+        with (
+            app.test_request_context("/agent/agent-1/chat-messages"),
+            patch("controllers.common.wraps.AgentRosterService") as mock_service,
+        ):
+            request.view_args = {"agent_id": "agent-1"}
+            mock_service.return_value.peek_authz_app_id.return_value = None
+
+            assert _extract_resource_id(RBACResourceScope.APP, "tenant-1") == "agent-1"
 
     def test_legacy_admin_decorator_noops_when_rbac_enabled(self):
         @is_admin_or_owner_required

api/tests/unit_tests/controllers/web/test_web_forgot_password.py

@@ -16,7 +16,7 @@ from controllers.web.forgot_password import (
 )
 from models.account import Account
 from models.engine import db
-from services.feature_service import SystemFeatureModel
+from services.feature_service import DeploymentEdition, SystemFeatureModel
 
 
 @pytest.fixture
@@ -32,7 +32,10 @@ def database_app() -> Iterator[Flask]:
 
 @pytest.fixture(autouse=True)
 def _patch_wraps():
-    wraps_features = SystemFeatureModel(enable_email_password_login=True)
+    wraps_features = SystemFeatureModel(
+        deployment_edition=DeploymentEdition.COMMUNITY,
+        enable_email_password_login=True,
+    )
     with (
         patch("controllers.console.wraps.db") as mock_db,
         patch("controllers.console.wraps.dify_config.ENTERPRISE_ENABLED", True),

api/tests/unit_tests/core/plugin/impl/test_base_client_impl.py

@@ -7,7 +7,7 @@ from pytest_mock import MockerFixture
 from core.plugin.endpoint.exc import EndpointSetupFailedError
 from core.plugin.entities.plugin_daemon import PluginDaemonInnerError
 from core.plugin.impl.base import PLUGIN_DAEMON_MAX_PATH_LENGTH, BasePluginClient
-from core.plugin.impl.exc import PluginLLMPollingUnsupportedError
+from core.plugin.impl.exc import PluginLLMPollingUnsupportedError, PluginRuntimeError
 from core.trigger.errors import (
     EventIgnoreError,
     TriggerInvokeError,
@@ -175,3 +175,25 @@ class TestBasePluginClientImpl:
 
         with pytest.raises(PluginLLMPollingUnsupportedError):
             client._handle_plugin_daemon_error("PluginInvokeError", message)
+
+    def test_handle_plugin_daemon_error_maps_runtime_error_to_typed_exception(self):
+        client = BasePluginClient()
+        lambda_request_id = "45664803-3d3c-4d4f-93fe-e3b19e43092b"
+        message = json.dumps(
+            {
+                "error_type": PluginRuntimeError.__name__,
+                "message": (
+                    "Plugin runtime request failed: Runtime.ExitError: "
+                    f"RequestId: {lambda_request_id} Error: Runtime exited with error: exit status 1"
+                ),
+                "args": {"request_id": lambda_request_id, "status_code": 200},
+            }
+        )
+
+        with pytest.raises(PluginRuntimeError) as exc_info:
+            client._handle_plugin_daemon_error("PluginInvokeError", message)
+
+        assert exc_info.value.description == (
+            "Plugin runtime request failed: Runtime.ExitError: Runtime exited with error: exit status 1"
+        )
+        assert exc_info.value.lambda_request_id == lambda_request_id

api/tests/unit_tests/libs/test_external_api.py

@@ -4,6 +4,7 @@ from werkzeug.exceptions import BadRequest, Unauthorized
 
 from constants import COOKIE_NAME_ACCESS_TOKEN, COOKIE_NAME_CSRF_TOKEN, COOKIE_NAME_REFRESH_TOKEN
 from core.errors.error import AppInvokeQuotaExceededError
+from core.plugin.impl.exc import PluginRuntimeError
 from libs.exception import BaseHTTPException
 from libs.external_api import ExternalApi
 from libs.rate_limit import _BearerRateLimited
@@ -39,6 +40,14 @@ def _create_api_app():
         def get(self):
             raise RuntimeError("oops")
 
+    @api.route("/plugin-runtime-error")
+    class PluginRuntime(Resource):
+        def get(self):
+            raise PluginRuntimeError(
+                "Plugin runtime request failed: Runtime.ExitError: Runtime exited with error: exit status 1",
+                lambda_request_id="lambda-request-id",
+            )
+
     # Note: We avoid altering default_mediatype to keep normal error paths
 
     # Special 400 message rewrite
@@ -107,6 +116,24 @@ def test_external_api_json_message_and_bad_request_rewrite():
     assert res.get_json()["message"] == "Invalid JSON payload received or JSON payload is empty."
 
 
+def test_external_api_plugin_runtime_error(mocker):
+    mocker.patch("libs.external_api.get_request_id", return_value="api-request-id")
+    app = _create_api_app()
+
+    res = app.test_client().get("/api/plugin-runtime-error")
+
+    assert res.status_code == 502
+    assert res.get_json() == {
+        "code": "plugin_runtime_error",
+        "message": "Plugin runtime request failed: Runtime.ExitError: Runtime exited with error: exit status 1",
+        "details": {
+            "request_id": "api-request-id",
+            "lambda_request_id": "lambda-request-id",
+        },
+        "status": 502,
+    }
+
+
 def test_external_api_param_mapping_and_quota():
     app = _create_api_app()
     client = app.test_client()

api/tests/unit_tests/services/agent/test_agent_services.py

@@ -135,6 +135,38 @@ def test_get_published_agent_soul_for_app_returns_none_without_backing_agent():
     assert result is None
 
 
+def test_peek_authz_app_id_uses_the_parent_app_not_the_hidden_backing_app():
+    """A workflow-only Agent is authorized against its parent workflow App."""
+    agent = SimpleNamespace(id="agent-1", backing_app_id="backing-app-1", app_id="parent-app-1")
+    service = AgentRosterService(FakeSession(scalar=[agent]))
+
+    result = service.peek_authz_app_id(tenant_id="tenant-1", agent_id="agent-1")
+
+    assert result == "parent-app-1"
+
+
+def test_peek_authz_app_id_uses_the_roster_agent_app():
+    agent = SimpleNamespace(id="agent-1", backing_app_id=None, app_id="roster-app-1")
+    service = AgentRosterService(FakeSession(scalar=[agent]))
+
+    result = service.peek_authz_app_id(tenant_id="tenant-1", agent_id="agent-1")
+
+    assert result == "roster-app-1"
+
+
+def test_peek_authz_app_id_returns_none_without_creating_a_backing_app():
+    """Authorization checks must not materialize the hidden backing App."""
+    session = FakeSession(scalar=[None])
+    service = AgentRosterService(session)
+
+    result = service.peek_authz_app_id(tenant_id="tenant-1", agent_id="agent-1")
+
+    assert result is None
+    assert session.added == []
+    assert session.commits == 0
+    assert session.flushes == 0
+
+
 def test_load_workflow_composer_returns_empty_state(monkeypatch: pytest.MonkeyPatch):
     session = FakeSession()
     monkeypatch.setattr(AgentComposerService, "_get_draft_workflow", lambda **kwargs: SimpleNamespace(id="workflow-1"))

api/tests/unit_tests/services/enterprise/test_rbac_service.py

@@ -933,3 +933,20 @@ class TestListOption:
             "page_number": 1,
             "resource_type": "app",
         }
+
+
+class TestLegacyAgentManageKey:
+    def test_legacy_agent_manage_key_membership(self):
+        # Mirrors the builtin roles in the rbac service, which grant agent.manage
+        # to owner/admin/editor only.
+        for keys in (
+            svc._LEGACY_WORKSPACE_OWNER_KEYS,
+            svc._LEGACY_WORKSPACE_ADMIN_KEYS,
+            svc._LEGACY_WORKSPACE_EDITOR_KEYS,
+        ):
+            assert "agent.manage" in keys
+        for keys in (
+            svc._LEGACY_WORKSPACE_NORMAL_KEYS,
+            svc._LEGACY_WORKSPACE_DATASET_OPERATOR_KEYS,
+        ):
+            assert "agent.manage" not in keys

api/tests/unit_tests/services/plugin/test_plugin_service_installation.py

@@ -24,6 +24,7 @@ from models.engine import db
 from models.provider import Provider, ProviderCredential, TenantPreferredModelProvider
 from services.errors.plugin import PluginInstallationForbiddenError
 from services.feature_service import (
+    DeploymentEdition,
     PluginInstallationPermissionModel,
     PluginInstallationScope,
     SystemFeatureModel,
@@ -35,10 +36,11 @@ def _make_features(
     scope: PluginInstallationScope = PluginInstallationScope.ALL,
 ) -> SystemFeatureModel:
     return SystemFeatureModel(
+        deployment_edition=DeploymentEdition.COMMUNITY,
         plugin_installation_permission=PluginInstallationPermissionModel(
             restrict_to_marketplace_only=restrict_to_marketplace,
             plugin_installation_scope=scope,
-        )
+        ),
     )
 
 

api/tests/unit_tests/services/test_app_dsl_service.py

@@ -5,10 +5,12 @@ from unittest.mock import Mock
 import pytest
 from sqlalchemy.orm import Session
 
+from core.rbac import RBACPermission
 from models import App, AppMode
 from models.model import AppModelConfig, IconType
 from services.app_dsl_service import AppDslService
 from services.entities.dsl_entities import ImportStatus
+from services.errors.account import NoPermissionError
 
 
 @pytest.mark.parametrize("sqlite_session", [()], indirect=True)
@@ -166,3 +168,61 @@ def test_export_dsl_loads_model_config_and_annotation_reply_with_request_session
     session.get.assert_called_once_with(AppModelConfig, "config-1")
     load_annotation_reply_config.assert_called_once_with(session, "app-1")
     app_model_config.to_dict.assert_called_once_with(annotation_reply=annotation_reply)
+
+
+def test_ensure_agent_manage_permission_noops_when_rbac_disabled(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("services.app_dsl_service.dify_config.RBAC_ENABLED", False)
+    check = Mock()
+    monkeypatch.setattr("services.app_dsl_service.RBACService.CheckAccess.check", check)
+
+    AppDslService._ensure_agent_manage_permission(Mock(id="account-1", current_tenant_id="tenant-1"))
+
+    check.assert_not_called()
+
+
+def test_ensure_agent_manage_permission_allows_agent_manager(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("services.app_dsl_service.dify_config.RBAC_ENABLED", True)
+    check = Mock(return_value=True)
+    monkeypatch.setattr("services.app_dsl_service.RBACService.CheckAccess.check", check)
+
+    AppDslService._ensure_agent_manage_permission(Mock(id="account-1", current_tenant_id="tenant-1"))
+
+    check.assert_called_once_with("tenant-1", "account-1", scene=RBACPermission.AGENT_MANAGE)
+
+
+def test_ensure_agent_manage_permission_rejects_without_agent_manage(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("services.app_dsl_service.dify_config.RBAC_ENABLED", True)
+    monkeypatch.setattr("services.app_dsl_service.RBACService.CheckAccess.check", Mock(return_value=False))
+
+    with pytest.raises(NoPermissionError):
+        AppDslService._ensure_agent_manage_permission(Mock(id="account-1", current_tenant_id="tenant-1"))
+
+
+def test_create_or_update_app_gates_agent_mode_before_creation(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("services.app_dsl_service.dify_config.RBAC_ENABLED", True)
+    monkeypatch.setattr("services.app_dsl_service.RBACService.CheckAccess.check", Mock(return_value=False))
+    session = Mock()
+    service = AppDslService(session=session)
+
+    with pytest.raises(NoPermissionError):
+        service._create_or_update_app(
+            app=None,
+            data={"app": {"mode": "agent", "name": "Gated agent"}},
+            account=Mock(id="account-1", current_tenant_id="tenant-1"),
+        )
+
+    session.add.assert_not_called()
+    session.flush.assert_not_called()
+
+
+def test_import_app_reraises_permission_denial_instead_of_failed_result(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("services.app_dsl_service.dify_config.RBAC_ENABLED", True)
+    monkeypatch.setattr("services.app_dsl_service.RBACService.CheckAccess.check", Mock(return_value=False))
+    service = AppDslService(session=Mock())
+
+    with pytest.raises(NoPermissionError):
+        service.import_app(
+            account=Mock(id="account-1", current_tenant_id="tenant-1"),
+            import_mode="yaml-content",
+            yaml_content="app:\n  mode: agent\n  name: Denied agent\n",
+        )

api/tests/unit_tests/services/test_feature_service_change_email.py

@@ -0,0 +1,25 @@
+import pytest
+
+from services.feature_service import FeatureService
+
+
+@pytest.mark.parametrize("enabled", [False, True])
+def test_get_system_features_reads_enable_change_email(
+    monkeypatch: pytest.MonkeyPatch,
+    enabled: bool,
+) -> None:
+    monkeypatch.setattr("services.feature_service.dify_config.ENABLE_CHANGE_EMAIL", enabled)
+
+    result = FeatureService.get_system_features()
+
+    assert result.enable_change_email is enabled
+
+
+def test_enterprise_disables_change_email(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("services.feature_service.dify_config.ENABLE_CHANGE_EMAIL", True)
+    monkeypatch.setattr("services.feature_service.dify_config.ENTERPRISE_ENABLED", True)
+    monkeypatch.setattr("services.feature_service.FeatureService._fulfill_params_from_enterprise", lambda *_: None)
+
+    result = FeatureService.get_system_features()
+
+    assert result.enable_change_email is False

api/tests/unit_tests/services/test_feature_service_deployment_edition.py

@@ -0,0 +1,34 @@
+import pytest
+from pydantic import ValidationError
+
+from services.feature_service import DeploymentEdition, FeatureService, SystemFeatureModel
+
+
+def test_system_feature_model_requires_deployment_edition() -> None:
+    with pytest.raises(ValidationError):
+        SystemFeatureModel.model_validate({})
+
+
+@pytest.mark.parametrize(
+    ("edition", "enterprise_enabled", "expected"),
+    [
+        ("SELF_HOSTED", False, DeploymentEdition.COMMUNITY),
+        ("SELF_HOSTED", True, DeploymentEdition.ENTERPRISE),
+        ("CLOUD", False, DeploymentEdition.CLOUD),
+        ("CLOUD", True, DeploymentEdition.CLOUD),
+    ],
+)
+def test_get_system_features_resolves_deployment_edition(
+    monkeypatch: pytest.MonkeyPatch,
+    edition: str,
+    enterprise_enabled: bool,
+    expected: DeploymentEdition,
+) -> None:
+    monkeypatch.setattr("services.feature_service.dify_config.EDITION", edition)
+    monkeypatch.setattr("services.feature_service.dify_config.ENTERPRISE_ENABLED", enterprise_enabled)
+    monkeypatch.setattr("services.feature_service.FeatureService._fulfill_params_from_enterprise", lambda *_: None)
+
+    result = FeatureService.get_system_features()
+
+    assert result.deployment_edition is expected
+    assert result.model_dump(mode="json")["deployment_edition"] == expected.value

api/tests/unit_tests/services/test_feature_service_enable_app_deploy.py

@@ -1,7 +1,7 @@
 import pytest
 
 from services import feature_service as feature_service_module
-from services.feature_service import FeatureService, SystemFeatureModel
+from services.feature_service import DeploymentEdition, FeatureService, SystemFeatureModel
 
 
 @pytest.mark.parametrize(
@@ -29,7 +29,7 @@ def test_fulfill_params_from_enterprise_enable_app_deploy(
         staticmethod(lambda: enterprise_info),
     )
 
-    features = SystemFeatureModel()
+    features = SystemFeatureModel(deployment_edition=DeploymentEdition.COMMUNITY)
     features.enable_app_deploy = initial
 
     FeatureService._fulfill_params_from_enterprise(features)

api/tests/unit_tests/services/test_feature_service_knowledge_fs.py

@@ -1,10 +1,10 @@
 import pytest
 
-from services.feature_service import FeatureService, SystemFeatureModel
+from services.feature_service import DeploymentEdition, FeatureService, SystemFeatureModel
 
 
 def test_system_feature_model_disables_knowledge_fs_by_default() -> None:
-    assert SystemFeatureModel().knowledge_fs_enabled is False
+    assert SystemFeatureModel(deployment_edition=DeploymentEdition.COMMUNITY).knowledge_fs_enabled is False
 
 
 @pytest.mark.parametrize("enabled", [False, True])

api/tests/unit_tests/services/test_feature_service_learn_app.py

@@ -1,12 +1,14 @@
 import pytest
 
 from services import feature_service as feature_service_module
-from services.feature_service import FeatureService, SystemFeatureModel
+from services.feature_service import DeploymentEdition, FeatureService, SystemFeatureModel
 
 
 def test_system_feature_model_defaults_enable_learn_app():
-    assert SystemFeatureModel().enable_learn_app is True
-    assert SystemFeatureModel().enable_step_by_step_tour is False
+    system_features = SystemFeatureModel(deployment_edition=DeploymentEdition.COMMUNITY)
+
+    assert system_features.enable_learn_app is True
+    assert system_features.enable_step_by_step_tour is False
 
 
 @pytest.mark.parametrize("enabled", [True, False])

api/tests/unit_tests/services/test_feature_service_licensed_seats.py

@@ -1,7 +1,7 @@
 import pytest
 
 from services import feature_service as feature_service_module
-from services.feature_service import FeatureService, SystemFeatureModel
+from services.feature_service import DeploymentEdition, FeatureService, SystemFeatureModel
 
 _ENTERPRISE_INFO = {"License": {"licensedSeats": {"enabled": True, "limit": 3, "used": 1}}}
 
@@ -14,7 +14,7 @@ def test_fulfill_params_from_enterprise_parses_licensed_seats(monkeypatch: pytes
         staticmethod(lambda: _ENTERPRISE_INFO),
     )
 
-    features = SystemFeatureModel()
+    features = SystemFeatureModel(deployment_edition=DeploymentEdition.COMMUNITY)
     FeatureService._fulfill_params_from_enterprise(features, is_authenticated=True)
 
     assert features.license.seats.enabled is True
@@ -30,7 +30,7 @@ def test_fulfill_params_from_enterprise_withholds_seats_when_unauthenticated(mon
         staticmethod(lambda: _ENTERPRISE_INFO),
     )
 
-    features = SystemFeatureModel()
+    features = SystemFeatureModel(deployment_edition=DeploymentEdition.COMMUNITY)
     FeatureService._fulfill_params_from_enterprise(features, is_authenticated=False)
 
     assert features.license.seats.enabled is False

api/tests/unit_tests/services/test_feature_service_webapp_public_access.py

@@ -1,6 +1,6 @@
 import pytest
 
-from services.feature_service import FeatureService, SystemFeatureModel
+from services.feature_service import DeploymentEdition, FeatureService, SystemFeatureModel
 
 
 @pytest.mark.parametrize(
@@ -18,7 +18,7 @@ def test_fulfill_system_params_from_env_sets_allow_public_access(
 ):
     monkeypatch.setattr("services.feature_service.dify_config.WEBAPP_PUBLIC_ACCESS_ENABLED", env_value)
 
-    system_features = SystemFeatureModel()
+    system_features = SystemFeatureModel(deployment_edition=DeploymentEdition.COMMUNITY)
     FeatureService._fulfill_system_params_from_env(system_features)
 
     assert system_features.webapp_auth.allow_public_access is expected

api/tests/unit_tests/services/test_recommended_app_service.py

@@ -12,7 +12,7 @@ from sqlalchemy.orm import Session
 
 from models.model import AccountTrialAppRecord, App, AppMode, TrialApp
 from services import recommended_app_service as service_module
-from services.feature_service import SystemFeatureModel
+from services.feature_service import DeploymentEdition, SystemFeatureModel
 from services.recommended_app_service import RecommendedAppService
 
 pytestmark = pytest.mark.parametrize(
@@ -298,7 +298,10 @@ class TestRecommendedAppServiceGetDetail:
         sqlite_session: Session,
     ) -> None:
         mock_config.HOSTED_FETCH_APP_TEMPLATES_MODE = "remote"
-        mock_feature_service.get_system_features.return_value = SystemFeatureModel(enable_trial_app=False)
+        mock_feature_service.get_system_features.return_value = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_trial_app=False,
+        )
         cases: list[tuple[str, RecommendedAppPayload]] = [
             (
                 "complex-app",
@@ -337,7 +340,10 @@ class TestRecommendedAppServiceGetDetail:
         mock_feature_service: MagicMock,
         sqlite_session: Session,
     ) -> None:
-        mock_feature_service.get_system_features.return_value = SystemFeatureModel(enable_trial_app=False)
+        mock_feature_service.get_system_features.return_value = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_trial_app=False,
+        )
         for mode in ["remote", "builtin", "db"]:
             mock_config.HOSTED_FETCH_APP_TEMPLATES_MODE = mode
             detail = _app_detail(app_id="test-app", name=f"App from {mode}")
@@ -367,7 +373,10 @@ class TestRecommendedAppServiceGetLearnDifyApps:
         sqlite_session: Session,
     ) -> None:
         mock_config.HOSTED_FETCH_APP_TEMPLATES_MODE = "remote"
-        mock_feature_service.get_system_features.return_value = SystemFeatureModel(enable_trial_app=False)
+        mock_feature_service.get_system_features.return_value = SystemFeatureModel(
+            deployment_edition=DeploymentEdition.COMMUNITY,
+            enable_trial_app=False,
+        )
         expected_app = RecommendedAppPayload(app_id="app-1", category="Workflow")
         mock_instance = MagicMock()
         mock_instance.get_learn_dify_apps.return_value = {
@@ -402,7 +411,12 @@ class TestRecommendedAppServiceGetLearnDifyApps:
         monkeypatch.setattr(
             service_module.FeatureService,
             "get_system_features",
-            MagicMock(return_value=SystemFeatureModel(enable_trial_app=True)),
+            MagicMock(
+                return_value=SystemFeatureModel(
+                    deployment_edition=DeploymentEdition.COMMUNITY,
+                    enable_trial_app=True,
+                )
+            ),
         )
         can_trial_mock = MagicMock(return_value=True)
         monkeypatch.setattr(RecommendedAppService, "_can_trial_app", can_trial_mock)
@@ -425,7 +439,12 @@ class TestRecommendedAppServiceTrialFeatures:
         monkeypatch.setattr(
             service_module.FeatureService,
             "get_system_features",
-            MagicMock(return_value=SystemFeatureModel(enable_trial_app=False)),
+            MagicMock(
+                return_value=SystemFeatureModel(
+                    deployment_edition=DeploymentEdition.COMMUNITY,
+                    enable_trial_app=False,
+                )
+            ),
         )
 
         result = RecommendedAppService.get_recommended_apps_and_categories("en-US", session=sqlite_session)
@@ -456,7 +475,12 @@ class TestRecommendedAppServiceTrialFeatures:
         monkeypatch.setattr(
             service_module.FeatureService,
             "get_system_features",
-            MagicMock(return_value=SystemFeatureModel(enable_trial_app=True)),
+            MagicMock(
+                return_value=SystemFeatureModel(
+                    deployment_edition=DeploymentEdition.COMMUNITY,
+                    enable_trial_app=True,
+                )
+            ),
         )
 
         result = RecommendedAppService.get_recommended_apps_and_categories("ja-JP", session=sqlite_session)
@@ -492,7 +516,12 @@ class TestRecommendedAppServiceTrialFeatures:
         monkeypatch.setattr(
             service_module.FeatureService,
             "get_system_features",
-            MagicMock(return_value=SystemFeatureModel(enable_trial_app=True)),
+            MagicMock(
+                return_value=SystemFeatureModel(
+                    deployment_edition=DeploymentEdition.COMMUNITY,
+                    enable_trial_app=True,
+                )
+            ),
         )
 
         result = RecommendedAppService.get_recommend_app_detail(app_id, session=sqlite_session)

docker/envs/core-services/shared.env.example

@@ -16,11 +16,21 @@ CHECK_UPDATE_URL=https://updates.dify.ai
 OPENAI_API_BASE=https://api.openai.com/v1
 MIGRATION_ENABLED=true
 FILES_ACCESS_TIMEOUT=300
+# System Features
+MARKETPLACE_ENABLED=true
+ENABLE_EMAIL_CODE_LOGIN=false
+ENABLE_EMAIL_PASSWORD_LOGIN=true
+ENABLE_SOCIAL_OAUTH_LOGIN=false
 # Remove `collaboration` from COMPOSE_PROFILES to stop the dedicated websocket service.
 ENABLE_COLLABORATION_MODE=true
-
-# Learn app feature toggle
+ALLOW_REGISTER=false
+ALLOW_CREATE_WORKSPACE=false
+ENABLE_CHANGE_EMAIL=true
+ENABLE_TRIAL_APP=false
+ENABLE_EXPLORE_BANNER=false
 ENABLE_LEARN_APP=true
+ENABLE_STEP_BY_STEP_TOUR=false
+RBAC_ENABLED=false
 CELERY_BROKER_URL=redis://:difyai123456@redis:6379/1
 CELERY_TASK_ANNOTATIONS=null
 AZURE_BLOB_ACCOUNT_URL=https://<your_account_name>.blob.core.windows.net
@@ -90,6 +100,8 @@ WORKFLOW_LOG_CLEANUP_SPECIFIC_WORKFLOW_IDS=
 EXPOSE_PLUGIN_DEBUGGING_HOST=localhost
 EXPOSE_PLUGIN_DEBUGGING_PORT=5003
 DEPLOY_ENV=PRODUCTION
+EDITION=SELF_HOSTED
+ENTERPRISE_ENABLED=false
 ACCESS_TOKEN_EXPIRE_MINUTES=60
 REFRESH_TOKEN_EXPIRE_DAYS=30
 APP_DEFAULT_ACTIVE_REQUESTS=0

docker/envs/core-services/web.env.example

@@ -15,7 +15,6 @@ TEXT_GENERATION_TIMEOUT_MS=60000
 ALLOW_INLINE_STYLES=false
 ALLOW_UNSAFE_DATA_SCHEME=false
 MAX_TREE_DEPTH=50
-MARKETPLACE_ENABLED=true
 MARKETPLACE_API_URL=https://marketplace.dify.ai
 INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH=4000
 ALLOW_EMBED=false

oxlint-suppressions.json

@@ -835,14 +835,6 @@
       "count": 1
     }
   },
-  "web/app/components/base/audio-btn/audio.ts": {
-    "node-js/prefer-global/buffer": {
-      "count": 1
-    },
-    "typescript/no-explicit-any": {
-      "count": 3
-    }
-  },
   "web/app/components/base/audio-gallery/AudioPlayer.tsx": {
     "jsx_a11y/media-has-caption": {
       "count": 1

packages/contracts/generated/api/console/system-features/types.gen.ts

@@ -6,6 +6,7 @@ export type ClientOptions = {
 
 export type SystemFeatureModel = {
   branding: BrandingModel
+  deployment_edition: DeploymentEdition
   enable_app_deploy: boolean
   enable_change_email: boolean
   enable_collaboration_mode: boolean
@@ -40,6 +41,8 @@ export type BrandingModel = {
   workspace_logo: string
 }
 
+export type DeploymentEdition = 'CLOUD' | 'COMMUNITY' | 'ENTERPRISE'
+
 export type LicenseModel = {
   expired_at: string
   seats: LicenseLimitationModel

packages/contracts/generated/api/console/system-features/zod.gen.ts

@@ -13,6 +13,11 @@ export const zBrandingModel = z.object({
   workspace_logo: z.string().default(''),
 })
 
+/**
+ * DeploymentEdition
+ */
+export const zDeploymentEdition = z.enum(['CLOUD', 'COMMUNITY', 'ENTERPRISE'])
+
 /**
  * PluginManagerModel
  */
@@ -104,6 +109,7 @@ export const zSystemFeatureModel = z.object({
     login_page_logo: '',
     workspace_logo: '',
   }),
+  deployment_edition: zDeploymentEdition,
   enable_app_deploy: z.boolean().default(false),
   enable_change_email: z.boolean().default(true),
   enable_collaboration_mode: z.boolean().default(true),

packages/contracts/generated/api/web/types.gen.ts

@@ -118,6 +118,8 @@ export type ConversationRenamePayload = (
   name?: string | null
 }
 
+export type DeploymentEdition = 'CLOUD' | 'COMMUNITY' | 'ENTERPRISE'
+
 export type EmailCodeLoginSendPayload = {
   email: string
   language?: string | null
@@ -510,6 +512,7 @@ export type SuggestedQuestionsResponse = {
 
 export type SystemFeatureModel = {
   branding: BrandingModel
+  deployment_edition: DeploymentEdition
   enable_app_deploy: boolean
   enable_change_email: boolean
   enable_collaboration_mode: boolean

packages/contracts/generated/api/web/zod.gen.ts

@@ -132,6 +132,11 @@ export const zConversationRenamePayload = z.intersection(
   }),
 )
 
+/**
+ * DeploymentEdition
+ */
+export const zDeploymentEdition = z.enum(['CLOUD', 'COMMUNITY', 'ENTERPRISE'])
+
 /**
  * EmailCodeLoginSendPayload
  */
@@ -782,6 +787,7 @@ export const zSystemFeatureModel = z.object({
     login_page_logo: '',
     workspace_logo: '',
   }),
+  deployment_edition: zDeploymentEdition,
   enable_app_deploy: z.boolean().default(false),
   enable_change_email: z.boolean().default(true),
   enable_collaboration_mode: z.boolean().default(true),

web/.env.example

@@ -1,7 +1,5 @@
 # For production release, change this to PRODUCTION
 NEXT_PUBLIC_DEPLOY_ENV=DEVELOPMENT
-# The deployment edition, SELF_HOSTED
-NEXT_PUBLIC_EDITION=SELF_HOSTED
 # The base path for the application
 NEXT_PUBLIC_BASE_PATH=
 # Server-only console API origin for server-side requests.
@@ -112,20 +110,3 @@ NEXT_PUBLIC_WEB_PREFIX=
 
 # number of concurrency
 NEXT_PUBLIC_BATCH_CONCURRENCY=5
-
-# Cloud system-features frontend defaults.
-# These values are only used when NEXT_PUBLIC_EDITION=CLOUD (IS_CLOUD_EDITION).
-NEXT_PUBLIC_ENABLE_MARKETPLACE=true
-NEXT_PUBLIC_ENABLE_EMAIL_CODE_LOGIN=true
-NEXT_PUBLIC_ENABLE_EMAIL_PASSWORD_LOGIN=false
-NEXT_PUBLIC_ENABLE_SOCIAL_OAUTH_LOGIN=true
-NEXT_PUBLIC_ENABLE_COLLABORATION_MODE=false
-NEXT_PUBLIC_ALLOW_REGISTER=true
-NEXT_PUBLIC_ALLOW_CREATE_WORKSPACE=true
-NEXT_PUBLIC_IS_EMAIL_SETUP=true
-NEXT_PUBLIC_ENABLE_CHANGE_EMAIL=true
-NEXT_PUBLIC_CREATORS_PLATFORM_FEATURES_ENABLED=true
-NEXT_PUBLIC_ENABLE_TRIAL_APP=true
-NEXT_PUBLIC_ENABLE_EXPLORE_BANNER=true
-NEXT_PUBLIC_RBAC_ENABLED=false
-NEXT_PUBLIC_KNOWLEDGE_FS_ENABLED=false

web/Dockerfile

@@ -49,7 +49,6 @@ RUN pnpm build && pnpm build:vinext
 FROM base AS production
 
 ENV NODE_ENV=production
-ENV EDITION=SELF_HOSTED
 ENV DEPLOY_ENV=PRODUCTION
 ENV CONSOLE_API_URL=http://127.0.0.1:5001
 ENV APP_API_URL=http://127.0.0.1:5001

web/__tests__/billing/billing-integration.test.tsx

@@ -1,3 +1,5 @@
+import type { RenderOptions } from '@testing-library/react'
+import type { ReactElement } from 'react'
 import type { UsagePlanInfo, UsageResetInfo } from '@/app/components/billing/type'
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
@@ -14,21 +16,21 @@ import TriggerEventsLimitModal from '@/app/components/billing/trigger-events-lim
 import { Plan } from '@/app/components/billing/type'
 import UpgradeBtn from '@/app/components/billing/upgrade-btn'
 import VectorSpaceFull from '@/app/components/billing/vector-space-full'
-import { render } from '@/test/console/render'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { render as renderWithConsoleState } from '@/test/console/render'
+
+const render = (ui: ReactElement, options: RenderOptions = {}) => {
+  const { wrapper } = createConsoleQueryWrapper({
+    systemFeatures: { deployment_edition: 'CLOUD' },
+  })
+  return renderWithConsoleState(ui, { ...options, wrapper })
+}
 
 let mockProviderCtx: Record<string, unknown> = {}
 let mockConsoleState: Record<string, unknown> = {}
 const mockSetShowPricingModal = vi.fn()
 const mockSetShowAccountSettingModal = vi.fn()
 
-vi.mock('@/config', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@/config')>()
-  return {
-    ...actual,
-    IS_CLOUD_EDITION: true,
-  }
-})
-
 vi.mock('@/context/provider-context', () => ({
   useProviderContext: () => mockProviderCtx,
 }))

web/__tests__/billing/education-verification-flow.test.tsx

@@ -1,3 +1,5 @@
+import type { RenderOptions } from '@testing-library/react'
+import type { ReactElement } from 'react'
 /**
  * Integration test: Education Verification Flow
  *
@@ -14,7 +16,15 @@ import * as React from 'react'
 import { defaultPlan } from '@/app/components/billing/config'
 import PlanComp from '@/app/components/billing/plan'
 import { Plan } from '@/app/components/billing/type'
-import { render } from '@/test/console/render'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { render as renderWithConsoleState } from '@/test/console/render'
+
+const render = (ui: ReactElement, options: RenderOptions = {}) => {
+  const { wrapper } = createConsoleQueryWrapper({
+    systemFeatures: { deployment_edition: 'CLOUD' },
+  })
+  return renderWithConsoleState(ui, { ...options, wrapper })
+}
 
 // ─── Mock state ──────────────────────────────────────────────────────────────
 let mockProviderCtx: Record<string, unknown> = {}
@@ -25,14 +35,6 @@ const mockRouterPush = vi.fn()
 const mockMutateAsync = vi.fn()
 const mockSetEducationVerifying = vi.hoisted(() => vi.fn())
 
-vi.mock('@/config', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@/config')>()
-  return {
-    ...actual,
-    IS_CLOUD_EDITION: true,
-  }
-})
-
 // ─── Context mocks ───────────────────────────────────────────────────────────
 vi.mock('@/context/provider-context', () => ({
   useProviderContext: () => mockProviderCtx,

web/__tests__/billing/partner-stack-flow.test.tsx

@@ -7,11 +7,15 @@
  * Covers URL param reading, cookie persistence, API bind on mount,
  * cookie cleanup after successful bind, and error handling for 400 status.
  */
-import { act, cleanup, render, renderHook, waitFor } from '@testing-library/react'
+import { act, cleanup, renderHook, waitFor } from '@testing-library/react'
 import Cookies from 'js-cookie'
 import * as React from 'react'
 import usePSInfo from '@/app/components/billing/partner-stack/use-ps-info'
 import { PARTNER_STACK_CONFIG } from '@/config'
+import { renderWithConsoleQuery } from '@/test/console/query-data'
+
+const render = (ui: React.ReactElement) =>
+  renderWithConsoleQuery(ui, { systemFeatures: { deployment_edition: 'CLOUD' } })
 
 // ─── Mock state ──────────────────────────────────────────────────────────────
 let mockSearchParams = new URLSearchParams()
@@ -39,7 +43,6 @@ vi.mock('@/config', async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>()
   return {
     ...actual,
-    IS_CLOUD_EDITION: true,
     PARTNER_STACK_CONFIG: {
       cookieName: 'partner_stack_info',
       saveCookieDays: 90,
@@ -288,7 +291,7 @@ describe('Partner Stack Flow', () => {
 
   // ─── 4. PartnerStack Component Mount ────────────────────────────────────
   describe('PartnerStack component mount behavior', () => {
-    it('should call saveOrUpdate and bind on mount when IS_CLOUD_EDITION is true', async () => {
+    it('should call saveOrUpdate and bind on mount', async () => {
       mockSearchParams = new URLSearchParams({
         ps_partner_key: 'mount-partner',
         ps_xid: 'mount-click',
@@ -299,18 +302,13 @@ describe('Partner Stack Flow', () => {
 
       render(<PartnerStack />)
 
-      // The component calls saveOrUpdate and bind in useEffect
       await waitFor(() => {
-        // Bind should have been called
         expect(mockMutateAsync).toHaveBeenCalledWith({
           partnerKey: 'mount-partner',
           clickId: 'mount-click',
         })
+        expect(Cookies.get(PARTNER_STACK_CONFIG.cookieName)).toBeUndefined()
       })
-
-      // Cookie should have been saved (saveOrUpdate was called before bind)
-      // After bind succeeds, cookie is removed
-      expect(Cookies.get(PARTNER_STACK_CONFIG.cookieName)).toBeUndefined()
     })
 
     it('should render nothing (return null)', async () => {

web/__tests__/env.spec.ts

@@ -1,6 +1,5 @@
 describe('env runtime transport', () => {
   const originalAgentV2Env = process.env.NEXT_PUBLIC_ENABLE_AGENT_V2
-  const originalRbacEnv = process.env.NEXT_PUBLIC_RBAC_ENABLED
 
   beforeEach(() => {
     vi.clearAllMocks()
@@ -8,17 +7,12 @@ describe('env runtime transport', () => {
     vi.doUnmock('../utils/client')
     document.body.removeAttribute('data-enable-agent-v2')
     document.body.removeAttribute('data-enable-agent-v-2')
-    document.body.removeAttribute('data-rbac-enabled')
     delete process.env.NEXT_PUBLIC_ENABLE_AGENT_V2
-    delete process.env.NEXT_PUBLIC_RBAC_ENABLED
   })
 
   afterAll(() => {
     if (originalAgentV2Env === undefined) delete process.env.NEXT_PUBLIC_ENABLE_AGENT_V2
     else process.env.NEXT_PUBLIC_ENABLE_AGENT_V2 = originalAgentV2Env
-
-    if (originalRbacEnv === undefined) delete process.env.NEXT_PUBLIC_RBAC_ENABLED
-    else process.env.NEXT_PUBLIC_RBAC_ENABLED = originalRbacEnv
   })
 
   it('should read NEXT_PUBLIC_ENABLE_AGENT_V2 from the browser runtime dataset key', async () => {
@@ -29,14 +23,6 @@ describe('env runtime transport', () => {
     expect(env.NEXT_PUBLIC_ENABLE_AGENT_V2).toBe(true)
   })
 
-  it('should read NEXT_PUBLIC_RBAC_ENABLED from the browser runtime dataset key', async () => {
-    document.body.setAttribute('data-rbac-enabled', 'true')
-
-    const { env } = await import('../env')
-
-    expect(env.NEXT_PUBLIC_RBAC_ENABLED).toBe(true)
-  })
-
   it('should emit the Agent v2 runtime dataset attribute from getDatasetMap on the server', async () => {
     process.env.NEXT_PUBLIC_ENABLE_AGENT_V2 = 'true'
 
@@ -51,18 +37,4 @@ describe('env runtime transport', () => {
     expect(datasetMap['data-enable-agent-v2']).toBe(true)
     expect(datasetMap['data-enable-agent-v-2']).toBeUndefined()
   })
-
-  it('should emit the RBAC runtime dataset attribute from getDatasetMap on the server', async () => {
-    process.env.NEXT_PUBLIC_RBAC_ENABLED = 'true'
-
-    vi.doMock('../utils/client', () => ({
-      isClient: false,
-      isServer: true,
-    }))
-
-    const { getDatasetMap } = await import('../env')
-    const datasetMap = getDatasetMap()
-
-    expect(datasetMap['data-rbac-enabled']).toBe(true)
-  })
 })

web/app/(commonLayout)/__tests__/console-bootstrap-gate.spec.tsx

@@ -2,6 +2,7 @@ import type { ReactNode } from 'react'
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { act, render, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createSystemFeaturesFixture } from '@/test/console/system-features'
 import { ConsoleBootstrapGate } from '../console-bootstrap-gate'
 
 const profileQueryKey = ['console', 'account', 'profile', 'get']
@@ -26,7 +27,9 @@ const createDeferred = <T,>(): Deferred<T> => {
 
 const mocks = vi.hoisted(() => ({
   profileQuery: undefined as Deferred<{ id: string }> | undefined,
-  systemFeaturesQuery: undefined as Deferred<{ branding: { enabled: boolean } }> | undefined,
+  systemFeaturesQuery: undefined as
+    | Deferred<ReturnType<typeof createSystemFeaturesFixture>>
+    | undefined,
 }))
 
 vi.mock('@/features/account-profile/client', () => ({
@@ -36,12 +39,24 @@ vi.mock('@/features/account-profile/client', () => ({
   }),
 }))
 
-vi.mock('@/features/system-features/client', () => ({
-  systemFeaturesQueryOptions: () => ({
-    queryKey: systemFeaturesQueryKey,
-    queryFn: () => mocks.systemFeaturesQuery!.promise,
-  }),
-}))
+vi.mock('@/service/client', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/service/client')>()
+  return {
+    ...actual,
+    consoleQuery: {
+      ...actual.consoleQuery,
+      systemFeatures: {
+        get: {
+          ...actual.consoleQuery.systemFeatures.get,
+          queryOptions: () => ({
+            queryKey: systemFeaturesQueryKey,
+            queryFn: () => mocks.systemFeaturesQuery!.promise,
+          }),
+        },
+      },
+    },
+  }
+})
 
 function createQueryClient() {
   return new QueryClient({
@@ -78,7 +93,7 @@ describe('ConsoleBootstrapGate', () => {
     expect(screen.queryByText('Console shell')).not.toBeInTheDocument()
 
     await act(async () => {
-      mocks.systemFeaturesQuery!.resolve({ branding: { enabled: false } })
+      mocks.systemFeaturesQuery!.resolve(createSystemFeaturesFixture())
     })
 
     expect(await screen.findByText('Console shell')).toBeInTheDocument()
@@ -87,11 +102,9 @@ describe('ConsoleBootstrapGate', () => {
   it('keeps atom consumers mounted when a cached profile background refetch fails', async () => {
     const queryClient = createQueryClient()
     queryClient.setQueryData(profileQueryKey, { id: 'user-1' }, { updatedAt: 1 })
-    queryClient.setQueryData(
-      systemFeaturesQueryKey,
-      { branding: { enabled: false } },
-      { updatedAt: 1 },
-    )
+    queryClient.setQueryData(systemFeaturesQueryKey, createSystemFeaturesFixture(), {
+      updatedAt: 1,
+    })
 
     renderGate(<div>Console shell</div>, queryClient)
 
@@ -102,7 +115,7 @@ describe('ConsoleBootstrapGate', () => {
 
     await act(async () => {
       mocks.profileQuery!.reject(new Error('profile refetch failed'))
-      mocks.systemFeaturesQuery!.resolve({ branding: { enabled: false } })
+      mocks.systemFeaturesQuery!.resolve(createSystemFeaturesFixture())
     })
 
     await waitFor(() => {

web/app/(commonLayout)/__tests__/hydration-boundary.spec.tsx

@@ -1,10 +1,11 @@
+import type { DehydratedState } from '@tanstack/react-query'
 import type { ReactElement } from 'react'
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { render, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
-  queryClient: undefined as QueryClient | undefined,
+  rootQueryClient: undefined as QueryClient | undefined,
   profileQueryFn: vi.fn(),
   systemFeaturesQueryFn: vi.fn(),
   workspaceQueryFn: vi.fn(),
@@ -18,9 +19,14 @@ const mocks = vi.hoisted(() => ({
   basePath: '',
 }))
 
-vi.mock('@/context/query-client-server', () => ({
-  getQueryClientServer: () => mocks.queryClient,
-}))
+vi.mock('@/context/query-client-server', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/query-client-server')>()
+
+  return {
+    ...actual,
+    getQueryClientServer: () => mocks.rootQueryClient,
+  }
+})
 
 vi.mock('@/next/headers', () => ({
   headers: () => mocks.headers(),
@@ -44,6 +50,14 @@ vi.mock('@/features/account-profile/server', () => ({
   }),
 }))
 
+vi.mock('@/features/system-features/server', () => ({
+  serverSystemFeaturesQueryOptions: () => ({
+    queryKey: ['console', 'system-features'],
+    queryFn: mocks.systemFeaturesQueryFn,
+    retry: false,
+  }),
+}))
+
 vi.mock('@/service/server', () => ({
   getServerConsoleClientContext: () => mocks.getServerConsoleClientContext(),
   resolveServerConsoleApiUrl: (...args: unknown[]) => mocks.resolveServerConsoleApiUrl(...args),
@@ -58,19 +72,11 @@ vi.mock('@/service/server', () => ({
   },
 }))
 
-vi.mock('@/features/system-features/server', () => ({
-  serverSystemFeaturesQueryOptions: () => ({
-    queryKey: ['console', 'system-features'],
-    queryFn: mocks.systemFeaturesQueryFn,
-    retry: false,
-  }),
-}))
-
 describe('CommonLayoutHydrationBoundary', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mocks.basePath = ''
-    mocks.queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+    mocks.rootQueryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
     mocks.headers.mockResolvedValue(
       new Headers({
         'x-dify-pathname': '/apps',
@@ -107,7 +113,7 @@ describe('CommonLayoutHydrationBoundary', () => {
     })
   })
 
-  it('should prefetch common layout queries and render children', async () => {
+  it('should prefetch common layout queries without requesting System Features', async () => {
     const { CommonLayoutHydrationBoundary } = await import('../hydration-boundary')
 
     const element = await CommonLayoutHydrationBoundary({
@@ -121,7 +127,7 @@ describe('CommonLayoutHydrationBoundary', () => {
     )
     expect(screen.getByText('Common shell')).toBeInTheDocument()
     expect(mocks.profileQueryFn).toHaveBeenCalledTimes(1)
-    expect(mocks.systemFeaturesQueryFn).toHaveBeenCalledTimes(1)
+    expect(mocks.systemFeaturesQueryFn).not.toHaveBeenCalled()
     expect(mocks.getServerConsoleClientContext).toHaveBeenCalledTimes(1)
     expect(mocks.workspaceQueryOptions).toHaveBeenCalledWith({
       context: {
@@ -133,6 +139,25 @@ describe('CommonLayoutHydrationBoundary', () => {
     expect(mocks.workspaceQueryFn).toHaveBeenCalledTimes(1)
   })
 
+  it('should dehydrate only Common-owned queries', async () => {
+    mocks.rootQueryClient?.setQueryData(['console', 'system-features'], {
+      deployment_edition: 'CLOUD',
+    })
+    const { CommonLayoutHydrationBoundary } = await import('../hydration-boundary')
+
+    const element = await CommonLayoutHydrationBoundary({ children: null })
+    const state = (element as ReactElement<{ state: DehydratedState }>).props.state
+    const queryKeys = state.queries.map((query) => query.queryKey)
+
+    expect(queryKeys).toHaveLength(2)
+    expect(queryKeys).toEqual(
+      expect.arrayContaining([
+        ['common', 'user-profile'],
+        ['console', 'workspaces', 'current', 'post'],
+      ]),
+    )
+  })
+
   it('should redirect unauthorized users to the refresh route with the current path', async () => {
     mocks.basePath = '/workflow'
     mocks.profileQueryFn.mockRejectedValue(

web/app/(commonLayout)/agents/__tests__/agents-access-guard.spec.tsx

@@ -0,0 +1,110 @@
+import { screen, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render } from '@/test/console/render'
+import { AgentsAccessGuard } from '../agents-access-guard'
+
+const mockReplace = vi.fn()
+const mockConsoleStateReader = vi.fn()
+
+vi.mock('@/next/navigation', () => ({
+  useRouter: () => ({
+    replace: mockReplace,
+  }),
+}))
+
+vi.mock('@/context/workspace-state', async () => {
+  const { createWorkspaceStateModuleMock } = await import('@/test/console/state-fixture')
+
+  return createWorkspaceStateModuleMock(() => mockConsoleStateReader())
+})
+vi.mock('@/context/permission-state', async () => {
+  const { createPermissionStateModuleMock } = await import('@/test/console/state-fixture')
+
+  return createPermissionStateModuleMock(() => mockConsoleStateReader())
+})
+
+type ConsoleStateFixture = {
+  isLoadingCurrentWorkspace: boolean
+  isLoadingWorkspacePermissionKeys: boolean
+  workspacePermissionKeys: string[]
+  currentWorkspace: {
+    id: string
+  }
+}
+
+const baseContext: ConsoleStateFixture = {
+  isLoadingCurrentWorkspace: false,
+  isLoadingWorkspacePermissionKeys: false,
+  workspacePermissionKeys: ['agent.manage'],
+  currentWorkspace: {
+    id: 'workspace-1',
+  },
+}
+
+const setConsoleState = (overrides: Partial<ConsoleStateFixture> = {}) => {
+  mockConsoleStateReader.mockReturnValue({
+    ...baseContext,
+    ...overrides,
+  })
+}
+
+describe('AgentsAccessGuard', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setConsoleState()
+  })
+
+  it('renders loading while the workspace is loading', () => {
+    setConsoleState({ isLoadingCurrentWorkspace: true, currentWorkspace: { id: '' } })
+
+    render(
+      <AgentsAccessGuard>
+        <div>agents</div>
+      </AgentsAccessGuard>,
+    )
+
+    expect(screen.getByRole('status')).toBeInTheDocument()
+    expect(screen.queryByText('agents')).not.toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
+  it('renders loading while workspace permission keys are loading', () => {
+    setConsoleState({ isLoadingWorkspacePermissionKeys: true, workspacePermissionKeys: [] })
+
+    render(
+      <AgentsAccessGuard>
+        <div>agents</div>
+      </AgentsAccessGuard>,
+    )
+
+    expect(screen.getByRole('status')).toBeInTheDocument()
+    expect(screen.queryByText('agents')).not.toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
+  it('redirects to /apps without agent.manage', async () => {
+    setConsoleState({ workspacePermissionKeys: ['dataset.create_and_management'] })
+
+    render(
+      <AgentsAccessGuard>
+        <div>agents</div>
+      </AgentsAccessGuard>,
+    )
+
+    expect(screen.queryByText('agents')).not.toBeInTheDocument()
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/')
+    })
+  })
+
+  it('renders children with agent.manage', () => {
+    render(
+      <AgentsAccessGuard>
+        <div>agents</div>
+      </AgentsAccessGuard>,
+    )
+
+    expect(screen.getByText('agents')).toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+})

web/app/(commonLayout)/agents/__tests__/layout.spec.tsx

@@ -1,3 +1,4 @@
+import type { ReactNode } from 'react'
 import { render, screen } from '@testing-library/react'
 
 const mocks = vi.hoisted(() => ({
@@ -8,6 +9,12 @@ vi.mock('../feature-guard', () => ({
   guardAgentV2Route: () => mocks.guardAgentV2Route(),
 }))
 
+// Access control is covered by agents-access-guard.spec.tsx; this suite is
+// about the feature-flag guard only.
+vi.mock('../agents-access-guard', () => ({
+  AgentsAccessGuard: ({ children }: { children: ReactNode }) => <>{children}</>,
+}))
+
 describe('RosterLayout', () => {
   beforeEach(() => {
     vi.clearAllMocks()

web/app/(commonLayout)/agents/agents-access-guard.tsx

@@ -0,0 +1,30 @@
+'use client'
+
+import type { ReactNode } from 'react'
+import { useAtomValue } from 'jotai'
+import { useEffect } from 'react'
+import Loading from '@/app/components/base/loading'
+import { workspacePermissionKeysLoadingAtom } from '@/context/permission-state'
+import { currentWorkspaceIdAtom, currentWorkspaceLoadingAtom } from '@/context/workspace-state'
+import { useCanManageAgents } from '@/features/agent-v2/permissions'
+import { useRouter } from '@/next/navigation'
+
+export function AgentsAccessGuard({ children }: { children: ReactNode }) {
+  const currentWorkspaceId = useAtomValue(currentWorkspaceIdAtom)
+  const isLoadingCurrentWorkspace = useAtomValue(currentWorkspaceLoadingAtom)
+  const isLoadingWorkspacePermissionKeys = useAtomValue(workspacePermissionKeysLoadingAtom)
+  const canManageAgents = useCanManageAgents()
+  const router = useRouter()
+  const isLoadingAccess = isLoadingCurrentWorkspace || !!isLoadingWorkspacePermissionKeys
+  const shouldRedirect = !isLoadingAccess && !!currentWorkspaceId && !canManageAgents
+
+  useEffect(() => {
+    if (shouldRedirect) router.replace('/')
+  }, [shouldRedirect, router])
+
+  if (isLoadingAccess || !currentWorkspaceId) return <Loading type="app" />
+
+  if (shouldRedirect) return null
+
+  return children
+}

web/app/(commonLayout)/agents/layout.tsx

@@ -1,8 +1,9 @@
 import type { ReactNode } from 'react'
+import { AgentsAccessGuard } from './agents-access-guard'
 import { guardAgentV2Route } from './feature-guard'
 
 export default function Layout({ children }: { children: ReactNode }) {
   guardAgentV2Route()
 
-  return children
+  return <AgentsAccessGuard>{children}</AgentsAccessGuard>
 }

web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/__tests__/chart-view.spec.tsx

@@ -1,5 +1,6 @@
+import type { PeriodParams } from '@/app/components/app/overview/app-chart'
 import { screen } from '@testing-library/react'
-import { renderWithAccountProfile as render } from '@/test/console/account-profile'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { AppACLPermission } from '@/utils/permission'
 import ChartView from '../chart-view'
 
@@ -13,6 +14,7 @@ const testState = vi.hoisted(() => ({
   currentUserId: 'user-1',
   workspacePermissionKeys: [] as string[],
   chartRenderSpy: vi.fn(),
+  conversationPeriodSpy: vi.fn(),
 }))
 
 vi.mock('@/context/workspace-state', async () => {
@@ -46,8 +48,9 @@ vi.mock('@/app/components/app/overview/app-chart', () => ({
     testState.chartRenderSpy('avg-user-interactions')
     return <div>avg user interactions chart</div>
   },
-  ConversationsChart: () => {
+  ConversationsChart: ({ period }: { period: PeriodParams }) => {
     testState.chartRenderSpy('conversations')
+    testState.conversationPeriodSpy(period)
     return <div>conversations chart</div>
   },
   CostChart: () => {

web/app/(commonLayout)/app/(appDetailLayout)/[appId]/overview/chart-view.tsx

@@ -1,6 +1,8 @@
 'use client'
+import type { DeploymentEdition } from '@dify/contracts/api/console/system-features/types.gen'
 import type { PeriodParams } from '@/app/components/app/overview/app-chart'
 import type { I18nKeysByPrefix } from '@/types/i18n'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import dayjs from 'dayjs'
 import quarterOfYear from 'dayjs/plugin/quarterOfYear'
 import { useAtomValue } from 'jotai'
@@ -23,10 +25,10 @@ import {
   WorkflowMessagesChart,
 } from '@/app/components/app/overview/app-chart'
 import { useStore as useAppStore } from '@/app/components/app/store'
-import { IS_CLOUD_EDITION } from '@/config'
 import { userProfileIdAtom } from '@/context/account-state'
 import { useDocLink } from '@/context/i18n'
 import { workspacePermissionKeysAtom } from '@/context/permission-state'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { getAppACLCapabilities } from '@/utils/permission'
 import LongTimeRangePicker from './long-time-range-picker'
 import TimeRangePicker from './time-range-picker'
@@ -51,7 +53,28 @@ type IChartViewProps = {
 }
 
 export default function ChartView({ appId, headerRight }: IChartViewProps) {
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
+
+  return (
+    <ChartViewContent
+      appId={appId}
+      headerRight={headerRight}
+      deploymentEdition={deploymentEdition}
+    />
+  )
+}
+
+function ChartViewContent({
+  appId,
+  headerRight,
+  deploymentEdition,
+}: IChartViewProps & { deploymentEdition: DeploymentEdition }) {
   const { t } = useTranslation()
+  const isCloudEdition = deploymentEdition === 'CLOUD'
+  const isNonCloudEdition = deploymentEdition === 'COMMUNITY' || deploymentEdition === 'ENTERPRISE'
   const docLink = useDocLink()
   const appDetail = useAppStore((state) => state.appDetail)
   const currentUserId = useAtomValue(userProfileIdAtom)
@@ -67,8 +90,8 @@ export default function ChartView({ appId, headerRight }: IChartViewProps) {
   )
   const isChatApp = appDetail?.mode !== 'completion' && appDetail?.mode !== 'workflow'
   const isWorkflow = appDetail?.mode === 'workflow'
-  const [period, setPeriod] = useState<PeriodParams>(
-    IS_CLOUD_EDITION
+  const [period, setPeriod] = useState<PeriodParams>(() =>
+    isCloudEdition
       ? {
           name: t(($) => $['filter.period.today'], { ns: 'appLog' }),
           query: {
@@ -112,13 +135,14 @@ export default function ChartView({ appId, headerRight }: IChartViewProps) {
           </div>
         </div>
         <div className="mt-1 flex h-10 items-center justify-between pr-10 pl-6">
-          {IS_CLOUD_EDITION ? (
+          {isCloudEdition && (
             <TimeRangePicker
               ranges={TIME_PERIOD_MAPPING}
               onSelect={setPeriod}
               queryDateFormat={queryDateFormat}
             />
-          ) : (
+          )}
+          {isNonCloudEdition && (
             <LongTimeRangePicker
               periodMapping={LONG_TIME_PERIOD_MAPPING}
               onSelect={setPeriod}

web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx

@@ -43,14 +43,6 @@ vi.mock('@/context/permission-state', async () => {
     workspacePermissionKeys: [],
   }))
 })
-vi.mock('@/context/system-features-state', async () => {
-  const { createSystemFeaturesStateModuleMock } = await import('@/test/console/state-fixture')
-
-  return createSystemFeaturesStateModuleMock(() => ({
-    datasetRbacEnabled: mockIsRbacEnabled,
-  }))
-})
-
 vi.mock('@/context/event-emitter', () => ({
   useEventEmitterContextContext: () => ({
     eventEmitter: undefined,

web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx

@@ -2,6 +2,7 @@
 import type { FC } from 'react'
 import type { DataSet } from '@/models/datasets'
 import { cn } from '@langgenius/dify-ui/cn'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import * as React from 'react'
 import { useEffect } from 'react'
@@ -13,8 +14,8 @@ import {
   workspacePermissionKeysAtom,
   workspacePermissionKeysLoadingAtom,
 } from '@/context/permission-state'
-import { datasetRbacEnabledAtom } from '@/context/system-features-state'
 import { currentWorkspaceLoadingAtom } from '@/context/workspace-state'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useDocumentTitle from '@/hooks/use-document-title'
 import { usePathname, useRouter } from '@/next/navigation'
 import { useDatasetDetail } from '@/service/knowledge/use-dataset'
@@ -60,7 +61,10 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   const pathname = usePathname()
   const isLoadingCurrentWorkspace = useAtomValue(currentWorkspaceLoadingAtom)
   const isLoadingWorkspacePermissionKeys = useAtomValue(workspacePermissionKeysLoadingAtom)
-  const isRbacEnabled = useAtomValue(datasetRbacEnabledAtom)
+  const { data: isRbacEnabled } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ rbac_enabled }) => rbac_enabled,
+  })
   const currentUserId = useAtomValue(userProfileIdAtom)
   const workspacePermissionKeys = useAtomValue(workspacePermissionKeysAtom)
 

web/app/(commonLayout)/datasets/layout.spec.tsx

@@ -149,7 +149,7 @@ describe('DatasetsLayout', () => {
     expect(mockReplace).not.toHaveBeenCalled()
   })
 
-  it.each(['/datasets/create', '/datasets/create-from-pipeline'])(
+  it.each(['/datasets/create', '/datasets/create-from-pipeline', '/datasets/new/create'])(
     'should redirect direct dataset creation route to /datasets without dataset.create_and_management: %s',
     async (pathname) => {
       mockPathname = pathname
@@ -186,6 +186,22 @@ describe('DatasetsLayout', () => {
     expect(mockReplace).not.toHaveBeenCalled()
   })
 
+  it('should render direct new knowledge creation route when workspace has dataset.create_and_management', () => {
+    mockPathname = '/datasets/new/create'
+    setConsoleState({
+      workspacePermissionKeys: ['dataset.create_and_management'],
+    })
+
+    render(
+      <DatasetsLayout>
+        <div>datasets</div>
+      </DatasetsLayout>,
+    )
+
+    expect(screen.getByText('datasets')).toBeInTheDocument()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
   it('should redirect direct external dataset connection route to /datasets without dataset.external.connect', async () => {
     mockPathname = '/datasets/connect'
     setConsoleState({

web/app/(commonLayout)/datasets/layout.tsx

@@ -17,6 +17,7 @@ const isDatasetCreatePath = (pathname: string) => {
   return (
     pathname === '/datasets/create' ||
     pathname.startsWith('/datasets/create/') ||
+    pathname === '/datasets/new/create' ||
     pathname === '/datasets/create-from-pipeline' ||
     pathname.startsWith('/datasets/create-from-pipeline/')
   )

web/app/(commonLayout)/datasets/new/[knowledgeSpaceId]/documents/page.tsx

@@ -0,0 +1,5 @@
+import { KnowledgeRoutePlaceholder } from '@/features/new-rag/knowledge-route-placeholder'
+
+export default function Page() {
+  return <KnowledgeRoutePlaceholder type="documents" />
+}

web/app/(commonLayout)/datasets/new/[knowledgeSpaceId]/layout.tsx

@@ -0,0 +1,18 @@
+import { KnowledgeRouteGuard } from '@/features/new-rag/knowledge-route-guard'
+import { KnowledgeSpaceShell } from '@/features/new-rag/knowledge-space-shell'
+
+export default async function Layout({
+  children,
+  params,
+}: {
+  children: React.ReactNode
+  params: Promise<{ knowledgeSpaceId: string }>
+}) {
+  const { knowledgeSpaceId } = await params
+
+  return (
+    <KnowledgeRouteGuard>
+      <KnowledgeSpaceShell knowledgeSpaceId={knowledgeSpaceId}>{children}</KnowledgeSpaceShell>
+    </KnowledgeRouteGuard>
+  )
+}

web/app/(commonLayout)/datasets/new/[knowledgeSpaceId]/page.tsx

@@ -0,0 +1,6 @@
+import { redirect } from '@/next/navigation'
+
+export default async function Page({ params }: { params: Promise<{ knowledgeSpaceId: string }> }) {
+  const { knowledgeSpaceId } = await params
+  redirect(`/datasets/new/${knowledgeSpaceId}/sources`)
+}

web/app/(commonLayout)/datasets/new/[knowledgeSpaceId]/sources/page.tsx

@@ -0,0 +1,5 @@
+import { KnowledgeRoutePlaceholder } from '@/features/new-rag/knowledge-route-placeholder'
+
+export default function Page() {
+  return <KnowledgeRoutePlaceholder type="sources" />
+}

web/app/(commonLayout)/datasets/new/create/page.tsx

@@ -0,0 +1,10 @@
+import { CreateKnowledgePage } from '@/features/new-rag/create-knowledge-page'
+import { KnowledgeRouteGuard } from '@/features/new-rag/knowledge-route-guard'
+
+export default function Page() {
+  return (
+    <KnowledgeRouteGuard>
+      <CreateKnowledgePage />
+    </KnowledgeRouteGuard>
+  )
+}

web/app/(commonLayout)/error.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import { Button } from '@langgenius/dify-ui/button'
+import { useQueryErrorResetBoundary } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
 import { FullScreenLoading } from '@/app/components/full-screen-loading'
 import { isLegacyBase401 } from '@/features/account-profile/client'
@@ -12,6 +13,7 @@ type Props = Readonly<{
 
 export default function CommonLayoutError({ error, unstable_retry }: Props) {
   const { t } = useTranslation('common')
+  const { reset } = useQueryErrorResetBoundary()
 
   console.error(error)
 
@@ -26,7 +28,14 @@ export default function CommonLayoutError({ error, unstable_retry }: Props) {
       <div className="system-sm-regular text-text-tertiary">
         {t(($) => $['errorBoundary.message'])}
       </div>
-      <Button size="small" variant="secondary" onClick={() => unstable_retry()}>
+      <Button
+        size="small"
+        variant="secondary"
+        onClick={() => {
+          reset()
+          unstable_retry()
+        }}
+      >
         {t(($) => $['errorBoundary.tryAgain'])}
       </Button>
     </div>

web/app/(commonLayout)/hydration-boundary.tsx

@@ -1,8 +1,7 @@
 import type { ReactNode } from 'react'
 import { dehydrate, HydrationBoundary } from '@tanstack/react-query'
-import { getQueryClientServer } from '@/context/query-client-server'
+import { makeQueryClient } from '@/context/query-client-server'
 import { serverUserProfileQueryOptions } from '@/features/account-profile/server'
-import { serverSystemFeaturesQueryOptions } from '@/features/system-features/server'
 import { headers } from '@/next/headers'
 import { redirect } from '@/next/navigation'
 import {
@@ -56,7 +55,7 @@ const handleProfileError = async (error: unknown) => {
 }
 
 export async function CommonLayoutHydrationBoundary({ children }: { children: ReactNode }) {
-  const queryClient = getQueryClientServer()
+  const queryClient = makeQueryClient()
   const accountProfileUrl = resolveServerConsoleApiUrl(ACCOUNT_PROFILE_PATH)
 
   if (accountProfileUrl) {
@@ -65,7 +64,6 @@ export async function CommonLayoutHydrationBoundary({ children }: { children: Re
 
       await Promise.all([
         queryClient.fetchQuery(serverUserProfileQueryOptions()),
-        queryClient.prefetchQuery(serverSystemFeaturesQueryOptions()),
         queryClient.prefetchQuery(
           serverConsoleQuery.workspaces.current.post.queryOptions({
             context,

web/app/(shareLayout)/webapp-signin/normalForm.tsx

@@ -6,7 +6,6 @@ import * as React from 'react'
 import { useCallback, useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
-import { IS_CE_EDITION } from '@/config'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { LicenseStatus } from '@/features/system-features/constants'
 import Link from '@/next/link'
@@ -19,6 +18,9 @@ const NormalForm = () => {
 
   const [isLoading, setIsLoading] = useState(true)
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isNonCloudEdition =
+    systemFeatures.deployment_edition === 'COMMUNITY' ||
+    systemFeatures.deployment_edition === 'ENTERPRISE'
   const [authType, updateAuthType] = useState<'code' | 'password'>('password')
   const [showORLine, setShowORLine] = useState(false)
   const [allMethodsAreDisabled, setAllMethodsAreDisabled] = useState(false)
@@ -236,7 +238,7 @@ const NormalForm = () => {
                   {t(($) => $.pp, { ns: 'login' })}
                 </Link>
               </div>
-              {IS_CE_EDITION && (
+              {isNonCloudEdition && (
                 <div className="w-hull mt-2 block system-xs-regular text-text-tertiary">
                   {t(($) => $.goToInit, { ns: 'login' })}
                   &nbsp;

web/app/__tests__/error.spec.tsx

@@ -0,0 +1,39 @@
+import { QueryErrorResetBoundary } from '@tanstack/react-query'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import CommonLayoutError from '@/app/(commonLayout)/error'
+import AppError from '@/app/error'
+
+describe('route error recovery', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it.each([
+    {
+      name: 'root error',
+      renderError: (retry: () => void) => <AppError error={new Error('failed')} reset={retry} />,
+    },
+    {
+      name: 'common layout error',
+      renderError: (retry: () => void) => (
+        <CommonLayoutError error={new Error('failed')} unstable_retry={retry} />
+      ),
+    },
+  ])('resets failed queries before retrying the $name', async ({ renderError }) => {
+    const user = userEvent.setup()
+    const retry = vi.fn()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    render(
+      <QueryErrorResetBoundary>
+        {({ isReset }) => renderError(() => retry(isReset()))}
+      </QueryErrorResetBoundary>,
+    )
+
+    await user.click(screen.getByRole('button', { name: 'common.errorBoundary.tryAgain' }))
+
+    expect(retry).toHaveBeenCalledWith(true)
+  })
+})

web/app/__tests__/layout.spec.tsx

@@ -0,0 +1,69 @@
+import { QueryClient } from '@tanstack/react-query'
+
+let queryClient: QueryClient
+
+const mocks = vi.hoisted(() => ({
+  getSystemFeatures: vi.fn(),
+  getCloudAnalyticsBoundaryState: vi.fn(() => ({ enabled: false })),
+  requestHeaders: new Headers(),
+}))
+
+vi.mock('@/context/query-client-server', () => ({
+  getQueryClientServer: () => queryClient,
+}))
+
+vi.mock('@/env', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/env')>()
+
+  return {
+    ...actual,
+    getDatasetMap: () => ({}),
+  }
+})
+
+vi.mock('@/features/system-features/server', () => ({
+  serverSystemFeaturesQueryOptions: () => ({
+    queryKey: ['console', 'system-features'],
+    queryFn: mocks.getSystemFeatures,
+    retry: false,
+  }),
+}))
+
+vi.mock('@/i18n-config/server', () => ({
+  getLocaleOnServer: async () => 'en-US',
+}))
+
+vi.mock('@/next/headers', () => ({
+  headers: async () => mocks.requestHeaders,
+}))
+
+vi.mock('@/app/components/base/analytics-consent/cloud-analytics-state', () => ({
+  getCloudAnalyticsBoundaryState: mocks.getCloudAnalyticsBoundaryState,
+}))
+
+describe('Root layout System Features bootstrap', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  })
+
+  it('renders with the resolved deployment edition', async () => {
+    mocks.getSystemFeatures.mockResolvedValue({ deployment_edition: 'CLOUD' })
+    const { default: RootLayout } = await import('../layout')
+
+    await expect(RootLayout({ children: <div>App</div> })).resolves.toBeDefined()
+
+    expect(mocks.getSystemFeatures).toHaveBeenCalledTimes(1)
+    expect(mocks.getCloudAnalyticsBoundaryState).toHaveBeenCalledWith(mocks.requestHeaders, 'CLOUD')
+  })
+
+  it('propagates System Features failures without rendering a fallback', async () => {
+    const error = new Error('system features unavailable')
+    mocks.getSystemFeatures.mockRejectedValue(error)
+    const { default: RootLayout } = await import('../layout')
+
+    await expect(RootLayout({ children: <div>App</div> })).rejects.toBe(error)
+
+    expect(mocks.getCloudAnalyticsBoundaryState).not.toHaveBeenCalled()
+  })
+})

web/app/account/(commonLayout)/account-page/index.tsx

@@ -12,7 +12,7 @@ import AppIcon from '@/app/components/base/app-icon'
 import Input from '@/app/components/base/input'
 import PremiumBadge from '@/app/components/base/premium-badge'
 import Collapse from '@/app/components/header/account-setting/collapse'
-import { IS_CE_EDITION, validPassword } from '@/config'
+import { validPassword } from '@/config'
 import { useProviderContext } from '@/context/provider-context'
 import { userProfileQueryOptions } from '@/features/account-profile/client'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
@@ -243,7 +243,7 @@ export default function AccountPage() {
             wrapperClassName="mt-2"
           />
         )}
-        {!IS_CE_EDITION && (
+        {systemFeatures.deployment_edition === 'CLOUD' && (
           <Button
             className="mt-2 text-components-button-destructive-secondary-text"
             onClick={() => setShowDeleteAccountModal(true)}

web/app/auth/refresh/__tests__/route.spec.ts

@@ -4,16 +4,12 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   basePath: '',
-  isCloudEdition: false,
 }))
 
 vi.mock('@/config', () => ({
   API_PREFIX: 'http://localhost:5001/console/api',
   CSRF_COOKIE_NAME: () => 'csrf_token',
   CSRF_HEADER_NAME: 'X-CSRF-Token',
-  get IS_CLOUD_EDITION() {
-    return mocks.isCloudEdition
-  },
 }))
 
 vi.mock('server-only', () => ({}))
@@ -52,7 +48,6 @@ describe('auth refresh route', () => {
     vi.resetModules()
     vi.unstubAllGlobals()
     mocks.basePath = ''
-    mocks.isCloudEdition = false
   })
 
   it('should refresh cookies and redirect back to the requested path', async () => {
@@ -244,8 +239,7 @@ describe('auth refresh route', () => {
     expect(response.headers.get('location')).toBe('/signin?redirect_url=%2F')
   })
 
-  it('should keep a Cloud staging fallback on the current deployment after refresh', async () => {
-    mocks.isCloudEdition = true
+  it('should keep a staging fallback on the current deployment after refresh', async () => {
     vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 200 })))
     const { GET } = await import('../route')
 
@@ -260,8 +254,7 @@ describe('auth refresh route', () => {
     expect(response.headers.get('location')).toBe('/')
   })
 
-  it('should carry the current Cloud deployment fallback through signin when refresh fails', async () => {
-    mocks.isCloudEdition = true
+  it('should carry the current deployment fallback through signin when refresh fails', async () => {
     vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 401 })))
     const { GET } = await import('../route')
 
@@ -277,7 +270,6 @@ describe('auth refresh route', () => {
   })
 
   it('should use the current deployment home when a trusted target loops back to auth refresh', async () => {
-    mocks.isCloudEdition = true
     vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 200 })))
     const { GET } = await import('../route')
 

web/app/components/__tests__/external-attribution-recorder.spec.tsx

@@ -6,17 +6,10 @@ import { setAnalyticsConsent } from '@/app/components/base/analytics-consent/con
 import { useSearchParams } from '@/next/navigation'
 import ExternalAttributionRecorder from '../external-attribution-recorder'
 
-const mockConfig = vi.hoisted(() => ({ IS_CLOUD_EDITION: true }))
 const { mockRememberCreateAppExternalAttribution } = vi.hoisted(() => ({
   mockRememberCreateAppExternalAttribution: vi.fn(),
 }))
 
-vi.mock('@/config', () => ({
-  get IS_CLOUD_EDITION() {
-    return mockConfig.IS_CLOUD_EDITION
-  },
-}))
-
 vi.mock('@/next/navigation', () => ({
   useSearchParams: vi.fn(),
 }))
@@ -43,7 +36,6 @@ describe('ExternalAttributionRecorder', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     Cookies.remove('utm_info')
-    mockConfig.IS_CLOUD_EDITION = true
     setAnalyticsConsent('granted')
     setSearchParams()
   })
@@ -150,14 +142,4 @@ describe('ExternalAttributionRecorder', () => {
     })
     expect(mockRememberCreateAppExternalAttribution).toHaveBeenCalledTimes(1)
   })
-
-  it('is a no-op outside the cloud edition', () => {
-    mockConfig.IS_CLOUD_EDITION = false
-    setSearchParams('utm_source=dify_blog&slug=get-started-with-dify')
-
-    render(<ExternalAttributionRecorder />)
-
-    expect(getUtmInfoCookie()).toBeNull()
-    expect(mockRememberCreateAppExternalAttribution).not.toHaveBeenCalled()
-  })
 })

web/app/components/app/app-access-control/__tests__/index.spec.tsx

@@ -35,7 +35,15 @@ vi.mock('@/service/access-control', () => ({
 
 vi.mock('@/service/client', () => ({
   consoleQuery: {
-    systemFeatures: { get: { queryKey: () => ['system-features'] } },
+    systemFeatures: {
+      get: {
+        queryKey: () => ['system-features'],
+        queryOptions: (options: Record<string, unknown> = {}) => ({
+          queryKey: ['system-features'],
+          ...options,
+        }),
+      },
+    },
     enterprise: {
       webAppAuth: {
         updateWebAppWhitelistSubjects: {

web/app/components/app/app-publisher/__tests__/sections.spec.tsx

@@ -1,7 +1,8 @@
 /* oxlint-disable typescript/no-explicit-any */
 import type { ReactNode } from 'react'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, screen } from '@testing-library/react'
 import { AccessMode } from '@/models/access-control'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { AppModeEnum } from '@/types/app'
 import {
   AccessModeDisplay,

web/app/components/app/configuration/config-var/__tests__/index.spec.tsx

@@ -3,10 +3,11 @@ import type { IConfigVarProps } from '../index'
 import type { ExternalDataTool } from '@/models/common'
 import type { PromptVariable } from '@/models/debug'
 import { toast } from '@langgenius/dify-ui/toast'
-import { act, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import { act, fireEvent, screen, waitFor, within } from '@testing-library/react'
 import * as React from 'react'
 import { vi } from 'vitest'
 import DebugConfigurationContext from '@/context/debug-configuration'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { AppModeEnum } from '@/types/app'
 import ConfigVar, { ADD_EXTERNAL_DATA_TOOL } from '../index'
 

web/app/components/app/configuration/config-var/config-modal/__tests__/index.spec.tsx

@@ -1,10 +1,11 @@
 import type { InputVar } from '@/app/components/workflow/types'
 import type { App, AppSSO } from '@/types/app'
 import { toast } from '@langgenius/dify-ui/toast'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, screen } from '@testing-library/react'
 import * as React from 'react'
 import { useStore } from '@/app/components/app/store'
 import { InputVarType } from '@/app/components/workflow/types'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { AppModeEnum } from '@/types/app'
 import ConfigModal from '../index'
 

web/app/components/app/configuration/dataset-config/settings-modal/__tests__/index.spec.tsx

@@ -8,7 +8,6 @@ import { IndexingType } from '@/app/components/datasets/create/step-two'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
 import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
-import { defaultSystemFeatures } from '@/features/system-features/config'
 import {
   ChunkingMode,
   DatasetPermission,
@@ -18,6 +17,7 @@ import {
 import { updateDatasetSetting } from '@/service/datasets'
 import { useMembers } from '@/service/use-common'
 import { renderWithConsoleQuery as render } from '@/test/console/query-data'
+import { createSystemFeaturesFixture } from '@/test/console/system-features'
 import { RETRIEVE_METHOD } from '@/types/app'
 import { DatasetACLPermission } from '@/utils/permission'
 import SettingsModal from '../index'
@@ -210,7 +210,7 @@ const renderWithProviders = (dataset: DataSet) => {
   const queryClient = new QueryClient({
     defaultOptions: { queries: { retry: false } },
   })
-  queryClient.setQueryData(systemFeaturesQueryOptions().queryKey, defaultSystemFeatures)
+  queryClient.setQueryData(systemFeaturesQueryOptions().queryKey, createSystemFeaturesFixture())
 
   return render(
     <QueryClientProvider client={queryClient}>

web/app/components/app/create-app-dialog/app-card/__tests__/index.spec.tsx

@@ -1,22 +1,18 @@
+import type { ReactElement } from 'react'
 import type { App } from '@/models/explore'
 import type { AppIconType } from '@/types/app'
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { trackEvent } from '@/app/components/base/amplitude'
 import AppListContext from '@/context/app-list-context'
-import { renderWithConsoleQuery as render } from '@/test/console/query-data'
+import { renderWithConsoleQuery } from '@/test/console/query-data'
 import { AppModeEnum } from '@/types/app'
 import AppCard from '../index'
 
 vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
 
-const mockConfig = vi.hoisted(() => ({ isCloudEdition: true }))
-vi.mock('@/config', async (importOriginal) => ({
-  ...(await importOriginal<typeof import('@/config')>()),
-  get IS_CLOUD_EDITION() {
-    return mockConfig.isCloudEdition
-  },
-}))
+const render = (ui: ReactElement) =>
+  renderWithConsoleQuery(ui, { systemFeatures: { deployment_edition: 'CLOUD' } })
 
 const app: App = {
   can_trial: true,
@@ -47,7 +43,6 @@ const app: App = {
 
 describe('AppCard', () => {
   beforeEach(() => {
-    mockConfig.isCloudEdition = true
     vi.clearAllMocks()
   })
 

web/app/components/app/create-app-dialog/app-card/index.tsx

@@ -4,13 +4,14 @@ import { PlusIcon } from '@heroicons/react/20/solid'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { RiInformation2Line } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useContextSelector } from 'use-context-selector'
 import { trackEvent } from '@/app/components/base/amplitude'
 import AppIcon from '@/app/components/base/app-icon'
-import { IS_CLOUD_EDITION } from '@/config'
 import AppListContext from '@/context/app-list-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { AppTypeIcon, AppTypeLabel } from '../../type-selector'
 
 type AppCardProps = {
@@ -21,8 +22,12 @@ type AppCardProps = {
 
 const AppCard = ({ app, canCreate, onCreate }: AppCardProps) => {
   const { t } = useTranslation()
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
   const { app: appBasicInfo } = app
-  const canViewApp = IS_CLOUD_EDITION
+  const canViewApp = deploymentEdition === 'CLOUD'
   const setShowTryAppPanel = useContextSelector(AppListContext, (ctx) => ctx.setShowTryAppPanel)
   const handleShowTryAppPanel = useCallback(() => {
     trackEvent('preview_template', {

web/app/components/app/in-site-message/__tests__/notification.spec.tsx

@@ -3,27 +3,26 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import InSiteMessageNotification from '../notification'
 
-const { mockConfig, mockNotification, mockNotificationDismiss } = vi.hoisted(() => ({
-  mockConfig: {
-    isCloudEdition: true,
+const { mockEdition, mockNotification, mockNotificationDismiss } = vi.hoisted(() => ({
+  mockEdition: {
+    value: 'CLOUD' as 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | null,
   },
   mockNotification: vi.fn(),
   mockNotificationDismiss: vi.fn(),
 }))
 
-vi.mock(import('@/config'), async (importOriginal) => {
-  const actual = await importOriginal()
-
-  return {
-    ...actual,
-    get IS_CLOUD_EDITION() {
-      return mockConfig.isCloudEdition
-    },
-  }
-})
-
 vi.mock('@/service/client', () => ({
   consoleQuery: {
+    systemFeatures: {
+      get: {
+        queryKey: () => ['console', 'systemFeatures', 'get'],
+        queryOptions: (options?: Record<string, unknown>) => ({
+          queryKey: ['console', 'systemFeatures', 'get'],
+          queryFn: () => new Promise(() => {}),
+          ...options,
+        }),
+      },
+    },
     notification: {
       get: {
         queryOptions: (options?: Record<string, unknown>) => ({
@@ -56,6 +55,9 @@ const createWrapper = () => {
       },
     },
   })
+  queryClient.setQueryData(['console', 'systemFeatures', 'get'], {
+    deployment_edition: mockEdition.value,
+  })
 
   const Wrapper = ({ children }: { children: ReactNode }) => (
     <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
@@ -67,7 +69,7 @@ const createWrapper = () => {
 describe('InSiteMessageNotification', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockConfig.isCloudEdition = true
+    mockEdition.value = 'CLOUD'
     vi.stubGlobal('open', vi.fn())
   })
 
@@ -78,7 +80,7 @@ describe('InSiteMessageNotification', () => {
   // Validate query gating and empty state rendering.
   describe('Rendering', () => {
     it('should render null and skip query when not cloud edition', async () => {
-      mockConfig.isCloudEdition = false
+      mockEdition.value = 'COMMUNITY'
       const Wrapper = createWrapper()
       const { container } = render(<InSiteMessageNotification />, { wrapper: Wrapper })
 

web/app/components/app/in-site-message/notification.tsx

@@ -1,9 +1,9 @@
 'use client'
 
 import type { InSiteMessageActionItem } from './index'
-import { useMutation, useQuery } from '@tanstack/react-query'
+import { useMutation, useQuery, useSuspenseQuery } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
-import { IS_CLOUD_EDITION } from '@/config'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { consoleQuery } from '@/service/client'
 import InSiteMessage from './index'
 
@@ -56,20 +56,25 @@ function parseNotificationBody(body: string): NotificationBodyPayload | null {
 
 function InSiteMessageNotification() {
   const { t } = useTranslation()
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
+  const isCloudEdition = deploymentEdition === 'CLOUD'
   const dismissNotificationMutation = useMutation(
     consoleQuery.notification.dismiss.post.mutationOptions(),
   )
 
   const { data } = useQuery(
     consoleQuery.notification.get.queryOptions({
-      enabled: IS_CLOUD_EDITION,
+      enabled: isCloudEdition,
     }),
   )
 
   const notification = data?.notifications?.[0]
   const parsedBody = notification ? parseNotificationBody(notification.body) : null
 
-  if (!IS_CLOUD_EDITION || !notification || !notification.notification_id) return null
+  if (!isCloudEdition || !notification || !notification.notification_id) return null
 
   const notificationId = notification.notification_id
   const fallbackActions: InSiteMessageActionItem[] = [

web/app/components/app/log/__tests__/archived-logs-notice.spec.tsx

@@ -5,17 +5,10 @@ import { Plan } from '@/app/components/billing/type'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
 import { useModalContextSelector } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
 import { render } from '@/test/console/render'
 import { ArchivedLogsNotice } from '../archived-logs-notice'
 
-vi.mock('@/config', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@/config')>()
-  return {
-    ...actual,
-    IS_CLOUD_EDITION: true,
-  }
-})
-
 vi.mock('@/context/workspace-state', async () => {
   const { createWorkspaceStateModuleMock } = await import('@/test/console/state-fixture')
 
@@ -57,6 +50,12 @@ function mockProviderPlan(planType: Plan) {
 
 describe('ArchivedLogsNotice', () => {
   const setShowAccountSettingModal = vi.fn()
+  const renderNotice = () => {
+    const { wrapper } = createConsoleQueryWrapper({
+      systemFeatures: { deployment_edition: 'CLOUD' },
+    })
+    return render(<ArchivedLogsNotice />, { wrapper })
+  }
 
   beforeEach(() => {
     vi.clearAllMocks()
@@ -69,7 +68,7 @@ describe('ArchivedLogsNotice', () => {
   })
 
   it('should show notice for paid workspace managers', () => {
-    render(<ArchivedLogsNotice />)
+    renderNotice()
 
     expect(screen.getByText('appLog.archives.notice.description')).toBeInTheDocument()
     fireEvent.click(screen.getByRole('button', { name: 'appLog.archives.notice.action' }))
@@ -81,7 +80,7 @@ describe('ArchivedLogsNotice', () => {
   it('should not show notice for sandbox workspaces', () => {
     mockProviderPlan(Plan.sandbox)
 
-    render(<ArchivedLogsNotice />)
+    renderNotice()
 
     expect(screen.queryByText('appLog.archives.notice.description')).not.toBeInTheDocument()
   })

web/app/components/app/log/archived-logs-notice.tsx

@@ -1,16 +1,21 @@
 'use client'
 
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import { Plan } from '@/app/components/billing/type'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
-import { IS_CLOUD_EDITION } from '@/config'
 import { useModalContextSelector } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { isCurrentWorkspaceManagerAtom } from '@/context/workspace-state'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 
 export function ArchivedLogsNotice() {
   const { t } = useTranslation()
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
   const isCurrentWorkspaceManager = useAtomValue(isCurrentWorkspaceManagerAtom)
   const { enableBilling, plan } = useProviderContext()
   const setShowAccountSettingModal = useModalContextSelector(
@@ -18,7 +23,7 @@ export function ArchivedLogsNotice() {
   )
 
   if (
-    !IS_CLOUD_EDITION ||
+    deploymentEdition !== 'CLOUD' ||
     !isCurrentWorkspaceManager ||
     !enableBilling ||
     plan.type === Plan.sandbox

web/app/components/app/overview/__tests__/app-card-utils.spec.ts

@@ -313,6 +313,7 @@ describe('app-card-utils', () => {
     expect(snippet).toContain('name: "Alice"')
     expect(snippet).toContain('count: "5"')
     expect(snippet).toContain('background-color: #FF0000')
+    expect(snippet).toContain(`baseUrl: 'https://example.com${basePath}'`)
   })
 
   it('should generate an embedded script snippet with empty inputs comment', () => {

web/app/components/app/overview/apikey-info-panel/__tests__/cloud.spec.tsx

@@ -5,10 +5,9 @@ import {
   interactions,
   mockUseModalContext,
   scenarios,
+  setDeploymentEdition,
 } from './test-utils'
 
-vi.mock('@/config', () => ({ IS_CE_EDITION: false }))
-
 afterEach(cleanup)
 
 describe('APIKeyInfoPanel - Cloud Edition', () => {
@@ -16,6 +15,7 @@ describe('APIKeyInfoPanel - Cloud Edition', () => {
 
   beforeEach(() => {
     clearAllMocks()
+    setDeploymentEdition('CLOUD')
     mockUseModalContext.mockReturnValue({
       ...defaultModalContext,
       setShowAccountSettingModal,

web/app/components/app/overview/apikey-info-panel/__tests__/index.spec.tsx

@@ -5,11 +5,10 @@ import {
   interactions,
   mockUseModalContext,
   scenarios,
+  setDeploymentEdition,
   textKeys,
 } from './test-utils'
 
-vi.mock('@/config', () => ({ IS_CE_EDITION: true }))
-
 afterEach(cleanup)
 
 describe('APIKeyInfoPanel - Community Edition', () => {
@@ -17,6 +16,7 @@ describe('APIKeyInfoPanel - Community Edition', () => {
 
   beforeEach(() => {
     clearAllMocks()
+    setDeploymentEdition('COMMUNITY')
     mockUseModalContext.mockReturnValue({
       ...defaultModalContext,
       setShowAccountSettingModal,

web/app/components/app/overview/apikey-info-panel/__tests__/test-utils.tsx

@@ -1,7 +1,8 @@
+import type { DeploymentEdition } from '@dify/contracts/api/console/system-features/types.gen'
 import type { RenderOptions } from '@testing-library/react'
 import type { Mock, MockedFunction } from 'vitest'
 import type { ModalContextState } from '@/context/modal-context'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, screen } from '@testing-library/react'
 import { noop } from 'es-toolkit/function'
 import { defaultPlan } from '@/app/components/billing/config'
 import {
@@ -9,6 +10,7 @@ import {
   useModalContextSelector as actualUseModalContextSelector,
 } from '@/context/modal-context'
 import { useProviderContext as actualUseProviderContext } from '@/context/provider-context'
+import { renderWithConsoleQuery } from '@/test/console/query-data'
 import APIKeyInfoPanel from '../index'
 
 const { mockRouterPush } = vi.hoisted(() => ({
@@ -102,6 +104,7 @@ type APIKeyInfoPanelRenderOptions = {
 } & Omit<RenderOptions, 'wrapper'>
 
 const mainButtonName = /appOverview\.apiKeyInfo\.setAPIBtn/
+let deploymentEdition: DeploymentEdition = 'COMMUNITY'
 
 // Setup function to configure mocks
 function setupMocks(overrides: MockOverrides = {}) {
@@ -129,7 +132,10 @@ function renderAPIKeyInfoPanel(options: APIKeyInfoPanelRenderOptions = {}) {
 
   setupMocks(mockOverrides)
 
-  return render(<APIKeyInfoPanel />, renderOptions)
+  return renderWithConsoleQuery(<APIKeyInfoPanel />, {
+    ...renderOptions,
+    systemFeatures: { deployment_edition: deploymentEdition },
+  })
 }
 
 // Helper functions for common test scenarios
@@ -200,5 +206,9 @@ export function clearAllMocks() {
   vi.clearAllMocks()
 }
 
+export function setDeploymentEdition(value: DeploymentEdition) {
+  deploymentEdition = value
+}
+
 // Export mock functions for external access
 export { defaultModalContext, mockUseModalContext }

web/app/components/app/overview/apikey-info-panel/index.tsx

@@ -3,17 +3,22 @@ import type { FC } from 'react'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { RiCloseLine } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { LinkExternal02 } from '@/app/components/base/icons/src/vender/line/general'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
 import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
-import { IS_CE_EDITION } from '@/config'
 import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 
 const APIKeyInfoPanel: FC = () => {
-  const isCloud = !IS_CE_EDITION
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
+  const isCloud = deploymentEdition === 'CLOUD'
 
   const { isAPIKeySet } = useProviderContext()
   const openIntegrationsSetting = useIntegrationsSetting()

web/app/components/app/overview/app-card-utils.ts

@@ -2,7 +2,6 @@ import type { InputVar } from '@/app/components/workflow/types'
 import type { AppDetailResponse } from '@/models/app'
 import type { AppSSO } from '@/types/app'
 import { BlockEnum, InputVarType } from '@/app/components/workflow/types'
-import { IS_CE_EDITION } from '@/config'
 import { AccessMode } from '@/models/access-control'
 import { AppModeEnum } from '@/types/app'
 import { basePath } from '@/utils/var'
@@ -177,20 +176,16 @@ export const getEmbeddedScriptSnippet = ({
   primaryColor: string
   isTestEnv?: boolean
   inputValues: Record<string, WorkflowLaunchInputValue>
-}) =>
-  `<script>
+}) => {
+  return `<script>
  window.difyChatbotConfig = {
   token: '${token}'${
     isTestEnv
       ? `,
   isDev: true`
       : ''
-  }${
-    IS_CE_EDITION
-      ? `,
-  baseUrl: '${url}${basePath}'`
-      : ''
-  }${
+  },
+  baseUrl: '${url}${basePath}'${
     webAppRoute !== 'chatbot'
       ? `,
   routeSegment: '${webAppRoute}'`
@@ -221,6 +216,7 @@ export const getEmbeddedScriptSnippet = ({
     height: 40rem !important;
   }
 </style>`
+}
 
 export const getChromePluginContent = (iframeUrl: string) => `ChatBot URL: ${iframeUrl}`
 

web/app/components/apps/__tests__/list.spec.tsx

@@ -105,6 +105,10 @@ vi.mock('@/service/client', () => ({
     systemFeatures: {
       get: {
         queryKey: () => ['console', 'systemFeatures', 'get'],
+        queryOptions: (options: Record<string, unknown> = {}) => ({
+          queryKey: ['console', 'systemFeatures', 'get'],
+          ...options,
+        }),
       },
     },
   },

web/app/components/base/amplitude/__tests__/AmplitudeProvider.spec.tsx

@@ -5,7 +5,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mockConfig = vi.hoisted(() => ({
   AMPLITUDE_API_KEY: 'test-api-key',
-  IS_CLOUD_EDITION: true,
 }))
 const mockConsent = vi.hoisted(() => ({
   value: 'granted' as 'unknown' | 'denied' | 'granted',
@@ -17,12 +16,6 @@ vi.mock('@/config', () => ({
   get AMPLITUDE_API_KEY() {
     return mockConfig.AMPLITUDE_API_KEY
   },
-  get IS_CLOUD_EDITION() {
-    return mockConfig.IS_CLOUD_EDITION
-  },
-  get isAmplitudeEnabled() {
-    return mockConfig.IS_CLOUD_EDITION && !!mockConfig.AMPLITUDE_API_KEY
-  },
 }))
 
 vi.mock('@amplitude/analytics-browser', () => ({
@@ -44,7 +37,6 @@ describe('AmplitudeProvider', () => {
     vi.resetModules()
     vi.clearAllMocks()
     mockConfig.AMPLITUDE_API_KEY = 'test-api-key'
-    mockConfig.IS_CLOUD_EDITION = true
     mockConsent.value = 'granted'
     ;({ AmplitudeProvider } = await import('../AmplitudeProvider'))
   })